Privacy Policy

Table of Contents

Introduction and Overview

We have prepared this privacy policy (version 14.04.2023-111824141) to inform you in accordance with the requirements of the General Data Protection Regulation (EU) 2016/679 und anwendbaren nationalen Gesetzen zu erklären, welche personenbezogenen Daten (kurz Daten) wir als Verantwortliche – und die von uns beauftragten Auftragsverarbeiter (z. B. Provider) – verarbeiten, zukünftig verarbeiten werden und welche rechtmäßigen Möglichkeiten Sie haben. Die verwendeten Begriffe sind geschlechtsneutral zu verstehen.
In short: Wir informieren Sie umfassend über Daten, die wir über Sie verarbeiten.

Privacy statements usually sound very technical and use legal terminology. This privacy statement, however, is intended to describe the most important matters to you as simply and transparently as possible. Where this promotes transparency, technical terms explained in a reader-friendly manner, links to further information are provided and graphics are used. In doing so, we communicate in clear and plain language that, in the course of our business activities, we only process personal data when an appropriate legal basis exists. That is certainly not possible if one provides very short, unclear and legally technical explanations, as are often standard on the internet when it comes to data protection. I hope you find the following explanations interesting and informative, and that there may be one or two pieces of information you did not yet know.
If you still have questions, we kindly ask you to contact the responsible body named below or in the imprint, follow the available links and consult further information on third-party sites. Our contact details can of course also be found in the imprint.

Scope

This privacy policy applies to all personal data processed by us within the company and to all personal data processed by companies commissioned by us (processors). By personal data we mean information within the meaning of Art. 4(1) GDPR, such as a person’s name, email address and postal address. The processing of personal data ensures that we can offer and bill our services and products, whether online or offline. The scope of this privacy policy includes:

  • all online presences (websites, online shops) that we operate
  • social media profiles and email communication
  • mobile apps for smartphones and other devices

In short: The privacy policy applies to all areas in which personal data is processed by the company via the aforementioned channels. If we enter into legal relationships with you outside these channels, we will inform you separately where appropriate.

Legal basis

In the following privacy policy we provide you with transparent information on the legal principles and regulations, i.e. the legal bases of the General Data Protection Regulation that allow us to process personal data.
As far as EU law is concerned, we refer to REGULATION (EU) 2016/679 OF THE EUROPEAN PARLIAMENT AND OF THE COUNCIL of 27 April 2016. You can of course find this EU General Data Protection Regulation online on EUR-Lex, the access to EU law, at "https://eur-lex.europa.eu/legal-content/DE/ALL/?uri=celex%3A32016R0679 read more.

We only process your data if at least one of the following conditions applies:

  1. Consent (Article 6(1)(a) GDPR): You have given us your consent to process data for a specific purpose. An example would be storing the data you entered in a contact form.
  2. Contract (Article 6(1)(b) GDPR): To fulfill a contract or pre-contractual obligations with you, we process your data. For example, if we conclude a purchase contract with you, we need personal information in advance.
  3. Legal obligation (Article 6(1)(c) GDPR): We process your data if we are subject to a legal obligation. For example, we are legally required to keep invoices for accounting purposes. These generally contain personal data.
  4. Legitimate interests (Article 6(1)(f) GDPR): In the case of legitimate interests that do not restrict your fundamental rights, we reserve the right to process personal data. For example, we must process certain data in order to operate our website securely and economically efficiently. This processing is therefore a legitimate interest.

Other conditions such as the performance of tasks carried out in the public interest and the exercise of official authority as well as the protection of vital interests generally do not apply to us. Should such a legal basis be relevant, it will be indicated at the appropriate place.

In addition to the EU regulation, national laws also apply:

  • In Austria this is the Federal Act on the Protection of Natural Persons during the Processing of Personal Data (Data Protection Act), short DSG.
  • In Germany applies Federal Data Protection Act, abbreviated BDSG.

If other regional or national laws apply, we will inform you about them in the following sections.

Contact details of the data controller

If you have any questions about data protection or the processing of personal data, you will find below the contact details of the person or body responsible:
AdSimple GmbH
Fabriksgasse 20, 2230 Gänserndorf, Austria

E-mail: [email protected]
Phone: +43 2282 / 60 715
Imprint: https://www.adsimple.at/impressum/

Retention period

A general principle for us is that we only retain personal data for as long as it is strictly necessary for the provision of our services and products. This means that we delete personal data as soon as the reason for processing the data no longer exists. In some cases we are legally required to retain certain data even after the original purpose has ceased to apply, for example for accounting purposes.

