Data Protection

BHM-Tech Produktionsgesellschaft m.b.H.

The protection of your personal data is an important concern for us. We process your data exclusively in accordance with applicable data protection regulations, in particular the General Data Protection Regulation (GDPR), the Austrian Data Protection Act (DSG), and the Telecommunications Act 2021 (TKG 2021). With this privacy policy, we inform you about the nature, scope, purposes, and legal bases of the processing of personal data in connection with the use of our website and the use of our online services.

1. Responsible party

The person responsible for the processing of personal data is:
BHM-Tech Produktionsgesellschaft m.b.H.
Grafenschachen 242
7423 Grafenschachen
Austria

Phone: +43 (0) 3359 20078
E-Mail: office@bhm-tech.com
Website: www.bhm-tech.com

This privacy policy applies to our website:
www.bhm-tech.com

For questions regarding data protection or the exercise of your rights as a data subject, you can contact us at any time using the contact details provided above.

2. General information about the processing of personal data

Personal data is all information relating to an identified or identifiable natural person. This includes, for example, name, address, email address, telephone number, IP address, and information that you provide to us as part of an inquiry or report.

We process personal data only to the extent necessary for the provision of our website, the processing of requests, the execution of pre-contractual or contractual measures, the fulfillment of legal obligations, or for the
The safeguarding of legitimate interests is required or an appropriate consent exists.

The processing takes place, in particular, on the basis of:

  • Article 6(1)(a) of the GDPR – Consent
  • Art. 6(1)(b) GDPR – Fulfillment of a contract or implementation of pre-contractual measures
  • Article 6(1)(c) GDPR – Fulfillment of legal obligations
  • Art. 6(1)(f) GDPR – Protection of legitimate interests Where special categories of personal data are processed, the requirements of Art. 9 GDPR also apply.

3. Accessing and using our website

When you visit our website, your browser automatically transmits technically necessary information to the web server.

In particular, the following data can be processed:

  • IP address of the accessing end device
  • Date and time of the access
  • Requested pages and files
  • Amount of data transferred
  • Browser type and browser version
  • Used operating system
  • Referrer URL, if submitted by the browser
  • Technical status and error messages

This data is used for the technical provision of our website, the guarantee of system security, the analysis of errors, and the detection and prevention of unauthorized access.
Processing is carried out based on our legitimate interest in a secure, stable, and functional website in accordance with Article 6(1)(f) of the GDPR. The server log data is stored only for as long as necessary for the stated purposes, and then deleted unless there are legal obligations or security-related reasons to delete it.

The specific storage duration depends on the configuration of our hosting provider.

4. Hosting and technical service providers

We use external service providers to provide, maintain and support our website.

As part of these services, personal data, in particular technical connection data and, where applicable, information submitted via online forms, may be processed by commissioned service providers.
To the extent that these service providers process personal data on our behalf, this is done on the basis of appropriate agreements in accordance with Article 28 of the GDPR.

When selecting our service providers, we ensure that they have appropriate technical and organizational measures in place to protect personal data. Processing outside the European Economic Area only takes place insofar as
the legal requirements of the GDPR are met for this purpose.

Contact and contact form

If you contact us by email, telephone or via the contact form provided on our website, we will process the personal data you provide to process and answer your request. The contact form can be used to collect the following information in particular:

  • First and last name
  • State
  • Postcode / ZIP
  • Phone number, if provided
  • Email address
  • Role of the requesting person
  • Type of attachment
  • Content of your message

The processing serves solely for the processing of your request, the communication with you, and, if applicable, the implementation of any further necessary measures. The legal basis is Art. 6(1)(b) GDPR, insofar as your request is directed towards initiating or executing a contract.

For other inquiries, processing is based on our legitimate interest in providing appropriate and efficient communication in accordance with Art. 6(1)(f) GDPR.
Providing the information marked as mandatory fields is necessary in order for us to process your request. Without these details, processing may not be possible.

We store your information only for as long as is necessary for processing your request and for appropriate follow-up. In addition, longer storage may be necessary if there are statutory retention obligations or the data is required for the assertion, exercise or defense of legal claims. Any disclosure to third parties will only take place if this is necessary for the processing, required by law, or covered by appropriate consent.

6. Forwarding of requests to specialist partners and providers

As part of our customer service, we offer you the option of referring your request to a suitable specialist partner, hearing care professional, or provider in your area. Any such referral, for requests for which we require your explicit consent, will only be made if you have expressly agreed to this transfer.

