Status 03/2020

Data Protection Information

I. Introduction

With this data protection information, we inform in particular about the type, scope and purpose of the personal data processed and inform the persons affected by the data processing about the rights to which they are entitled. For further information, or if you have any questions about data protection, please contact us by e-mail office@kurzzeitmiete.at, by letter or by telephone at +43 662 23 10 55 to kurzzeitmiete.at GmbH, Sonnenweg 4, 5204 Straßwalchen.

Legal basis

Your personal data will be protected to the best of our ability in the context of all the services provided when you visit the website and when using the services provided on the website, insofar as they are within your own area of responsibility, as well as in the context of the provision of services. The processing of personal data is therefore carried out exclusively on the basis of legal provisions (GDPR, DSG, TKG 2003).

Data security on the Internet and links to third-party websites

Internet-based or wireless data transmissions generally have security gaps which, despite extensive efforts, do not allow absolute protection to be guaranteed. In addition, the public - and thus also the website operators - often does not know to what extent and for what purposes global companies such as Facebook, Google, Microsoft & Co collect, store and use data.

This website contains applications and plug-ins as well as links to third party websites, which are outside our area of responsibility under data protection law. By clicking on a link, you will be directed to the websites of third parties who may process personal data when you access the website.

II. Table of contents

You can access the individual topics of the data protection information directly by clicking on the respective item in the following table of contents:

D A T A P R O T E C T I O N I N F O R M A T I O N

I. Introduction

Legal basis

Data security on the Internet and links to third-party websites

II. Table of contents

III. Name and address of the person responsible

IV. Interested parties

V. Registered users of the online portal kurzzeitmiete.at

VI. Business partners (cooperation partners, service providers, suppliers, contractors)

VII. Applicants

VIII. Website visitor

IX. E-mail contact and telephone contact

X. Contact form

XI. Cookies

1. First party cookies - functional cookies

1.1 Session Cookie - Registered Users

2. Third party cookies - analysis and targeting cookies

2.1 Google Analytics cookie

2.2 Facebook cookie

2.3 Instagram Cookie

XII. Google Analytics

XIII. Google Ads

XIV. Facebook plugin

XV. Instagram plugin

XVI Technical and Organizational Safeguards / Changes to Privacy Information

ANNEX I

ANNEX II

III. Name and address of the person responsible

The controller in the sense of the basic data protection regulation for the processing of personal data is

kurzzeitmiete.at GmbH, FN 370213 g

Sonnenweg 4

5204 Straßwalchen

Tel.: +43 662 23 10 55

E-Mail: office@kurzzeitmiete.at

kurzzeitmiete.at

IV. Interested parties

1. Data processed

The following data - as far as provided - will be processed:

Master data: Title, first name, last name, gender
Contact/communication data: postal address, telephone number, e-mail address
Request data: Request content, date and, if applicable, time of the request, e.g. for e-mails
Date, time, duration and content of telephone calls and appointments
Correspondence
Notes
Data that you provide us with in addition

2. Purpose of the data processing

Your data will be used for the following purposes

Query response and correspondence
advertising and marketing, if applicable
Data backup
Paper, file and data carrier disposal
Respect for the rights of data subjects

including the preparation of related records and documents and the conduct of correspondence.

3. Recipients of personal data

3.1 Persons responsible who may be recipients of your personal data

The data subjects themselves, if applicable their representatives/agents/employees/contact persons
Internet and email service provider if applicable
Cooperation partner
Telecommunication providers/mobile operators
Logistician (e.g. for postal dispatch)

3.2 Processors who may be recipients of your personal data

IT service provider
Service provider for storage and data management
Database provider
Waste disposal service provider

Processors will only receive your personal data to the extent that they need it to perform their respective tasks. All contract processors are obliged on the basis of data protection regulations and a contract processor contract in accordance with Art. 28 GDPR to observe all applicable data protection regulations, to treat your data confidentially and to process it only within the scope of providing the service.

3.3 Transfer of personal data to third countries

As a matter of principle, your personal data will not be transferred to third countries, except in encrypted form within the framework of electronic communication or with your consent, provided that the service provider has submitted to the Privacy Shield Agreement or an appropriate decision on adequacy has been made.

4. Legal basis of the data processing

4.1 Protection of legitimate interests (Art. 6 para. 1 lit. f GDPR)

To protect our legitimate interests, your data will be processed in the following cases:

In the area of answering enquiries and correspondence, data processing is carried out not only on the basis of the implementation of (pre-)contractual measures (Art. 6 Para. 1 lit. b GDPR) but also because of the legitimate interest of the person responsible in answering enquiries and initiating business relations.
In the field of advertising and marketing, the processing of personal data is based on the legitimate interest of the responsible party in the targeted addressing of interested parties and users, user acquisition and retention as well as sales promotion and increasing the efficiency of sales strategies.
In the area of data security, data processing is carried out not only to fulfil legal obligations (Art. 6 Para. 1 lit. c GDPR) but also because of the legitimate interest in property protection, system security, access and access restriction.
When processing personal data on the basis of our legitimate interest in accordance with Art. 6 para. 1 lit. f GDPR or data processing for direct marketing purposes, we have the right to object in accordance with Art. 21 GDPR. You can exercise this right of objection at any time by notifying us.

4.2 Consent (Art. 6 para. 1 lit. a GDPR; Art. 9 para. 2 lit. a GDPR)

If you have given your consent to the processing of your personal data in connection with advertising and marketing measures, the data will only be processed

in accordance with the purposes specified in the consent form,
to the extent agreed therein and
by the recipients described in the declaration of consent and
is subject to the specified storage period.

A given consent can be revoked at any time with effect for the future by e-mail, letter or in any other way in writing or verbally to the person responsible named in the declaration of consent. The revocation of consent does not affect the lawfulness of the processing carried out on the basis of the consent until revocation.

5. Storage period

The data will be deleted after 3 years from the end of the communication, unless longer storage is necessary in particular for the fulfilment of a contract, for the fulfilment of documentation obligations or for the assertion, exercise or defence of legal claims.

6. Consequences of not making data available

If data required to answer the inquiry, such as contact data or information on the content of the inquiry, is not provided, the inquiry cannot be answered or can only be answered in a limited form. The non-supply of further information is voluntary and has neither consequences for the answering of the inquiry, nor consequences beyond the answering of the inquiry.

7. Rights of data subjects

With regard to personal data, there is a right of access, rectification, deletion, restriction of processing, data transferability and opposition, and with regard to consent given, the right to withdraw consent at any time. Revocation of consent shall not affect the lawfulness of the processing carried out on the basis of the consent until revoked.

Violations of applicable data protection law or violations of rights and obligations under data protection law can be asserted before the Austrian Data Protection Authority (DSB), Barichgasse 40-42, 1030 Vienna.

In addition, you are free to seek legal assistance if you believe that a violation of data protection law has occurred.

V. Registered users of the online portal kurzzeitmiete.at

1. Processed data

We process the personal data that we receive from you in the course of the business initiation and within the scope of the contractual relationship.