If you wish to have your data deleted or revoke consent to data processing, the data will be deleted as soon as possible, provided there is no legal obligation to retain it.

We will inform you below about the specific duration of each data processing activity, provided we have further information about it.

Rights under the General Data Protection Regulation

In accordance with Articles 13 and 14 of the GDPR, we inform you about the following rights to which you are entitled to ensure fair and transparent data processing:

  • Under Article 15 of the GDPR, you have the right to obtain confirmation as to whether we are processing personal data about you. If that is the case, you have the right to receive a copy of the data and to be informed of the following:
    • the purposes for which we process the data;
    • the categories, i.e. the types of data being processed;
    • who receives this data and, if the data are transferred to third countries, how security can be ensured;
    • how long the data are stored;
    • the existence of the right to rectification, erasure or restriction of processing and the right to object to processing;
    • that you may lodge a complaint with a supervisory authority (links to these authorities can be found below);
    • the source of the data if we did not collect it from you;
    • whether profiling is carried out, i.e., whether data are automatically analyzed to create a personal profile of you.
  • You have a right to rectification under Article 16 of the GDPR, which means that we must correct data if you find errors.
  • You have the right to erasure under Article 17 of the GDPR ("right to be forgotten"), which specifically means that you may request the deletion of your data.
  • You have the right to restriction of processing under Article 18 of the GDPR, which means that we may only retain the data but not further process it.
  • You have the right to data portability under Article 20 of the GDPR, which means that we will provide your data to you on request in a commonly used format.
  • You have a right to object under Article 21 of the GDPR, which, if exercised, will result in a change to the processing.
    • If the processing of your data is based on Article 6(1)(e) (public interest, exercise of public authority) or Article 6(1)(f) (legitimate interests), you may object to the processing. We will then examine as soon as possible whether we can legally comply with that objection.
    • If data are used to carry out direct advertising, you can object to this type of data processing at any time. We may then no longer use your data for direct marketing.
    • If data are used for profiling, you can object to this type of data processing at any time. We may then no longer use your data for profiling.
  • Under Article 22 of the GDPR, you may have the right not to be subject to a decision based solely on automated processing (for example profiling).
  • Under Article 77 of the GDPR, you have the right to lodge a complaint. This means you can at any time complain to the Data Protection Authority if you believe that the processing of personal data violates the GDPR.

In short: You have rights – do not hesitate to contact the responsible party listed above at our organization!

If you believe that the processing of your data violates data protection law or that your data protection rights have otherwise been infringed, you can lodge a complaint with the supervisory authority. For Austria, this is the Data Protection Authority, whose website you can find at https://www.dsb.gv.at/ can be found. In Germany there is a data protection officer for each federal state. For further information you can contact the Federal Commissioner for Data Protection and Freedom of Information (BfDI) contact. The following local data protection authority is responsible for our company:

Austrian Data Protection Authority

Head: Mag. Dr. Andrea Jelinek

Address: Barichgasse 40-42, 1030 Vienna

Telephone: +43 1 52 152-0

Email address:
[email protected]

Website:
https://www.dsb.gv.at/

Data transfers to third countries

We transfer or process data to countries outside the EU (third countries) only when you consent to this processing, it is legally required, or contractually necessary — and in any case only insofar as this is generally permitted. In most cases, your consent is the primary reason that we have data processed in third countries. The processing of personal data in third countries such as the USA, where many software vendors provide services and have their server locations, can mean that personal data may be processed and stored in unexpected ways.

We expressly point out that, in the view of the Court of Justice of the European Union, there is currently no adequate level of protection for data transfers to the USA. Data processing by US services (such as Google Analytics) can result in data possibly not being processed and stored anonymously. Furthermore, US government authorities may, in certain cases, gain access to individual data. It may also happen that collected data are linked with data from other services of the same provider, if you have a corresponding user account. Where possible, we try to use server locations within the EU, provided these are offered.

We will inform you in the appropriate sections of this privacy policy in more detail about data transfers to third countries, where applicable.

