Data Protection

The protection of your personal data is important to us. We process your data exclusively on the basis of the applicable legal provisions, in particular the General Data Protection Regulation (GDPR), the Austrian Data Protection Act (DSG) and the Austrian Telecommunications Act 2021 (TKG 2021). This privacy policy informs you about the main aspects of data processing in connection with our website www.phi-oil.com.

1. Controller

The controller responsible for data processing on this website is:

PHI OIL GmbH
Unterechingerstraße 2
5113 St. Georgen bei Salzburg
Austria
E-mail: office@phi-oil.com

No data protection officer has been appointed, as the legal requirements for this do not apply. Please direct any data protection enquiries to the e-mail address above.

2. Hosting and server log files

This website is hosted by:

PERFECTNET GMBH
Statteggerstraße 60
8045 Graz
Austria
Web: www.perfectnet.at

Server location: Germany. We have concluded a data processing agreement with the hosting provider in accordance with Art. 28 GDPR. The hosting provider processes data exclusively on our instructions.

When you visit our website, the web server automatically records information in so-called server log files that your browser transmits:

• IP address of the accessing device
• date and time of access
• page or file accessed and amount of data transferred
• referrer URL (previously visited page)
• browser type and version, operating system

This data is not merged with other data sources. Processing is based on our legitimate interest in the technically error-free presentation, security and optimisation of our website (Art. 6(1)(f) GDPR). Log files are deleted after 14 days, unless longer retention is required to investigate a security incident.

3. SSL/TLS encryption

For security reasons and to protect the transmission of confidential content, such as enquiries you send to us, this website uses SSL/TLS encryption. You can recognise an encrypted connection by the fact that the address line of your browser begins with “https://” and a padlock symbol is displayed. When encryption is active, the data you transmit to us cannot be read by third parties.

4. Cookies and consent management

4.1 General information on cookies

Our website uses cookies. These are small text files stored on your device. Some cookies are technically necessary for the website to function; other services are only used with your consent. We use technically necessary cookies on the basis of Section 165(3) TKG 2021 and Art. 6(1)(f) GDPR (legitimate interest in the proper operation of the website). For all other cookies and comparable technologies we obtain your consent in accordance with Section 165(3) TKG 2021 and Art. 6(1)(a) GDPR.

You can set your browser to inform you about the setting of cookies, to allow cookies only in individual cases or to reject them altogether. If cookies are disabled, the functionality of this website may be limited.

4.2 Consent management with Borlabs Cookie

To obtain and document your consent, we use the consent tool Borlabs Cookie provided by Borlabs GmbH, Rübenkamp 32, 22305 Hamburg, Germany. Borlabs Cookie is installed on our own server; no data is transmitted to Borlabs.

When you enter the website, a cookie named borlabs-cookie is stored in your browser. It records the consents you have given or refused, an anonymous identifier and the time of your decision. This cookie has a lifetime of 60 days. Processing is carried out to fulfil our legal obligation to be able to demonstrate consent (Art. 6(1)(c) GDPR in conjunction with Art. 7(1) GDPR).

You can view, change or withdraw your selection at any time via the icon in the bottom left corner of the screen (“Privacy Preferences”).

4.3 Overview of technically necessary cookies

5. Language selection (Polylang)

Our website is available in German and English. We use the WordPress plug-in Polylang (WP SYNTEX, France) to manage the language versions. The plug-in runs entirely on our server and does not transmit any data to the manufacturer. The technically necessary cookie pll_language is set to store your language choice (legal basis: Section 165(3) TKG 2021, Art. 6(1)(f) GDPR).

6. Website security (Wordfence)

To protect our website against attacks, malware and unauthorised access, we use the security plug-in Wordfence. The provider is Defiant, Inc., 800 5th Ave Ste 101-171, Seattle, WA 98104, USA.

Wordfence operates as a web application firewall and checks incoming requests for malicious patterns. In doing so, your IP address is processed and compared with lists of known attackers; in the event of suspicious access, the IP address may be temporarily blocked. To check against current threat data, the IP address may be transmitted to Defiant servers in the USA. Data transfer to the USA is based on the standard contractual clauses of the EU Commission; Defiant, Inc. is also certified under the EU-US Data Privacy Framework.

Processing is based on our legitimate interest in the secure and trouble-free operation of the website (Art. 6(1)(f) GDPR). Security-related logs are deleted after 30 days at the latest, unless they are required to investigate an incident. Further information: https://www.wordfence.com/privacy-policy/

7. Fonts (Monotype Fonts)

For the uniform display of fonts, this website uses web fonts (“Neue Helvetica World”) from the provider Monotype. The provider is Monotype Imaging Inc., 600 Unicorn Park Drive, Woburn, MA 01801, USA; EU representative: Monotype GmbH, Spichernstraße 2, 10777 Berlin, Germany.