Personal data is always collected from you yourself, as far as this is possible.

Under certain circumstances, personal data may also be disclosed by your representatives or contact persons or third parties or collected from publicly accessible sources (e.g. website, telephone directory, trade register, register of residents, etc.). Data collected from public registers or other sources will be merged with the personal data collected from you for the purposes stated in point V.2.

Should your personal data have been transmitted by a third party, you will be informed, unless there is an exception to the obligation to inform pursuant to Art. 14 GDPR, within a reasonable period of time, but no later than one month after receipt of your data, of the categories of personal data specifically processed in each individual case and of any other information required pursuant to Art. 14 GDPR.

The personal data processed are in particular:

Master data: Title, title, surname, first name, gender, language, country of origin
Communication/contact details: Postal address, billing address, telephone number, e-mail address
Contact person/representative
Contract (draft) data: Contract partner, start date, content, scope, conditions, termination
Data of the rental agreement and data of other services used, if applicable photos and videos of the property
Customer data: Customer number, profile data, portal usage data;
Advertising and marketing data: Preferences, interests, advertising media and frequency, reaction behavior
Date, time, duration and content of telephone calls and appointments
Correspondence
Notes
Billing, invoice and payment data
Tax-relevant data (e.g. UID no., permanent establishment)
Bank details
IP address, browser data (depending on the configuration of the website visitor's browser, e.g. browser type, browser version, operating system used, referrer URL)
User name and password (encrypted)
Data that you provide us with in addition

2. Purpose of data processing

Networking of potential landlords with potential tenants
Provision of rental contracts
Operation, maintenance, administration and further development of the online portal kurzzeitmiete.at
Mediation of services in connection with the object letting
Mediation of photo shootings for existing properties
Deposit and rent service, deposit safekeeping and administration, handling of deposit refund or disbursement
Contract management
Customer management and support
Query response and correspondence
Accounting, bookkeeping
Materials management, purchasing, logistics
Print and copy jobs
Advertising and marketing
PC/Laptop/Tablet/Smartphone access and use/End User Computing
User data and access management
Data backup
Paper, file and data carrier disposal
Respect for the rights of data subjects

(in each case including the preparation of related records and documents and the conduct of correspondence.)

3. Recipient of personal data

3.1 Persons responsible who may be recipients of your personal data

The data subjects themselves, their representatives, agents, employees, contact persons, if applicable
Courts, authorities
External consultants (e.g. tax consultants, legal representatives, marketing service providers)
Insurance
Business partners (cooperation partners, service providers, suppliers, contractors)
IT service provider
Banks for processing payments
Telecommunication providers/mobile operators
Logisticians (e.g. for postal dispatches)

3.2 processors who may be recipients of your personal data

IT service provider
Service provider for storage and data management
Host service provider
Database provider
Waste disposal service provider

3.3 Transfer of personal data to third countries

4. Legal bases of the data processing

4.1. Implementation of pre-contractual measures and fulfilment of contractual obligations (Art. 6 para. 1 lit. b GDPR

The processing of personal data in the areas of Networking of potential landlords with potential tenants

Provision of rental contracts
Operation, maintenance and further development of the online portal kurzzeitmiete.at
Mediation of photo shootings for existing properties
Mediation of services in connection with the letting of properties
Deposit and rent service, deposit safekeeping and administration, handling of deposit refund or disbursement
Query response and correspondence
Accounting, bookkeeping
Data backup

takes place in the course of the implementation of measures for the initiation of contracts as well as for the fulfilment of contracts.

4.2 Fulfilment of legal obligations (Art. 6 para. 1 lit. c GDPR)

The processing of personal data is subject to

Contract management
Accounting, bookkeeping
PC/Laptop/Tablet/Smartphone access and use/End User Computing
User data and access management
Data backup
Paper, file and data carrier disposal
Respect for the rights of data subjects

The personal data provided is required to fulfil legal obligations, e.g. in connection with tax, civil and data protection law, as well as obligations arising from (administrative) criminal law.

4.3 Consent (Art. 6 para. 1 lit. a GDPR; Art. 9 para. 2 lit. a GDPR)

If you have given your consent to the processing of your personal data in connection with advertising and marketing measures or to the processing of data of special categories, processing will only take place

in accordance with the purposes specified in the consent form,
to the extent agreed therein and
by the recipients described in the declaration of consent and
is subject to the specified storage period.

4.4 Protection of legitimate interests (Art. 6 para. 1 lit. f GDPR)

To protect our legitimate interests, your data will be processed in the following cases:

In the area of answering enquiries and correspondence, data processing is carried out not only on the basis of the implementation of (pre-)contractual measures (Art. 6 para. 1 lit. b GDPR) but also on the basis of the legitimate interest of the person responsible in answering enquiries and initiating business relations.
In the area of portal administration and further development, data processing is carried out in addition to the legal basis for the fulfilment of (pre)contractual obligations (Art. 6 para. 1 lit. c GDPR) on the basis of the legitimate interest of the responsible party in the improvement and optimisation of the online portal to increase user satisfaction and the development of new business areas to ensure the long-term success of the company.
In the field of advertising and marketing, the processing of personal data is carried out on the basis of the legitimate interest of the responsible party in the targeted addressing of interested parties and users, user acquisition and retention as well as sales promotion and increasing the efficiency of sales strategies.
In the area of PC/laptop/tablet/smartphone access and use/end user computing, general network protection and logging in IT systems, data backup and user data and access management, data processing is carried out in addition to the fulfilment of legal obligations (Art. 6 para. 1 lit. c GDPR) due to the legitimate interest in property protection, system security, access and access restriction.

When processing personal data on the basis of our legitimate interest in accordance with Art. 6 Para. 1 letter f GDPR or when processing data for direct marketing purposes, we have the right to object in accordance with Art. 21 GDPR. You can exercise this right of objection at any time by notifying us.

5. Storage period

Your personal data is processed in connection with contractual relationships as well as in the pre-contractual context will be stored until the respective purpose is achieved and as far as necessary

for the duration of the entire contractual relationship (from the initiation to the fulfilment/terming/cancellation of the contract/agreement)
until three years after the last contact,
in accordance with the statutory storage and documentation obligations arising, for example, from the Austrian Enterprise Code (UGB), the Federal Fiscal Code (BAO), the Value Added Tax Act (UStG), the Trade Regulation Act (GewO) and other laws,
until the expiry of limitation periods for potential legal claims, and
as long as the data is used to assert, exercise or defend legal claims and until the end of any legal disputes in which the data is required.

In particular, the following legal retention periods must be taken into account

Business and tax law retention periods (7 years each according to § 132 BAO, §§190, 212 UGB, 18 UstG, § 152 GewO)
Warranty periods (§ 933 ABGB, 2 or 3 years)
Limitation periods (§ 1295 ABGB, 3 or 30 years)

6. Consequences of not providing data

The provision of personal data is partly required by law (e.g. tax regulations) or results from legal and contractual necessities (e.g. information on the contractual partner). In order to conclude and fulfil a contract, it is therefore necessary to provide personal data, which will subsequently be processed.

