Basic Information
This Privacy Policy was prepared by the operator of this website (ENJO GmbH) on 30 July 2026 to explain which data is collected from users of our website and for what purposes it is used. All website data is either stored using cookies or sent by email (for example, via the contact form). Further information can be found in the following document. We also explain the options and rights available to users in relation to data protection.
The General Data Protection Regulation (GDPR) and the Telecommunications Act (TKG) regulate this process in considerable detail, which is why the information provided may appear highly technical and extensive. We process data strictly and exclusively in accordance with the applicable legal provisions. However, we make every effort to present this information as clearly and concisely as possible in order to ensure transparency.
If you have any questions, you can contact us at any time by email or via our contact form. You can also reach us at the following address:
ENJO GmbH
Morsbacherstraße 3
6330 Kufstein
Austria
International Support & Production
Riedstrasse 1
6845 Hohenems
Austria
External Links
We use external links on our website to provide you with additional information. These links take you to third-party websites. Some of these third parties use their own cookies, for example to track IP addresses. This may be necessary to display content correctly. We make every effort to use only links whose providers use their cookies solely to deliver this content. However, we have no control over whether third parties store the data collected for purposes such as statistical analysis.
All content on our website has been created with the greatest possible care. Despite carefully reviewing the content, we cannot guarantee the accuracy, completeness or current validity of information provided via external links. No legal infringements were apparent at the time the links were created. If we become aware of any legal infringement associated with a link, we will remove it immediately.
Contact via Contact Form or Email
If you contact us using the contact form on our website or by email, we process the data you provide in order to handle and respond to your enquiry.
Depending on the topic selected, the following data in particular may be collected:
- First and last name
- Email address
- Telephone number, if provided voluntarily
- Postal code and country
- Subject and content of your message
- Any other information provided voluntarily
We use the postal code and country in particular to clearly identify existing customers in our system or to find a suitable ENJO Consultant near you.
Changing or Cancelling a Subscription
If you request a change to or cancellation of an existing subscription via the contact form, we additionally collect your full address. This may include your street and house number, an optional additional address line, postal code, city and country.
This information is required to identify you clearly as the contractual partner and to avoid confusion with other customers, particularly where first and last names are identical. The address data is used exclusively to match you with your customer or contract account and to process the requested subscription change or cancellation.
Purpose and Legal Basis
We process enquiries concerning the purchase of products, an ENJO consultation, ENJOlife or an existing subscription on the basis of Article 6(1)(b) GDPR. In these cases, processing is necessary in order to take steps prior to entering into a contract or to perform, amend or terminate an existing contractual relationship.
We process general enquiries on the basis of Article 6(1)(f) GDPR. Our legitimate interest is the proper, secure and efficient handling of and response to enquiries addressed to us.
Where statutory retention obligations apply, further storage is based on Article 6(1)(c) GDPR.
Processing and Recipients
The contact form is provided using the Fluent Forms WordPress plugin. The information entered is transmitted to us and subsequently processed manually by the responsible employees.
If you request contact with or referral to the responsible ENJO Consultant, the contact details and enquiry information required for this purpose may be passed on to the ENJO Consultant responsible for your region. Any further disclosure will take place only where it is necessary to process your enquiry, where a legal obligation exists or where you have given your prior express consent.
The email service providers described in this Privacy Policy are used for the technical transmission and delivery of emails.
Storage Period
As a general rule, we delete general enquiries and the related correspondence no later than twelve months after the matter has been fully processed, unless further retention is required.
If the enquiry concerns an existing contractual relationship or results in a contractual relationship, the necessary information may be incorporated into the customer or contract documentation. In this case, the statutory retention periods and limitation periods applicable to the contractual relationship apply.
Protection Against Abusive Enquiries
We use Cloudflare Turnstile to protect our forms against spam, automated access and misuse. Further information can be found in the “Cloudflare Turnstile” section of this Privacy Policy.