Depending on the request, the following data can be transmitted:

  • Name and contact details
  • State and postal code
  • Required product or supply information
  • Content of your request
  • Further voluntarily submitted information necessary for processing

The purpose of the transfer is to provide a suitable contact person and to assist with product-related questions or potential hearing care. The legal basis is your consent pursuant to Art. 6(1)(a) GDPR. If the information transmitted contains health data, an appropriate express consent pursuant to Art. 9(2)(a) GDPR is also required, unless another legal exception applies.

Consent is voluntary and can be revoked at any time with effect for the future. Please note that a revocation does not affect the legality of data processing that has already taken place. To the extent that data has already been submitted to an independently responsible professional partner, it may be necessary to assert data subject rights additionally against that party.

7. Reporting of medical incidents and safety risks

As a manufacturer of medical products, we take the safety of our products and the protection of users seriously. On our website, we provide a reporting form that can be used to report unexpected incidents, malfunctions with health consequences, and possible safety risks related to our medical products. As part of such a report, the following data can be processed in particular:

  • First and last name
  • Company name, if provided
  • State and postal code
  • Phone number and email address
  • Role of the reporting person
  • Date of the incident
  • Information about possible personal injury
  • Product description
  • Article number, serial number or batch number
  • Description of the incident
  • Other voluntarily submitted information

Depending on the content of the notification, special categories of personal data, in particular health data within the meaning of Article 9(1) of the GDPR, may also be affected. The processing takes place for the purpose of examining, documenting, evaluating and handling safety-related events, as well as fulfilling the regulatory requirements applicable to medical devices. This includes, in particular, the obligations regarding market surveillance, vigilance, traceability and product safety pursuant to Regulation (EU) 2017/745 on medical devices (MDR), insofar as they are applicable in the specific case.

Processing takes place, in particular, on the basis of Art. 6(1)(c) GDPR in conjunction with the relevant legal obligations. To the extent that health data are processed to fulfill the corresponding legal obligations, the relevant exception for this purpose pursuant to Art. 9(2) GDPR applies. Any disclosure may take place, insofar as necessary and provided for by law, in particular to the following recipients:

  • Competent authorities and market surveillance authorities
  • Other entities that must be included by law
  • External specialist bodies required for investigation or evaluation
  • Contracted service providers, insofar as this is necessary for the processing

Personal data from incident reports is stored taking into account the applicable regulatory documentation and retention obligations.

Deletion takes place as soon as the data for the stated purposes are no longer required and there are no statutory retention obligations or other lawful reasons for further storage.

8. Requests for business partnership

Through our website, companies and professionals can express their interest in collaborating with BHM-Tech. In the context of such an inquiry, the following data may be processed in particular:

  • Company name
  • Business address
  • UID number
  • State
  • Name of the contact person
  • Telephone number
  • Email address
  • Product interests
  • Content of the transmitted message

The processing takes place for the purpose of examining and processing the request, for contacting the user, and, if necessary, for preparing a business collaboration.

The legal basis is, insofar as the prerequisites are met, Article 6(1)(b) GDPR. Otherwise, the processing takes place on the basis of our legitimate interest in initiating and maintaining business relationships pursuant to Art. 6.
Art. 1 lit. f GDPR.

The data will be stored for the duration of the processing and, if applicable, during an existing business relationship. Legal retention obligations remain unaffected.

9. Protected Partner Portal

On our website, we provide authorized professional partners with a protected area through which they can access product-related information, technical documentation, and other materials. In connection with the provision and use of the partner portal, the following data may be processed in particular:

  • Username
  • Membership in an organization
  • Login and authentication data
  • Permissions and access status
  • Technical protocol data
  • Time and duration of application processes

The processing serves the purpose of providing a protected information area, user management, controlling access permissions, and ensuring system security.

The legal basis is Article 6(1)(b) of the GDPR, insofar as processing is necessary for the performance of a contractual agreement with the data subject. Otherwise, it is based on Article 6(1)(f) of the GDPR, in particular our legitimate interest in the secure management of business partner access.

Access data is processed according to the respective authorization status. After the access authorization expires, the data is deleted unless further storage is required or legally required. Passwords and authentication information are protected through appropriate technical and organizational measures.

10. Cookies and similar technologies

Our website may use cookies and similar technologies to provide technical functions, store settings, and, if necessary, analyze the use of our website. Cookies are small files or information that can be stored on your device or read from it. We distinguish between technically necessary technologies and those that require prior consent.

10.1 Technically necessary cookies

Technically necessary cookies enable basic functions of our website, such as session management, secure login in the partner portal, or the storage of data protection-related settings.