If you do not will be rejected or an existing contract can no longer be fulfilled, which is why the business relationship will be terminated.

7. Rights of data subjects

Violations of applicable data protection law or violations of rights and obligations under data protection law can be asserted before the Austrian Data Protection Authority (DSB), Barichgasse 40-42, 1030 Vienna.

In addition, you are free to seek legal assistance if you believe that a violation of data protection law has occurred.

VI. Business partners (cooperation partners, service providers, suppliers, contractors)

1. Data processed

We process the personal data that we receive from you in the course of the business initiation and within the scope of the contractual relationship.

Personal data is always collected from you yourself, as far as this is possible.

Under certain circumstances, personal data may also be disclosed by your representatives or contact persons or third parties or collected from publicly accessible sources (e.g. website, telephone directory, trade register, etc.). Data collected from public registers or other sources will be merged with the personal data collected from you for the purposes mentioned in VI.2.

The personal data processed are in particular:

Master data: title, title, surname, first name, gender
Communication/contact details: postal address, telephone number, e-mail address
Contact person/representative
Date, time, duration and content of telephone calls and appointments
Contract (draft) data: Contract partner, start date, content, scope, conditions, termination
Date, time, duration and content of telephone calls and appointments
Correspondence
Notes
Billing, invoice and payment data
Tax-relevant data (e.g. UID no., permanent establishment)
Bank details
In connection with photo shootings of the other mediated services if necessary master data of users;
In connection with the operation, maintenance, administration and further development of the online portal kurzzeitmiete.at possibly profile data of users
Data that you provide us with in addition

2. Purpose of the data processing

Operation, maintenance, administration and further development of the online portal kurzzeitmiete.at
Mediation of photo shootings for existing properties and handling of service mediation
Brokerage of services in connection with the letting of properties and handling of service brokerage
Initiation, fulfilment, execution and termination of contract
Query response and correspondence
Business partner support and administration
Contract management
Accounting, bookkeeping
Materials management, purchasing, logistics
Print and copy jobs
Advertising and marketing
PC/Laptop/Tablet/Smartphone access and use/End User Computing
User data and access management
Data backup
Paper, file and data carrier disposal
Respect for the rights of data subjects

(in each case including the preparation of related records and documents and the conduct of correspondence.)

3. Recipients of personal data

3.1 Data controllers who may be recipients of your personal data

Data subjects themselves and, if applicable, their representatives/agents/employees/contact persons
Experts, appraisers
Courts, authorities
External consultants (e.g. tax consultants, legal representatives, IT service providers, management consultants, marketing service providers)
Insurance
Internet and email service providers
Banks for processing payments
Telecommunication providers/mobile operators
Logisticians (e.g. for postal dispatch)

3.2 Processors who may be recipients of your personal data

IT service providers in the course of electronic communication (web/mail server) as well as remote maintenance if necessary
Service providers for storage and data management
Host service provider
Database providers
Waste disposal service providers

3.3 Transfer of personal data to third countries

4. Legal basis of the data processing

4.1. implementation of pre-contractual measures and fulfilment of contractual obligations (Art. 6 para. 1 lit. b GDPR)

The processing of personal data in the areas of

Operation, maintenance, administration and further development of the online portal kurzzeitmiete.at
Mediation of photo shootings for existing properties and handling of service mediation
Brokerage of services in connection with the letting of properties and handling of service brokerage
Initiation, fulfilment, execution and termination of contract
Query response and correspondence
Accounting, bookkeeping

(takes place in the course of the implementation of measures for the initiation of contracts as well as for the fulfilment of contracts with business partners (cooperation partners, service providers, suppliers, contractors).)

4.2 Fulfilment of legal obligations (Art. 6 para. 1 lit. c GDPR)

The processing of personal data is subject to

Initiation, fulfilment, execution and termination of contract
Contract management
Accounting, bookkeeping
Advertising and marketing
PC/Laptop/Tablet/Smartphone access and use/End User Computing
User data and access management
Data backup
Paper, file and data carrier disposal
Respect for the rights of data subjects

The personal data provided is required to fulfil legal obligations, e.g. in connection with tax, civil and data protection law, as well as obligations arising from (administrative) criminal law.

4.3 Consent (Art. 6 para. 1 lit. a GDPR; Art. 9 para. 2 lit. a GDPR)

If you have given your consent to the processing of your personal data in connection with advertising and marketing measures or to the processing of data of special categories, processing will only take place

in accordance with the purposes specified in the consent form,
to the extent agreed therein and
by the recipients described in the declaration of consent and
is subject to the specified storage period.

4.4 Protection of legitimate interests (Art. 6 para. 1 lit. f GDPR)

To protect our legitimate interests, your data will be processed in the following cases:

In the area of answering enquiries and correspondence, data processing is carried out not only on the basis of the implementation of (pre-)contractual measures (Art. 6 para. 1 lit. b GDPR) but also on the basis of the legitimate interest of the person responsible in answering enquiries and initiating business relations.
In the area of portal administration and further development, data processing is carried out in addition to the legal basis for the fulfilment of (pre)contractual obligations (Art. 6 para. 1 lit. c GDPR) on the basis of the legitimate interest of the responsible party in the improvement and optimisation of the online portal to increase user satisfaction and the development of new business areas to ensure the long-term success of the company.
In the field of advertising and marketing, the processing of personal data is carried out on the basis of the legitimate interest of the responsible party in the targeted addressing of interested parties and users, user acquisition and retention as well as sales promotion and increasing the efficiency of sales strategies.
In the area of PC/laptop/tablet/smartphone access and use/End User Computing, general network protection and logging in IT systems as well as data backup and user data and access management, data processing is carried out in addition to the fulfilment of legal obligations (Art. 6 para. 1 lit. c GDPR) due to the legitimate interest in property protection, system security, access and access restriction.

When processing personal data on the basis of our legitimate interest in accordance with Art. 6 Para. 1 letter f GDPR or data processing for direct marketing purposes, we have the right to object in accordance with Art. 21 GDPR. You can exercise this right of objection at any time by notifying us.

5. Storage period

Your personal data will be processed in connection with contractual relationships and in the pre-contractual context until the respective purpose is achieved and as far as necessary

for the duration of the entire contractual relationship (from the initiation to the fulfilment/terming/termination of the contract/agreement),
until three years after the last contact,
in accordance with the statutory storage and documentation obligations arising, for example, from the Austrian Enterprise Code (UGB), the Federal Fiscal Code (BAO), the Value Added Tax Act (UStG), the Trade Regulation Act (GewO) and other laws,
until the expiry of limitation periods for potential legal claims, and
as long as the data is used to assert, exercise or defend legal claims and until the end of any legal disputes in which the data is required.