Sending and Receiving Emails
We primarily use Microsoft 365 to receive and send emails and automated notifications, for example notifications generated by contact forms or appointment bookings. The provider is Microsoft Ireland Operations Limited, One Microsoft Place, South County Business Park, Leopardstown, Dublin 18, Ireland.
If delivery via Microsoft 365 fails for technical reasons, we use Google Workspace as a fallback connection. The provider is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. Google Workspace is used for the relevant email only if the primary Microsoft connection is unable to deliver the message.
The following data in particular may be processed when emails are sent:
- Name and email address of the sender and recipient
- Subject and content of the message
- Telephone number and any other contact details provided
- Content from contact forms or appointment bookings
- Time, delivery status and technical delivery information
- Any attachments included
The legal basis depends on the specific reason for the communication. For enquiries relating to a contract or steps prior to entering into a contract, processing is carried out in accordance with Article 6(1)(b) GDPR. For other business communications and to ensure reliable and secure email delivery, processing is carried out in accordance with Article 6(1)(f) GDPR.
For the technical transmission of emails, we use the self-hosted FluentSMTP WordPress plugin on our website. This plugin maintains a delivery log on our own server. In particular, the log may contain the recipient, subject, time of sending, delivery status and technical error information. These delivery logs are automatically deleted after 14 days. This does not affect the actual emails in the mailboxes used; these are stored in accordance with the relevant purpose of the communication and the applicable retention obligations.
Microsoft and Google may engage additional processors to provide their services. Processing of data outside the European Union or the European Economic Area, particularly in the United States, cannot be completely ruled out. Where required, the providers base data transfers in particular on the adequacy decision for the EU–US Data Privacy Framework for certified companies and on the Standard Contractual Clauses approved by the European Commission.
Further information about data processing is available at:
Microsoft: https://www.microsoft.com/de-de/privacy/privacystatement
Google: https://policies.google.com/privacy?hl=de
Online Appointment Booking
We use the “Simply Schedule Appointments” WordPress plugin to arrange introductory calls. The plugin is operated on our own web server. According to the plugin provider, the booking data entered is neither transmitted to nor stored by the plugin provider.
When an appointment is booked, we process the following data in particular:
- Name
- Email address
- Telephone number
- Selected appointment, including date and time
- Any other information provided voluntarily
We process this data in order to handle your appointment request, organise and conduct the call, and send appointment confirmations and appointment-related notifications.
The legal basis is Article 6(1)(b) GDPR, insofar as the appointment booking serves to take steps prior to entering into a contract at your request.
The booking data is stored in our website database on our own server. According to the plugin provider, Simply Schedule Appointments does not set its own cookies and does not receive any booking or customer data.
As a general rule, we delete the data no later than twelve months after the appointment has taken place or after the last appointment-related communication. Data is stored for a longer period only if the enquiry results in a contractual relationship, if statutory retention obligations apply, or if the data is required for the establishment, exercise or defence of legal claims.
The information in the section on email communication also applies to appointment confirmations and notifications sent by email.
Recurring Delivery Service and SEPA Direct Debit
You can order a recurring delivery service for selected products via our website. In this context, we process the following data in particular:
- Selected product, delivery interval and requested start date for delivery
- Salutation, title, first name and last name
- Delivery and billing address
- Telephone number and email address
- Any comments provided voluntarily
- The assigned ENJO Consultant, where applicable
- Bank details and the information required for the SEPA Direct Debit Mandate
The data submitted using the order form is manually reviewed by our employees and then entered into our Merlin customer and order system (enjo.software). The recurring delivery service is managed in Merlin, and each order is automatically triggered in accordance with the delivery interval you select.
No decision based solely on automated processing within the meaning of Article 22 GDPR takes place in this context. The automatic triggering of subsequent orders serves only to implement the recurring delivery service you have ordered from a technical perspective.
