Skip to content

Privacy policy

Rechtlich verbindlich ist die deutsche Fassung. / The German version is legally binding.

We take the protection of your personal data seriously. Below we explain which personal data we process when you use this Ærocore brand website, for which purposes and on which legal basis. Ærocore is a brand of AWS-Technik GmbH.

1. Controller

The controller within the meaning of the GDPR is:
AWS-Technik GmbH
Erkrather Str. 401, 40231 Düsseldorf, Germany
E-mail: info@aws-technik.de

2. Hosting and server log files (Cloudflare)

This website runs on infrastructure provided by Cloudflare, Inc. (Cloudflare Workers, D1 database, R2 object storage) under a data processing agreement pursuant to Art. 28 GDPR. Data storage (D1 database, R2 storage) is configured to take place in the European Union; page delivery uses Cloudflare's global network. When pages are requested, Cloudflare processes technically necessary connection data in server log files (in particular IP address, date and time, requested resource, referrer, user agent) to deliver, stabilise and secure the service. Legal basis: Art. 6(1)(f) GDPR. Cloudflare may also set technically required security cookies (e.g. __cf_bm; Section 25(2) no. 2 TDDDG).

Server log files are generally deleted or anonymised after 30 days at the latest, unless exceptionally required longer to investigate security incidents. For third-country transfers see section 9.

Cloudflare Web Analytics: to measure delivery quality (load times, error rates, rough page view counts) Cloudflare adds — where enabled — a small measurement script to our pages (static.cloudflareinsights.com); the measurements are sent back to our own address. This service works without cookies and without identifiers that would make you recognisable across page views or websites; in particular no cross-device profiling takes place. Since nothing is stored on or read from your device, no consent under Section 25(1) TDDDG is required - the service therefore runs independently of your choice in the consent banner. Legal basis: Art. 6(1)(f) GDPR (legitimate interest in a technically sound and swiftly delivered website). You may object to this processing under Art. 21 GDPR; contact details are in section 1.

Entries in your browser: Without your consent, we store entries in your browser's storage only for functions you use yourself; we set cookies for this only if you open the configurator from Plancore. What is added with your consent is described in sections 7 and 8. Local storage (localStorage) holds your choice in the consent banner, together with the time and the version of the banner text (aerocore_consent_v2), so that we do not ask again on every visit and can demonstrate your consent, and the light or dark display mode if you switch it (pc-theme). Both remain until you change them or clear the site data in your browser. Session storage (sessionStorage) holds the interim state of your entries in the configurator (aerocore-konfigurator-v1), so that they are kept, for example, when you switch language or reload the page. It contains the technical details, but no contact or address data; it is deleted when you submit the inquiry and ends when you close the browser tab. If you open the configurator from Plancore, we set a cookie for the handover (__Host-plancore-vorsitzung), which expires after at most 10 minutes, and then a cookie (__Host-aerocore-planer) that keeps you signed in to the configurator for up to 8 hours, limited to the existing or newly created project you came with; the sign-in ends after 8 hours, or earlier when you sign out in Plancore. Access to your device is strictly necessary for these functions you have requested and does not require consent (Section 25(2) no. 2 TDDDG). Insofar as personal data is processed, the legal basis is Art. 6(1)(f) GDPR, and for demonstrating your consent Art. 6(1)(c) in conjunction with Art. 7(1) GDPR.

Error monitoring (Sentry): To detect and fix technical errors in our offering, our server sends error reports to the Sentry service of Functional Software, Inc. (USA); the data is stored in the EU data region (Frankfurt am Main). An error report contains the type of error, the location in the program code, the requested address without parameters, the time and the program version. We do not transmit form contents, cookies or request headers, and your IP address is not stored; numbers, email addresses and quoted values in error messages are made unrecognisable before sending. Nothing is stored on or read from your device for this. Legal basis: Art. 6(1)(f) GDPR (legitimate interest in secure and error-free operation). A data processing agreement under Art. 28 GDPR is in place with Sentry; transfers to the USA are safeguarded by its certification under the EU-US Data Privacy Framework. Error reports are deleted after 90 days at the latest. You may object to this processing under Art. 21 GDPR; contact details are in section 1. We report errors from your browser only with your consent to analytics (see there).

3. Inquiries and configurator

When you use our selection tunnel (configurator) and submit an inquiry, we process the technical specifications you enter and your contact details (in particular company, name, e-mail address, phone number and company address as well as, if you enter a different delivery address, that address too). These data are stored in a database (Cloudflare D1, EU location). The purpose is to handle your inquiry and prepare a quotation. Together with the inquiry we store the sizing result calculated on the server.