In particular, the following legal retention periods must be taken into account

Business and tax law retention periods (7 years each according to § 132 BAO, §§190, 212 UGB, 18 UstG, § 152 GewO)
Guarantee periods
Warranty periods (§ 933 ABGB, 2 or 3 years)
Limitation periods (§ 1295 ABGB, 3 or 30 years)
Time limits for work wage claims (§1486 ABGB, 3 years)
Time limits for purchase price claims ( § 1062 in connection with § 1486 ABGB, 3 years)
Periods for rent claims (§ 1486 ABGB, 3 years)

6. Consequences of not providing data

If you do not provide the data required in this context, the conclusion of the contract or the execution of the order must usually be rejected or an existing contract can no longer be fulfilled, which is why the business relationship must be terminated.

7. Rights of data subjects

In addition, you are free to seek legal assistance if you believe that a violation of data protection law has occurred.

VII. Applicants

1. Data processed

In connection with your application the following data will be processed:

Master data: Title, first name, last name, date of birth, gender, marital status
Contact/communication data: Main residence/mail address, telephone number, e-mail address
Application data: Date of application, type of application (e.g. unsolicited), curriculum vitae, training data, professional experience, special knowledge and skills, desired employment, desired start date;
Applications by e-mail: Date and time of e-mail receipt, sender, recipient, IP address, content, attachments)
Other data: Photograph, notes, date of decision and notification, record keeping (with consent), disclosure (with consent), other information of the applicant;

2. Purpose of data processing

The applicant data is used for the following purposes

Applicant Management
Query response and correspondence
Data backup
Paper, file and data carrier disposal
Respect for the rights of data subjects

including the preparation of related records and documents and the conduct of correspondence.

3. Recipients of personal data

Recipients of the personal data may, under certain circumstances, necessarily be third parties (IT service providers, e-mail service providers, host service providers and providers) and, if applicable, courts or authorities, who are entrusted with the electronic communication as well as with any error and fault rectification or maintenance.

4. Legal basis of the data processing

The processing of personal data is based on the implementation of pre-contractual measures pursuant to Art. 6 para. 1 lit. b GDPR, since the application phase constitutes a potentially pre-contractual legal relationship.

If you, as an applicant, have given your consent to the processing of your personal data for the purpose of keeping records, processing based on your consent pursuant to Art. 6 Paragraph 1 lit. a GDPR will only be

in accordance with the purposes specified in the consent form,
to the extent agreed therein and
by the recipients named in the declaration of consent and
is subject to the specified storage period.

Furthermore, the storage of applicant data is based on the justified interest in the defence and defence of legal claims (in particular GlBG and ABGB) in accordance with Art. 6 Para. 1 lit. f GDPR.

When processing personal data on the basis of our legitimate interest in accordance with Art. 6 Para. 1 lit. f GDPR, we have the right to object in accordance with Art. 21 GDPR. You can exercise this right of objection at any time by notifying us.

5. Storage duration

Your personal data will be processed in connection with your application - as far as necessary in each case

for the duration of the entire contractual relationship (from the initiation to the fulfilment/terming/termination of a contract/agreement),
in addition, in accordance with the statutory storage and documentation obligations arising, for example, from the Austrian Commercial Code (UGB) and other laws,
until the expiry of limitation periods for potential legal claims, and
as long as the data is used to assert, exercise or defend legal claims and until the end of any legal disputes in which the data is required.

In particular, the following retention periods must be taken into account

up to 7 months after notification of the rejection of an applicant (§§ 15 para. 1, 29 GlBG)
up to 3 years after the cancellation until the limitation of possible introduction costs (§ 1486 Z 5 ABGB)
up to 3 years after the date of cancellation with the consent of the applicant to keep records

6. Consequences of not providing data

If the data required for the application process, such as master data or training data, is not provided, the application cannot be considered when filling the vacancy due to a lack of ability to assess suitability.

7. rights of data subjects

In addition, you are free to seek legal assistance if you believe that a violation of data protection law has occurred.

VIII. Website visitor

1. Data processed

Each time the website is accessed, the following general data and information is processed:

IP address of the user
Logfiles Information about the browser type and version used
Operating system of the user
User's internet service provider
Date and time of access

2. Purpose of the data processing

When processing the data of website visitors, no conclusions are drawn about the data subject. This information is rather required for the purpose of correctly delivering the contents of the website serving advertising and marketing purposes, to ensure the permanent operability of information technology systems and the technology of the website, to provide law enforcement authorities with the information necessary for criminal prosecution in the event of a cyber attack and to fulfil obligations under data protection law.

3. Recipients of personal data

4. Legal basis of the data processing

The legal basis for data processing is on the one hand the legitimate interest of the website operator in the correct delivery of the contents and on the other hand the possibility of providing law enforcement authorities with the information necessary for criminal prosecution in case of a cyber attack. Furthermore, the legitimate interest in the implementation of marketing and advertising measures to increase the level of awareness and the economic efficiency of the business forms the legal basis for data processing in accordance with Art. 6 Para. 1 lit. f GDPR.

5. Storage period

The storage of the data is basically carried out until the purpose is achieved. If data is processed for the purpose of correct presentation of the website, the data is deleted after the end of the session. If data is stored beyond this, it is stored - except for the purpose of criminal prosecution - exclusively in anonymous form.

6. Consequences of not providing data

Failure to provide data means that the website cannot be displayed correctly.

7. Rights of data subjects

Violations of applicable data protection laws or violations of rights and obligations under data protection law can be asserted before the Austrian Data Protection Authority (DSB), Barichgasse 40-42, 1030 Vienna.

In addition, you are free to seek legal assistance if you believe that a violation of data protection law has occurred.

IX. E-mail contact and telephone contact

1. Data processed

When you contact us by e-mail, in addition to the content of your e-mail message, information such as the addresses of the sender and recipient, the date and the subject of the message are transmitted and processed. In the case of a telephone call, in addition to the personal data you have provided, notes on the content of the call, the time and duration of the call will be processed.

2. Purpose and legal basis of the data processing

If an enquiry is in connection with an existing contract or aims at the conclusion of a contract, data processing for the purpose of communication and answering enquiries is carried out not only on the basis of the implementation of (pre)contractual measures (Art. 6 Para. 1 letter b GDPR) but also because of the legitimate interest of the person responsible in answering the enquiry and initiating a business relationship in accordance with Art. 6 Para. 1 letter f GDPR.

3. Recipients of personal data

4. Storage duration

The storage of the data is basically carried out until the purpose is achieved. All data will be deleted after 3 years from the end of correspondence, unless longer storage is necessary in particular for the fulfilment of a contract, for the fulfilment of documentation obligations or for the assertion, exercise or defence of legal claims.

5. Consequences of not making data available

Failure to provide necessary data such as contact details or useful data, e.g. information on the content of the enquiry, will result in the enquiry not being answered or not being answered correctly.

6. Rights of data subjects

Furthermore, you are free to seek legal assistance if you believe that there has been a violation of data protection law.

X. Contact form

1. Data processed and purpose of processing

In connection with the contact form, your IP address as well as the time and date of the request are processed in addition to the data in the input mask.