The fonts are only loaded after you have given your consent in the privacy dialog to the category “External Media” or to the service “Monotype Fonts”. When loading, your browser establishes a connection to Monotype servers (cdn.fonts.net). Your IP address, the page accessed, browser information and the time of access are transmitted to Monotype; Monotype also records the number of page views for licence billing. According to Monotype, no cookies are set in the process.

The legal basis is your consent pursuant to Art. 6(1)(a) GDPR and Section 165(3) TKG 2021. You can withdraw your consent at any time with effect for the future via the Privacy Preferences; the website will then be displayed in a standard font of your system. Data transfer to the USA is based on the standard contractual clauses of the EU Commission. Further information can be found in Monotype’s privacy policy: https://www.monotype.com/legal/privacy-policy

8. Customer area, contact form and e-mail enquiries

8.1 Registration for the customer area (data sheets)

Customers and prospective customers can use the form in the “Customer Zone” section to register for access to our product data sheets. We collect the following data: title, first and last name, position, company, street/number, postcode, city, country, e-mail address, telephone number and your questions and comments (free text).

The information is sent by e-mail to office@phi-oil.com and stored there to process your request and to provide the data sheets. Before submission, a spam protection mechanism of the website system is used that does not transmit any data to third parties.

The legal basis is Art. 6(1)(b) GDPR (pre-contractual measures or performance of a contract with business customers). Insofar as your enquiry has no contractual connection, we process the data on the basis of our legitimate interest in responding to enquiries (Art. 6(1)(f) GDPR). Confirming the privacy policy via the mandatory checkbox serves to inform you; it does not constitute consent within the meaning of Art. 6(1)(a) GDPR.

We store the data until your enquiry has been fully processed and no business relationship exists any longer, but for no longer than three years after the last contact. Data that becomes part of our accounting records in the course of a business relationship is retained for seven years in accordance with Section 132 of the Austrian Federal Fiscal Code (BAO).

8.2 Enquiries by e-mail or telephone

If you contact us by e-mail or telephone, your details (name, contact details, content of the enquiry) are stored by us in order to process the matter and for follow-up questions. Processing is based on Art. 6(1)(b) GDPR if the enquiry is related to a contract or is necessary for pre-contractual measures, and otherwise on our legitimate interest in processing the enquiry (Art. 6(1)(f) GDPR). The data is deleted once the matter has been resolved and no statutory retention obligations apply.

9. Recipients, third-country transfers and retention period

Recipients: Within our company, only those departments that need your data to fulfil the purposes described have access to it. We use the hosting provider PERFECTNET GMBH as a processor. Service providers for website security (Defiant, Inc.) and fonts (Monotype Imaging Inc.) receive the data described above. Data is only passed on to other third parties if this is required by law or if you have given your consent.

Third-country transfers: Data is only transferred to the USA in the cases described in Sections 6 and 7 and is based on the standard contractual clauses of the EU Commission (Art. 46(2)(c) GDPR) or on the recipient’s certification under the EU-US Data Privacy Framework (Art. 45 GDPR).

Retention period: Unless a more specific retention period is stated in this policy, your data remains with us until the purpose of processing no longer applies, you withdraw your consent or object to processing, and no statutory retention obligations (in particular seven years under Section 132 BAO and Section 212 of the Austrian Commercial Code (UGB)) stand in the way.

10. Your rights as a data subject

You have the following rights with regard to your personal data:

• Access (Art. 15 GDPR) to the data stored about you,
• Rectification (Art. 16 GDPR) of inaccurate or incomplete data,
• Erasure (Art. 17 GDPR), provided no statutory retention obligations apply,
• Restriction of processing (Art. 18 GDPR),
• Data portability (Art. 20 GDPR) in a commonly used, machine-readable format,
• Objection (Art. 21 GDPR) to processing based on Art. 6(1)(f) GDPR on grounds relating to your particular situation; you may object to direct marketing at any time without giving reasons,
• Withdrawal of consent given (Art. 7(3) GDPR) at any time with effect for the future – for cookies and services via the Privacy Preferences, otherwise by e-mail to office@phi-oil.com.

To exercise your rights, please contact office@phi-oil.com or write to the address given in Section 1.

11. Right to lodge a complaint with the supervisory authority

If you believe that the processing of your data violates data protection law or that your data protection rights have otherwise been infringed, you can lodge a complaint with the supervisory authority. In Austria, this is:

Österreichische Datenschutzbehörde (Austrian Data Protection Authority)
Barichgasse 40–42
1030 Vienna
Austria
Telephone: +43 1 52 152-0
E-mail: dsb@dsb.gv.at
Web: www.dsb.gv.at

12. No automated decision-making

No automated decision-making, including profiling, within the meaning of Art. 22 GDPR takes place on this website.

13. Changes to this privacy policy

We reserve the right to amend this privacy policy so that it always complies with current legal requirements or to reflect changes to our services. The version published on this page at the relevant time applies.

Last updated: 10 November 2026