Privacy Policy
How we handle your personal data
Free State AG takes the protection of your personal data seriously. The processing of personal data of people in Austria is governed by the EU General Data Protection Regulation (GDPR) and the Austrian Data Protection Act (DSG). As a company based in Switzerland we also comply with the Swiss Data Protection Act (revFADP). This privacy policy explains which data we collect, why we use it, with whom we share it and which rights you have.
Data Controller and Data Collection
The controller responsible for the processing of personal data on this website within the meaning of the revFADP and the GDPR is: Free State AG Stettemerstrasse 40 8207 Schaffhausen, Switzerland Email: info@freestate.ch Phone: +41 52 525 33 05 Legal representative: Ivan Miric, Member of the Board of Directors and Managing Director. We collect personal data in two ways: actively, when you provide it to us (e.g., via the contact form, the newsletter form, the solar calculator, maintenance requests, or when registering a customer account), and automatically through our IT systems when you visit the website (technical connection data such as browser, operating system and time of access).
Automatically Collected Server Logs
When you visit our website, our web servers temporarily store each access in a log file. The following data is automatically recorded and stored until automatic deletion after a maximum of 30 days: • IP address of the requesting device (truncated or anonymized) • Date and time of access • Name and URL of the retrieved file • Referring website (referrer URL) • Browser used and operating system • Name of your internet access provider The processing is carried out on the basis of our legitimate interest (Art. 31 para. 2 lit. d revFADP and Art. 6 para. 1 lit. f GDPR) in the stable operation of the website, IT security and protection against abuse. This data is not combined with other data sources and is not used to create user profiles.
Cookies and Consent Management
Our website uses cookies and comparable technologies (e.g., localStorage). Cookies are small text files placed on your device. They differ by purpose: • Strictly necessary cookies: required for the operation of the website (e.g., language preference, login session, the cookie consent itself). These cannot be deselected. • Analytics cookies: enable us to evaluate usage behavior anonymously and improve the website. • Marketing cookies: used to deliver personalized content and advertising. The first time you visit our website, a cookie banner appears in which you can decide per category whether you consent to their use. Analytics and marketing cookies are only set after your explicit consent (Art. 31 para. 1 revFADP / Art. 6 para. 1 lit. a GDPR). If you have consented to marketing cookies, we additionally report conversion events (e.g., a submitted enquiry) server-side to Meta Platforms (Conversions API); contact data such as email address or phone number is transmitted exclusively in hashed form (SHA-256), and processing in the USA is possible. You can withdraw your consent at any time for the future by reopening the cookie settings via the link at the bottom of the page. As long as you have not given consent, no analytics or marketing cookies are loaded, and our analytics services run in "Consent Mode v2" mode with the status "denied", i.e., without setting identifying cookies. Origin and usage measurement without cookies: When you submit an enquiry (e.g., via the solar calculator or a contact form), we store the marketing origin of your visit together with the enquiry: UTM parameters of the URL you opened, the referring website, the landing page and any ad click IDs (e.g., fbclid, gclid). The legal basis is our legitimate interest in measuring the effectiveness of our advertising and the initiation of a contract (Art. 31 para. 1 and para. 2 lit. a revFADP / Art. 6 para. 1 lit. b and f GDPR). These origin parameters are first stored exclusively locally in your browser (sessionStorage/localStorage) for a maximum of 30 days; no cookies are set and no data is shared with third parties. They are only used if you actually submit an enquiry. In addition, we record pseudonymous usage events of the solar calculator (e.g., reaching the individual steps, viewing the result, opening a customer account, requesting a consultation appointment and signing a contract) under a randomly generated session identifier. These events are not linked to any person unless you submit an enquiry. Our own cookieless audience measurement: in addition to the analytics services listed below, we operate our own cookie-free audience measurement. On each page view we store in our own database the page visited (path without query parameters), the referring website, any campaign identifier (utm_id) and the time of the visit, in each case together with the random session identifier mentioned above. We expressly do not store your IP address, cookies, or device and browser identifiers. The session identifier is held only in the memory of the individual browser tab (sessionStorage) and expires as soon as you close that tab, so recognition across several visits is not possible. If you submit an enquiry, the same session identifier is recorded on that enquiry, which means a page view could be attributed to it for as long as the enquiry is retained. After 24 months at the latest we irreversibly replace the session identifier on the measurement data with a new random value, which permanently removes that possibility. Evaluation is exclusively aggregated, for example as the number of sessions per page or the drop-off rate within the solar calculator. The legal basis is our legitimate interest in a data-minimising measurement of the performance of our website and our advertising (Art. 31 para. 2 lit. d revFADP or Art. 6 para. 1 lit. f GDPR). Because no cookies are set and no personal identifiers are stored, no consent is required. You may object to this processing at any time at info@freestate.ch.
