Data Protection
Privacy Policy
Table of Contents
• Introduction and Overview
• Scope
• Legal Bases
• Contact Information of the Data Controller
• Data Retention
• Rights under the General Data Protection Regulation
• Data Processing Security
• Communication
• Cookies
• Customer Data
• Registration
• Web Hosting Introduction
• Payment Service Providers Introduction
• Explanation of Terms Used
• Conclusion
Introduction and Overview
We have drafted this privacy policy (version 28.08.2023-322572080) to explain to you, in accordance with the provisions of the General Data Protection Regulation (EU) 2016/679 and applicable national laws, what personal data (hereinafter referred to as "data") we, as data controllers, and our commissioned data processors (e.g., providers), currently process, will process in the future, and what lawful options you have. The terms used are to be understood in a gender-neutral manner.
In summary, we provide comprehensive information about the data we process about you. Privacy policies typically sound very technical and use legal terminology. However, this privacy policy is designed to describe the most important things as simply and transparently as possible. To enhance transparency, technical terms are explained in a reader-friendly manner, links to further information are provided, and graphics are used. We aim to inform you in clear and simple language that we only process personal data within the scope of our business activities when there is a corresponding legal basis. This is not possible if we provide concise, unclear, and legally technical explanations, as is often the standard on the internet when it comes to data protection. We hope you find the following explanations interesting and informative, and perhaps you will come across some information you were not aware of.
If you still have questions, we kindly ask you to contact the responsible entity mentioned below or follow the provided links and explore further information on third-party websites. Our contact details can, of course, also be found in the imprint.
Scope
This privacy policy applies to all personal data processed by us within the company and to all personal data processed by companies commissioned by us (data processors). By personal data, we mean information as defined in Article 4(1) of the GDPR, such as a person's name, email address, and postal address. The processing of personal data enables us to offer and bill for our services and products, whether online or offline. The scope of this privacy policy includes:
• All online presences (websites, online shops) that we operate
• Social media presences and email communication
• Mobile apps for smartphones and other devices
In short, this privacy policy applies to all areas in which personal data is processed within the company through the mentioned channels. If we enter into legal relationships with you outside of these channels, we will inform you separately.
Legal Bases
In the following privacy policy, we provide you with transparent information about the legal principles and regulations, i.e., the legal bases of the General Data Protection Regulation that allow us to process personal data.
Regarding EU law, we refer to REGULATION (EU) 2016/679 OF THE EUROPEAN PARLIAMENT AND OF THE COUNCIL of April 27, 2016. You can, of course, read this EU General Data Protection Regulation online at EUR-Lex, the access point to EU law, at https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX%3A32016R0679.
We only process your data if at least one of the following conditions applies:
1. Consent (Article 6(1)(a) of the GDPR): You have given us your consent to process data for a specific purpose. An example would be storing the data you enter into a contact form.
2. Contract (Article 6(1)(b) of the GDPR): To fulfill a contract or pre-contractual obligations with you, we process your data. For example, if we enter into a purchase contract with you, we need personal information in advance.
3. Legal obligation (Article 6(1)(c) of the GDPR): If we are subject to a legal obligation, we process your data. For example, we are legally obligated to retain invoices for accounting purposes, which usually contain personal data.
4. Legitimate interests (Article 6(1)(f) of the GDPR): In cases of legitimate interests that do not infringe upon your fundamental rights, we reserve the right to process personal data. For example, we may need to process certain data to operate our website securely and economically efficiently. This processing is therefore a legitimate interest.
Other conditions such as the performance of tasks carried out in the public interest or in the exercise of official authority and the protection of vital interests do not typically apply to us. If such a legal basis were to be relevant, it would be indicated at the respective point.
In addition to the EU regulation, national laws also apply:
• In Austria, this is the Federal Act on the Protection of Natural Persons with regard to the Processing of Personal Data (Data Protection Act), abbreviated as DSG.
• In Germany, the Federal Data Protection Act (Bundesdatenschutzgesetz), abbreviated as BDSG, applies.
If further regional or national laws come into play, we will inform you in the following sections.
Contact Information of the Data Controller
If you have any questions about data protection or the processing of personal data, you can find the contact details of the responsible person or entity below:
Simone Strauss
Strauss & Mayer GbR
Hauptstraße 38, 55270 Bubenheim, Germany
Email: info@novawood.de
Phone: 06130/919680
Imprint: https://www.novawood.de/impressum/
Data Retention
We consider it a general criterion to store personal data only for as long as it is absolutely necessary for the provision of our services and products. This means that we delete personal data as soon as the purpose of data processing is no longer present. In some cases, we are legally obligated to retain certain data even after the original purpose has ceased, for example, for accounting purposes.
If you wish to have your data deleted or withdraw your consent for data processing, the data will be deleted as soon as possible, unless there is an obligation to store it.
We will inform you about the specific duration of data processing below, if we have further information about it.