Legal basis: Art. 6(1)(b) GDPR (pre-contractual measures) and, where the inquiry is made on behalf of an organisation, Art. 6(1)(f) GDPR (legitimate interest in handling business inquiries).

After submitting you receive an automatic confirmation e-mail that mirrors your own entries and, where one has already been assigned at that point, states the reference number of your inquiry. The reference number is a sequential number that contains no information about you; we store it together with your inquiry and handle the matter under it up to the quotation. This confirmation and the internal notification to our team are sent via Cloudflare's e-mail service, covered by the data processing agreement named in section 2; the internal notification additionally contains a rough technical first assessment of your inquiry (sizing bands). Providing your data is voluntary; without your contact details we cannot process the inquiry or prepare a quotation. For retention see section 10.

Optional question “How did you find us?”: when submitting an inquiry or right afterwards you can choose from a fixed list how you came across us; there is no free text. We store your choice with your inquiry and use it only to measure the success of our channels, i.e. to evaluate through which channels inquiries reach us. Legal basis: Art. 6(1)(f) GDPR (legitimate interest in measuring the success of our channels). The information is optional; we handle your inquiry the same way without it. It is kept as long as the inquiry itself (section 10).

For air-to-air inquiries, you receive a personal link with the automatic confirmation e-mail. You can use it to add to or correct the technical details of your inquiry until our quotation, for at most 30 days. For this we store a non-reversible check value of the link, its validity period, how often it was used and technical administrative data such as the language and the times of issue and of any blocking; for each change we store the previous state of your technical details, the changed values, the time and the result of our recalculation. After each of your changes, we send a confirmation to the e-mail address of your inquiry so that you notice changes you did not make. We delete this data together with your inquiry. Adding to and correcting your details is based on the same legal basis as your inquiry (see above). The check value, usage counter, change history and confirmation also serve our legitimate interest in protecting the link against misuse and keeping changes traceable (Art. 6(1)(f) GDPR).

4. Spam and abuse protection (Cloudflare Turnstile)

Where enabled, we use Cloudflare Turnstile to protect our forms against automated submissions. A verification token is validated server-side with Cloudflare; technical information such as your IP address and browser details is processed. Legal basis: Art. 6(1)(f) GDPR; access to your device is required for the form function (Section 25(2) no. 2 TDDDG). If Turnstile is not enabled, no such processing takes place.

5. Lead management

For the structured follow-up of your inquiry we store a lead record: your e-mail address and, where provided, company, name, phone number and the application field. This record is held in the same database as the inquiry itself (Cloudflare D1, EU location, see section 3); no external lead management service is used. The confirmation e-mail and the internal notification to our team are sent through Cloudflare's infrastructure (see section 2). Legal basis: Art. 6(1)(b) GDPR (pre-contractual measures) and Art. 6(1)(f) GDPR (legitimate interest in handling business inquiries).

Inclusion in our prospect list serves exclusively to process and follow up your inquiry. You will not receive marketing e-mails through it without separate consent: newsletters and further product information require double opt-in; the legal basis in that case is your consent under Art. 6(1)(a) GDPR, which you may withdraw at any time with effect for the future.

6. Internal processing, sales system and automation

For internal handling and routing of inquiries we use the self-hosted automation software n8n (operated on our own infrastructure, EU). No inquiry data is transmitted to external third parties through this. Legal basis: Art. 6(1)(b) and (f) GDPR.

For sales processing, inquiries are additionally transferred to an internal, self-hosted CRM system, where internal signals (e.g. the completeness of the details and the technical first assessment described in section 3) are used for prioritisation. No decision based solely on automated processing with legal effect on you (Art. 22 GDPR) takes place - inquiries are always decided by humans.

7. Analytics (only with your consent)

If you have consented via our consent banner, we use — where enabled — the analytics service PostHog (PostHog, Inc., USA; the European instance eu.i.posthog.com is used). Without your consent no PostHog script is loaded and no analytics data is collected. Legal basis: Art. 6(1)(a) GDPR; storing and reading information on your device is based on Section 25(1) TDDDG. Analytics data is deleted or aggregated after 12 months at the latest. With the same consent we also report technical errors that occur in your browser to the error monitoring service Sentry (EU data region, see section 2): type of error, program location, the pages of our offering visited before without parameters, browser and program version, without form contents and without click or input logs. The error script is loaded only after your consent and stores nothing in your browser; after you withdraw consent it sends nothing more.