Security of data processing

To protect personal data, we have implemented both technical and organizational measures. Where possible, we encrypt or pseudonymize personal data. This makes it, within the limits of our capabilities, as difficult as possible for third parties to infer personal information from our data.

Article 25 GDPR refers here to "data protection by design and by default" and means that one should always consider security and implement appropriate measures for both software (e.g. forms) and hardware (e.g. access to the server room). Below, if necessary, we will go into specific measures.

TLS encryption with https

TLS, encryption and https sound very technical — and they are. We use HTTPS (Hypertext Transfer Protocol Secure) to transmit data securely over the Internet.
This means that the complete transmission of all data from your browser to our web server is secured — no one can "eavesdrop".

With this, we have introduced an additional layer of security and comply with data protection by design (Article 25(1) GDPR). By using TLS (Transport Layer Security), an encryption protocol for secure data transmission on the internet, we can ensure the protection of confidential data.
You can recognize the use of this data transmission security by the small lock symbol in the top left of the browser, to the left of the internet address (e.g., beispielseite.de) and the use of the https scheme (instead of http) as part of our internet address.
If you would like to know more about encryption, we recommend searching Google for “Hypertext Transfer Protocol Secure wiki” to find good links for further information.

Communication

Communication SummaryData subjects: Everyone who communicates with us via telephone, email, or online form
Processed data: e.g. telephone number, name, email address, entered form data. More details can be found in the respective contact method used.
Purpose: handling communication with customers, business partners, etc.
Retention period: duration of the business transaction and the statutory provisions.
⚖️ Legal basis: Art. 6(1)(a) GDPR (consent), Art. 6(1)(b) GDPR (contract), Art. 6(1)(f) GDPR (legitimate interests)

If you contact us and communicate by telephone, email or online form, personal data may be processed.

The data are processed for handling and dealing with your inquiry and the related business transaction. The data are stored only for as long as necessary for that purpose or for as long as required by law.

Data subjects

All persons who seek to contact us via the communication channels we provide are affected by the aforementioned processes.

Phone

If you call us, the call data will be stored pseudonymized on the respective end device and with the telecommunications provider used. In addition, data such as name and telephone number may subsequently be sent by email and stored for the purpose of responding to the inquiry. The data will be deleted as soon as the business matter has been concluded and legal requirements allow it.

Email

If you communicate with us by email, data may be stored on the respective end device (computer, laptop, smartphone, …) and data will be stored on the email server. The data will be deleted as soon as the business matter has been concluded and legal requirements allow it.

Online forms

If you communicate with us via an online form, data will be stored on our web server and, if applicable, forwarded to one of our email addresses. The data will be deleted as soon as the business matter has been concluded and legal requirements allow it.

Legal basis

The processing of the data is based on the following legal bases:

  • Art. 6(1)(a) GDPR (consent): You give us consent to store your data and to further use it for purposes related to the business matter;
  • Art. 6(1)(b) GDPR (contract): There is a necessity for the performance of a contract with you or a processor (e.g., the telephone provider), or we must process the data for pre-contractual activities, such as preparing a quote;
  • Art. 6(1)(f) GDPR (legitimate interests): We want to handle customer inquiries and business communication in a professional manner. For this purpose, certain technical systems such as email clients, Exchange servers and mobile network operators are necessary to operate communication efficiently.

Data processing agreement (DPA)

In this section we would like to explain what a data processing agreement (DPA) is and why it is needed. Because the word “Auftragsverarbeitungsvertrag” is quite a tongue-twister, we will also often use the acronym DPA in the text. Like most companies, we do not work alone but also make use of services from other companies or individuals. By involving various companies or service providers, it may happen that we pass on personal data for processing. These partners then act as data processors, with whom we enter into a contract — the so‑called data processing agreement (DPA). The most important thing for you to know is that the processing of your personal data takes place solely on our instructions and must be governed by the DPA.

Who are data processors?

As a company and website owner we are responsible for all data we process about you. In addition to the controller there may also be so‑called processors. This includes any company or person that processes personal data on our behalf. More precisely, and according to the GDPR definition: any natural or legal person, public authority, agency or other body that processes personal data on our behalf is considered a processor. Processors can therefore be service providers such as hosting or cloud providers, payment or newsletter providers, or large companies such as Google or Microsoft.