We process the data to handle and fulfil your order, manage the recurring delivery service, deliver the goods ordered, communicate with customers and process the agreed payments.
The legal basis for this processing is Article 6(1)(b) GDPR, as the processing is necessary to perform the contract concluded with you and, where applicable, to take steps prior to entering into a contract. Where statutory retention obligations apply, further processing is based on Article 6(1)(c) GDPR.
For the purpose of administering the recurring delivery service, the necessary data may be transmitted in particular to the following recipients or categories of recipients:
- Employees responsible for processing the order
- Operators and technical service providers of our Merlin customer and order system
- Shipping and logistics companies engaged to deliver the goods
- Participating banks and payment service providers for processing the SEPA Direct Debit
- Tax advisers, accounting service providers and public authorities, where required by law
The data required to provide the recurring delivery service is generally stored for the duration of the contractual relationship. Contractual, payment and accounting records are generally retained for seven years in accordance with statutory retention obligations. Data is stored beyond this period only where required due to specific legal obligations or for the establishment, exercise or defence of legal claims.
We use Cloudflare Turnstile to protect the form against automated access and misuse. Further information can be found in the relevant section of this Privacy Policy.
Newsletter Distribution and Performance Measurement
You can subscribe on our website to our ENJO newsletter, which is published approximately four times a year. For this purpose, we process your email address and the information required to document your subscription, in particular the time and technical details of the subscription.
Your subscription is submitted to us using a form created with Fluent Forms. We use Cloudflare Turnstile to protect against automated subscriptions and misuse. Further information can be found in the “Cloudflare Turnstile” section.
After receiving the subscription request, we use the email address provided to check whether a customer record already exists in our Merlin customer management system (enjo.software). For existing customers, the newsletter subscription is transmitted to Mailchimp via the interface available in Merlin. If no corresponding customer record exists, we manually add the email address to the designated Mailchimp recipient list.
We use the Mailchimp service for distribution. The provider is The Rocket Science Group LLC, which operates under the name Mailchimp and is part of the Intuit group of companies. Mailchimp processes the data on our behalf to distribute the newsletter and analyse its delivery.
Open and Click Tracking
Newsletters sent via Mailchimp contain technologies used to measure opens and link visits. To record when a newsletter is opened, a small invisible image known as a tracking pixel or web beacon may be embedded in the message. When the newsletter is opened, this image is retrieved from Mailchimp’s server.
Links in the newsletter may also be routed via Mailchimp so that it can be determined whether and when a link was clicked. In particular, the following information may be processed and associated with the relevant newsletter recipient:
- Delivery and time of newsletter distribution
- Whether and when the newsletter was opened
- Links clicked and the time they were accessed
- IP address
- Information about the browser, device and email client used
- Technical information about the delivery and use of the newsletter
The analysis is used to determine the reach of our newsletters and to tailor and improve their content based on the interests of our recipients. Open and click data may be inaccurate due to technical protection features used by email providers, automated checks or blocked images.
Legal Basis
The legal basis for distributing the newsletter and the associated performance measurement is your consent pursuant to Article 6(1)(a) GDPR in conjunction with Section 174 of the Telecommunications Act 2021 (TKG 2021). Consent is given by actively subscribing to the newsletter.
You may withdraw your consent at any time with effect for the future. You can do so using the unsubscribe link included in every newsletter or by contacting us directly. The lawfulness of processing carried out before consent was withdrawn remains unaffected.
After you unsubscribe, your email address will be removed from the active recipient list or stored on a suppression list where this is necessary to reliably prevent further newsletters from being sent. Records documenting the consent given may also be retained to the extent necessary to comply with statutory accountability obligations and to defend against potential legal claims.
Data Transfers to the United States
When Mailchimp is used, personal data may be transferred to the United States and to other subprocessors. According to Mailchimp, it relies in particular on the EU–US Data Privacy Framework and the Standard Contractual Clauses approved by the European Commission for such transfers.
