English law applies; the place of jurisdiction is Oxford.
Nature and processing of data
Nature of the processed data:
- Personal data (e.g. names, addresses)
- Contact data (e.g. email, telephone numbers)
- Content data (e.g. text input, images, videos)
- Usage data (e.g. visited websites, interest in content, access times)
- Meta/communication data (e.g. device information, IP addresses)
Categories of persons concerned
Visitors and users of the online offer (hereinafter we collectively refer to all data subjects as “users”).
Purpose of processing
- Provision of the online offer, its functions and contents
- Security measures
- Reach measurement/marketing
“Personal data” is any information relating to an identified or identifiable natural person (hereinafter referred to as “data subject”); an identifiable natural person is one who can be identified, directly or indirectly, in particular by assignment to an identifier such as a name, an identification number, location data, an online identifier (e.g. cookie) or to one or more special features that express the physical, physiological, genetic, psychological, economic, cultural or social identity of that natural person.
“Processing” is any operation or set of operations performed upon personal data, with or without the aid of automated processes. The term goes a long way and covers practically every handling of data.
“Pseudonymization” is the processing of personal data in such a way that the personal data can no longer be attributed to a specific data subject without the use of additional information, provided that this additional information is kept separately and is subject to technical and organizational measures to ensure that the personal data are not attributed to an identified or identifiable natural person.
“Profiling” is any automated processing of personal data, insofar such personal data is used to evaluate certain personal aspects relating to a natural person, in particular to analyze or predict aspects relating to the performance, economic situation, health, personal preferences, interests, reliability, behavior, location or relocation of that natural person.
“Person responsible” is any natural or legal person, authority, institution or other body that alone or together with others decides on the purposes and means of processing personal data.
“Processor” is any natural or legal person, authority, institution or other body processing personal data on behalf of the person responsible.
Legal bases and security measures
Relevant legal bases
In accordance with Art. 32 GDPR, we take appropriate technical and organizational measures to ensure an adequate level of protection in line with the risks incurred, while also taking into account the state of the art, the costs of implementation, and the type, scope, circumstances and purposes of processing as well as the probability of occurrence and the severity of the risk to the rights and freedoms of natural persons.
These measures include: ensuring the confidentiality, integrity and availability of data by controlling physical access to said data; ensuring the access, entry, transmission of data; and securing the availability and separation of data. Furthermore, we have established procedures to ensure the exercise of rights of data subjects, the deletion of data and an adequate response to compromised data. In addition, we take steps to ensure the safety of personal data during the development process, respectively the selection of hardware, software and procedures, in accordance with the principle of data protection through technology design and privacy-friendly settings (Art. 25 GDPR).
Cooperation with third parties
Cooperation with external processors and third parties
If we disclose data to other persons and companies (external processors or third parties) within the scope of our processing, transmit data to them or otherwise grant them access to the data, it shall only be done within the framework of a legal permission (e.g. if a transmission of data to third parties, such as payment service providers, is necessary for contract fulfilment in accordance with Art. 6 para. 1 let. b GDPR), a consent, if a legal obligation exists or based on our legitimate interests (e.g. when using authorized persons, web hosts, etc.).
If we commission third parties with the processing of data on the basis of a so-called “processing contract”, this shall be done in accordance with the provisions laid out in Art. 28 GDPR.
Transfers to third countries
If we process data in a third country (i.e. outside the European Union (EU), Switzerland or the European Economic Area (EEA)) or if this occurs in the context of the use of services of third parties or the disclosure, respectively the transfer, of data to third parties, this is done solely for the fulfilment of our (pre)contractual obligations, on the basis of your consent, a legal obligation or our legitimate interests. Subject to legal or contractual permissions, we process or leave the data in a third country only if the special requirements of Art. 44 ff. GDPR have been fulfilled. This means, for example, that processing is carried out in accordance with special security measures, such as the officially recognized determination of a certain level of data protection corresponding to EU standards (e.g. the “Privacy Shield” in the USA), or the compliance with officially recognized special contractual obligations (so-called “standard contractual clauses”).
Rights of data subjects
In accordance with Art. 15 GDPR, you have the right to request confirmation as to whether or not data related to you is being processed, and to request information about such data, but also to receive further information and a copy of said data.
In accordance with Art. 16 GDPR, you have the right to make a request to supplement your data or to correct any inaccurate data related to you.
In accordance with Art. 17 GDPR, you have the right to demand that data related to you be deleted immediately or, alternatively, to demand a restriction on the processing of the data in accordance with Art. 18 GDPR.
In accordance with Art. 20 GDPR, you have the right to ask us to send you your personal data that you have provided to us and to demand that it be forwarded to other persons responsible.
In accordance with Art. 77 GDPR, you also have the right to file a complaint with the competent supervisory authority.
Right of revocation
You have the right to rescind any consent you have given us pursuant to Art. 7 para. 3 GDPR with effect for the future.
Right of objection
In accordance with Art. 21 GDPR, you have the right to object to the future processing of data related to you at any time. The objection may be submitted particularly in the case of processing for direct marketing purposes.
