Thank you for your interest in our website. Protecting your personal data matters to us. Below we inform you, pursuant to Articles 13 and 14 of the General Data Protection Regulation (GDPR), which data we process when you visit this website.

1. Controller

HWSI – Herbert Egon Willi Society International
Lackierergasse 4/1
1090 Vienna
Austria

Email: office@herbertwillisociety.org
Phone: +43 5552 67148

We have not appointed a data protection officer, as the conditions of Article 37 GDPR do not apply to us.

2. General

This website does not collect any data about you that you do not provide yourself. There is no registration, no customer area, no newsletter subscription and no contact form. Anyone who only reads leaves nothing with us beyond the technical traces described in section 3.

There is one exception: you can order a book through this website. In doing so you give us your name and address, and we need them in order to send you the book. Section 9 describes this in detail.

3. Hosting and server log files

This website is operated on servers of Hetzner Online GmbH, Industriestrasse 25, 91710 Gunzenhausen, Germany, in the Falkenstein data centre (Germany). A data processing agreement pursuant to Article 28 GDPR is in place with Hetzner. The data does not leave the European Economic Area.

Each time a page is requested, data transmitted by your browser is automatically stored in server log files:

• IP address of the requesting device
• date and time of access
• name and URL of the file retrieved
• volume of data transferred and server status code
• referring page, where transmitted
• browser and operating system used

Purpose: ensuring trouble-free operation, safeguarding system security, and investigating and preventing abusive access.

Legal basis: Article 6(1)(f) GDPR. Our legitimate interest lies in the secure and stable operation of this website.

Retention: log data is not archived. It is held in a ring buffer of limited size and is continuously overwritten by newer entries; it is not retained over the longer term.

This data is not merged with other data sources, and we draw no conclusions about you as an individual from it.

4. Cookies

Our content management system does not set any cookies when you view the pages.

Two exceptions:

Audience measurement. The measurement described in section 6 sets cookies, but only if you have given your prior consent.

Order form. As soon as you open the order form we set a session cookie named SULUSESSID. It contains no personal data, only a random identifier that assigns your entries to the right order, and it protects the form against attacks from other sites (cross-site request forgery). No order can be submitted without this cookie. It is deleted when you close your browser and requires no consent under section 165(3) of the Austrian Telecommunications Act 2021, because it is strictly necessary for the service you requested.

5. Search function

When you use the search function, your search term is transmitted to our server and processed there in order to display results. No storage or person-related evaluation beyond the server log files (section 3) takes place. The legal basis is Article 6(1)(f) GDPR.

6. Audience measurement with Google Analytics

This website uses Google Analytics, a web analytics service provided by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland (“Google”). Google Analytics uses cookies that enable an analysis of your use of the website.

The data processed includes: truncated IP address, pages visited, time and duration of the visit, referrer, approximate location at country or city level, and the device, browser and operating system used.

We have activated IP anonymisation. Your IP address is truncated by Google within the European Union or the European Economic Area before being transferred to a Google server. Transfer to and processing in the United States by Google LLC can nevertheless not be excluded. Google LLC is certified under the EU-US Data Privacy Framework; standard contractual clauses pursuant to Article 46(2)(c) GDPR apply in addition.

Cookies used and their lifetime:

Legal basis: your consent pursuant to Article 6(1)(a) GDPR in conjunction with section 165(3) of the Austrian Telecommunications Act 2021. You may withdraw your consent at any time with effect for the future by clicking “Cookie settings” in the footer and declining there.

Further information: https://policies.google.com/privacy
Browser opt-out add-on: https://tools.google.com/dlpage/gaoptout

7. External resources

Resources are loaded from third-party servers in order to display the website. For technical reasons, your IP address is transmitted to the respective provider.

Legal basis: Article 6(1)(f) GDPR; our legitimate interest lies in the consistent and functional presentation of the website.

8. Contacting us by email

If you contact us by email, we process your details solely in order to handle your enquiry. The legal basis is Article 6(1)(f) GDPR (responding to your enquiry) or Article 6(1)(b) GDPR where your enquiry is aimed at concluding a contract. Your message is deleted once the matter has been dealt with conclusively and no statutory retention obligations prevent deletion.

9. Ordering the book

You can order a book through this website. This section describes what happens to your data when you do.

9.1 What we collect

An order requires your first and last name, street and house number, an address line 2 if applicable, postcode, town, country and your email address. A phone number is optional — we use it only if there is a problem with delivery — as is a message to us.