Withdrawal: you may withdraw your consent at any time with effect for the future - most easily via the “Privacy settings” link in the page footer, which reopens the consent banner; if you decline, analytics stops and the associated cookies and storage entries are removed. Alternatively an informal notice to the contact details above suffices. The lawfulness of processing before withdrawal remains unaffected.

8. Marketing attribution and conversion measurement

If you reach our website via an advertising or campaign link, the URL may contain origin parameters: UTM parameters (utm_source, utm_medium, utm_campaign, utm_term, utm_content) and the click identifiers gclid (Google Ads) and msclkid (Microsoft/Bing Ads). We do not read these parameters, do not place them in your browser and do not store them with your inquiry. Like any address you call up, they do nonetheless appear in your browser history and in the server logfiles described in section 2.

We do not attribute your inquiry to an advertising campaign. Independently of that, the Google Ads script described in the next paragraph reports an event to Google - only with your consent and where activated.

Retention: we do not store campaign parameters. The period stated in section 2 applies to the server logfiles.

Google Ads conversion measurement (only with your consent and where enabled): if you have consented via our consent banner or the optional checkbox in the configurator, we load the gtag.js script from googletagmanager.com and report a conversion event to Google when a configurator inquiry is submitted. What is transmitted: our conversion identifier (Google Ads account and conversion action ID), your IP address, browser and device details and the timestamp; Google attributes the event to a specific ad using the click identifier gclid. The contents of your inquiry - in particular name, e-mail address and technical design data - are not transmitted to Google (enhanced conversions are disabled). For this purpose Google sets cookies on your device, in particular _gcl_aw with a lifetime of typically 90 days, and reads the gclid.

The recipient is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland; data is also transferred to Google LLC in the United States. Google LLC is certified under the EU-US Data Privacy Framework, so the transfer relies on the European Commission's adequacy decision of 10 July 2023. In addition, Google uses the EU Standard Contractual Clauses for certain transfers. We will provide you with a copy of the respective safeguards on request using the contact details above.

Joint controllership: for the collection of this data on our website and its transmission to Google, we and Google are joint controllers within the meaning of Art. 26 GDPR. We decide on the integration and the measurement purpose; Google determines the technical means - script, cookies and attribution logic - and at the same time uses the data for its own purposes, in particular to improve its advertising services. Google alone is responsible for any subsequent processing it carries out; the Google Ads data processing terms and Google's privacy policy govern that stage. Under Art. 26(3) GDPR you may exercise your data subject rights both against us and directly against Google.

We use the service solely for measuring success: personalised advertising, remarketing and customer-list matching are permanently disabled (Google Consent Mode v2, the “ad_personalization” signal always remains denied). As long as you have not consented, no Google script is loaded and no connection to Google is established. Legal basis: your consent (Art. 6(1)(a) GDPR); storing and reading on your device is based on Section 25(1) TDDDG.

You give this consent separately from web analytics (section 7): our consent banner lets you allow or decline each of the two services individually. You may withdraw at any time via “Privacy settings” in the page footer, likewise separately per service. We then stop measurement without delay: no further conversion event is reported, we set the consent signals towards Google to “denied”, and we delete the Google cookies we set (_gcl_*) as far as our website can access them. We have no access to data already transmitted to Google before the withdrawal, nor to cookies Google has set on its own domains; please contact Google directly regarding those. Besides the consent banner, you can also give your consent to conversion measurement via an optional checkbox in the configurator. It is the same consent with the same effect: it is stored in the same place, submitting your enquiry does not depend on it, and a withdrawal via “Privacy settings” covers it as well.

9. Recipients, processors and third-country transfers

Processors: Cloudflare, Inc. (hosting/infrastructure; transfers safeguarded by its certification under the EU-US Data Privacy Framework), Functional Software, Inc. (Sentry, error monitoring; EU data region, DPF-certified) and - only with consent - PostHog, Inc. (analytics; DPF-certified, EU instance). Data processing agreements pursuant to Art. 28 GDPR are in place. In addition, and likewise only with consent, Google Ireland Limited receives data from conversion measurement (section 8). Google is not our processor here: for collection and transmission we and Google are joint controllers under Art. 26 GDPR, while Google alone is responsible for its subsequent processing. Onward transfer to Google LLC, USA (DPF-certified). Data may furthermore be disclosed to authorities or courts where we are legally obliged to do so.

With US providers a residual risk remains that US authorities may access data on the basis of US surveillance laws. You can request a copy of the relevant safeguards from us using the contact details above.