Rights under the General Data Protection Regulation
In accordance with Articles 13 and 14 of the GDPR, we inform you about the following rights that you have, ensuring fair and transparent data processing:
• According to Article 15 of the GDPR, you have the right to know whether we process data about you. If this is the case, you have the right to receive a copy of the data and obtain the following information:
o The purpose of the processing we carry out.
o The categories, i.e., the types of data being processed.
o Who receives this data, and if the data is transferred to third countries, how the security of the data is guaranteed.
o How long the data will be stored.
o The existence of the right to rectify, delete, or restrict processing and the right to object to processing.
o That you have the right to lodge a complaint with a supervisory authority (links to these authorities can be found below).
o The origin of the data, if it was not collected from you.
o Whether profiling is being carried out, i.e., whether data is automatically evaluated to create a personal profile of you.
• According to Article 16 of the GDPR, you have the right to rectify data, which means we must correct data if you find any errors.
• According to Article 17 of the GDPR, you have the right to erasure ("right to be forgotten"), meaning you can request the deletion of your data.
• According to Article 18 of the GDPR, you have the right to restrict processing, meaning we can only store the data but not use it further.
• According to Article 20 of the GDPR, you have the right to data portability, meaning we will provide you with your data in a commonly used format upon request.
• According to Article 21 of the GDPR, you have the right to object, which, when enforced, leads to a change in processing.
o If the processing of your data is based on Article 6(1)(e) (public interest, exercise of public authority) or Article 6(1)(f) (legitimate interests), you can object to the processing. We will then promptly review whether we can legally comply with this objection.
o If data is used for direct marketing, you can object to this type of data processing at any time. Afterward, we may no longer use your data for direct marketing.
o If data is used for profiling, you can object to this type of data processing at any time. Afterward, we may no longer use your data for profiling.
• According to Article 22 of the GDPR, you may, under certain circumstances, have the right not to be subject to a decision based solely on automated processing (e.g., profiling).
• According to Article 77 of the GDPR, you have the right to lodge a complaint. This means you can complain to the data protection authority at any time if you believe that the processing of personal data is in violation of the GDPR.
In short, you have rights – do not hesitate to contact the responsible entity listed above!
If you believe that the processing of your data is in violation of data protection law or your data protection rights have been violated in any other way, you can complain to the supervisory authority. In Austria, this is the Data Protection Authority, whose website you can find at https://www.dsb.gv.at/. In Germany, there is a data protection officer for each federal state. For more information, you can contact the Federal Commissioner for Data Protection and Freedom of Information (BfDI). For our company, the following local data protection authority is responsible:
Rhineland-Palatinate Data Protection Authority
State Commissioner for Data Protection: Prof. Dr. Dieter Kugelmann
Address: Hintere Bleiche 34, 55116 Mainz
Phone: 061 31/208 22 26
Email: poststelle@datenschutz.rlp.de
Website: https://www.datenschutz.rlp.de/en/home/
Data Processing Security
To protect personal data, we have implemented both technical and organizational measures. Where possible, we encrypt or pseudonymize personal data. This makes it as difficult as possible for third parties to deduce personal information from our data.
Article 25 of the GDPR refers to "Data Protection by Design and by Default," emphasizing the importance of considering security in both software (e.g., forms) and hardware (e.g., server room access). Below, we will discuss specific measures if necessary.
TLS Encryption with HTTPS
TLS, encryption, and HTTPS may sound highly technical, and they are. We use HTTPS (Hypertext Transfer Protocol Secure) to transmit data securely over the internet.
This means that the entire transmission of data from your browser to our web server is secure and cannot be intercepted by anyone.
By implementing TLS (Transport Layer Security), an encryption protocol for secure data transmission over the internet, we ensure the protection of confidential data.
You can recognize the use of this data transmission security by the small padlock symbol in the top left corner of your browser, located to the left of the web address (e.g., example.com), and the use of the "https" scheme in our web address instead of "http."
If you would like to learn more about encryption, we recommend searching for "Hypertext Transfer Protocol Secure wiki" on Google to find useful links to further information.
Communication
Communication Summary
👥 Data Subjects: All those who communicate with us via telephone, email, or online forms.
📓 Processed Data: e.g., telephone number, name, email address, entered form data. More details can be found for each specific contact method.
🤝 Purpose: Processing communication with customers, business partners, etc.
📅 Data Retention: Duration of the business case and legal requirements.
⚖️ Legal Bases: Art. 6(1)(a) GDPR (Consent), Art. 6(1)(b) GDPR (Contract), Art. 6(1)(f) GDPR (Legitimate Interests)
When you contact us and communicate via telephone, email, or online forms, personal data may be processed.
The data is processed for the purpose of handling and processing your inquiry and related business transactions. The data is stored for as long as necessary or as required by law.
Affected Individuals
All individuals who seek contact with us through the communication channels we provide are affected by the processes described below.
Telephone
When you call us, call data is pseudonymized and stored on the respective device and at the telecommunications provider used. Additionally, data such as name and phone number may be sent by email and stored for responding to the inquiry. Data is deleted once the business case is concluded and legal requirements allow it.
Email
When you communicate with us via email, data may be stored on the respective device (computer, laptop, smartphone, etc.) and on the email server. Data is deleted once the business case is concluded and legal requirements allow it.
Online Forms
When you communicate with us using online forms, data is stored on our web server and may be forwarded to our email address. Data is deleted once the business case is concluded and legal requirements allow it.
Legal Bases
The processing of data is based on the following legal bases:
• Art. 6(1)(a) GDPR (Consent): You provide consent to store your data and use it for purposes related to the business case.