The transmitted data will be used exclusively for communication purposes, processing and answering enquiries as well as for subsequent correspondence and, if a business relationship is established, will be further processed within the framework of this relationship.

2. Recipients of personal data

Recipients of the personal data may in particular be third parties (IT service providers, e-mail service providers, host service providers and providers) and, if applicable, courts or authorities, who are necessarily entrusted with electronic communication and any error and fault rectification or maintenance.

3. Legal basis of the data processing

Personal data is processed on the basis of the implementation of pre-contractual measures or in the course of the performance of a contract in accordance with Art. 6 Para. 1 letter b GDPR, if the request is aimed at the conclusion of a contract or is connected with the performance of a contract.

Otherwise, the legitimate interest in answering the enquiry or, in the case of processing of the name in connection with the contact form, the legitimate interest in addressing the person making the enquiry personally and assigning him/her to existing interested parties, customers or business partners, pursuant to Art. 6 Paragraph 1 letter f GDPR, constitutes the legal basis for data processing.

The indication of the telephone number is voluntary. The processing serves the purpose of the telephone processing of the enquiry requested by the enquirer and is therefore based on the legitimate interest of the enquiry answer requested by the enquirer by telephone in accordance with Art. 6 Para. 1 lit. f GDPR.

When processing personal data on the basis of our legitimate interest in accordance with Art. 6 para. 1 lit. f GDPR, we have the right to object in accordance with Art. 21 GDPR. You can exercise this right of objection at any time by notifying us.

4. Storage period

5. Consequences of not providing data

If the data required for answering the inquiry, such as contact data or inquiry contents, is not provided, the inquiry cannot be answered or can only be answered in a limited form. The nonprovision of the name and telephone number of the inquiring person in connection with the contact form is voluntary and has neither effects on the answering of the inquiry nor effects beyond the answering of the inquiry.

6. Rights of data subjects

With regard to personal data, there is a right of access, rectification, cancellation, restriction of processing, revocation of consent given, data transferability and opposition. Revocation of consent shall not affect the lawfulness of the processing carried out on the basis of the consent until revoked.

Violations of applicable data protection law or violations of rights and obligations under data protection law may be asserted before the Austrian Data Protection Authority (DSB), Barichgasse 40-42, 1030 Vienna.

In addition, you are free to seek legal assistance if you believe that a violation of data protection law has occurred.

XI. Cookies

This website uses cookies. Cookies are text files which the operator of a website or a third party places on the end device of the website user, stores them and can call them up again. Cookies facilitate Internet navigation, enable functions and/or provide information about user behaviour.

Cookies can contain a so-called cookie ID. A specific Internet browser can be recognized and identified by the unique cookie ID. For example, this enables us to analyse user behaviour and to optimise information and offers on a website in the interests of the user.

1. First party cookies - functional cookies

Cookies that are absolutely necessary for website delivery or that serve to carry out or facilitate the transmission or the provision of an expressly requested service are so-called function cookies. The following function cookies are set on this website:

1.1 Session Cookie - Registered Users

1. Data processed

Currently, a technically necessary session cookie is set on this website for the purpose of recognizing registered website visitors. The following data is processed:

IP address
Cookie ID
Browser type

2. Purpose of the data processing

The recognition of registered and logged in website visitors by the session cookie prevents the logged in website visitor from having to log in again each time he or she accesses a subpage and from being able to use all the functions of the website fully and optimally.

3. Recipients of personal data

Recipients of the personal data may, under certain circumstances, necessarily be third parties (IT service providers, e-mail service providers, host service providers and providers) charged with electronic communication as well as with any error and fault rectification or maintenance and, if necessary, courts or authorities.

4. Legal basis of the data processing

The recognition of registered and logged-in website visitors to enable the complete and optimal use of all website functions of the website visitors is in the legitimate interest of the website operator in the correct delivery of a functioning website in accordance with Art. 6 para. 1 lit. f GDPR.

When processing personal data on the basis of our legitimate interest according to Art. 6 Para. 1 lit. f GDPR, we have the right to object according to Art. 21 GDPR. You can exercise this right of objection at any time by notifying us.

5. Storage period

The cookie is stored for the duration of the logged on website visit.

6. Consequences of not providing data

If the website visitor prevents the session cookie from being set, e.g. by his browser settings, this will result in the website visitor not being recognised as a registered website visitor, having to log in again each time a subpage is accessed and possibly not being able to use all the functions of the website.

7. Rights of persons concerned

In addition, you are free to seek legal assistance if you believe that a violation of data protection law has occurred.

2. Third party cookies - analysis and targeting cookies

If, when using cookies, user settings are processed or analyses of user behaviour are carried out, the informed consent of the website visitor must be obtained. The following third party cookies are currently used to analyse and evaluate user behaviour:

2.1 Google Analytics cookie

If you have given your consent to the use of Google Analytics, a cookie from Google LLC will be set on your end device, which also enables the processing of personal data of the website visitor. All information on data processing in connection with the "Google Analytics Cookie (_ga)" can be found under point XII. of this privacy information.

2.2 Facebook cookie

If you have given your consent to use the Facebook plugin, a cookie from Facebook Inc. will be set on your end device, which also enables processing of personal data of the website visitor. All information on data processing in connection with the "Facebook cookie" can be found under point XII. of this privacy information.

2.3 Instagram Cookie

If you have given your consent to use the Instagram plugin, a cookie from Instagram Inc. (Facebook Inc.) is set on your end device, which also enables processing of personal data of the website visitor. All information on data processing in connection with the "Instagram Cookie" can be found under point XII of this Privacy Policy.

XII. Google Analytics

On our website we use Google Analytics, a web analysis service of Google LLC ("Google") and in this context we have concluded a contract with Google.

Google is certified under the Privacy Shield Agreement and thus guarantees compliance with European data protection law. For more information about Google's certification, please click here.

For more information about Google's data processing practices, please refer to Google's privacy policy.

1. Data processed

If you have given your consent to use Google Analytics, the following data will be processed:

IP address
Cookie ID
Browser data
Date and time when the cookie setting was made and, if necessary, when it was changed
Date and time of consent and, where appropriate, of withdrawal of consent
Location: Country, region, city, approximate longitude and latitude (geolocation)
Date and time of the request (visit of the website)
Dwell time
Click behaviour
Clicked and downloaded files (Downloads)
URL of the visited page (page URL)
URL of the previously visited page (referrer URL)
Links to a clicked external domain (outlink)
Search queries on the website

According to its own information, Google processes data that is provided when using the services as well as data that is collected when using the services (apps, browsers and devices, activities, location data). Details can be found here.

To protect your personal data, we have extended Google Analytics on our website to include IP anonymisation. This results in an anonymised recording of IP addresses (IP masking). Only in exceptional cases is the full IP address transferred to a Google server in the USA and shortened there.

In addition, we have deactivated the User ID function and thus do not use Google Analytics as Universal Analytics and without so-called "cross-device tracking". Furthermore, the "Audiences" or "Target Groups" function, which, for example, enables a selection of certain website visitors as a target group for our Google ads, is not activated on our website.