We also store what the ordering process itself produces: order and invoice number, time, amount, tax rate, shipping zone, payment method, and the identifiers under which our payment service provider records the transaction. We further record that and when you confirmed the terms and conditions including the withdrawal instructions, and this privacy policy.

We do not collect payment data. You enter your card number, IBAN or online banking credentials solely with our payment service provider, never with us. We only learn whether payment was made and by what means.

Legal basis: Article 6(1)(b) GDPR — the processing is necessary for the performance of the purchase contract. For the invoice and its retention, additionally Article 6(1)(c) GDPR in conjunction with tax law.

9.2 Payment processing through Stripe

Payments are processed by Stripe Payments Europe, Ltd., 1 Grand Canal Street Lower, Grand Canal Dock, Dublin, Ireland.

When you click “Buy now” you are redirected to a payment page operated by Stripe. We transmit the amount, the currency, the order identifier and your email address. Everything else — in particular your payment details — you enter directly with Stripe.

Stripe processes this data not only on our behalf but also as a controller in its own right, for instance to prevent fraud and to meet its own regulatory and anti-money laundering obligations. For that part Stripe is independently responsible under data protection law. Details are in Stripe’s privacy policy: https://stripe.com/privacy

A transfer to the United States, to the parent company Stripe, Inc., 510 Townsend Street, San Francisco, CA 94103, USA, cannot be ruled out.

Such transfers are based on the European Commission’s standard contractual clauses under Article 46(2)(c) GDPR, which form part of Stripe’s data processing agreement. Stripe, Inc. is additionally certified under the EU-U.S. Data Privacy Framework; for transfers on that basis an adequacy decision of the European Commission under Article 45 GDPR is in place.

Legal basis: Article 6(1)(b) GDPR.

9.3 Sending the order confirmation through Brevo

We send the order confirmation including the invoice through the service Brevo, operated by Brevo GmbH, Köpenicker Straße 126, 10179 Berlin, Germany.

Brevo receives your email address, your name and the content of the message including the attached invoice. Brevo processes this data solely on our instructions; a data processing agreement under Article 28 GDPR is in place. Brevo does not use your address for its own purposes and does not send you advertising of its own accord.

Legal basis: Article 6(1)(b) GDPR.

9.4 Where the data is held, and for how long

Order data is held in the database on the server named in section 3. The invoice and the shipping label are additionally stored as PDFs outside the publicly reachable area and are included in the backup.

Retention: we keep invoices and the associated order data for seven years. This is required by section 132(1) of the Austrian Federal Fiscal Code; the period runs from the end of the calendar year in which the order was placed. We cannot delete them earlier, not even on request — your right to erasure is restricted accordingly under Article 17(3)(b) GDPR.

Orders that were never paid expire after 24 hours and are deleted in full 90 days after the order was placed. The same applies to orders you cancelled and to orders whose payment failed. No contract ever came about from such an order, there is no invoice for it, and nothing obliges us to keep your address beyond that point.

9.5 If you withdraw

If you declare a withdrawal, we process your declaration and the reversal on the basis of Article 6(1)(c) GDPR. The correspondence is subject to the same retention periods as the order itself.

10. Recipients and disclosure

Your data is disclosed only to the service providers named in this policy and only to the extent necessary to operate the website and to process an order:

For shipments to Switzerland and Liechtenstein, your name and address are additionally stated on the customs declaration and thereby become known to the customs authorities of the destination country. The legal basis is Article 6(1)(c) GDPR.

Data is never sold.

11. Automated decision-making

No automated decision-making, including profiling, within the meaning of Article 22 GDPR takes place.

12. Your rights

You have the following rights regarding your personal data:

• Access (Article 15 GDPR)
• Rectification of inaccurate data (Article 16 GDPR)
• Erasure (Article 17 GDPR)
• Restriction of processing (Article 18 GDPR)
• Data portability (Article 20 GDPR)
• Objection to processing based on legitimate interests (Article 21 GDPR)
• Withdrawal of consent with effect for the future (Article 7(3) GDPR)

An informal message to office@herbertwillisociety.org is sufficient to exercise them.

13. Right to lodge a complaint

You have the right to lodge a complaint with a supervisory authority about our processing of your personal data. The authority responsible for us is:

Austrian Data Protection Authority (Österreichische Datenschutzbehörde)
Barichgasse 40–42, 1030 Vienna, Austria
Phone: +43 1 52 152-0
Email: dsb@dsb.gv.at
Web: https://www.dsb.gv.at

14. Changes

We will update this privacy policy whenever changes to this website or to the legal situation make it necessary.

Last updated: August 2026