Further information:
Intuit/Mailchimp Privacy Statement:
https://www.intuit.com/privacy/statement/
Mailchimp Data Processing Addendum:
https://mailchimp.com/legal/data-processing-addendum/
Cookies
Our website uses cookies. Cookies are small text files that are stored on your device with the help of your browser. They do not cause any damage.
We use cookies for technical reasons so that we can provide our information services in a functional manner. Some cookies remain stored on your device until you delete them. They enable us to recognise your browser when you next visit our website.
Which categories are used?
Essential
These services are required for the website’s basic functionality. They include only technically necessary services that cannot be rejected.
Functional
Functional services are required to provide features beyond the website’s essential functionality, such as enhanced fonts, video playback or interactive Web 2.0 features. Content from video and social media platforms, for example, is blocked by default.
Statistics
Statistics services are required to collect pseudonymised data about visitors to the website. The data enables us to understand visitors better and optimise the website.
All services that use cookies are listed below, together with the category to which they belong.
Real Cookie Banner [Essential]
Real Cookie Banner asks website visitors for their consent to the use of cookies and the processing of personal data. Each website visitor is assigned a UUID (a pseudonymous user identifier), which remains valid for storing consent until the cookie expires.
Cookies are used to test whether cookies can be set, to store a reference to the documented consent, and to record the services and service groups to which the visitor has consented.
Cookies are also set where consent is obtained in accordance with the Transparency & Consent Framework (TCF), in order to store consent relating to TCF partners, purposes, special purposes, features and special features.
To fulfil the accountability requirements under the GDPR, the consent obtained is documented in full. In addition to the services and service groups to which the visitor has consented—and, where consent is obtained in accordance with the TCF standard, the TCF partners, purposes and features to which the visitor has consented—this documentation includes all cookie banner settings at the time consent was given, as well as the technical circumstances (for example, the size of the visible area when consent was given) and user interactions (for example, clicking buttons) that led to consent. Consent is obtained once for each language.
Provider: Walter Griesser GmbH
Provider’s Privacy Policy: https://en.enjo.com/privacy-policy/
List of Cookies
Cookie type: HTTP cookie
Technical cookie name: real_cookie_banner*
Technical cookie host: .en.enjo.com
Cookie validity period: 365 days
Cookie type: HTTP cookie
Technical cookie name: real_cookie_banner*-tcf
Technical cookie host: .en.enjo.com
Cookie validity period: 365 days
Cookie type: HTTP cookie
Technical cookie name: real_cookie_banner-test
Technical cookie host: .en.enjo.com
Cookie validity period: 365 days
Cloudflare Turnstile [Essential]
We use Cloudflare Turnstile to protect our online forms against automated access, spam and misuse by bots. The service checks in the background whether a request is likely to originate from a human or an automated system.
In particular, the IP address, TLS fingerprint, information about the browser and device used (user agent), the site key and the origin of the request may be processed. This data is used exclusively to detect and prevent automated access and to improve bot detection. According to Cloudflare, the data is not used for advertising or profiling purposes.
Processing is based on our legitimate interests pursuant to Article 6(1)(f) GDPR. Our legitimate interest is to protect our website and forms against spam, misuse and automated attacks. Turnstile is therefore integrated as an essential service and is loaded without prior consent.
Provider: Cloudflare Germany GmbH, Rosental 7, 80331 Munich, Germany
Further information about data processing by Turnstile is available at:
https://www.cloudflare.com/de-de/turnstile-privacy-policy/
ENJO Product Catalogue and Consultant Search [Functional]
We integrate an ENJO Consultant Search provided by Oskfel Software Limited into our website. Visitors can use it to find suitable ENJO Consultants near them by entering an address.
The product catalogue and Consultant Search are loaded only after you have given your consent through our privacy settings or the content blocker displayed. When the service is loaded, a connection is established to the provider’s servers at at-west.enjo.software.