• Art. 6(1)(b) GDPR (Contract): Data processing is necessary for the performance of a contract with you or a data processor, such as a telephone service provider, or for pre-contractual activities, such as preparing a quote.
• Art. 6(1)(f) GDPR (Legitimate Interests): We aim to conduct customer inquiries and business communication within a professional framework. Certain technical facilities, such as email programs, Exchange servers, and mobile network operators, are necessary for efficient communication.
Cookies
Cookies Summary
👥 Data Subjects: Website visitors
🤝 Purpose: Depending on the specific cookie. More details can be found below or with the software manufacturer that sets the cookie.
📓 Processed Data: Depending on the specific cookie. More details can be found below or with the software manufacturer that sets the cookie.
📅 Data Retention: Varies depending on the specific cookie, ranging from hours to years.
⚖️ Legal Bases: Art. 6(1)(a) GDPR (Consent), Art. 6(1)(f) GDPR (Legitimate Interests)
What are Cookies?
Our website uses HTTP cookies to store user-specific data.
Below, we explain what cookies are and why they are used to help you better understand the following data protection statement.
Whenever you browse the internet, you use a web browser. Well-known browsers include Chrome, Safari, Firefox, Internet Explorer, and Microsoft Edge. Most websites store small text files in your browser. These files are called cookies.
One thing is certain: cookies are genuinely useful helpers. Almost all websites use cookies. Specifically, they are HTTP cookies, as there are other cookies for different application areas. HTTP cookies are small files that our website stores on your computer. These cookie files are automatically placed in the cookie folder, essentially the "brain" of your browser. A cookie consists of a name and a value. When defining a cookie, one or more attributes must also be specified.
Cookies store certain user data, such as language or personal page settings. When you revisit our site, your browser transmits the "user-related" information back to our site. Thanks to cookies, our website knows who you are and offers you the settings you are accustomed to. In some browsers, each cookie has its own file, while in others, such as Firefox, all cookies are stored in a single file.
The following graphic illustrates a possible interaction between a web browser, such as Chrome, and a web server. In this scenario, the web browser requests a website and receives a cookie from the server, which the browser subsequently uses when requesting another page.
There are both first-party cookies and third-party cookies. First-party cookies are created directly by our site, while third-party cookies are created by partner websites (e.g., Google Analytics). Each cookie needs to be evaluated individually since each cookie stores different data. Also, the expiration time of a cookie varies from a few minutes to several years. Cookies are not software programs and do not contain viruses, trojans, or other "malware." Cookies also cannot access information on your PC.
For example, cookie data can look like this:
Name: _ga
Value: GA1.2.1326744211.152322572080-9
Purpose: Distinguishing website visitors
Expiration Date: 2 years
These are the minimum sizes that a browser should be able to support:
• At least 4096 bytes per cookie
• At least 50 cookies per domain
• At least 3000 cookies in total
What Types of Cookies Are There?
The specific types of cookies we use depend on the services used and will be explained in the following sections of the privacy policy. At this point, we would like to briefly discuss the different types of HTTP cookies.
Four types of cookies can be distinguished:
Essential Cookies
These cookies are necessary to ensure basic functionality of the website. For example, these cookies are needed when a user adds a product to the shopping cart, then continues browsing other pages, and later goes to checkout. These cookies prevent the shopping cart from being deleted even if the user closes their browser window.
Functional Cookies
These cookies collect information about user behavior and whether the user receives error messages. Additionally, these cookies measure the loading time and the behavior of the website in various browsers.
Performance Cookies
These cookies contribute to a better user experience. For example, entered locations, font sizes, or form data are stored.
Advertising Cookies
These cookies are also known as targeting cookies. They serve to deliver individually tailored advertising to the user. This can be very practical but also potentially annoying.
Typically, when you first visit a website, you will be asked which of these types of cookies you want to allow. And, of course, this decision is also stored in a cookie.
If you want to learn more about cookies and don't mind technical documentation, we recommend https://datatracker.ietf.org/doc/html/rfc6265, the Internet Engineering Task Force (IETF) Request for Comments titled "HTTP State Management Mechanism."
Purpose of Processing via Cookies
The purpose ultimately depends on the specific cookie. More details can be found below or with the manufacturer of the software that sets the cookie.
What Data Is Processed?
Cookies are small helpers for many different tasks. Unfortunately, data stored in cookies cannot be generalized, but we will inform you about the processed or stored data in the following privacy policy.
Storage Duration of Cookies
The storage duration depends on the specific cookie and is further specified below. Some cookies are deleted after less than an hour, while others can remain on a computer for several years.
You also have control over the storage duration. You can manually delete all cookies at any time through your browser (see also "Right to Object" below). Furthermore, cookies based on consent are deleted no later than upon withdrawal of your consent, with the legality of storage remaining unaffected until then.
Right to Object – How Can I Delete Cookies?
Whether and how you want to use cookies is your decision. Regardless of the service or website where the cookies originate, you always have the option to delete, deactivate, or only partially allow cookies. For example, you can block third-party cookies while allowing all other cookies.
