2. Data processing, purposes and legal bases

2.1. Contacting us

If you contact us, e.g. by email, telephone or post, we process the personal data you voluntarily provide (e.g. name, email address, telephone number or postal address and the content of your message to us).

We process the personal data transmitted to us when you contact us in order to handle your enquiry and to provide you with the information you have requested. This data processing is therefore necessary for the fulfilment of our (pre-)contractual obligations pursuant to Art 6(1)(b) GDPR and for our legitimate interest in maintaining our business relationship with you pursuant to Art 6(1)(f) GDPR. Any use of tools to support the handling of enquiries and to summarise conversations is likewise carried out in pursuit of your and our legitimate interests in efficient and prompt processing pursuant to Art 6(1)(f) GDPR.

2.2. Access data and server log files

We collect and process the following data when you use the website (so-called server log files): URL accessed, date and time of access, amount of data transferred, server status codes, processing time, browser and client type including version, your operating system, referrer URL (the previously visited page), IP address, connection data for source and destination (network identifier or address, port numbers).

This data is generated automatically by our servers when you use our website and is required so that we can provide you with the services you request. We therefore process server log files solely in order to provide you with our website and the related services, to identify you as an authorised user, to distribute web server requests across our server pool, and for security reasons (e.g. to investigate misuse or fraud). This data processing is therefore necessary to safeguard our legitimate interests in providing a user-friendly and secure website pursuant to Art 6(1)(f) GDPR.

2.3. Contract initiation and contract performance

We collect and process the personal data (e.g. name, address, telephone number, email address, bank details) that you provide to us, for example in the context of an enquiry or for the conclusion of a contract. Providing your name and email address is mandatory for the conclusion of a contract (mandatory information). All other information is not required for the performance of the contract and is therefore voluntary. If the mandatory information required for the performance of the contract is not provided, no contract will be concluded. Not providing the voluntary information has no effect on the conclusion of the contract.

The data provided is processed for the following purposes:

• Contract initiation and contract performance: We require the data in order to fulfil our obligations towards our contractual partners (Art 6(1)(b) GDPR).
• Compliance with a legal obligation: Processing of the data may be necessary for the purpose of complying with various legal obligations arising, for example, from the Austrian Federal Fiscal Code (BAO) or the Austrian Commercial Code (UGB) (Art 6(1)(c) GDPR).
• Consent: If, in addition, voluntary consent to the processing of the data has been given, in particular in connection with direct marketing measures, processing takes place in accordance with the purposes set out in the declaration of consent and to the extent agreed therein (Art 6(1)(a) GDPR).

3. Cookies

3.1. General

Our website uses so-called cookies. These are small text files that are stored on your device by means of your browser. There are cookies that require your voluntary consent before they can be used on your device, and cookies that are activated without your consent because they are technically necessary for us to provide our services ("strictly necessary cookies").

We use cookies to make the website and our offering user-friendly and tailored to your needs. Some cookies remain stored on your device until you delete them. They enable us to recognise your browser on your next visit.

If you do not want this, you can set up your browser so that it informs you about the setting of cookies and you only allow this in individual cases. However, deactivating cookies may limit the functionality of our website.

Specific details about which cookies are activated for which purposes and on which legal basis can be found in the cookie banner. This is displayed to you on your first visit to our website. In addition, at the bottom of our websites you will find a link, button or icon through which you can change your preferences at any time (depending on the system used, labelled Cookie Settings, Cookie Policy or an icon with a cookie symbol, etc.)  Here you will also find an up-to-date list of cookie providers by purpose. Some of these are located in third countries without an adequate level of data protection, such as the USA. If you give your voluntary consent for purposes that involve a transfer to recipients in third countries, your consent pursuant to Art 49(1)(a) GDPR also covers this transfer. There is a risk that your data transferred in this way may be subject to access by authorities in these third countries for control and surveillance purposes and that no effective legal remedies are available against this.

3.2. Data processed

Depending on the type of cookie, the following information about you may be collected and processed: the user's IP address, log files, domain, browser type and language, pages accessed, date/time of access to the website, search terms, visitor activities and actions on the website, browser history (on our domain), internet service provider, referring/exit pages, platform type, geolocation, usage habits and characteristics of the website's users, the type of advertising viewed, and information about the user's device, such as device type, device model, device operating system, device operating system version and data connection type, amount of data transferred, etc.

3.3. Strictly necessary – essential cookies

In the case of strictly necessary cookies, the data processing is necessary for the purposes of data security measures, the prevention of misuse and the optimisation of the website, and is therefore based on our legitimate interests pursuant to Art 6(1)(f) GDPR in conjunction with § 165(3) TKG.

These cookies are necessary for the website to function and cannot be deactivated in your systems. As a rule, these cookies are only set in response to actions you take that amount to a request for services, such as setting your privacy preferences, logging in or filling in forms. You can set your browser to block these cookies or to alert you about them. However, some parts of the website will then not work.

3.4. Cookies requiring consent

We use all other cookies on our website exclusively on the basis of your prior express and voluntary consent pursuant to Art 6(1)(a) GDPR in conjunction with § 165(3) TKG via the cookie banner. At the start of your use of the website, depending on the consent solution used, you can give your voluntary consent in general by clicking the button "Accept all", "accept", "save selection", "allow all", etc., or select or deselect each individual type separately by clicking the button "Customise", "cookie settings", etc. If you do not select any cookies and click "Save my settings", "save settings", "confirm my selection", etc., no cookies requiring consent will be loaded.

You can change your settings at any time via a link, button or icon at the bottom of our websites (depending on the system used, labelled Cookie Settings, Cookie Policy or an icon with a cookie symbol, etc.).

