2. Data processing, purposes and legal bases

2.1. Contacting us

If you contact us, e.g. by email, telephone or post, we process the personal data you voluntarily provide (e.g. name, email address, telephone number or address and the content of your message to us).

We process the personal data you transmit when contacting us in order to handle your enquiry and to send you the information you have requested. This data processing is therefore necessary for the performance of our (pre-)contractual obligations pursuant to Art 6(1)(b) GDPR and for our legitimate interest in maintaining our business relationship with you pursuant to Art 6(1)(f) GDPR. Any use of tools to support the handling of enquiries and to summarise conversations is likewise carried out on the basis of your and our legitimate interests in efficient and prompt processing pursuant to Art 6(1)(f) GDPR.

2.2. Access data and server log files

We collect and process the following data when you use the website (so-called server log files): requested URL, date and time of access, amount of data transferred, server status codes, processing time, browser and client type including version, your operating system, referrer URL (the previously visited page), IP address, connection data source and destination (network identifier or address, port numbers).

This data is generated automatically by our servers when you use our website and is necessary so that we can provide you with the services you request. We therefore process server log files solely to provide you with our website and related services, to identify you as an authorised user, to distribute web server requests across our server pool and for security reasons (e.g. to investigate misuse or fraud). This data processing is therefore necessary to safeguard our legitimate interests in providing a user-friendly and secure website pursuant to Art 6(1)(f) GDPR.

2.3. Initiation and performance of contracts

We collect and process the personal data (e.g. name, address, telephone number, email address, bank details) that you provide to us, for example in the context of an enquiry or to conclude a contract. Providing your name and email address is mandatory for concluding a contract (mandatory information). All other information is not required for the performance of the contract and is therefore voluntary. If the mandatory information required for the performance of the contract is not provided, no contract will be concluded. Not providing the voluntary information has no influence on the conclusion of the contract.

The data provided is processed for the following purposes:

• Initiation and performance of contracts: we need the data in order to fulfil our obligations towards our contractual partners (Art 6(1)(b) GDPR).
• Compliance with a legal obligation: processing of the data may be necessary to comply with various legal obligations arising, for example, from the Austrian Federal Fiscal Code (BAO) or the Austrian Commercial Code (UGB) (Art 6(1)(c) GDPR).
• Consent: if voluntary consent to the processing of data has also been given, in particular in connection with direct marketing measures, processing takes place in accordance with the purposes set out in the declaration of consent and to the extent agreed therein (Art 6(1)(a) GDPR).

3. Cookies

3.1. General

Our website uses so-called cookies. These are small text files that are stored on your device by your browser. Some cookies require your voluntary consent before they can be used on your device, while others are activated without your consent because they are technically necessary for the provision of our services ("strictly necessary cookies").

We use cookies to make the website and our offer user-friendly and tailored to your needs. Some cookies remain stored on your device until you delete them. They enable us to recognise your browser on your next visit.

If you do not want this, you can set up your browser so that it informs you about the setting of cookies and you only allow this in individual cases. However, if cookies are deactivated, the functionality of our website may be limited.

Specific details about which cookies are activated, for which purposes and on which legal basis can be found in the cookie banner. This is displayed to you on your first visit to our website. In addition, at the bottom of our websites you will find a link, button or icon that you can use to change your preferences at any time (depending on the system used, labelled Cookie Settings, Cookie Policy or an icon with a cookie symbol, etc.)  Here you will also find an up-to-date list of cookie providers by purpose. Some of these are located in third countries without an adequate level of data protection, such as the USA. If you give your voluntary consent for purposes that involve a transfer to recipients in third countries, your consent pursuant to Art 49(1)(a) GDPR also covers this transfer. There is a risk that your data transferred in this way may be subject to access by authorities in these third countries for control and surveillance purposes, and that no effective legal remedies are available against this.

3.2. Data processed

Depending on the type of cookie, the following information about you may be collected and processed: the user's IP address, log files, domain, browser type and language, pages accessed, date/time of access to the website, search terms, visitor activities and actions on the website, browser history (on our domain), internet service provider, referring/exit pages, platform type, geolocation, usage habits and characteristics of website users, the type of advertising viewed, and information about the user's device, such as device type, device model, device operating system, operating system version and data connection type, amount of data transferred, etc.

3.3. Strictly necessary cookies

In the case of strictly necessary cookies, data processing is required for data security measures, to prevent misuse and to optimise the website, and is therefore based on our legitimate interests pursuant to Art 6(1)(f) GDPR in conjunction with § 165(3) TKG (Austrian Telecommunications Act).

These cookies are necessary for the website to function and cannot be deactivated in your systems. As a rule, these cookies are only set in response to actions you take that amount to a request for services, such as setting your privacy preferences, logging in or filling in forms. You can set your browser to block these cookies or to notify you about them. However, some areas of the website will then not work.

3.4. Cookies requiring consent

We use all other cookies on our website exclusively on the basis of your prior, explicit and voluntary consent pursuant to Art 6(1)(a) GDPR in conjunction with § 165(3) TKG via the cookie banner. You can give your voluntary consent generally at the beginning of your use of the website, depending on the consent solution used, by clicking the button "Accept all", "accept", "save selection", "allow all", etc., or you can select or deselect each individual type separately by clicking the button "Customize", "cookie settings", etc. If you do not select any cookies and click "Save my preferences", "save settings", "confirm my selection", etc., no cookies requiring consent will be loaded.

You can change your settings at any time via a link, button or icon at the bottom of our websites (depending on the system used, labelled Cookie Settings, Cookie Policy or an icon with a cookie symbol, etc.).