If you want to find out which cookies are stored in your browser, change cookie settings, or delete them, you can find this in your browser settings:
Chrome: Delete, enable, and manage cookies in Chrome
Safari: Manage cookies and website data with Safari
Firefox: Delete cookies to remove data that websites have placed on your computer
Internet Explorer: Delete and manage cookies
Microsoft Edge: Delete and manage cookies
If you don't want any cookies at all, you can configure your browser to always notify you when a cookie is to be set. You can then decide for each individual cookie whether to allow it or not. The procedure varies depending on the browser. It's best to search for instructions on Google with the search term "Delete cookies Chrome" or "Disable cookies Chrome" if you are using Chrome.
Legal Basis
Since 2009, there have been the so-called "Cookie Directives." It is stipulated that storing cookies requires consent (Article 6(1)(a) GDPR) from you. Within EU countries, there are still very different reactions to these directives. In Austria, however, the implementation of this directive is recorded in § 96(3) of the Telecommunications Act (TKG). In Germany, the cookie directives were not implemented as national law. Instead, the implementation of these directives largely took place in § 15(3) of the Telemedia Act (TMG).
For absolutely necessary cookies, even when no consent is given, there are legitimate interests (Article 6(1)(f) GDPR), which are mostly of an economic nature. We want to provide visitors to the website with a pleasant user experience, and for this, certain cookies are often absolutely necessary.
If non-essential cookies are used, this is only done with your consent. The legal basis is then Article 6(1)(a) GDPR.
The following sections will provide more detailed information about the use of cookies if the software used employs cookies.
Customer Data
Customer Data Summary
👥 Affected Individuals: Customers or business and contractual partners
🤝 Purpose: Provision of contractually or pre-contractually agreed services, including related communication
📓 Processed Data: Name, address, contact information, email address, phone number, payment information (e.g., invoices and bank details), contract data (e.g., duration and subject of the contract), IP address, order data
📅 Storage Period: Data is deleted when it is no longer necessary for the provision of our business purposes and there is no legal obligation to retain it.
⚖️ Legal Bases: Legitimate interest (Art. 6(1)(f) GDPR), Contract (Art. 6(1)(b) GDPR)
What are Customer Data?
To provide our services or contractual services, we also process data of our customers and business partners. These data always include personal data. Customer data refers to all information processed based on contractual or pre-contractual cooperation to be able to provide the services offered. Customer data includes all collected information that we gather and process about our customers.
Why Do We Process Customer Data?
There are many reasons why we collect and process customer data. The most important one is that we need various data to provide our services. Sometimes, just your email address is enough, but if you purchase a product or service, we also need data such as your name, address, bank details, or contract data. We also use the data for marketing and sales optimization to improve our service for our customers. Another important aspect is our customer service, which is very important to us. We want you to be able to come to us with questions about our offers at any time, and for that, we need at least your email address.
What Data Is Processed?
What data is specifically stored can only be presented in categories at this point. It always depends on the services you obtain from us. In some cases, you only provide us with your email address so that we can contact you or answer your questions. In other cases, when you purchase a product or service from us, we need much more information, such as your contact details, payment information, and contract data.
Here is a list of possible data that we may receive and process from you:
• Name
• Contact address
• Email address
• Phone number
• Date of birth
• Payment data (invoices, bank details, payment history, etc.)
• Contract data (duration, content)
• Usage data (visited websites, access data, etc.)
• Metadata (IP address, device information)
How Long Is the Data Stored?
We will store the entered data for at least the time during which the associated account with us exists and is used, as long as contractual obligations exist between us, and, when the contract ends, until the respective claims from it have expired. Furthermore, we will store your data as long as and to the extent that we are subject to legal obligations to retain it. After that, we keep booking documents related to the contract (invoices, contract documents, bank statements, etc.) and other relevant business documents for the legally required duration (usually several years).
Right to Object
You have registered, entered data, and want to revoke the processing? No problem. As you can read above, the rights under the General Data Protection Regulation (GDPR) also apply during and after registration, login, or having an account with us. Contact the data protection officer listed above to exercise your rights. If you already have an account with us, you can easily view or manage your data and texts in your account.
Legal Basis
By completing the registration process, you approach us pre-contractually to conclude a usage agreement for our platform (even if no payment obligation arises automatically). You invest time to enter data and register, and we offer you our services after registering in our system and access to your customer account. We also fulfill our contractual obligations. Finally, we must keep registered users informed by email about important changes. Thus, Art. 6(1)(b) GDPR (Performance of pre-contractual measures, fulfillment of a contract) applies.
Additionally, we may obtain your consent, for example, if you voluntarily provide more than the absolutely necessary data or if we are allowed to send you advertising. Art. 6(1)(a) GDPR (Consent) therefore applies.
We also have a legitimate interest in knowing who we are dealing with to contact you in certain cases. Additionally, we need to know who is using our services and whether they are being used as our terms of use dictate. Therefore, Art. 6(1)(f) GDPR (Legitimate interests) applies.
Note: Users should check the following sections as needed.
Registration with Real Names
Since we need to know who we are dealing with in business operations, registration is only possible with your real name (clear name) and not with pseudonyms.
Registration with Pseudonyms
Pseudonyms can be used during registration, meaning you don't have to register with your real name. This ensures that your name cannot be processed by us.
Storage of IP Address
As part of registration, login, and account usage, we store the IP address in the background for security reasons, in order to verify lawful use.