10. Retention

We store personal data only as long as necessary for the respective purposes or as required by statutory retention obligations. For inquiry and lead data: inquiries that do not lead to a contract are deleted no later than three years after the end of the year of the inquiry (standard limitation period, Section 195 German Civil Code). Inquiries classified as rejected or no interest are deleted after six months. If a contract is concluded, we retain the related records under commercial and tax law: six years for commercial and business letters and eight years for accounting records and invoices (Section 257 German Commercial Code, Section 147 German Fiscal Code, Section 14b German VAT Act). Your inquiry itself counts as a business letter; we delete it six years after the end of the year in which it was received. After expiry the data is deleted; deletion also covers the associated lead record.

11. Data processing in the course of business relationships

Beyond this website we process personal data of our customers, prospects, other business partners and their contact persons where necessary to initiate, perform and settle contracts (Art. 6(1)(b) GDPR; for contact persons of legal entities Art. 6(1)(f) GDPR). Before deliveries on account we may obtain credit information from credit agencies or trade credit insurers (Art. 6(1)(f) GDPR). Where we have obtained your e-mail address in connection with the sale of goods or services, we occasionally inform you by e-mail about our own similar products (Section 7(3) German Act against Unfair Competition; Art. 6(1)(f) GDPR); we point this out, together with your right to object at any time, when collecting the address and in every e-mail.

Right to object to direct marketing (Art. 21(2) GDPR): you may object at any time, without stating reasons, to the use of your data for direct marketing; an informal notice to the contact details above suffices.

12. Your rights as a data subject

Under the GDPR you have the following rights: access (Art. 15), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20) and objection to processing (Art. 21). Where processing is based on your consent, you may withdraw it at any time with effect for the future (Art. 7(3) GDPR). If you exercise your right to erasure, we delete your data in all systems involved, including the lead record and our internal sales processing, unless statutory retention obligations prevent this.

Right to object (Art. 21(1) GDPR): where we process data on the basis of legitimate interests (Art. 6(1)(f) GDPR), you may object at any time on grounds relating to your particular situation. We will then no longer process the data unless we can demonstrate compelling legitimate grounds or the processing serves to establish, exercise or defend legal claims.

To exercise your rights, please contact: info@aws-technik.de.

13. Right to lodge a complaint with a supervisory authority

You have the right to lodge a complaint with a data protection supervisory authority (Art. 77 GDPR). The authority responsible for us is:
Landesbeauftragte für Datenschutz und Informationsfreiheit Nordrhein-Westfalen (LDI NRW)
Kavalleriestr. 2-4, 40213 Düsseldorf
https://www.ldi.nrw.de/

14. Our LinkedIn showcase page

We operate a showcase page on LinkedIn (linkedin.com/showcase/ærocore). The provider is LinkedIn Ireland Unlimited Company, Wilton Plaza, Wilton Place, Dublin 2, Ireland. The reference to this page on our website is a plain link: visiting our website transfers no data to LinkedIn; that only happens once you click the link.

For the page statistics (Page Insights) that LinkedIn compiles from your visit to and interactions with our page, we are joint controllers with LinkedIn (Article 26 GDPR). The details are set out in the Page Insights Joint Controller Addendum (legal.linkedin.com/pages-joint-controller-addendum). Under it, LinkedIn has primary responsibility for processing the Insights data and for fulfilling your rights; we only receive aggregated statistics that do not relate to individuals. You can exercise your rights with LinkedIn and with us. The legal basis is our legitimate interest in presenting our offering and getting in touch with prospective customers (Article 6(1)(f) GDPR).

Which further data LinkedIn processes under its own responsibility, including transfers to the USA, is described in LinkedIn's privacy policy (linkedin.com/legal/privacy-policy).

If you send us a message via LinkedIn or comment on a post, we process your details in order to reply. The legal basis is our legitimate interest in answering your request (Article 6(1)(f) GDPR). If a message turns into an inquiry, we transfer your name, company, contact details and the content of the message into our customer management. If you make the inquiry on your own behalf with a view to a contract with us, the legal basis is Article 6(1)(b) GDPR; if you inquire on behalf of a company or your inquiry is not aimed at concluding a contract, the legal basis is our legitimate interest in handling the inquiry and communicating with you as a contact person (Article 6(1)(f) GDPR). Retention is governed by section 10.