Cookies and right of objection to direct advertising
“Cookies” are small files that are stored on a user’s computer. Different data can be stored in cookies. A cookie is primarily used to store information about a user (or the device on which the cookie is stored) during or after visiting an online offering. Temporary cookies, respectively “session cookies” or “transient cookies”, are cookies that are deleted after a user leaves an online offering and closes his browser. Such a cookie can store, for example, the content of a shopping basket in an online shop or a login status. “Permanent” or “persistent” cookies remain stored even after the browser is closed. For example, a user’s login can be saved when he or her visits the website after several days. Furthermore, such a cookie can also store the interests of users, which can be used to for audience measurement or marketing purposes. “Third-party cookies” are cookies that are offered by providers other than the person responsible for operating the online offering (the cookies of the person responsible for the online offering are referred to as “first-party cookies”).
If you as a user do not want cookies to be stored on your computer, you may deactivate the corresponding option in the system settings of your browser. Stored cookies can be deleted in the system settings of the browser. Opting out of cookies can lead to functional restrictions of this online offering.
Deletion of data
According to legal requirements in Austria, the storage period is set to 7 years pursuant to § 132 (1) BAO (accounting documents, receipts/invoices, accounts, receipts, business documents, statement of income and expenses, etc.), 22 years in relation to real estate and 10 years for documents relating to electronically provided services, telecommunications, radio and television services which are provided to non-entrepreneurs in EU member states and for which the Mini One Stop Shop (MOSS) is used.
Establishment of contact
When contacting us (e.g. via contact form, email, telephone or social media), the user’s details are processed pursuant to Art. 6 para. 1 let. b (in the context of contractual/pre-contractual relationships) and Art. 6 para. 1 let. f (other requests) of the GDPR for the purpose of processing and handling contact requests. User information can be stored in a customer relationship management system (“CRM system”) or similar organizational tool.
We delete the requests if they are no longer necessary. We review this requirement every two years; the statutory archiving obligations also apply
With the following information we inform you about the contents of our newsletter as well as the registration, dispatch and statistical evaluation procedure and your rights of objection. By subscribing to our newsletter, you agree to the receipt and the outlined procedures.
Content of the newsletter: We send out newsletters, emails and other electronic notifications containing advertising information (hereinafter “newsletters”) only with the consent of the recipients or based on a statutory permission. If the contents of a newsletter are specifically outlined within the scope of a subscription, they are decisive for the consent of the users. In addition, our newsletters contain information about our products, but also supplementary information (e.g. safety information), offers, promotions, as well as additional information about our company.
Double opt-in procedure and record keeping: For the subscription to our newsletter we rely on a so-called double opt-in procedure. This means that after subscribing, you will receive an e-mail asking you to confirm your subscription. This confirmation is necessary so that no one can subscribe with someone else’s email address. Subscriptions to the newsletter are logged in order to be able to prove that the subscription process complies with legal requirements. A record is kept of the time of subscription and confirmation, as well as of the IP address. The changes to your data stored with the delivery service provider are also logged.
Subscription details: To subscribe to the newsletter, simply enter your email address. Optionally, you can also enter a name, and you will be addressed personally in the newsletter.
The dispatch of the newsletter and the performance measurement associated with it are carried out on the basis of the recipient’s consent pursuant to Art. 6 para. 1 let. a, Art. 7 GDPR in conjunction with § 107 para. 2 TKG or, if consent is not required, on the basis of our legitimate interests in direct marketing pursuant to Art. 6 para. 1 let. f GDPR in conjunction with § 107 (2) and (3) TKG.
The registration procedure is recorded on the basis of our legitimate interests pursuant to Art. 6 para. 1 let. f GDPR. It is in our interest to use a user-friendly and secure newsletter system that serves our business interests and meets the expectations of users, but also allows us to provide proof of consent.
Cancellation/revocation: You can cancel your subscription to our newsletter at any time, i.e. revoke your consent. You will find a link to cancel your subscription at the end of each newsletter. On the basis of our legitimate interests, we may store the email addresses of unsubscribed users for up to three years before we delete them; this is done so that we can prove a previously given consent. The processing of these data is limited to the purpose of a possible defence against claims. An individual deletion request can be made at any time, provided that the previous existence of a consent is simultaneously confirmed.
Distribution service providers
The newsletter is sent by the email marketing service provider “MailChimp”, a newsletter delivery platform of the US company Rocket Science Group, LLC, 675 Ponce De Leon Ave NE #5000, Atlanta, GA 30308, USA. The data protection regulations of the delivery service provider. The Rocket Science Group LLC d/b/a MailChimp is certified under the Privacy Shield Agreement and thus guarantees compliance with the European data protection standards. The delivery service provider is commissioned on the basis of our legitimate interests in accordance with Art. 6 para. 1 let. f GDPR and a processing contract pursuant to Art. 28 para. 3 s. 1 GDPR.
The delivery service provider can use the recipient’s data in pseudonymous form, i.e. without assignment to a user, to optimize or improve its own services, e.g. to technically optimize the dispatch and presentation of the newsletter, or for statistical purposes. However, the delivery service provider does not use the data of our newsletter recipients to contact them on his own account or to pass it on to third parties.