Web Analytics, Tag Management and Usage Measurement
Subject to your consent, we use the following services to understand how our website is used and to improve our offering. Without your consent, these services are not activated. 1) Google Tag Manager Provider: Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. Google Tag Manager is a management tool that allows us to embed measurement and analytics tags centrally. The Tag Manager itself does not create user profiles and does not set its own cookies. However, it loads other services (see below) that process data themselves. 2) Google Analytics 4 (GA4) Provider: Google Ireland Limited. GA4 produces anonymized statistics about the use of our website (e.g., page views, session duration, country of origin, device type, traffic source). The IP address is truncated before storage ("IP Anonymization") and individual users are not directly identified. We operate GA4 with Google Consent Mode v2 enabled and with advertising features ("Google Signals") disabled. The retention period for event data in GA4 is 14 months. 3) Contentsquare (formerly Hotjar) Provider: Contentsquare SAS, 7 Rue de Madrid, 75008 Paris, France. Contentsquare produces aggregated heatmaps and, on certain pages (in particular the solar calculator and the customer area), pseudonymized session recordings to identify usability issues. Keystrokes in form fields are masked by default; sensitive content (customer data, contracts) is not recorded. Contentsquare sets cookies with a maximum lifetime of 13 months. 4) Google Search Console Provider: Google Ireland Limited. Google Search Console is used exclusively for verifying domain ownership and analyzing anonymous SEO statistics (e.g., incoming search queries from Google). It does not set any cookies on this website and does not process any personal data of our visitors. Legal basis: consent (Art. 31 para. 1 revFADP / Art. 6 para. 1 lit. a GDPR). Data transfer to the USA: GA4, Google Tag Manager, Google Search Console and Contentsquare partly process data in the USA. Google is certified under the EU-US Data Privacy Framework; Contentsquare primarily processes data in the EU but may use sub-processors in third countries. Where data is transferred to a country without an adequate level of data protection, we rely on Standard Contractual Clauses pursuant to Art. 16 revFADP / Art. 46 GDPR.
Hosting and data processors
We use carefully selected processors who process personal data on our behalf to run our website: • Vercel Inc. (USA): delivery of the website, servers in Frankfurt am Main. • Railway Corporation (USA): operation of our server and the PostgreSQL database that stores account, customer and request data. Servers in the Netherlands. • Cloudflare, Inc. (USA): storage of documents, images and uploaded files. • Resend, Inc. (USA): sending emails such as confirmations, sign-in links and offer notices. • Google (Google Fonts): fonts used when creating PDF documents. Where these providers process data in the USA, we base the transfer on the adequacy decision for the EU-US Data Privacy Framework if the recipient is certified, or on standard contractual clauses (Art. 46 GDPR). We have data processing agreements with all processors (Art. 28 GDPR). Switzerland, where we are based, has an adequacy decision of the European Commission.
Links to Social Networks
In the footer of our website you will find links to our profiles on Facebook, Instagram and LinkedIn. These are explicitly simple hyperlinks, not embedded plugins or tracking pixels. Merely visiting our website does not transfer any data to these social networks. Only when you actively click one of these links will you be redirected to the respective platform, and from that point on the privacy provisions of the respective provider apply exclusively. We have no influence over what data is collected or processed there. • Facebook (Meta Platforms Ireland Ltd.): https://www.facebook.com/privacy/policy • Instagram (Meta Platforms Ireland Ltd.): https://privacycenter.instagram.com/policy • LinkedIn (LinkedIn Ireland Unlimited Company): https://www.linkedin.com/legal/privacy-policy
Google Maps
On certain pages (in particular the contact page and the solar calculator for address entry and roof area selection) we embed interactive maps from Google Maps. The provider is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. In order for the maps to be displayed correctly, your browser transmits technical connection data (in particular your IP address) to Google when you use these features. Processing in the USA cannot be ruled out. This processing is necessary to provide the function you actively requested (e.g., address entry in the solar calculator) and is based on our legitimate interest in a user-friendly online application as well as, where an explicit configuration step is required, on your consent. For more information on the handling of user data by Google, please see: https://policies.google.com/privacy
Yield calculation and postcodes (PVGIS, OpenPLZ)
To calculate the yield in the solar calculator, our server queries the Photovoltaic Geographical Information System (PVGIS) of the European Commission's Joint Research Centre. We only send the building's coordinates and the roof tilt and orientation, no names or contact details. To match your postcode to municipality, federal state and grid area, our server queries the OpenPLZ API and only sends the postcode.