Public Profile
User profiles are publicly visible, meaning parts of the profile can be seen on the internet without providing a username and password.
Two-Factor Authentication (2FA)
Two-Factor Authentication (2FA) provides additional security during login, preventing login without a smartphone, for example. This technical measure to secure your account protects you from data loss or unauthorized access, even if the username and password are known. You can learn about the 2FA method used during registration, login, and in your account.
Web Hosting Introduction
Web Hosting Summary
👥 Affected Individuals: Visitors to the website
🤝 Purpose: Professional hosting of the website and ensuring its operation
📓 Processed Data: IP address, time of website visit, browser used, and other data. More details can be found below or with the respective web hosting provider.
📅 Storage Period: Depends on the specific provider, but typically 2 weeks
⚖️ Legal Basis: Art. 6(1)(f) GDPR (Legitimate Interests)
What is Web Hosting?
When you visit websites today, certain information, including personal data, is automatically created and stored, as is the case on this website. This data should be processed as sparingly as possible and only with justification. By "website," we mean the entirety of all web pages on a domain, from the homepage to the very last subpage, like this one. By "domain," we mean something like example.com or sampleexample.com.
To view a website on a computer, tablet, or smartphone, you use a program called a web browser. You probably know some web browsers by name: Google Chrome, Microsoft Edge, Mozilla Firefox, and Apple Safari. We'll refer to them as browsers or web browsers for short.
To display the website, the browser on your computer (desktop, laptop, tablet, or smartphone) must connect to another computer where the website's code is stored: the web server. Running a web server is a complex and labor-intensive task, which is usually handled by professional providers, known as hosts. They offer web hosting and ensure reliable and error-free storage of website data. Lots of technical terms, but please stay with us; it gets better!
When the browser on your computer connects and data is transferred to and from the web server, it may involve the processing of personal data. On the one hand, your computer stores data, and on the other hand, the web server must also store data for a certain period to ensure proper operation.
A picture is worth a thousand words, so the following graphic illustrates the interaction between the browser, the internet, and the hosting provider:
Why Do We Process Personal Data?
The purposes of data processing are:
1. Professional hosting of the website and ensuring its operation.
2. Maintaining operational and IT security.
3. Anonymous analysis of access behavior to improve our offering and potentially for law enforcement or pursuing claims.
What Data Is Processed?
Even as you visit our website right now, our web server, the computer where this webpage is stored, typically automatically stores data such as:
• The complete internet address (URL) of the visited webpage.
• Browser and browser version (e.g., Chrome 87).
• The operating system used (e.g., Windows 10).
• The address (URL) of the previously visited page (referrer URL) (e.g., https://www.examplesourcepage.com/howigotthere/).
• The hostname and IP address of the device from which access is made (e.g., COMPUTERNAME and 194.23.43.121).
• Date and time.
• In files, the so-called web server log files.
How Long Are Data Stored?
Usually, the data mentioned above is stored for two weeks and then automatically deleted. We do not disclose this data, but we cannot rule out that these data may be viewed by authorities in case of unlawful behavior.
In short: Your visit is logged by our provider (the company that runs our website on special computers or servers), but we do not share your data without consent.
Legal Basis
The lawfulness of processing personal data in the context of web hosting is based on Art. 6(1)(f) GDPR (Legitimate Interests). The use of professional hosting with a provider is necessary to present the company securely and user-friendly on the internet and to potentially track attacks and claims.
In most cases, there is a contract for order processing between us and the hosting provider in accordance with Art. 28 et seq. GDPR, which ensures compliance with data protection and guarantees data security.
Payment Provider Introduction
Payment Provider Privacy Policy Summary
👥 Concerned Individuals: Website visitors
🤝 Purpose: Facilitating and optimizing the payment process on our website
📓 Processed Data: Data such as name, address, bank details (account number, credit card number, passwords, TANs, etc.), IP address, and contract data
For more details, please refer to the respective payment provider tool.
📅 Storage Period: Depends on the used payment provider
⚖️ Legal Basis: Art. 6(1)(b) GDPR (Contractual Performance)
What Is a Payment Provider?
We use online payment systems on our website that enable us and you to have a secure and smooth payment process. In this process, personal data may be sent to, stored, and processed by the respective payment provider. Payment providers are online payment systems that allow you to place orders through online banking. The payment transaction is handled by the payment provider you choose. We subsequently receive information about the completed payment. Any user with an active online banking account with a PIN and TAN can use this method. There are hardly any banks that do not offer or accept such payment methods.
Why Do We Use Payment Providers on Our Website?
Naturally, we aim to provide the best possible service on our website and integrated online shop so that you feel comfortable on our site and can use our offerings. We understand that your time is valuable, and especially payment transactions must work quickly and smoothly. For these reasons, we offer you various payment providers. You can choose your preferred payment provider and pay in your preferred way.
What Data Is Processed?
The specific data processed depends on the respective payment provider. However, in general, data such as name, address, bank details (account number, credit card number, passwords, TANs, etc.) are stored. These are necessary data to even carry out a transaction. Additionally, contract data and user data, such as when you visit our website, what content you are interested in, or which subpages you click on, may also be stored. Most payment providers also store your IP address and information about your computer.