15. Planner inquiry in the configurator (Plancore)

Consulting engineers can request a planning package in the configurator instead of a quotation. You can do this directly in the configurator or from Plancore while signed in, our project area for consulting engineers at plancore.tech; the cookies used for this handover are described in section 2. The planning package is available only for air-to-air heat exchangers: Inquiries for process gas are not handled via Plancore. If you select process gas on one side in the form, we handle your inquiry as described in section 3 as an inquiry for a custom design, discard the project details and pass nothing to Plancore. If you come from Plancore while signed in, we use the address you are signed in with there as the contact address. If you create a new project with the inquiry, you provide, in addition to the details described in section 3, a project name, the project location, the expected periods for award and execution and, optionally, the design phase and quantity; if you add to an existing project, these details are not required. In both cases you confirm the terms for the planning package. Please do not name private individuals (such as private building owners) in the project name or location; these details appear on the planning sheet. We store your inquiry with the project details and the version of the terms you confirmed in our database (Cloudflare D1, EU location). The legal basis is Art. 6(1)(b) GDPR (provision of the requested planning package); if you inquire on behalf of a company, the legal basis is our legitimate interest in providing the package and communicating with you as a contact person (Art. 6(1)(f) GDPR). The project details are required for the planning package (see the terms at the mandatory checkbox); without them we cannot compile a planning package but will handle your inquiry as described in section 3.

Handover to Plancore and copies: we provide the office, projects, planning package and bidder route in Plancore. After you submit, we pass the sizing, the project details, the confirmed terms and your contact details (e-mail address, name, company, telephone number) to Plancore via an internal interface; If you come from Plancore while signed in, Plancore assigns the inquiry to the existing project you came from or creates a new project in your office with it. If you send the inquiry without being signed in, Plancore creates an office for your address unless it is already confirmed in Plancore; the project is only added to it once you add it yourself after signing in to Plancore, and you receive access only with the planning package after our review. This way nobody can place projects in your area using your address. Plancore stores a copy of these data with each version. For the handover we create a handover job with the same details and repeat the handover if necessary until Plancore has confirmed it. The handover job with your contact and project details then remains stored with us until your inquiry is deleted (section 10). Handover jobs for changed values of a version are deleted no later than 30 days after they are completed. If you change the values of a version from within Plancore, a new version is created the same way. In our sales system (section 6) we additionally record, for your inquiry, the assignment to the project and version in Plancore. Plancore sends the acknowledgement of receipt for your planner inquiry under the name Plancore from noreply@plancore.tech via Cloudflare's e-mail service (section 2); replies go to plancore@aws-technik.de. As in the first paragraph of this section, the legal basis is Art. 6(1)(b) or (f) GDPR.

Project status enquiries and offers: only if you tick the voluntary box when creating the project do we occasionally ask you by e-mail about the project status until the project is completed (end of the execution period you stated) and inform you about suitable offers. The legal basis is your consent (Art. 6(1)(a) GDPR; Section 7(2) no. 2 German Act against Unfair Competition). Plancore stores the time and text version of your consent and of any withdrawal with the project as evidence (Art. 7(1) GDPR). You may withdraw your consent at any time with effect for the future, for example by e-mail to plancore@aws-technik.de or by replying 'Unsubscribe' to one of our e-mails; you receive the planning package regardless. Without consent we do not ask about the project status. We do not send consulting engineers notes on our own similar products under section 11 unless goods or services have been sold to them.

Bidder inquiries, access and deletion: bidders to whom you pass on the bidder link of your planning request their quotation via a form in Plancore. Plancore forwards this inquiry to us with the bidder's contact details and the sizing, but without your planner details; we store and handle it like an inquiry under section 3, and Plancore records which planning it belongs to. Your inquiry, the handover job and the copy in the sales system are subject to the retention periods in section 10; handover jobs for changed values are deleted 30 days after they are completed. The copies in Plancore are subject to the periods in Plancore's privacy policy. You obtain access (Art. 15 GDPR) to your inquiry, the handover job and the copy in the sales system from us (section 12), and to the copies in Plancore from Plancore. If you exercise your right to erasure (Art. 17 GDPR) with us, we delete your inquiry, the handover job and the copy in the sales system (section 12); beforehand we also delete the associated item in Plancore together with its versions and documents, and for a bidder inquiry its assignment to the planning. If Plancore cannot be reached at that moment, we delete nothing prematurely but complete the deletion in both systems together later. You can also have your data deleted in Plancore itself, as described in Plancore's privacy policy.

What happens in Plancore (office area and invitations, sign-in by link or code, projects and documents, planning package, bidder route, feedback, and the retention of project details and deletion periods) is described in Plancore's privacy policy at plancore.tech: plancore.tech/en/datenschutz/

16. Currency of this policy

This privacy policy is updated whenever our data processing changes or new legal requirements make it necessary. The version published on this page applies.

Last updated: 30 October 2026