Newsletter
If you would like to subscribe to our newsletter, we require a valid email address from you as well as information that allows us to verify that you are actually the owner of the email address provided (double opt-in procedure). The data required for sending is processed exclusively on the basis of your consent (Art. 31 para. 1 revFADP / Art. 6 para. 1 lit. a GDPR). You can withdraw the subscription and the underlying consent at any time for the future, for example via the unsubscribe link in any newsletter or by emailing info@freestate.ch. The legality of the processing carried out up to the withdrawal remains unaffected.
Solar calculator and requests
Our solar calculator guides you step by step to a non-binding estimate for a solar plant and, if you wish, to an offer request. We process these categories of personal data: • Address and location data to assess the roof • Roof details (shape, orientation, area) and consumption and building data (e.g. electricity use, planned devices such as a wallbox or heat pump) • Contact details (name, address, phone number, email address) We process this data to take pre-contractual steps at your request (Art. 6(1)(b) GDPR). If you have consented to data processing and entered a valid email address, we store your email address together with the address you entered and the calculated system size even if you do not complete the form, so we can contact you about your results. The legal basis is your consent (Art. 6(1)(a) GDPR), which you can withdraw at any time. No contracts are concluded online on freestate.at. You receive a binding offer in writing after the site visit. We process support requests and data from the customer area ("Dashboard") to handle your request and to meet legal retention duties.
Your Rights as a Data Subject
Under the GDPR you have these rights: • Right of access (Art. 15 GDPR): you can ask free of charge which data we hold about you. • Right to rectification (Art. 16 GDPR) • Right to erasure (Art. 17 GDPR), unless legal retention duties apply • Right to restriction of processing (Art. 18 GDPR) • Right to data portability (Art. 20 GDPR) • Right to withdraw consent at any time with effect for the future (Art. 7(3) GDPR) • Right to object (Art. 21 GDPR) To exercise your rights, write to info@freestate.ch. To protect your data we may need to verify your identity before we handle the request. Right to complain: you can lodge a complaint with the Austrian Data Protection Authority (Barichgasse 40 to 42, 1030 Vienna, www.dsb.gv.at) or with the supervisory authority of your place of residence in the EU.
Retention and Deletion
We store personal data only for as long as is necessary for the respective purposes or required by statutory retention obligations. The following retention periods apply: • Server log files: maximum 30 days • Cookie consent records: up to 12 months from last confirmation • Google Analytics 4 event data: 14 months • Contentsquare session recordings: maximum 365 days • Our own cookieless audience measurement (page views and pseudonymous usage events): the session identifier is irreversibly replaced with a new random value after 24 months at the latest. The remaining anonymous metrics are retained indefinitely for statistical analysis. • Newsletter subscription data: until consent is withdrawn • Contact and inquiry data: name, email address, telephone number, address and free-text entries are irreversibly anonymised no later than 24 months after the enquiry is received. The remaining, no longer personal information (e.g. postal code, time of the enquiry, source) is retained for statistical analysis. • Contract and accounting data: 10 years pursuant to Art. 958f Swiss Code of Obligations • Customer account data ("Dashboard"): for as long as your account exists. You can request deletion of your account at any time by emailing info@freestate.ch. Where statutory retention obligations apply (e.g. contract and accounting data), we delete or anonymize the affected data only after the statutory period has expired. After the respective period has expired, the data is deleted or anonymized.
Contact for Data Protection Matters
Controller: Free State AG Attn. Data Protection Stettemerstrasse 40 8207 Schaffhausen Switzerland Email: info@freestate.ch Phone: +41 52 525 33 05 Free State AG is not required to appoint a data protection officer (Art. 37 GDPR). The appointment of a representative in the European Union under Art. 27 GDPR is in preparation. Until then, please send requests to the address above.
Last updated: November 2026