As far as these technologies are absolutely necessary to provide a specifically desired service, no consent is required under § 165, paragraph 3 of the TKG 2021.

As far as personal data is processed in this context, this is done, in particular, on the basis of Article 6(1)(f) GDPR or, where applicable, Article 6(1)(b) GDPR.

10.2 Optional cookies and tracking technologies

If we use cookies or similar technologies for statistical analysis, marketing or other non-technically necessary purposes, their activation will generally only take place after your prior consent.

The legal basis for the associated processing of personal data is Art. 6(1)(a) GDPR in conjunction with § 165(3) TKG 2021. You can withdraw your consent at any time with effect for the future by contacting us via
revoke the privacy settings offered on our website.

The individual technologies used, their providers, purposes, and storage periods are indicated in the corresponding cookie information.

11. External content and links

Our website may contain links to third-party Internet offerings, such as external information offerings, digital maps, or other websites.

By clicking on an external link, you may leave our website. The subsequent processing of personal data by the respective provider is governed by its own privacy policy.

Insofar as external content is directly integrated into our website and personal data, such as your IP address, is transmitted to third-party providers, we will inform you separately and, if necessary, obtain your prior consent.

12. Recipient of personal data

The transmission of personal data takes place only to the extent necessary for the purposes specified in each case and provided that there is an appropriate legal basis.

Possible recipients include in particular:

  • IT and hosting service providers
  • Technical service providers for the maintenance and operation of the website
  • Authorized specialist partners and providers with appropriate authorization
    Transmission
  • External service providers to support operational processes
  • Competent authorities and other statutory bodies

Insofar as service providers act on our behalf, the processing takes place in accordance with the terms of corresponding data protection agreements.

Transmission to recipients outside the European Economic Area will only take place if there is a permissible basis for transmission under Chapter V of the GDPR, such as a decision on adequacy or appropriate safeguards.
Guarantees.

13. Duration of data storage

We generally only store personal data for as long as is necessary for the respective processing purposes.

The specific storage period depends in particular on:

  • The purpose of the processing
  • The duration of processing an inquiry
  • The duration of an existing business relationship
  • Legal documentation and retention obligations
  • Regulatory requirements related to medical devices
  • The necessity to establish, exercise or defend a
    Legal claims

As soon as the respective processing purpose no longer exists and there are no legitimate reasons for further storage, the relevant data will be deleted or anonymized.

14. Data security

We implement appropriate technical and organizational measures to protect personal data from unauthorized access, loss, manipulation, destruction, or improper disclosure.

These include, in particular, measures to restrict access, to ensure the secure transmission of data, and to protect our technical systems.

Our website uses an encrypted HTTPS connection to secure the transmission of information between your end device and our web server.

Despite appropriate protective measures, absolute security cannot be guaranteed when transferring data over the Internet.

15. Your rights under the GDPR

As a data subject, you have the following rights under the legal requirements:

Right of information (Art. 15 GDPR)
You have the right to obtain information about whether and what personal data we process about you.

Right to rectification (Art. 16 GDPR)
You have the right to request the correction of incorrect or the completion of incomplete personal data.

Right to erasure (Art. 17 GDPR)
You may request the deletion of your personal data, unless there are statutory retention obligations or other legal exceptions to this.

Right to restrict processing (Art. 18 GDPR)
Under certain conditions, you may request a restriction on the processing of your personal data.

Right to data portability (Art. 20 GDPR)
Provided the legal requirements are met, you have the right to receive the personal data you have provided in a structured, commonly used and machine-readable format or to have it transmitted to another controller.
to demand it from other responsible persons.

Right to object (Art. 21 GDPR)
To the extent that processing is based on Art. 6(1)(e) or (f) of the GDPR, you may object to the processing for reasons arising from your particular situation.

Right to revoke a consent (Art. 7(3) GDPR)
If the processing is based on your consent, you can revoke it at any time with effect for the future. The revocation does not affect the legality of the processing that has taken place up to that point.
To exercise your rights, please contact:
office@bhm-tech.com

16. Right of appeal to the data protection authority

If you believe that the processing of your personal data violates data protection regulations, you have the right to file a complaint with a competent data protection supervisory authority.

In Austria, this is:

Austrian Data Protection Authority
Barichgasse 40–42
1030 Vienna
Austria
Website: https://www.dsb.gv.at

Your right to complain exists regardless of any prior contact with us.

17. Changes to this privacy policy

We reserve the right to adapt this privacy policy as necessary due to changed legal requirements, technical developments, or changes in our data processing processes. The most current version is available on our website.

Status: October 2026