The data is typically stored and processed on the servers of the payment providers. As website operators, we do not receive this data. We are only informed whether the payment was successful or not. For identity and credit checks, payment providers may forward data to the relevant authorities. For all payment transactions, the terms and privacy policies of the respective provider always apply. Therefore, please always check the terms and privacy policy of the payment provider. You also have the right to have data deleted or corrected at any time. Please contact the respective service provider regarding your rights (right of withdrawal, right to information, and right to object).
Duration of Data Processing
We will inform you below if we have further information on the duration of data processing. In general, we only process personal data for as long as it is absolutely necessary for the provision of our services and products. If, for example, it is legally required, as is the case with accounting, this storage period may be exceeded. We keep accounting records (invoices, contracts, bank statements, etc.) related to a contract for 10 years (§ 147 AO) and other relevant business documents for 6 years (§ 247 HGB) after they are generated.
Right to Object
You always have the right to information, correction, and deletion of your personal data. If you have questions, you can also contact the responsible person of the respective payment provider. You can delete, deactivate, or manage cookies used by payment providers for their functions in your browser. Depending on the browser you use, this may work differently. Please note, though, that this may potentially disrupt the payment process.
Legal Basis
We offer various payment service providers for processing contractual or legal relationships (Art. 6(1)(b) GDPR), in addition to conventional banks/credit institutions. The privacy policies of the individual payment providers (such as Amazon Payments, Apple Pay, or Discover) provide a detailed overview of data processing and data storage. If you have any questions regarding data protection, you can always contact the responsible parties.
Information about specific payment providers can be found in the following sections, if available.
PayPal Privacy Policy
We use the online payment service PayPal on our website. The service provider is the American company PayPal Inc. For the European region, the responsible company is PayPal Europe (S.à r.l. et Cie, S.C.A., 22-24 Boulevard Royal, L-2449 Luxembourg).
PayPal also processes data from you in the USA. We would like to point out that, according to the European Court of Justice, there is currently no adequate level of protection for data transfers to the USA. This can be associated with various risks regarding the legality and security of data processing.
As the basis for data processing for recipients based in third countries (outside the European Union, Iceland, Liechtenstein, Norway, especially in the USA) or for data transfers there, PayPal uses so-called standard contractual clauses (= Art. 46, para. 2 and 3 GDPR). Standard contractual clauses (Standard Contractual Clauses - SCC) are sample templates provided by the EU Commission and are intended to ensure that your data also complies with European data protection standards when transferred and stored in third countries (such as the USA). Through these clauses, PayPal commits to complying with the European data protection level when processing your relevant data, even if the data is stored, processed, and managed in the USA. These clauses are based on an EU Commission implementing decision. You can find the decision and the corresponding standard contractual clauses here: https://eur-lex.europa.eu/eli/dec_impl/2021/914/oj?locale=en.
For more information about the standard contractual clauses and the data processed by using PayPal, please refer to the privacy policy at https://www.paypal.com/webapps/mpp/ua/privacy-full.
Explanation of Terms Used
We always strive to make our privacy policy as clear and understandable as possible. However, when it comes to technical and legal topics, this is not always easy. It often makes sense to use legal terms (such as personal data) or specific technical terms (such as cookies, IP address), but we do not want to use them without explanation. Below is an alphabetical list of important terms used, which we may not have adequately explained in the previous privacy policy. If these terms have been taken from the GDPR and are definitions, we will also provide the GDPR texts and, if necessary, add our own explanations.
Supervisory Authority
Definition according to Article 4 of the GDPR
For the purposes of this Regulation, the expression:
"supervisory authority" means an independent public authority established by a Member State pursuant to Article 51;
Explanation: "Supervisory authorities" are always governmental, independent institutions that are also empowered in certain cases. They serve to carry out so-called state supervision and are located in ministries, special departments, or other authorities. For data protection in Austria, there is an Austrian data protection authority, and in Germany, each federal state has its own data protection authority.
Data Processor
Definition according to Article 4 of the GDPR
For the purposes of this Regulation, the expression:
"data processor" means a natural or legal person, public authority, agency, or other body that processes personal data on behalf of the controller;
Explanation: As a company and website owner, we are responsible for all data we process from you. In addition to data controllers, there may also be so-called data processors. This includes any company or person who processes personal data on our behalf. Data processors may include service providers such as tax advisors, hosting or cloud providers, payment or newsletter providers, or large companies such as Google or Microsoft.
Concerned Supervisory Authority
Definition according to Article 4 of the GDPR
For the purposes of this Regulation, the expression:
"concerned supervisory authority" means a supervisory authority which is concerned by the processing of personal data because
a)
the controller or the processor is established on the territory of the Member State of that supervisory authority;
b)
the processing substantially affects or is likely to substantially affect data subjects residing in the Member State of that supervisory authority; or
c)
a complaint has been lodged with that supervisory authority;
Explanation: In Germany, each federal state has its own data protection authority. If your company's headquarters (main branch) are in Germany, the relevant data protection authority of the federal state is generally your point of contact. In Austria, there is only one data protection authority for the entire country.