For a better understanding of the terms, here is an overview of the three roles under the GDPR:

Data subject (You as a customer or prospective customer) → Controller (we as the company and controller) → Data processor (service providers such as web hosts or cloud providers)

Contents of a data processing agreement

As mentioned above, we have concluded a data processing agreement (DPA) with our partners who act as processors. It primarily states that the processor will process the data to be handled solely in accordance with the GDPR. The contract must be concluded in writing; however, in this context the electronic conclusion of the contract is also considered "in writing." Processing of personal data takes place only on the basis of the contract. The contract must contain the following:

  • Obligation to us as the controller
  • Duties and rights of the controller
  • Categories of data subjects
  • Types of personal data
  • Nature and purpose of data processing
  • Subject matter and duration of data processing
  • Location of data processing

Furthermore, the contract contains all obligations of the data processor. The most important obligations are:

  • to ensure data security measures
  • to take appropriate technical and organizational measures to protect the rights of the data subject
  • to maintain a data processing register
  • to cooperate with the data protection supervisory authority upon request
  • to conduct a risk analysis in relation to the personal data received
  • Sub-processors may only be engaged with the controller's written approval

How such a DPA looks in practice, you can see, for example, at https://www.wko.at/service/wirtschaftsrecht-gewerberecht/eu-dsgvo-mustervertrag-auftragsverarbeitung.html ansehen. A sample contract is presented here.

Cookies

Cookie summaryData subjects: visitors to the website
Purpose: depends on the respective cookie. You can find more details below or from the software provider that sets the cookie.
Processed data: depends on the cookie used. You can find more details below or from the software provider that sets the cookie.
Storage duration: depends on the respective cookie, and can range from hours to years
⚖️ Legal basis: Art. 6(1)(a) GDPR (consent), Art. 6(1)(f) GDPR (legitimate interests)

What are cookies?

Our website uses HTTP cookies to store user-specific data.
Below we explain what cookies are and why they are used so that you can better understand the following privacy policy.

Whenever you browse the internet, you use a browser. Well-known browsers include Chrome, Safari, Firefox, Internet Explorer and Microsoft Edge. Most websites store small text files in your browser. These files are called cookies.

One thing is undeniable: cookies are really useful little helpers. Almost all websites use cookies. More precisely, they are HTTP cookies, since there are also other cookies for other purposes. HTTP cookies are small files that our website stores on your computer. These cookie files are automatically placed in the cookie folder, basically the 'brain' of your browser. A cookie consists of a name and a value. When defining a cookie, one or more attributes must also be specified.

Cookies store certain user data about you, such as language or personal page settings. When you revisit our site, your browser sends the 'user-related' information back to our site. Thanks to cookies, our website knows who you are and offers you the settings you are used to. In some browsers each cookie has its own file, while in others, such as Firefox, all cookies are stored in a single file.

The following graphic shows a possible interaction between a web browser (e.g. Chrome) and the web server. The web browser requests a website and receives a cookie from the server, which the browser uses again when another page is requested.

HTTP cookie interaction between browser and web server

There are both first-party cookies and third-party cookies. First-party cookies are created directly by our site, while third-party cookies are created by partner websites (e.g., Google Analytics). Each cookie must be evaluated individually, as each cookie stores different data. The expiration time of a cookie also varies from a few minutes to a few years. Cookies are not software programs and do not contain viruses, Trojans, or other "malware." Cookies also cannot access information on your PC.

For example, cookie data can look like this:

Name: _ga
Value: GA1.2.1326744211.152111824141-9
Purpose: Distinguishing website visitors
Expiration date: after 2 years

A browser should be able to support these minimum sizes:

  • At least 4096 bytes per cookie
  • At least 50 cookies per domain
  • At least 3000 cookies in total

What types of cookies are there?

The question of which cookies we use in particular depends on the services used and is clarified in the following sections of the privacy policy. At this point, we would like to briefly discuss the different types of HTTP cookies.

There are 4 types of cookies:

Essential cookies
These cookies are necessary to ensure the basic functions of the website. For example, they are needed when a user adds a product to the shopping cart, then continues browsing other pages and only later goes to checkout. These cookies prevent the shopping cart from being cleared even if the user closes their browser window.

Functional cookies
These cookies collect information about user behavior and whether the user encounters any error messages. In addition, these cookies are used to measure load times and how the website behaves in different browsers.

