Data protection
Information Requirements General Data Protection Regulation (GDPR)
Preamble
The protection of your privacy and your data is very important to us and is always taken into account in all business transactions.
· the name and contact details of the controller
· all purposes for which your data is processed
· the legal basis on which the processing activities are based, including our legitimate interest, if applicable
· all recipients of your data
· any transfer of your data to a third country and the legal basis for this
· the storage period of your data or the criteria for determining the period
· the categories of your data that are processed
· the origin of your data
· the rights of the data subjects
The data controller is
VEMO GmbH, Bachleiten 4, A-4680 Haag am Hausruck, Email: datenschutz@vemo.at.
No data protection officer has been appointed as this is not legally required.
Your Rights
You have the following rights with regard to your personal data concerning you:
· Right of access
· Right to rectification or erasure
· Right to restriction of processing
· Right to object to processing
· Right to data portability
· Right to withdraw your consent
You also have the right to lodge a complaint with a data protection supervisory authority about our processing of your personal data.
For this and other questions on the subject of personal data, you can contact us at any time.
Right of access
You have the right to obtain free information from us at any time about the personal data stored about you and a copy of this information, including about
· the purposes of processing
· the categories of personal data that are processed
· the recipients or categories of recipients to whom the personal data has been or will be disclosed, in particular recipients in third countries or international organizations
· where possible, the envisaged period for which the personal data will be stored, or, if not possible, the criteria used to determine that period
· the existence of the right to request from us rectification or erasure of personal data or restriction of processing concerning the data subject or to object to such processing
· the existence of the right to lodge a complaint with a supervisory authority
· where the personal data are not collected from the data subject, any available information as to their source
· the existence of automated decision-making including profiling according to Art 22 para 1 and 4 GDPR and – at least in these cases – meaningful information about the logic involved as well as the scope and the intended effects of such processing for the data subject.
Furthermore, you have the right to receive information on whether personal data has been transferred to a third country or to an international organisation. If this is the case, you also have the right to obtain information about the appropriate safeguards relating to the transfer.
Right to rectification
You have the right to obtain the immediate rectification of inaccurate personal data concerning you.
Furthermore, taking into account the purposes of the processing, you have the right to have incomplete personal data completed – also by means of a supplementary declaration.
Right to erasure
You have the right to obtain from us the immediate erasure of personal data concerning you, where one of the following grounds applies and insofar as the processing is not necessary:
· The personal data are no longer necessary in relation to the purposes for which they were collected or otherwise processed.
· You withdraw your consent on which the processing is based according to Art 6 para 1 lit a GDPR or Art 9 para 2 lit a GDPR, and there is no other legal ground for the processing.
· You object to the processing pursuant to Art 21 para 1 GDPR, and there are no overriding legitimate grounds for the processing, or you object to the processing pursuant to Art 21 para 2 GDPR.
· The personal data have been unlawfully processed.
· The erasure of the personal data is necessary for compliance with a legal obligation in Union or Member State law to which the controller is subject.
· The personal data have been collected in relation to the offer of information society services referred to in Art 8 para 1 GDPR.
Right to be forgotten
If the personal data have been made public by us and our company as controller is obliged to erase the personal data pursuant to Art 17 para 1 GDPR, we shall take reasonable steps, including technical measures, taking into account available technology and the cost of implementation, to inform other controllers who are processing the published personal data that you have requested the erasure by such other controllers of any links to, or copy or replication of, those personal data, insofar as processing is not required.
Right to restriction of processing
You have the right to obtain from us restriction of processing where one of the following applies:
· the internet service provider of the accessing system
· other similar data and information that serve to avert danger in the event of attacks on our information technology systems.
When using this general data and information, we do not draw any conclusions about you.
This information is required to
· deliver the content of our website correctly
· optimise the content of our website and its advertising
· ensure the long-term functionality of our information technology systems and the technology of our website
· provide law enforcement authorities with the information necessary for prosecution in the event of a cyber attack.
We evaluate these anonymously collected data and information statistically and also with the aim of increasing data protection and data security in our company, to ultimately ensure an optimal level of protection for you. In any case, we are permitted to process this data due to our legitimate interest pursuant to Art 6 para 1 lit f GDPR.
The logs are stored separately from all personal data provided by you and are also deleted after a maximum of 90 days.
Cookies
Information on the use of cookies and clarification of your corresponding choices and rights can be found in our cookie banner.
You can currently send us an email, contact us by phone or in person. Please note that unencrypted emails sent over the internet are not sufficiently protected from unauthorised access by third parties.
Orders
If you would like to order from our webshop, it is necessary for the conclusion of the contract that you provide your personal data listed below, which we require for processing your order. To prevent unauthorised third-party access to your personal data, especially financial data, the ordering process is encrypted using SSL technology.