Newsletter – Performance Measurement
The newsletters contain a so-called “web beacon”, i.e. a pixel-sized file that is fetched from our server when the newsletter is opened or, if we use a delivery service provider, from his third-party server. Within the scope of this retrieval, technical information is collected, such as information about the browser and your system, your IP address and time of retrieval.
This information is used to technically improve the services with the help of technical data or target groups and their reading behavior based on their retrieval locations (which can be determined using the IP address) or access times. The statistical analysis also makes it possible to determine whether the newsletters are opened, when they are opened, and which links are clicked. Technically speaking, this information can be assigned to the individual newsletter recipients. However, it is neither our endeavor, nor that of the delivery service provider, to observe individual users. The analysis is rather used to recognize the reading habits of our users and to adapt our contents accordingly, or to send out various contents based on the interests of our users.
Separately opting-out of the performance measurement is unfortunately not possible, in this case the entire newsletter subscription must be cancelled.
Hosting and log files
Hosting and email dispatch
The hosting services we use provide the following services: infrastructure and platform services, computing capacity, storage capacity and database services, email distributions, security services and technical maintenance services that we use for the purpose of operating this online offering.
We, respectively our hosting provider, process inventory data, contact data, content data, contract data, usage data, meta and communication data of customers, interested parties and visitors of this online offering on the basis of our legitimate interests in an efficient and secure provision of this online offering according to Art. 6 Para. 1 let. f GDPR in conjunction with. Art. 28 GDPR (conclusion of processing contracts).
Collection of access data and log files
We, respectively our hosting provider, collect the following data on the basis of our legitimate interests within the scope of Art. 6 para. 1 let. f GDPR pertaining to each access to the server on which this service is located (so-called server log files). Access data includes: name of the visited website, file, date and time of access, transferred data volume, notification of successful access, browser type and version, the user’s operating system, referrer URL (the previously visited page), IP address and the requesting provider.
Log file information is stored for a maximum of 7 days for security reasons (e.g. to investigate misuse or fraud), and then deleted. Data for which further storage is required for evidentiary purposes are excluded from deletion until the respective incident has been clarified.
Integration of third-party services and content
Within the scope of our legitimate interests (i.e. for purposes such as the analysis, optimization and rentability of our online offering pursuant to Art. 6 para. 1 let. f GDPR), we use contents or services of third parties and incorporate them into our online offering, for example, videos or fonts (hereinafter uniformly referred to as “contents”).
This always presupposes that the third-party providers of this content obtain the IP address of the users, since without the IP address they would not be able send the content to their browser. The IP address is therefore required for the display of this content. We make every effort to use only such contents whose respective providers use the IP address solely for delivering the contents. Third-party providers may also use so-called pixel tags (invisible graphics, also known as “web beacons”) for statistical or marketing purposes. Pixel tags can be used to evaluate information such as visitor traffic on the pages of this website. The pseudonymous information may also be stored in cookies on the user’s device and may include technical information about the browser and operating system, referring websites, visiting time and other information about the use of our online offering; they may also be associated with such information from other sources.
Google Tag Manager
Google Tag Manager is a solution which allows us to manage so-called website tags via an interface (and thus, for example, integrate Google Analytics and other Google marketing services into our online offering). The Tag Manager itself (which implements the tags) does not process any personal data of the users. We refer you to the following information on Google services with regard to the processing of users’ personal data. Usage guidelines.
Google is certified under the Privacy Shield Agreement and thus complies with the European data protection laws.
Google will use this information on our behalf to evaluate the use of our online offering by users, to compile reports on the activities within this online offering and to provide us with further services associated with the use of this online offering and the use of the Internet. Anonymized user profiles can be created from the processed data.
We use Google Analytics only with IP anonymization enabled. This means that Google will abbreviate the IP address of users within Member States of the European Union or in other states party to the Agreement on the European Economic Area. Only in exceptional cases will the full IP address be transmitted to a Google server in the USA and abbreviated there.
The IP address transmitted by the user’s browser is not merged with other Google data. Users can prevent the storage of cookies by setting their browser software accordingly; users can also prevent Google from collecting the data generated by the cookie and relating to their use of the online offering, and the processing of this data by Google by downloading and installing the browser plug-in.
Users’ personal data will be deleted or made anonymous after 14 months.
Jetpack (WordPress Stats)
Within the scope of our legitimate interests (i.e. for purposes such as the analysis, optimization and rentability of our online offering pursuant to Art. 6 para. 1 let. f GDPR), we use the plugin Jetpack (i.e. the subfunction “WordPress Stats”), which integrates a tool for statistical analysis of visitor access, offered by Automattic Inc. 60 29th Street #343, San Francisco, CA 94110, USA. Jetpack uses “cookies”, which are text files placed on your computer, to help the website analyze how users use the site.
Online presence in social media
We have an online presence on social networks and different platforms to communicate with active customers, interested parties and users, and to inform them about our services. When accessing the respective networks and platforms, the terms and conditions and the data processing policies of their respective operators apply.
Status as of 28 May 2018