2. Purpose of data processing

Google sets cookies on your end device to analyse the use of the website and transfers the data to a Google server. The information processed by the cookie about your activities on this website is transferred to a Google server in the USA and stored there. Google uses the processed data for us to evaluate your use of our website and to compile reports on website activity which help us to subject our website to statistical analysis and to evaluate website usage in order to optimise our website and service offering.

Google itself processes the collected data according to its own specifications for the provision, maintenance and improvement of services, the development of new services, the provision of personalised services, including content and advertising, performance measurement, communication, improvement of security and reliability of services. Details can be found here.

3. Recipients of personal data

The recipient of the personal data is Google LLC. In addition, the recipients of personal information may include third parties (IT service providers, email service providers and providers) who are engaged in electronic communications and any necessary troubleshooting or maintenance, and may include courts of law or government agencies.

All contract processors are obliged on the basis of data protection regulations and a contract processor contract in accordance with Art. 28 GDPR to observe all applicable data protection regulations and to treat your data confidentially.

Your personal data will be transferred to third countries, specifically to Google servers, whereby Google is subject to the Privacy Shield Agreement.

4. Legal basis of data processing

Google Analytics will only be used on our website if you have given your consent to do so in accordance with Art 6 Paragraph 1 lit. a GDPR.

5. Storage period

The storage of the data is basically carried out until the purpose is achieved. However, the storage period of the data is a maximum of 14 months. The data sent and linked to cookies, user IDs or advertising IDs are deleted after the storage period has expired. We process the data of consent for the duration of the website visit and store them for documentation purposes in the sense of the accountability under data protection law in accordance with Art. 24 Para. 1 GDPR for a period of three years.

6. Consequences of not providing data

Consent to use Google Analytics is voluntary and there is no obligation on the part of the website visitor to grant consent. The granting or refusal of consent does not lead to any advantages or disadvantages in the context of website use or business relations with the website operator.

7. Rights of affected persons

If you have given your consent, but wish to revoke your consent to use Google Analytics in the future, the following link "Revoke Google Analytics" will take you to the cookie settings you have made, which you can change at any time. Revocation of your consent does not affect the legality of the processing carried out on the basis of your consent until revocation.

When processing personal data for direct marketing purposes, you have the right to object in accordance with Art. 21 GDPR. You can exercise this right of objection at any time by notifying us.

In addition, you are free to seek legal assistance if you believe that a violation of data protection law has occurred.

8. Further information

The collection of data generated by the cookie and related to your website usage - including your IP address - by Google and the data processing by Google can prevent you from downloading and activating this tool. In order for Google Analytics to work, the browser must load several JavaScript files when calling up a website that uses the data collection tool. The above plugin prevents the browser from loading these files. This makes users invisible to Google Analytics.

You can also prevent the storage of cookies by selecting appropriate technical settings in your browser software. This technical setting is possible in all common internet browsers. The transmission of Flash cookies can be prevented by changing the settings of the Flash Player.

XIII. Google Ads

We use Google Ads, an online advertising program of Google LLC ("Google") on our website and have concluded a contract with Google in this connection.

Google is certified under the Privacy Shield Agreement, which guarantees that it complies with European data protection law. For more information about Google's certification, please click here.

For more information about Google's data processing practices, please refer to Google's Privacy Policy.

1. Data processed

If you have given your consent to use Google Ads, the following data will be processed:

2. Purpose of data processing

Google Ads is an online advertising program that uses conversion tracking. When you click on an ad placed on Google, a conversion tracking cookie is placed on your device. This cookie is not used for personal identification. These cookies expire after 30 days. If you visit certain pages on our site and the cookie hasn't expired, Google and we can tell that you clicked on the ad and were redirected to that page. Conversion statistics thus show us which of our advertising measures are particularly effective and which are of little interest. We do not receive any personal data or data that enables us to identify individuals in this context.

Google itself processes the collected data according to its own specifications for the provision, maintenance and improvement of services, the development of new services, the provision of personalised services, including content and advertising, performance measurement, communication, improvement of the security and reliability of services. Details can be found here.

3. Recipients of personal data

The recipient of the personal data is Google LLC. In addition, the data will be transferred to an advertising and marketing service provider based in Austria for the purpose of evaluating and optimizing the advertising strategy and campaigns. Recipients of personal data may also be third parties (IT service providers, e-mail service providers and providers) and, if necessary, courts or public authorities, who are necessarily entrusted with electronic communication and any error and fault rectification or maintenance.

Your personal data will be transferred to third countries, specifically to Google servers, whereby Google is subject to the Privacy Shield Agreement.

4. Legal basis of data processing

Google Ads will only be used on our website if you have given your consent to do so in accordance with Art 6 Paragraph 1 lit. a GDPR.

5. Storage period

We process the data of the consent for the duration of the website visit and store them for documentation purposes in the sense of the accountability under data protection law in accordance with Art. 24 Para. 1 GDPR for a period of three years.

6. Consequences of not providing data

Consent to use Google Ads is voluntary and there is no obligation on the website visitor to give consent. The granting or refusal of consent does not result in any advantages or disadvantages in the context of website use or business relations with the website operator.

7. Rights of affected persons

If you have given your consent, but wish to revoke your consent to use Google Analytics in the future, the following link Revoke Google Ads will take you to the cookie settings you have made, which you can change at any time. Revocation of your consent does not affect the legality of the processing carried out on the basis of your consent until revocation.

When processing personal data for direct marketing purposes, you have the right to object in accordance with Art. 21 GDPR. You can exercise this right of objection at any time by notifying us.

Furthermore, you are free to seek legal assistance if you believe that there has been a violation of data protection law.

8. Further information

You can deactivate the advertising personalised for you by Google. You can find instructions here.

You can also prevent the storage of cookies by selecting the appropriate technical settings in your browser software. This technical setting is possible in all common internet browsers. The transmission of Flash cookies can be prevented by changing the settings of the Flash Player.

XIV. Facebook plugin

We use on our website the Facebook plugin of Facebook Inc.

In connection with the collection and transfer of data by transmission, we are together with Facebook responsible for data processing in the sense of Art. 26 GDPR. Apart from this, both Facebook and we act as independent responsible parties or Facebook acts in some areas as contract processors.

We have made appropriate arrangements and agreements with Facebook in order to fulfil our obligations within the meaning of the GDPR in the best possible way. The agreement reached with Facebook can be viewed here.

Facebook is certified under the Privacy Shield Agreement and thus guarantees compliance with European data protection law. You can find out more about Facebook's certification here.

1. Processed data

If you have given your consent to use the Facebook plugin, we will not process any personal data of the website visitor, with the exception of the consent data. On our Facebook fan page - not via our website - we receive an anonymised evaluation of user statistics, which, however, do not contain any personal data or allow conclusions to be drawn about them.

Facebook processes numerous data provided by the user, device data and information from partners in the context of setting a cookie. Details can be found here.