Targeted cookies
These cookies provide a better user experience. For example, entered locations, font sizes, or form data are saved.

Advertising cookies
These cookies are also called targeting cookies. They are used to deliver individually tailored ads to the user. That can be very useful, but also very annoying.

When you first visit a website, you are usually asked which of these types of cookies you want to allow. And of course this decision is also stored in a cookie.

If you want to learn more about cookies and don't shy away from technical documentation, we recommend https://datatracker.ietf.org/doc/html/rfc6265, the Request for Comments of the Internet Engineering Task Force (IETF) called "HTTP State Management Mechanism".

Purpose of processing via cookies

The purpose ultimately depends on the specific cookie. You can find more details below or from the software vendor that sets the cookie.

What data is processed?

Cookies are small helpers for many different tasks. Unfortunately, it is not possible to generalize which data is stored in cookies, but we will inform you in the following privacy policy about the data processed or stored.

Storage duration of cookies

The storage period depends on the respective cookie and is specified in more detail below. Some cookies are deleted after less than an hour, while others can remain stored on a computer for several years.

You can also influence the storage period yourself. You can manually delete all cookies at any time through your browser (see also "Right to object" below). Furthermore, cookies that are based on consent will be deleted at the latest after you withdraw your consent, whereby the lawfulness of the storage up to that point remains unaffected.

Right to object – how can I delete cookies?

Whether and how you want to use cookies is up to you. Regardless of which service or website the cookies come from, you always have the option to delete, disable, or only partially allow cookies. For example, you can block third‑party cookies while allowing all other cookies.

If you want to find out which cookies have been stored in your browser, or if you want to change or delete cookie settings, you can find this in your browser settings:

Chrome: Delete, enable, and manage cookies

Safari: Manage cookies and website data with Safari

Firefox: Delete cookies to remove data that websites have stored on your computer

Internet Explorer: Deleting and managing cookies

Microsoft Edge: Deleting and managing cookies

If you generally do not want any cookies, you can set your browser to always inform you when a cookie is to be set. This allows you to decide for each individual cookie whether you want to allow it or not. The procedure varies depending on the browser. It is best to search for instructions on Google using the search term “delete cookies Chrome” or “disable cookies Chrome” in the case of a Chrome browser.

Legal basis

Since 2009, there have been the so-called “cookie guidelines”. These state that the storage of cookies requires your Consent (Article 6 (1) (a) GDPR). However, there are still very different reactions to these guidelines within EU countries. In Austria, this directive was implemented in § 96 (3) of the Telecommunications Act (TKG). In Germany, the cookie guidelines were not implemented as national law. Instead, the implementation of this directive largely took place in § 15 (3) of the Telemedia Act (TMG).

For strictly necessary cookies, even if there is no consent, there are legitimate interests (Article 6(1)(f) GDPR), which in most cases are of an economic nature. We want to provide website visitors with a pleasant user experience, and for that certain cookies are often strictly necessary.

To the extent that cookies that are not strictly necessary are used, this only happens with your consent. The legal basis for this is Art. 6(1)(a) GDPR.

In the following sections you will be informed in more detail about the use of cookies, provided that the software used employs cookies.

Web hosting introduction

Web hosting summaryData subjects: visitors to the website
Purpose: professional hosting of the website and safeguarding its operation
Processed data: IP address, time of the website visit, browser used and other data. You can find more details below or from the respective web hosting provider.
Retention period: depends on the respective provider, but usually 2 weeks
⚖️ Legal basis: Art. 6(1)(f) GDPR (legitimate interests)

What is web hosting?

When you visit websites nowadays, certain information — including personal data — is automatically generated and stored, as is the case on this website. These data should be processed as sparingly as possible and only for a justified reason. By "website" we mean the entirety of all web pages under a domain, i.e. everything from the homepage to the very last subpage (like this one). By "domain" we mean, for example, beispiel.de or musterbeispiel.com.

If you want to view a website on a computer, tablet or smartphone, you use a program called a web browser. You probably know some web browsers by name: Google Chrome, Microsoft Edge, Mozilla Firefox and Apple Safari. We simply call them browsers or web browsers.