With your consent, you can subscribe to our newsletter, with which we inform you about our current interesting offers. This means that we will contact you directly and personally via email and inform you if, based on the data you provide, we assume that information about our products, services and events and those of our partner companies are particularly relevant and interesting for you.
You can generally only receive our company's newsletter if (1) you have a valid email address and (2) you have registered for newsletter delivery.
A confirmation email will be sent via the double opt-in procedure to the email address you initially provided for the newsletter distribution list, in which we ask you to confirm that you wish to receive the newsletter.
This confirmation email serves to verify that you, as the owner of the email address, have authorised receipt of the newsletter.
The purpose of the procedure is to be able to prove your registration and, if necessary, to clarify any possible misuse of your personal data.
Why do we process your data?
If you contact us, for example, just to receive information from us, we process your data for this purpose. If you contact us, for example, to conclude a contract, we process your data for this purpose.
Order, including customer service
If you provide your order data on our website, by telephone or by email, the data you provide, including your personal data, will be processed by us and the recipients mentioned below within the framework of our business relationship with you for the (pre-)contractual processing of your order and to manage it, as well as to provide you with customer service.
If you wish to order from our webshop, it is necessary for the conclusion of the contract that you provide your personal data, which we need for the processing of your order. We process the data you provide only for the purpose of processing your order.
This data is necessary for the performance of the contract or for the implementation of pre-contractual measures. Without this data, we cannot conclude the contract with you.
We regularly inform our customers and business partners about company offers by means of a newsletter.
The data collected as part of your newsletter registration will be used exclusively for sending our newsletter.
Furthermore, newsletter subscribers may be informed by e-mail if this is necessary for the operation of the newsletter service or a related registration, as might be the case for changes to the newsletter offering or changes in technical conditions.
Marketing (general)
For business initiation and intensification of the business relationship with existing and potential customers.
Why are we allowed to process your data?
If you contact us, for example, just to receive information from us, we may process your data based on your consent pursuant to Art. 6 (1) (a) GDPR or Art. 6 (1) (f) GDPR. If you contact us, for example, to conclude a contract, we may process your data based on Art. 6 (1) (b) GDPR and, if applicable, store it based on Art. 6 (1) (c) GDPR.
Order
The processing of your data, including the personal data provided by you, is carried out by us and the recipients listed below on the legal basis of Art. 6 (1) (1) (b), in order to identify you as a customer, to process the purchase contract appropriately, and for correspondence with you. The data processing takes place at your request and is necessary for the appropriate processing of your order for the stated purposes.
Newsletter
The legal basis is your consent pursuant to Art. 6 (1) (a) GDPR. You have the right to withdraw your consent at any time. Further details can be found under your rights above.
Marketing (general)
The legal basis is our legitimate interest pursuant to Art. 6 (1) (1) (f) GDPR. The legitimate interest
· The accuracy of the personal data is contested by you, for a period enabling us to verify the accuracy of the personal data.
· The processing is unlawful and you oppose the erasure of the personal data and request instead the restriction of their use.
· We no longer need the personal data for the purposes of the processing, but they are required by you for the establishment, exercise or defence of legal claims.
· You have objected to processing pursuant to Article 21(1) GDPR pending the verification whether our legitimate grounds override yours.
Right to data portability
You have the right to receive the personal data concerning you, which we have provided, in a structured, commonly used and machine-readable format.
You also have the right to transmit this data to another controller without hindrance from us, where the processing is based on consent pursuant to Article 6(1)(a) GDPR or Article 9(2)(a) GDPR or on a contract pursuant to Article 6(1)(b) GDPR and the processing is carried out by automated means, provided that the processing is not necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in us.
Furthermore, when exercising your right to data portability, you have the right to have the personal data transmitted directly from us to another controller, where technically feasible and provided that this does not adversely affect the rights and freedoms of others.
Right to object
You have the right to object, on grounds relating to your particular situation, at any time to processing of personal data concerning you which is based on Article 6(1)(e) or (f) GDPR. This also applies to profiling based on these provisions.
We shall no longer process the personal data in the event of an objection, unless we can demonstrate compelling legitimate grounds for the processing which override your interests, rights and freedoms or for the establishment, exercise or defence of legal claims.
Where personal data are processed for direct marketing purposes, you have the right to object at any time to processing of personal data concerning you for such marketing. This applies to profiling to the extent that it is related to such direct marketing.
If you object to our processing for direct marketing purposes, we will no longer process your personal data for these purposes.
In addition, you have the right to object, on grounds relating to your particular situation, to the processing of personal data concerning you carried out by us for scientific or historical research purposes or for statistical purposes pursuant to Art. 89 (1) GDPR, unless such processing is necessary for the performance of a task carried out for reasons of public interest.