2. Purpose of data processing

By integrating the Facebook plugin, you can "link" certain contents of our website or our entire website or share them on your Facebook profile. For us, the use of the Facebook plugin increases the reach of our website and the number of visitors to our site.

Facebook processes your data to provide, personalize and improve our products, to provide measurement, analysis and other corporate services, to promote protection, integrity and security, to communicate and to conduct research and innovation for social purposes. Details can be found here.

3. Recipients of personal data

Recipients of personal data are Facebook and its cooperation partners as well as their other recipients. Details can be found here.

4. Legal basis of the data processing

The legal basis for data processing is the consent granted to us in accordance with Art. 6 Para. 1 lit. a GDPR. Details of the legal basis for data processing by Facebook can be found here.

5. Storage period

6. Consequences of not providing data

Consent to use Facebook is voluntary and there is no obligation on the part of the website visitor to give consent. The granting or refusal of consent does not lead to any advantages or disadvantages in the context of the business relationship with the website operator, but does mean that not all functions of the website can be fully used, as the Facebook plugin remains inactive.

7. Rights of affected persons

If you have given your consent, but wish to revoke your consent to activate the Facebook plugin for the future, the following link Revoke Facebook plugin will take you to the cookie settings you have made, which you can change at any time. Revocation of the consent does not affect the legality of the processing carried out on the basis of the consent until revocation.

When processing personal data for direct marketing purposes, you have the right to object in accordance with Art. 21 GDPR. You can exercise this right of objection at any time by notifying us.

Violations of applicable data protection law or violations of rights and obligations under data protection law may be asserted before the Austrian Data Protection Authority (DSB), Barichgasse 40-42, 1030 Vienna.

In addition, you are free to seek legal assistance if you believe that there has been a violation of data protection law.

8. Further information

If you are logged in to your Facebook account, you can link the contents of our pages to your Facebook profile by clicking the Facebook button. This allows Facebook to assign your visit to our website to your user account. If you want to prevent this direct assignment, you must log out of Facebook before activating the Facebook plugin.

XV. Instagram plugin

We use on our website the Instagram plugin of Instagram Inc, a company of Facebook Inc.

In connection with the collection and transfer of data by transmission, we are together with Instagram (Facebook) responsible for data processing within the meaning of Art. 26 GDPR. Apart from this, both Instagram (Facebook) and we as independent responsible parties or Instagram (Facebook) act in some areas as contract processors.

Instagram (Facebook) is certified under the Privacy Shield Agreement and thus guarantees compliance with European data protection law. You can find out more about Facebook's certification here.

1. Data processed

If you have given your consent to use the Instagram plugin, we will not process any personal data of the website visitor except for the consent data. We receive on our Instagram account - not via our website - an anonymous evaluation of user statistics, which, however, do not contain any personal data or allow conclusions to be drawn about them.

Instagram (Facebook) processes numerous data, device data and information from partners provided by the user when setting a cookie. Details can be found here.

2. Purpose of data processing

We use Instagram to provide a link to our Instagram profile. In addition, a widget is integrated which allows us to display photos and videos of our Instagram profile on our website. For us, the use of the Instagram plugin allows us to increase the reach of our website and the number of visitors to our site.

Instagram (Facebook) processes your data to provide, personalize and improve its products; to provide measurement, analysis and other business services; to promote protection, integrity and security; to communicate; and to conduct research and innovation for social purposes. Details can be found here.

3. Recipient of personal data

Recipients of personal data are Instagram (Facebook) and its cooperation partners and other recipients. Details can be found here.

4. Legal basis of the data processing

The legal basis for data processing is the consent granted to us in accordance with Art. 6 Para. 1 lit. a GDPR. Details on the legal basis of data processing by Instagram (Facebook) can be found here.

5. Storage period

6. Consequences of not providing data

Consent to use Instagram is voluntary and there is no obligation on the part of the site visitor to give such consent. Granting or refusing consent does not result in any advantages or disadvantages in the context of business relations with the website operator, but does mean that not all functions of the website can be fully used, as the Instagram plugin remains inactive.

7. Rights of affected persons

If you have given your consent, but wish to revoke your consent to activate the Instagram Plugin for the future, the following link Revoke Instagram Plugin will take you to the cookie settings you have made, which you can change at any time. Revocation of consent does not affect the legality of the processing carried out on the basis of the consent until revocation.

When processing personal data for direct marketing purposes, you have the right to object in accordance with Art. 21 GDPR. You can exercise this right of objection at any time by notifying us.

Furthermore, you are free to seek legal assistance if you believe that there has been a violation of data protection law.

8. Further information

If you are logged in to your Instagram account, you can associate your visit to our site with your Instagram (Facebook) account. If you want to prevent this immediate assignment, you must log out of Instagram before activating the Instagram plugin.

XVI Technical and Organizational Safeguards / Changes to Privacy Information

Technical and organizational protective measures are implemented in the company in connection with the processing of personal data, which are continuously evaluated and, if necessary, adjusted to ensure the highest possible level of protection. Please feel free to contact us at any time for further information.

This data protection information can be changed and adapted to new developments at any time. The new version is valid from the time it is made available on the website, by e-mail, letter, fax or personal delivery.

ANNEX I

Definitions

This data protection information uses the terms as defined in the basic data protection regulation (GDPR) itself. In Art. 12, the DPA stipulates that the information to be provided - such as in the context of this data protection information - must be written in "precise, transparent, comprehensible and easily accessible form in clear and simple language". I would therefore like to explain the terminology used. Trusting that the European legislator has formulated the provisions in line with its own specifications - comprehensible, clear and simple - a reference is essentially made to the wording of the law.

1. Personal data

Personal data (hereinafter "pbD") is any information relating to an identified or identifiable natural person (hereinafter "data subject"). An identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an on-line identifier or one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person.

2. Data subject

The data subject is the person who makes their pbD available to the controller for processing purposes. The primary objective of the GDPR is to protect the rights of data subjects.

3. Processing

Processing is any operation or set of operations, performed with or without the aid of automated means, which is performed upon personal data, such as collection, recording, organisation, organisation, filing, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure or destruction.

4. Person responsible

The controller is the natural or legal person, public authority, agency or other body which alone or jointly with others determines the purposes and means of the processing of personal data. Together with the processor, it is the norm addressee of the GDPR and must ensure that the processing of the pbD is carried out in compliance with the law and that the rights of the data subjects are fulfilled.

5. Processor

A Processor is a natural or legal person, public authority, agency or other body that processes pbD on behalf of the controller. As a rule, independent decisions on the means and purposes of processing pbD are not taken. The processor shall act exclusively on behalf of and at the instruction of the Controller. Example: If we record pbD (name, address, etc.) of customers as "responsible party" and e.g. an IT service provider gains access to this data in the course of remote maintenance, the IT service provider is the "processor" with whom a corresponding contract must be concluded in accordance with Art. 28 GDPR.

6. Recipient

The recipient is a natural or legal person, authority, institution or other body to whom pbD is disclosed, whether or not it is a third party. The recipient may be internal to the company (e.g. a department) or an external third party.