To display the website, the browser has to connect to another computer where the website's code is stored: the web server. Running a web server is a complex and demanding task, which is why it is usually handled by professional providers. They offer web hosting and thus ensure reliable and error-free storage of website data. A lot of technical terms, but please hang on — it will get better!

When the browser on your computer (desktop, laptop, tablet or smartphone) establishes a connection and while data is being transferred to and from the web server, personal data may be processed. On the one hand your computer stores data; on the other hand the web server must also store data for a period of time to ensure proper operation.

A picture is worth a thousand words, so the following graphic illustrates the interaction between the browser, the internet and the hosting provider.

Browsers and web servers

Why do we process personal data?

The purposes of data processing are:

  1. Professional hosting of the website and securing of operations
  2. to maintain operational and IT security
  3. Anonymous analysis of access behavior to improve our offering and, where applicable, for law enforcement or pursuing claims

What data is processed?

Even while you are visiting our website right now, our web server, that is the computer on which this website is stored, usually automatically stores data such as

  • the complete internet address (URL) of the accessed webpage
  • browser and browser version (e.g. Chrome 87)
  • the operating system used (e.g. Windows 10)
  • the address (URL) of the previously visited page (referrer URL) (e.g. \"https://www.beispielquellsite.de/vondabinichgekommen/)
  • the hostname and IP address of the device from which access is made (e.g. COMPUTERNAME and 194.23.43.121)
  • Date and time
  • in files, the so-called web server log files

How long are data stored?

As a rule, the above-mentioned data are stored for two weeks and are then automatically deleted. We do not disclose these data, but we cannot rule out that authorities may access them in the event of unlawful conduct.

In short: Your visit is logged by our provider (the company that runs our website on special computers (servers)), but we do not share your data without consent!

Legal basis

The lawfulness of the processing of personal data within the scope of web hosting is based on Art. 6(1)(f) GDPR (protection of legitimate interests), since the use of professional hosting with a provider is necessary to present the company on the Internet in a secure and user-friendly manner and, where applicable, to pursue and follow up attacks and claims arising therefrom.

In most cases, there is a data processing agreement between us and the hosting provider in accordance with Art. 28 et seq. GDPR, which ensures compliance with data protection and guarantees data security.

World4You privacy policy

We use World4You for our website, among other things as a web hosting provider. The service provider is the Austrian company World4You Internet Services GmbH, Hafenstraße 35, 4020 Linz, Austria.

To learn more about the data processed through the use of World4You, see the privacy policy at https://www.world4you.com/de/unternehmen/datenschutzerklaerung.html.

Data Processing Agreement (DPA) World4You

In accordance with Article 28 of the General Data Protection Regulation (GDPR), we have concluded a data processing agreement (DPA) with World4You (World4You Internet Services GmbH, Hafenstraße 35 , 4020 Linz, Austria). What exactly a DPA is, and above all what must be included in a DPA, can be read in our general section “Data Processing Agreement (DPA)”.

This contract is legally required because World4You processes personal data on our behalf. It clarifies that World4You may process data it receives from us only on our instructions and must comply with the GDPR. You can find the link to the data processing agreement (DPA) at https://www.world4you.com/faq/de/dsgvo/faq.stellt-world4you-eine-vereinbarung-zur-auftragsverarbeitung-zur-verfuegung.html.

Web design introduction

Web design privacy policy summaryData subjects: visitors to the website
Purpose: Improving the user experience
Processed data: Which data is processed depends heavily on the services used. Usually this includes the IP address, technical data, language settings, browser version, screen resolution and the name of the browser. You can find more details in the respective web design tools used.
Storage duration: dependent on the tools used
⚖️ Legal basis: Art. 6(1)(a) GDPR (consent), Art. 6(1)(f) GDPR (legitimate interests)

What is web design?

We use various tools on our website that serve our web design. Web design is not, as is often assumed, only about making our website look nice, but also about functionality and performance. Of course, the right appearance of a website is also one of the major goals of professional web design. Web design is a sub-discipline of media design and deals with both the visual and the structural and functional design of a website. The aim is to improve your experience on our website through web design. In web design jargon this is referred to as user experience (UX) and usability. User experience comprises all impressions and experiences that a website visitor has on a website. A subset of user experience is usability. This concerns the user-friendliness of a website. The emphasis here is on ensuring that content, subpages or products are clearly structured and that you can find what you are looking for quickly and easily. To provide you with the best possible experience on our website, we also use so-called third-party web design tools. Under the category “web design” in this privacy policy are therefore all services that improve the design of our website. These can be, for example, fonts, various plugins or other embedded web design functions.

