Cookie
Policy.

Purpose and scope of this policy

This Cookie Policy explains how BCA Unternehmensberatung UG uses cookies and comparable technologies in connection with the website bcaun.at.

It should be read together with our Privacy Policy, which explains how personal data is processed, the applicable legal bases, possible recipients, retention and your rights under the GDPR.

This policy does not state that every technology described below is active on every page. The technologies actually used depend on the current website configuration, the services embedded on a particular page and the preferences selected by the visitor.

Cookies and similar technologies

A cookie is a small data file that a website or service stores in the visitor’s browser or device. Cookies can contain an identifier, settings, timestamps or other technical information.

Similar technologies may perform comparable functions without necessarily creating a conventional browser cookie.

• Local storage and session storage;
• pixels and tracking tags;
• scripts and software-development components;
• device or browser identifiers;
• embedded content and external-service requests;
• consent records stored in the browser.

These technologies can be used for technical operation, security, remembering choices, analytics, external content or advertising. The legal requirements depend on the technology’s actual purpose and operation.

Device access and personal-data processing are separate legal questions.

Under § 25(1) TDDDG, storing information in a user’s terminal equipment or accessing information already stored there generally requires informed consent.

Consent is not required under § 25(2) TDDDG where the sole purpose is transmitting a communication over a public telecommunications network or where the technology is strictly necessary to provide a digital service expressly requested by the user.

Where a technology also processes personal data, that processing must separately have a legal basis under the GDPR.

Technologies required for the requested website service

Essential technologies may be used where they are technically required to deliver, protect or operate a function expressly requested by the visitor.

• Delivering pages and balancing technical requests;
• protecting the website against abuse or security threats;
• maintaining a session required for a requested function;
• transmitting a submitted contact form;
• storing the visitor’s consent or rejection choices;
• preventing the consent interface from appearing repeatedly;
• maintaining necessary language or navigation settings.

A technology is not essential merely because it is convenient for the website operator. The classification depends on whether the requested digital service can reasonably be provided without it.

Optional functions and remembered preferences

Functional technologies can support additional features or remember settings that are not strictly required for the basic delivery of the website.

• Remembering optional display preferences;
• retaining non-essential regional settings;
• activating enhanced media or interactive components;
• remembering settings for an external service;
• providing functionality beyond the basic page requested.

Where consent is legally required, these functions remain inactive until the visitor accepts the relevant category.

Website measurement and performance analysis

Analytics technologies may be used to understand how the website is reached and used and to identify technical or content-related problems.

• Pages viewed and navigation paths;
• general traffic sources;
• approximate visit duration;
• interactions with page elements;
• browser, device and operating-system information;
• performance data and technical errors;
• aggregated conversion or enquiry information.

Where analytics involves optional storage, device access or personal-data processing, it is activated only after consent.

Tilda’s embedded statistics may use cookies for more detailed results and attribution. The website configuration may instead use a simplified statistics mode with reduced accuracy and reduced reliance on cookies.

Campaign measurement and advertising technologies

Advertising technologies may be used where enabled to measure campaigns, attribute enquiries or display advertising based on previous interactions.

• Conversion measurement;
• campaign and referral attribution;
• frequency control;
• audience creation;
• remarketing or personalised advertising;
• fraud and invalid-click detection.

Advertising and remarketing technologies are optional. They should not be activated merely because the visitor opened or scrolled through a page.

Maps, media and third-party components

A page may include content or functionality supplied by an external provider, such as a map, video, widget or interactive media component.

Loading an external component can transmit the visitor’s IP address, browser information, referring page and interaction data to the provider. The provider may also store or access information on the visitor’s device.

Where consent is required, the component should initially appear as a blocked placeholder and load only after the visitor accepts the relevant category or deliberately activates the content.

Ordinary hyperlinks to external websites do not generally cause the destination provider to receive information before the link is clicked.

Google Analytics, Tag Manager, Ads and Maps

Depending on the current technical configuration and the particular page, the website may use or integrate services provided by Google Ireland Limited and associated Google companies.

Depending on the service and configuration, Google may process IP addresses, browser and device information, website interactions, approximate location information, identifiers and consent signals.

Where Google Consent Mode is implemented, tags may alter their behaviour according to the consent signals received. Consent Mode does not itself replace a legally valid consent interface and does not by itself prove that every website tag is correctly configured.

More information is available in Google’s Privacy Policy and its information about cookies .

Website platform and consent interface

The website is built and technically delivered using Tilda Publishing. Tilda components may use essential technologies for page delivery, form handling, security and storage of consent choices.

Depending on the settings selected by the website operator, Tilda may also provide analytics functionality and integration with external scripts or services.

Tilda’s configurable consent tool can distinguish between categories such as essential, analytics, advertising and custom technologies. The actual classification and blocking rules must correspond to the scripts and services genuinely used on the website.

The current cookie list must reflect the live website.

Cookie names, providers and storage periods can change when website settings, platform components or third-party services are updated.

The most reliable cookie declaration is therefore the live list generated or maintained through the website’s consent tool. It should identify, where applicable:

• cookie or storage-item name;
• provider or domain;
• purpose;
• category;
• storage or expiry period;
• whether the technology is first-party or third-party.

Technologies detected during a technical scan should be checked against the real purpose and configuration. Automated scanners can identify files and requests but cannot always determine the correct legal classification.

Accepting, rejecting and withdrawing consent

On the first relevant visit, the consent interface should allow the visitor to:

• accept all optional categories;
• reject optional categories;
• review categories before deciding;
• save a granular selection;
• access this Cookie Policy and the Privacy Policy.

Consent may be withdrawn or changed at any time with future effect through the Cookie Settings control available in the website footer or consent interface.

Withdrawing consent does not affect processing that was lawful before withdrawal. It should prevent the relevant optional technologies from being used on subsequent page loads, subject to the technical operation of the selected service.

Browser and device settings

Most browsers allow users to display, block or delete cookies and site-storage data. The available controls differ between browsers and devices.

Blocking all cookies through browser settings may also remove or prevent essential technologies and can therefore affect form handling, consent storage, language settings or other requested functions.

Browser deletion does not replace withdrawal through the website’s consent interface, but it may reset the stored consent selection and cause the banner to appear again.

Processing outside the European Economic Area

Some external providers or their sub-processors may process data outside the European Union and European Economic Area, particularly in the United States.

Where Chapter V GDPR applies, a transfer must rely on a valid mechanism, which may include:

• an adequacy decision of the European Commission;
• participation in the EU–US Data Privacy Framework, where the recipient is eligible and certified;
• European Commission Standard Contractual Clauses;
• another mechanism permitted by the GDPR;
• a specific statutory derogation where legally available for the particular transfer.

Details concerning personal-data transfers are also addressed in the Privacy Policy and the relevant provider’s own documentation.

Storage periods

Session technologies generally expire when the browser session ends. Persistent technologies remain until their stated expiry, until they are deleted by the visitor or until the website or provider removes them.

Consent records may be retained for the period reasonably required to remember the selection and demonstrate when and how consent was obtained or withdrawn.

The precise duration of each active cookie or storage item should be shown in the live cookie declaration or consent interface where that information is technically available.

Policy updates and controller contact

This policy may be updated when the website configuration, consent tool, external providers or applicable legal requirements change.

The version published on this page applies at the relevant time. Material amendments should be reflected by updating the version date shown at the top of the page.