The following data in particular may be processed:
- IP address
- Browser and device information
- Date and time of access
- Technical connection and request data
- Address data entered or selected
- Location information derived from the address
The data is processed in order to provide the Consultant Search from a technical perspective and to identify suitable ENJO Consultants based on the selected address.
The service uses two session cookies for technical operation. Functional information is also stored in the browser’s local storage. To the best of our knowledge, this service does not use the data for analytical, advertising or profiling purposes.
The legal basis for loading the external service, processing personal data, and storing or accessing information on your device is your consent pursuant to Article 6(1)(a) GDPR and Section 165(3) of the Telecommunications Act 2021 (TKG 2021).
You may withdraw your consent at any time with effect for the future through our website’s privacy settings. The ENJO Consultant Search will not be loaded without your consent.
Provider: Oskfel Software Limited, 24 Burgundy House, The Forresters, Harpenden, AL5 2FB, United Kingdom
Further information about the provider:
https://oskfel.com/
List of Cookies and Local Storage Items
Cookie type: HTTP cookie
Technical cookie name: ARRAffinity
Technical cookie host: at-west.enjo.software
Cookie validity period: Session
Purpose: Technically necessary assignment of consecutive requests to the same server instance
Cookie type: HTTP cookie
Technical cookie name: ARRAffinitySameSite
Technical cookie host: at-west.enjo.software
Cookie validity period: Session
Purpose: Technically necessary session assignment when the service is embedded
Storage type: Local storage
Technical storage name: locale
Technical storage host: at-west.enjo.software
Storage period: Until deleted by the user or the service
Purpose: Storage of the language setting
Storage type: Local storage
Technical storage name: shopState*
Technical storage host: at-west.enjo.software
Storage period: Until deleted by the user or the service
Purpose: Storage of the current state of the embedded Consultant Search
Cookie type: HTTP cookie
Technical cookie name: ARRAffinity
Technical cookie host: www.enjo-merlin.at
Cookie validity period: Session
Purpose: Technically necessary assignment of consecutive requests to the same server instance
Cookie type: HTTP cookie
Technical cookie name: ARRAffinitySameSite
Technical cookie host: www.enjo-merlin.at
Cookie validity period: Session
Purpose: Technically necessary session assignment when the service is embedded
Storage type: Local storage
Technical storage name: locale
Technical storage host: www.enjo-merlin.at
Storage period: Until deleted by the user or the service
Purpose: Storage of the language setting
Storage type: Local storage
Technical storage name: shopState*
Technical storage host: www.enjo-merlin.at
Storage period: Until deleted by the user or the service
Purpose: Storage of the current state of the embedded Consultant Search
The United Kingdom is a country outside the European Union and the European Economic Area. An adequacy decision by the European Commission applies to data transfers to the United Kingdom.
Google Places – Consultant Search [Functional]
We use Google Places and Google Places Autocomplete within the ENJO Consultant Search. The service is used to recognise addresses entered and to display suitable address suggestions as users type. Once an address has been selected, it can be used to identify ENJO Consultants nearby.
Google Places is loaded only after you have given your consent through our privacy settings or the content blocker displayed.
When the service is loaded, the IP address, browser and device information, language settings and technical connection data may in particular be transmitted to Google. As soon as you use the address field, the search terms or address components entered are also transmitted to Google in order to provide suitable address suggestions.
Based on our current technical assessment, Google Places does not set its own cookies on the device as part of this integration. Irrespective of this, personal data is transmitted to Google when the service is loaded and used.
The legal basis for processing is your consent pursuant to Article 6(1)(a) GDPR. Insofar as information is stored on or accessed from your device, this is additionally based on Section 165(3) of the Telecommunications Act 2021 (TKG 2021).
You may withdraw your consent at any time with effect for the future through our website’s privacy settings. Without your consent, Google Places will not be loaded and the Consultant Search cannot be used.