Automated decision-making in individual cases including profiling
You have the right not to be subject to a decision based solely on automated processing - including profiling - which produces legal effects concerning you or similarly significantly affects you, unless the decision (1) is necessary for entering into, or performance of, a contract between you and us, or (2) is authorised by Union or Member State law to which we are subject and which also lays down suitable measures to safeguard your rights and freedoms and legitimate interests, or (3) is based on your explicit consent.
Right to withdraw consent under data protection law
You have the right to withdraw your consent to the processing of personal data at any time. Your withdrawal does not affect the lawfulness of processing carried out before the withdrawal.
Minors
Our website and our services are not intended for use by minors, and we do not intend to collect any data from minors. If a parent or guardian of a minor believes that their child may have provided us with personal data, please contact us using the contact details provided below, and we will delete such personal data subject to applicable law and this policy.
Data security
We use appropriate technical and organisational measures and security precautions (TOMs) designed to prevent unauthorised access, unlawful processing, and unauthorised or accidental loss of your data.
This includes, for example, the encryption of your communication with us via this website based on the Secure Socket Layer (SSL) encryption protocol.
You can check the quality of our encryption here: https://www.ssllabs.com/ssltest
It is important for us to point out that data transmission over the Internet can have security vulnerabilities, as complete protection against access by unauthorised third parties is not possible.
Web Host
The server on which this website is hosted is located in Austria and is operated by iT works4you GmbH, with whom we have concluded a data processing agreement. For more details, please refer to:
https://itworks4you.at/hp/index.php/cloud
https://itworks4you.at/hp/index.php/dsvgo
Server-Log-Files
Our website records a series of general data and information with each of your accesses via an automated system.
These general data and information are stored in the log files of our server by iT works4you GmbH in Austria.
The following may be collected:
· the browser types and versions used
· the operating system used by the accessing system
· the website from which an accessing system reaches our website (so-called referrer)
· the sub-websites accessed on our website via an accessing system
· the date and time of an access to the website
· an Internet Protocol address (IP address)
· The accuracy of the personal data is contested by you, for a period enabling us to verify the accuracy of the personal data.
· The processing is unlawful and you oppose the erasure of the personal data and request the restriction of their use instead.
· We no longer need the personal data for the purposes of the processing, but you require them for the establishment, exercise or defence of legal claims.
· You have objected to processing pursuant to Art. 21 (1) GDPR and it has not yet been determined whether our legitimate grounds override yours.
Right to data portability
You have the right to receive your personal data, which we have provided, in a structured, commonly used and machine-readable format.
You also have the right to transmit these data to another controller without hindrance from us, provided that the processing is based on consent pursuant to Art. 6 (1) (a) GDPR or Art. 9 (2) (a) GDPR or on a contract pursuant to Art. 6 (1) (b) GDPR and the processing is carried out by automated means, unless the processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in us.
Furthermore, when exercising your right to data portability, you have the right to have personal data transmitted directly from us to another controller, where technically feasible and provided that this does not adversely affect the rights and freedoms of other persons.
Right to object
You have the right to object, on grounds relating to your particular situation, at any time to the processing of personal data concerning you which is based on Art. 6 (1) (e) or (f) GDPR. This also applies to profiling based on these provisions.
In the event of an objection, we will no longer process the personal data unless we can demonstrate compelling legitimate grounds for the processing which override your interests, rights and freedoms, or for the establishment, exercise or defence of legal claims.
If we process personal data for direct marketing purposes, you have the right to object at any time to the processing of your personal data for the purpose of such marketing. This also applies to profiling, to the extent that it is related to such direct marketing.
If you object to our processing for direct marketing purposes, we will no longer process your personal data for these purposes.
Furthermore, you have the right to object, on grounds relating to your particular situation, to the processing of personal data carried out by us for scientific or historical research purposes or for statistical purposes pursuant to Article 89(1) GDPR, unless such processing is necessary for the performance of a task carried out for reasons of public interest.
Automated decision-making in individual cases including profiling
You have the right not to be subject to a decision based solely on automated processing – including profiling – which produces legal effects concerning you or similarly significantly affects you, provided that the decision (1) is not necessary for entering into, or performance of, a contract between you and us, or (2) is authorised by Union or Member State law to which we are subject and which also lays down suitable measures to safeguard your rights and freedoms and legitimate interests, or (3) is based on your explicit consent.
Right to withdraw data protection consent
You have the right to withdraw consent to the processing of personal data at any time. However, your withdrawal does not affect the lawfulness of data processing carried out until the withdrawal.
Minors
Our website and our services are not intended for use by minors, and we do not wish to collect data from minors. If a parent or guardian of a minor believes that their child may have provided us with personal data, please write to us using the contact options provided below, and we will then delete this personal data subject to applicable law and this policy.
Data security
We use appropriate technical and organisational measures and security precautions (TOMs) designed to prevent unauthorised access, unlawful processing, and unauthorised or accidental loss of your data.