File System
Definition according to Article 4 of the GDPR
For the purposes of this Regulation, the term:
"file system" means any structured collection of personal data which is accessible according to specific criteria, whether centralized, decentralized, or dispersed on a functional or geographical basis;
Explanation: Any organized storage of data on a computer's storage device is referred to as a "file system." For example, when we store your name and email address on a server for our newsletter, this data is stored in a so-called "file system." The primary tasks of a "file system" include fast searching and retrieval of specific data and, of course, secure data storage.
Information Society Service
Definition according to Article 4 of the GDPR
For the purposes of this Regulation, the term:
"information society service" means a service as defined in point (b) of Article 1(1) of Directive (EU) 2015/1535 of the European Parliament and of the Council (19);
Explanation: In general, the term "information society" refers to a society that relies on information and communication technologies. Specifically, as a website visitor, you are familiar with various types of online services, and most online services fall under the category of "information society services." A classic example of this is online transactions, such as purchasing goods over the internet.
Third Party
Definition according to Article 4 of the GDPR
For the purposes of this Regulation, the term:
"third party" means a natural or legal person, public authority, agency, or body other than the data subject, controller, processor, and persons who, under the direct authority of the controller or processor, are authorized to process personal data;
Explanation: The GDPR essentially defines what is not considered a "third party." In practice, a "third party" is anyone who has an interest in personal data but does not fall into the categories of data subjects, controllers, processors, or persons authorized to process personal data under the direct authority of the controller or processor. For example, a parent company can be considered a "third party" in relation to its subsidiary. However, this does not automatically grant the parent company the right to access, collect, or store the personal data of the subsidiary.
Restriction of Processing
Definition according to Article 4 of the GDPR
For the purposes of this Regulation, the term:
"restriction of processing" means the marking of stored personal data with the aim of limiting their processing in the future;
Explanation: It is one of your rights to request processors to restrict the processing of your personal data for further processing. This involves marking specific personal data, such as your name, date of birth, or address, in a way that prevents their further processing. For example, you could restrict processing so that your data cannot be used for personalized advertising.
Consent
Definition according to Article 4 of the GDPR
For the purposes of this Regulation, the term:
"consent" of the data subject means any freely given, specific, informed, and unambiguous indication of the data subject's wishes by which he or she, by a statement or by a clear affirmative action, signifies agreement to the processing of personal data relating to him or her;
Explanation: In most cases on websites, consent is obtained through a cookie consent tool. You are probably familiar with this. When you first visit a website, you are usually asked through a banner whether you consent to data processing. Often, you can also make individual settings and decide for yourself which data processing you allow and which you do not. If you do not give consent, no personal data about you can be processed. In principle, consent can also be given in writing, not through a tool.
Recipient
Definition according to Article 4 of the GDPR
For the purposes of this Regulation, the term:
"recipient" means a natural or legal person, public authority, agency, or another body, to which the personal data are disclosed, whether a third party or not. However, public authorities which may receive personal data in the framework of a particular inquiry in accordance with Union or Member State law shall not be regarded as recipients; the processing of those data by those public authorities shall be in compliance with the applicable data protection rules according to the purposes of the processing;
Explanation: Every individual and company that receives personal data is considered a recipient. Therefore, we and our processors are also recipients. Only authorities with a specific inquiry are not considered recipients.
Cross-Border Processing
Definition according to Article 4 of the GDPR
For the purposes of this Regulation, the term:
"cross-border processing" means either
a)
processing of personal data which takes place in the context of the activities of establishments in more than one Member State of a controller or processor in the Union where the controller or processor is established in more than one Member State; or
b)
processing of personal data which takes place in the context of the activities of a single establishment of a controller or processor in the Union but which substantially affects or is likely to substantially affect data subjects in more than one Member State.
Explanation: For example, if a company or organization has branches in Spain and Croatia and processes personal data in connection with the activities of these branches, it constitutes "cross-border processing" of personal data. Even if the data is processed only in one country (such as Spain in this example), but the effects on data subjects are noticeable in another country, it is also referred to as "cross-border processing."
Substantial and Specific Objection
Definition according to Article 4 of the GDPR
For the purposes of this Regulation, the term:
"substantial and specific objection" means an objection to a draft decision as to whether there is an infringement of this Regulation, or whether envisaged action in relation to the controller or processor complies with this Regulation, which clearly demonstrates the significance of the risks posed by the draft decision as regards the fundamental rights and freedoms of the data subject and, where applicable, the free movement of personal data within the Union;
Explanation: When certain measures taken by us as the controller or our processors are not in compliance with the GDPR, you can raise a "substantial and specific objection." In doing so, you must clarify the extent of the risks to your fundamental rights and freedoms and, if applicable, the free movement of your personal data within the EU.
Personal Data
Definition according to Article 4 of the GDPR
For the purposes of this Regulation, the term:
"personal data" means any information relating to an identified or identifiable natural person (‘data subject’); an identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier, or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural, or social identity of that natural person;
Explanation: Personal data includes all information that can identify a person. This typically includes data such as:
• Name
• Address
• Email address
• Mailing address
• Phone number
• Date of birth
• Identification numbers such as social security number, tax identification number, ID number, or student ID number
• Bank data such as account number, credit information, account balances, etc.