We use these cookies for the following purposes:

• to gain valuable insights into users' needs, with the aim of further improving the high quality of the website and its offering and making it more user-friendly;
• to measure traffic and general usage patterns in order to find and fix errors more quickly and to manage server capacity so that adequate data volume is available at peak times;
• to inform advertisers about the usage habits and characteristics of the website's users;
• for market research purposes.

The cookies used by the controller serve to make the website more user-friendly, effective and secure. The purpose of these cookies is to adapt the controller's offering to the user's wishes as closely as possible and to make browsing as convenient and attractive as possible. Users benefit from the display of information specifically tailored to their interests and more personalised advertising, faster access to information, and, for example, being recognised when they visit the website again.

You can withdraw your consent at any time, without giving reasons, with effect for the future:

• On the one hand, you can reject or delete accepted cookies by adjusting your browser settings accordingly (for general information see e.g. here: https://media.ztat.net/media/agb/2012-07-27_Cookies_Browser.pdf). The browser can also be set so that cookies are only stored if this has been expressly agreed to. If the user does not wish to accept cookies from partner companies, they can do so by selecting the setting "Block third-party cookies" in their browser.
• Furthermore, you can change your settings at any time via a link, button or icon at the bottom of our websites and thereby also withdraw your consent for all or individual purposes or providers (depending on the system used, labelled Cookie Settings, Cookie Policy or an icon with a cookie symbol, etc.).

In general, we distinguish between the following types of cookies:

3.4.1. Performance cookies

These cookies allow us to count visits and traffic sources so that we can measure and improve the performance of our website. They help us answer questions about which pages are the most popular, which are used least and how visitors move around the website.

3.4.2. Functional cookies

These cookies enable the website to provide enhanced functionality and personalisation. They may be set by us or by third-party providers whose services we use on our pages. If you do not allow these cookies, some or all of these services may not function properly. The complete list of third-party providers can be found in the cookie banner.

3.4.3.   Cookies for marketing purposes – analytics cookies

These cookies may be set through our website by our advertising partners. This allows them to be shown information about the effectiveness of their advertising, such as how many users have seen the advertisement. In addition, these cookies may be used to track a user's visits to all pages on which the advertising is displayed. They can therefore be used by these companies to build a profile of your interests and show you relevant ads on our website and other websites. They do not store personal data directly, but are based on a unique identification of your browser and internet device. If you do not allow these cookies, you will experience advertising that is less tailored to your interests.

4. Disclosure of personal data

To fulfil our contractual obligations and for other data processing activities, the controller uses service providers. To the extent necessary, we therefore provide personal data to the following service providers (processors):

• IT service providers and/or providers of data hosting or data processing;
• software providers for the provision of services;
• providers of marketing tools, communication service providers, messenger service providers;
• providers of web analytics tools and tools for summarising conversations.

We have concluded a data processing agreement with each of our processors. They therefore process the data on our behalf and on the basis of our documented instructions.

In addition, we transfer your personal data to the following recipients (controllers) to the extent necessary:

• external third parties and authorities on the basis of our legitimate interests in fulfilling our legal obligations or official orders, or in asserting, exercising or defending legal claims of the controller (e.g. auditors, legal representatives where required, debt collection agencies, KSV);
• any third parties involved in providing services to you, in order to fulfil our contractual obligations towards you (e.g. payment service providers, postal service providers);
• companies that support the controller in the provision of other services, e.g. web agencies and domain registrars;
• if you have opted for the subsidy option, external subsidy advisers on the basis of your consent to be contacted for subsidy advice or processing.

Personal data is only transferred to third countries outside the EU or the EEA if there is an adequacy decision by the European Commission for these countries, if appropriate safeguards for the protection of personal data have been provided by concluding a legally binding document, or if you have expressly given your voluntary consent in individual cases within the meaning of Art 49(1)(a) GDPR.

Where payment options are integrated via payment providers or comparable third parties, the data transfer strictly required for this purpose takes place in the context of contract performance (Art 6(1)(b) GDPR)

5. Storage period and data deletion

We only store your personal data for as long as is necessary for the purposes for which it is processed. Beyond that, we may be obliged to retain your data for longer due to statutory retention periods.

Specifically, we store your data in connection with enquiries for a period of 3 years in order to be able to respond to any follow-up questions.

We store data in connection with contractual relationships until the end of your customer relationship with us or, beyond that, until the expiry of the relevant statutory retention obligations (generally for a period of seven years).

If you withdraw your voluntary consent, we will delete the stored personal data processed on this legal basis (provided there are no statutory retention obligations).

Data collected for marketing purposes is stored for 5 years.

The website's server log files are stored for a maximum of 31 days and then deleted.

In addition, where required, we also store your personal data beyond the periods mentioned for as long as legal claims arising from the relationship between you and us can be asserted, or until a specific incident or legal dispute has been finally resolved. This longer retention serves to safeguard our legitimate interests in asserting, clarifying and defending legal claims.

6. Your rights

If your personal data is processed, you have the following rights vis-à-vis the controller:

You have the right to access the personal data we process about you. You also have the right to rectification of inaccurate data and the right to erasure of your data. You can withdraw any consent you have given to the processing of personal data at any time with effect for the future. You also have the right to restriction of the processing of your data and the right to receive the personal data you have provided in a structured, commonly used and machine-readable format.

You also have the right to object, on grounds relating to your particular situation, where we process your data on the basis of our legitimate interests. Such an objection may in particular be made against the processing of your data for direct marketing purposes.

You also have the right to lodge a complaint with a data protection supervisory authority. The data protection supervisory authority responsible for the controller is: Österreichische Datenschutzbehörde (Austrian Data Protection Authority), Barichgasse 40-42, 1030 Vienna.

However, we kindly ask you to contact us first with any complaints or questions. You can reach us using the contact details provided in section 1.