7. Third party

Third party means any natural or legal person, public authority, agency or body other than the data subject, the controller, the processor and the persons who, under the direct authority of the controller or the processor, are authorized to process the personal data.

8. Restriction of processing

Restriction of processing is the marking of stored personal data with the aim of limiting their future processing.

9. Profiling

Profiling is any automated processing of personal data consisting of the use of such personal data to evaluate certain personal aspects relating to a natural person, in particular to analyse or predict aspects relating to the performance of work, economic situation, health, personal preferences, interests, reliability, conduct, location or change of location of that natural person.

10. Pseudonymisation

Pseudonymisation is the processing of personal data in such a way that the personal data can no longer be attributed to a specific data subject without the need for additional information, provided that this additional information is kept separately and is subject to technical and organisational measures which ensure that the personal data is not attributed to an identified or identifiable natural person.

11. Consent

Consent shall mean any freely given specific and informed unequivocal expression of the data subject's wishes in relation to a particular case, in the form of a statement or any other unequivocal affirmative act by which the data subject signifies his or her consent to the processing of personal data relating to him or her.

ANNEX II

Rights of data subjects

1. Right to information

Every person concerned by the processing of personal data has the right to obtain at any time from the controller the confirmation of whether personal data relating to him or her are being processed. Furthermore, the data subject has the right to obtain, free of charge, information on personal data stored about him/her and a copy of such data.

2. Right of rectification

Any person concerned by the processing of personal data shall have the right to obtain the rectification without delay of inaccurate personal data relating to him. The data subject shall also have the right to obtain the completion of incomplete personal data, including by means of a supplementary declaration, having regard to the purposes of the processing.

3. Right to erasure (right to be forgotten)

Any person concerned by the processing of personal data shall have the right to obtain from the controller the erasure without delay of personal data relating to him/her, where one of the following reasons applies and unless the processing is still necessary for other reasons:

The personal data have been collected or otherwise processed for purposes for which they are no longer necessary
The data subject withdraws his or her consent on which the processing was based pursuant to Art. 6 para. 1 lit. a GDPR or Art. 9 para. 2 lit. a GDPR, and there is no other legal basis for the processing.
The data subject lodges an objection to the processing pursuant to Article 21 para. 1 FADP, and there are no overriding legitimate reasons for the processing, or the data subject lodges an objection to the processing pursuant to Article 21 para. 2 FADP.
The personal data were processed unlawfully.
The deletion of the personal data is necessary to comply with a legal obligation under Union law or the law of the Member States to which the controller is subject.
The personal data was collected in relation to information society services offered in accordance with Art. 8 Paragraph 1 GDPR.

4. Right to restrict processing

Any person concerned by the processing of personal data shall have the right to obtain from the controller the restriction of the processing if one of the following conditions is met:

The accuracy of the personal data is contested by the data subject, for a period enabling the controller to verify the accuracy of the personal data.
The processing is unlawful, the data subject refuses to have the personal data deleted and instead requests that the use of the personal data be restricted.
The controller no longer needs the personal data for the purposes of the processing, but the data subject needs them in order to assert, exercise or defend legal claims.
The data subject has lodged an objection to the processing pursuant to Art. 21 (1) DPA and it is not yet clear whether the legitimate reasons of the controller outweigh those of the data subject.

5. Right to data transferability

Every data subject shall have the right to obtain, in a structured, standard and machine-readable format, the personal data concerning him/her which have been supplied by the data subject to a controller. He/she also has the right to have this data communicated to another controller without hindrance by the controller to whom the personal data has been made available, provided that the processing is based on the consent pursuant to Art. 6, paragraph 1, letter a of the DPA or Art. 9, paragraph 2, letter a of the DPA or on a contract pursuant to Art. 6, paragraph 1, letter b of the DPA and that the processing is carried out by means of automated procedures, unless the processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller.

Furthermore, when exercising their right to data transfer pursuant to Art. 20 Para. 1 GDPR, the data subject has the right to request that personal data be transferred directly from one controller to another controller, insofar as this is technically feasible and provided that the rights and freedoms of other persons are not affected.

6. Right to object

Every person concerned by the processing of personal data has the right to object at any time, for reasons arising from his or her particular situation, to the processing of personal data concerning him or her carried out pursuant to Article 6 paragraph 1 letters e or f of the DPA. This also applies to profiling based on these provisions. In the event of an objection, personal data must not be processed unless compelling reasons for processing worthy of protection can be demonstrated which outweigh the interests, rights and freedoms of the data subject, or the processing serves to assert, exercise or defend legal claims.

Where personal data are processed for the purpose of direct marketing, the data subject shall have the right to object at any time to the processing of personal data for the purpose of such marketing. This also applies to profiling, insofar as it is related to such direct marketing. If the data subject objects to processing for the purposes of direct marketing, personal data may no longer be processed for those purposes.

In addition, the data subject has the right to object, for reasons arising from his or her particular situation, to the processing of personal data concerning him or her which may be carried out for the purposes of scientific or historical research or for statistical purposes pursuant to Article 89 (1) DPA, unless such processing is necessary for the performance of a task carried out in the public interest.

7. Right not to be exclusively subject to an automated decision, including profiling

Every data subject shall have the right not to be subject to a decision based solely on automated processing, including profiling, which produces legal effects concerning him or her or significantly affects him or her in a similar way, except where the decision (1 ) is necessary for the conclusion or performance of a contract between the data subject and the controller, or (2) is authorised by Union or national legislation to which the controller is subject and that legislation provides for adequate measures to safeguard the rights and freedoms and legitimate interests of the data subject, or (3) is done with the explicit consent of the data subject.

Where the decision is (1) necessary for the conclusion or performance of a contract between the data subject and the controller or (2) is taken with the express consent of the data subject, adequate measures must be taken to safeguard the rights and freedoms and legitimate interests of the data subject, including at least the right to obtain the intervention of the controller, to put forward his point of view and to challenge the decision.

At present, no automated decision making is carried out in accordance with Art. 22 GDPR.

8. Right to withdraw consent under data protection law

Every person affected by the processing of personal data has the right, granted by the European Directive and Regulation Giver, to revoke his or her consent to the processing of personal data at any time.

A given consent can be revoked at any time with effect for the future by e-mail to office@kurzzeitmiete.at, by letter to Kurzzeitmiete.at GmbH, Sonnenweg 4, 5204 Straßwalchen, or in any other way in writing or orally.

The revocation of the consent does not affect the legality of the processing carried out on the basis of the consent until the revocation. With the exercise of your right of revocation, your data will be deleted, unless there is a legal obligation to store the data in accordance with Art. 6 para. 1 lit. c GDPR or a justified interest in accordance with Art. 6 para. 1 lit. f GDPR in the exercise, enforcement or defence of legal claims justifies further storage.

9. Right of appeal

In addition, you are free to seek legal assistance if you believe that a violation of data protection law has occurred.

This data protection information was created by AICHINGER CONSULTING E.U.