We use these cookies for the following purposes:

• to gain valuable insights into users' needs, with the aim of improving the high quality of the website and its offer and making it more user-friendly;
• to measure traffic and general usage patterns in order to find and fix errors more quickly and to manage server capacity so that sufficient data volume is available at peak times;
• to inform advertisers about the usage habits and characteristics of website users;
• for market research purposes.

The cookies used by the controller serve to make the website more user-friendly, effective and secure. The purpose of these cookies is to adapt the controller's offer as closely as possible to the user's wishes and to make browsing as convenient and attractive as possible. Users benefit from the display of information specifically tailored to their interests and more personalised advertising, faster access to information and, for example, being recognised when they visit the website again.

You can withdraw your consent at any time without giving reasons, with effect for the future:

• On the one hand, you can reject or delete accepted cookies using the appropriate browser settings (for general information see e.g. here: https://media.ztat.net/media/agb/2012-07-27_Cookies_Browser.pdf). The browser can also be set so that cookies are only accepted if this has been expressly agreed to. If users do not wish to accept cookies from partner companies, they can do so by selecting the setting "Block third-party cookies" in their browser.
• Furthermore, you can change your settings at any time via a link, button or icon at the bottom of our websites and thus also withdraw your consent for all or individual purposes or providers (depending on the system used, labelled Cookie Settings, Cookie Policy or an icon with a cookie symbol, etc.).

In general, we distinguish between the following types of cookies:

3.4.1. Performance cookies

These cookies allow us to count visits and traffic sources so that we can measure and improve the performance of our website. They help us answer questions about which pages are most popular, which are used least and how visitors move around the website.

3.4.2. Functional cookies

These cookies enable the website to provide enhanced functionality and personalisation. They may be set by us or by third-party providers whose services we use on our pages. If you do not allow these cookies, some or all of these services may not work properly. The complete list of third-party providers can be found in the cookie banner.

3.4.3.   Cookies for marketing purposes – analytics cookies

These cookies may be set via our website by our advertising partners. This allows them to see information about the effectiveness of their advertising, such as how many users have seen the advertisement. These cookies can also be used to track a user's visits to all pages on which the advertising is displayed. These companies can therefore use them to build a profile of your interests and show you relevant ads on our website and other websites. They do not store personal data directly, but are based on a unique identification of your browser and internet device. If you do not allow these cookies, you will experience advertising that is less tailored to your interests.

4. Disclosure of personal data

The controller uses service providers to fulfil our contractual obligations and for other data processing. To the extent necessary, we therefore provide personal data to the following service providers (processors):

• IT service providers and/or providers of data hosting or data processing;
• software providers for the provision of services;
• providers of marketing tools, communication service providers, messenger service providers;
• providers of web analytics tools and tools for summarising conversations.

We have concluded a data processing agreement with each of our processors. They therefore process the data on our behalf and on the basis of our documented instructions.

In addition, we transfer your personal data to the following recipients (controllers) to the extent necessary:

• external third parties and authorities on the basis of our legitimate interests in complying with our legal obligations or official orders or in asserting, exercising or defending the controller's legal claims (e.g. auditors, legal representatives where required, debt collection agencies, KSV);
• any third parties involved in providing services to you in order to fulfil our contractual obligations towards you (e.g. payment service providers, postal service providers);
• companies that support the controller in the handling of other services, e.g. web agencies and domain registrars;
• if you have opted for the subsidy option, external subsidy advisors on the basis of your consent to be contacted for subsidy advice or processing.

Personal data is only transferred to third countries outside the EU or EEA if there is an adequacy decision by the European Commission for these countries, if appropriate safeguards for the protection of personal data have been provided by concluding a legally binding document, or if you have explicitly given your voluntary consent in individual cases within the meaning of Art 49(1)(a) GDPR.

If payment options are integrated via payment providers or comparable third parties, the data transfer strictly necessary for this takes place in the context of the performance of the contract (Art 6(1)(b) GDPR)

5. Storage period and data deletion

We only store your personal data for as long as is necessary for the purposes for which it is processed. In addition, we may be obliged to retain your data for longer due to statutory retention periods.

Specifically, we store your data in connection with contacting us for a period of 3 years in order to be able to respond to any follow-up questions.

We store data in connection with contractual relationships until the end of your customer relationship with us or beyond that until the expiry of the corresponding statutory retention obligations (usually for a period of seven years).

If you withdraw your voluntary consent, we will delete the stored personal data processed on this legal basis (unless there are statutory retention obligations).

Data collected for marketing purposes is stored for 5 years.

The website's server log files are stored for a maximum of 31 days and then deleted.

In addition, where necessary, we also store your personal data beyond the periods mentioned for as long as legal claims arising from the relationship between you and us can be asserted, or until a specific incident or legal dispute has been finally resolved. This longer retention serves to safeguard our legitimate interests in asserting, investigating and defending legal claims.

6. Your rights

If your personal data is processed, you have the following rights vis-à-vis the controller:

You have the right to information about the personal data we process about you. You also have the right to have inaccurate data corrected and the right to have your data deleted. You can withdraw any consent you have given to the processing of personal data at any time with effect for the future. You also have the right to restrict the processing of your data and the right to receive the personal data you have provided in a structured, commonly used and machine-readable format.

You also have the right to object on grounds relating to your particular situation, insofar as we process your data on the basis of our legitimate interests. Such an objection may in particular be made against the processing of your data for direct marketing purposes.

You also have the right to lodge a complaint with a data protection supervisory authority. The data protection supervisory authority responsible for the controller is: Austrian Data Protection Authority (Österreichische Datenschutzbehörde), Barichgasse 40-42, 1030 Vienna.

However, we ask that you contact us first with any complaints or questions. You can reach us using the contact details given in section 1.