This includes, for example, the encryption of your communication with us via this website based on the Secure Socket Layer (SSL) encryption protocol.
You can check the quality of our encryption here: https://www.ssllabs.com/ssltest
It is important to us to point out that data transmission over the Internet may have security vulnerabilities, as complete protection against access by unauthorised third parties is not possible.
Web Host
The server on which this website is hosted is located in Austria and is operated by iT works4you GmbH, with whom we have concluded a data processing agreement. For more details, please refer to:
https://itworks4you.at/hp/index.php/cloud
https://itworks4you.at/hp/index.php/dsvgo
Server log files
Our website collects a series of general data and information with each visit through an automated system.
These general data and information are stored in the log files of our server by iT works4you GmbH in Austria.
The following may be recorded:
· the browser types and versions used
· the operating system used by the accessing system
· the website from which an accessing system reaches our website (so-called referrers)
· the sub-websites that are accessed via an accessing system on our website
· the date and time of access to the website
· an Internet Protocol address (IP address)
is our interest in initiating business and intensifying business relationships with existing and potential customers.
What data do we process?
In general, we explicitly ask you not to disclose any data to us that is likely to have little or no relevance for your intended purpose; this applies in particular to special categories of personal ("sensitive") data. The provision of information is entirely voluntary on your part.
Information
If you contact us merely to receive information from us, we process the data you provide.
Website Order
Depending on what you voluntarily provide to us, your data processed by us may include:
· Your contact details (name, address, telephone number, email address, etc.)
· Content of your order
· Special categories of personal data voluntarily and unsolicitedly provided by you to us
The provision of information is entirely voluntary on your part. Nevertheless, we explicitly ask you not to disclose any data that is likely to have little or no relevance for your intended purpose; this applies in particular to special categories of personal ("sensitive") data.
The personal data transmitted to us when ordering the newsletter can be found in the input mask used for this purpose.
The only mandatory information for sending the newsletter is your email address.
The provision of any further, separately marked data is voluntary and is used to address you personally.
Marketing (general)
Depending on what you have voluntarily provided to us, the data processed by us may include the following:
· Your contact data (name, address, phone number, email address, etc.)
To whom will your data be disclosed?
Your data may be disclosed in whole or in part, but always only to the extent and as far as necessary, to the following controllers:
· Banks (payment transactions - Austria)
· Tax advisors (accounting - Austria)
· Collection agencies (debt collection - Austria)
· Legal representatives (legal enforcement - Austria)
· Courts (legal enforcement - Austria)
· Administrative authorities (Austria)
In addition, your data may be disclosed to the following recipients as (sub-)processors; we have concluded a data processing agreement with all of them and verified the appropriate technical and organizational measures (TOMs):
· Online Media Solution (IT service provider, Austria)
· iT works4you GmbH (web hosting, webmail, Austria)
· Klaviyo, Inc (newsletter dispatch - USA - Privacy Framework)
How long do we process your data?
Your data will be stored in a form that allows your identification only for as long as necessary for the purpose for which it is processed.
Information
By providing us with your data via email, contacting us by phone or in person, you expressly agree that your data, including the personal data you provide and any special categories of personal data provided unsolicited and voluntarily, will be processed by us and the recipients listed above for the duration of the processing of the information in question.
If you contact us merely to receive information from us, your data will therefore either be deleted immediately or after a reasonable period corresponding to the content, depending on the content of the communication.
If you revoke your declaration of consent, we will delete (or have deleted) all your data - including accumulated data - from all databases.
Orders
After cancelling the purchasing process, the data stored with us will be deleted.
Due to company and tax law requirements, we are obliged to store your address, payment and order data for a period of 7 years. If you contact us to conclude a contract, the data will be deleted at the end of the 7th year after booking the last receipt (Section 132 BAO). In the event of a contract conclusion, all data from the contractual relationship will therefore be stored until the expiry of this period.
Legal/statutory retention obligations or contractual obligations, e.g., towards customers arising from warranty or compensation for damages, or towards contractual partners, are another basis for continuing to store your data. (Article 6 Para 1 lit c GDPR; Article 17 Para 3 lit e GDPR).
The data categories name, address, purchased goods and date of purchase are stored beyond that until the expiry of product liability (10 years).
Your data provided for the newsletter will only be stored by us for as long as you wish to receive the newsletter and, beyond that, only for as long as we need data to enforce or defend legal claims.
You can revoke your consent to the newsletter at any time with effect for the future by clicking on the link provided in each newsletter e-mail, in writing by e-mail or letter to our contact address. The revocation of consent does not affect the legality of the processing of your data carried out up to the revocation based on your consent.
After revocation of consent, the collected and stored personal data of the participant will be deleted immediately.
Marketing (general)
Marketing data is stored for up to 3 years after the last contact.