Provider: Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland
Processing of personal data by affiliated companies or service providers outside the European Union or the European Economic Area cannot be completely ruled out. According to Google, it relies on applicable adequacy decisions and the Standard Contractual Clauses approved by the European Commission for such transfers.
Provider’s Privacy Policy:
https://policies.google.com/privacy?hl=de
Information about international data transfers:
https://policies.google.com/privacy/frameworks?hl=de
Emojis [Functional]
WordPress Emoji is an emoji set loaded from wordpress.org. No cookies in the technical sense are set on the user’s device. However, technical and personal data, such as the IP address, is transmitted from the user’s device to the service provider’s server to enable use of the service.
Provider: WordPress.org
Provider’s Privacy Policy: https://de.wordpress.org/about/privacy/
Google Analytics and Google Ads [Statistics]
We use Google Analytics 4, a web analytics service provided by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. Google Analytics helps us understand how visitors use our website and enables us to improve the website’s content and user experience.
Google Analytics is loaded only after you have given your consent through our privacy settings. The following data in particular may be processed:
- Pages visited and time of access
- Session duration and interactions with the website
- Scrolling activity, outbound clicks, search queries and file downloads
- Source or referrer URL
- Browser, operating system, device type and screen resolution
- Approximate location at city or regional level
- Events triggered and actions defined as conversions
For access from within the European Union, Google initially uses the IP address to derive approximate location information. According to Google, the IP address is then discarded and is not logged or stored.
Our Google Analytics property is linked to our Google Ads account. After you have given the relevant consent, Analytics data and defined audiences or conversions may be used to analyse and optimise our Google Ads campaigns and for personalised advertising.
Google Signals, the Google Analytics User ID feature and the collection of user-provided data are not currently enabled.
Cookies
Google Analytics uses the following cookies in particular:
- _ga: Used to distinguish visitors; validity period of up to 24 months
- *ga_*: Used to store and assign session information; validity period of up to 24 months
Legal Basis
Processing and the storage of or access to information on your device take place exclusively on the basis of your consent pursuant to Article 6(1)(a) GDPR and Section 165(3) of the Telecommunications Act 2021 (TKG 2021).
You may withdraw your consent at any time with effect for the future through the privacy settings. The lawfulness of processing carried out before consent was withdrawn remains unaffected.
Storage Period
User and event data is stored in our Google Analytics property for 14 months. The retention period is not reset by renewed activity. This setting applies to user-related and event-related data; aggregated standard reports may continue to exist beyond this period.
Recipients and Transfers to Third Countries
Recipients of the data may include Google Ireland Limited and affiliated companies, particularly Google LLC in the United States. Processing in countries outside the European Union or the European Economic Area cannot be ruled out. According to Google, it relies for this purpose on the EU–US Data Privacy Framework and the Standard Contractual Clauses approved by the European Commission, among other safeguards.
Further information:
Google Privacy Policy:
https://policies.google.com/privacy
Information about Google Analytics and privacy:
https://support.google.com/analytics/answer/12017362
Withdrawal of Consent
You may withdraw your consent at any time with effect for the future by opening the cookie settings Privacy Settings and changing your selection there. The lawfulness of processing based on consent before its withdrawal remains unaffected.
You can also prevent cookies from being stored in the first place by configuring your browser software accordingly. However, if you configure your browser to reject all cookies, some features of this and other websites may be restricted. You can also prevent Google from collecting the data generated by the cookie and relating to your use of the website (including your IP address), as well as from processing this data, by withholding your consent to the cookie being set.
Further information about the Google Analytics Terms of Service and data protection is available at https://marketingplatform.google.com/about/analytics/terms/de/ and https://policies.google.com/?hl=de.
This Privacy Policy was prepared by the operator of this website (ENJO GmbH) and last updated on 3 August 2026 to explain which data is collected from users of our website and for what purposes it is used.