According to the European Court of Justice (ECJ), your IP address is also considered personal data. IT experts can at least determine the approximate location of your device based on your IP address and, subsequently, identify you as the subscriber. Therefore, the storage of an IP address also requires a legal basis under the GDPR. There are also so-called "special categories" of personal data that are considered particularly sensitive. These include:
• Racial and ethnic origin
• Political opinions
• Religious or philosophical beliefs
• Trade union membership
• Genetic data, such as data derived from blood or saliva samples
• Biometric data (information about psychological, physical, or behavioral characteristics that can identify a person)
• Health data
• Data related to sexual orientation or sexual life
Profiling
Definition according to Article 4 of the GDPR
For the purposes of this Regulation, the term:
"profiling" means any form of automated processing of personal data consisting of the use of personal data to evaluate certain personal aspects relating to a natural person, in particular to analyze or predict aspects concerning that natural person's performance at work, economic situation, health, personal preferences, interests, reliability, behavior, location, or movements;
Explanation: Profiling involves collecting various information about a person to gain insights into that person. In the context of the web, profiling is often used for advertising purposes or for credit assessments. Web or advertising analysis programs, for example, collect data about your behavior and interests on a website. This information is used to create a user profile that allows targeted advertising to a specific audience.
Company
Definition according to Article 4 of the GDPR
For the purposes of this Regulation, the term:
"company" means a natural or legal person engaged in an economic activity, irrespective of its legal form, including partnerships or associations which regularly engage in an economic activity;
Explanation: We are, for example, a company and conduct economic activity through our website by offering and selling services and/or products. Every company has a formal legal structure, such as a GmbH (limited liability company) or an AG (public limited company).
Controller
Definition according to Article 4 of the GDPR
For the purposes of this Regulation, the term:
"controller" means the natural or legal person, public authority, agency, or other body which, alone or jointly with others, determines the purposes and means of the processing of personal data; where the purposes and means of such processing are determined by Union or Member State law, the controller or the specific criteria for his nomination may be provided for by Union or Member State law;
Explanation: In our case, we are responsible for the processing of your personal data and therefore referred to as the "controller." When we share collected data for processing with other service providers, they are considered "processors." For this, a "Data Processing Agreement (DPA)" must be signed.
Processing
Definition according to Article 4 of the GDPR
For the purposes of this Regulation, the term:
"processing" means any operation or set of operations which is performed on personal data or on sets of personal data, whether or not by automated means, such as collection, recording, organization, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination, or otherwise making available, alignment or combination, restriction, erasure, or destruction;
Note: When we refer to processing in our privacy policy, we mean any type of data processing. This includes not only collecting but also storing and processing data.
Binding Corporate Rules
Definition according to Article 4 of the GDPR
For the purposes of this Regulation, the term:
"binding corporate rules" means personal data protection policies which are adhered to by a controller or processor established on the territory of a Member State for transfers or a set of transfers of personal data to a controller or processor in one or more third countries within a group of undertakings, or group of enterprises engaged in a joint economic activity;
Explanation: You may have heard or read the term "Binding Corporate Rules" (BCRs). This term is most commonly associated with corporate internal data protection policies. Especially for companies (such as Google) that process data in third countries, having such an internal policy that obligates the company to comply with data protection regulations is recommended. This policy governs the handling of personal data that is transferred and processed in third countries.
Personal Data Breach
Definition according to Article 4 of the GDPR
For the purposes of this Regulation, the term:
"personal data breach" means a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to, personal data transmitted, stored, or otherwise processed;
Explanation: For example, a "personal data breach" can occur in the event of a data breach, such as a technical issue or a cyberattack. If the breach poses a risk to the rights and freedoms of individuals, the controller must immediately report the incident to the relevant supervisory authority. Additionally, affected individuals must be informed if the breach poses a high risk to their rights and freedoms.
Representative
Definition according to Article 4 of the GDPR
For the purposes of this Regulation, the term:
"representative" means a natural or legal person established in the Union who, designated by the controller or processor in writing pursuant to Article 27, represents the controller or processor with regard to their respective obligations under this Regulation;
Explanation: A "representative" can be any person who has been designated in writing by us (the controller) or one of our service providers (the processor) as their representative. Companies outside the EU that process data of EU citizens must appoint a representative within the EU. For example, if a web analytics provider is headquartered in the USA, they must appoint a "representative" within the European Union to represent them in matters related to data processing.
Closing Words
Congratulations! If you're reading these lines, you've made your way through our entire privacy policy or at least scrolled down to this point. As you can see from the extent of our privacy policy, we take the protection of your personal data very seriously.
We believe it's essential to inform you about the processing of personal data to the best of our knowledge and abilities. However, we don't want to merely inform you about the data being processed but also provide insights into the reasons for using various software programs. Privacy policies often sound very technical and legalistic. However, since most of you are not web developers or lawyers, we wanted to use plain and clear language to explain the matter. In some cases, due to the complexity of the subject, this may not be entirely possible. Therefore, the most important terms are explained at the end of the privacy policy.
If you have any questions about data protection on our website, please don't hesitate to contact us or the responsible authority. We wish you a pleasant time and hope to welcome you back to our website soon.
All texts are protected by copyright.
Source: Created with the AdSimple Privacy Policy Generator
Please note that this translation may not be perfect, but it should help convey the meaning of the original text in English.