Why do we use web design tools?

How you take in information on a website depends heavily on the structure, functionality and visual perception of the website. For this reason, good and professional web design has become increasingly important to us. We are constantly working to improve our website and also see this as an additional service for you as a website visitor. Furthermore, an attractive and well-functioning website also has economic benefits for us. After all, you will only visit us and use our services if you feel completely comfortable.

What data are stored by web design tools?

When you visit our website, web design elements may be embedded in our pages that can also process data. Exactly which data this is depends, of course, largely on the tools used. Further below you can see exactly which tools we use for our website. For more information about data processing, we also recommend reading the respective privacy policy of the tools used. There you will usually find out which data are processed, whether cookies are used, and how long the data are retained. For example, fonts such as Google Fonts automatically transmit information such as language settings, IP address, browser version, browser screen resolution, and browser name to Google's servers.

Duration of data processing

How long data are processed is very individual and depends on the web design elements used. If cookies are used, for example, the retention period can be as short as one minute or it can last several years. Please inform yourself on this. To that end, we recommend both our general section on cookies and the privacy policies of the tools used. There you will generally learn exactly which cookies are used and what information is stored in them. Google Font files, for example, are stored for one year. This is intended to improve a website's loading time. In principle, data are always retained only as long as is necessary to provide the service. Under legal requirements, data may be stored for a longer period.

Right to object

You also have the right and the possibility at any time to withdraw your consent to the use of cookies or third parties. This works either via our cookie management tool or via other opt-out functions. You can also prevent data collection by cookies by managing, disabling, or deleting cookies in your browser. However, among web design elements (mostly fonts) there are also data that cannot be deleted quite so easily. That is the case when data are automatically collected on a page request and transmitted to a third party (such as Google). In that case, please contact the support of the respective provider. In the case of Google, you can reach support at https://support.google.com/?hl=de.

Legal basis

If you have consented to the use of web design tools, the legal basis for the corresponding data processing is that consent. According to Art. 6(1)(a) GDPR (consent), this consent constitutes the legal basis for the processing of personal data, as may occur when data are collected by web design tools. On our part, there is also a legitimate interest in improving the web design on our website. After all, only then can we provide you with an attractive and professional web offering. The corresponding legal basis for that is Art. 6(1)(f) GDPR (legitimate interests). Nevertheless, we only use web design tools to the extent that you have given your consent. We want to emphasize that here once again.

Information about specific web design tools — if available — can be found in the following sections.

Google Fonts Privacy Policy

Google Fonts Privacy Policy SummaryData subjects: visitors to the website
Purpose: Optimization of our service
Processed data: Data such as IP address and CSS and font requests
More details can be found below in this privacy policy.
Storage duration: Font files are stored by Google for one year
⚖️ Legal basis: Art. 6(1)(a) GDPR (consent), Art. 6(1)(f) GDPR (legitimate interests)

What are Google Fonts?

On our website we use Google Fonts. These are the “Google fonts” of the company Google Inc. For the European region the company Google Ireland Limited (Gordon House, Barrow Street Dublin 4, Ireland) is responsible for all Google services.

You do not need to register or provide a password to use Google fonts. Furthermore, no cookies are stored in your browser. The files (CSS, fonts) are requested via the Google domains fonts.googleapis.com and fonts.gstatic.com. According to Google, requests for CSS and fonts are completely separate from all other Google services. If you have a Google account, you need not worry that your Google account data will be transmitted to Google while using Google Fonts. Google records the usage of CSS (Cascading Style Sheets) and the fonts used and stores this data securely. We will look in more detail at exactly how the data storage works.

Google Fonts (formerly Google Web Fonts) is a directory with over 800 fonts that Google make available to their users free of charge.

Many of these fonts are published under the SIL Open Font License, while others were released under the Apache License. Both are free software licenses.

Why do we use Google Fonts on our website?

With Google Fonts we can use fonts on our own website without having to upload them to our own server. Google Fonts is an important building block for keeping the quality of our website high. All Google fonts are automatically optimized for the web, which saves data volume and is a major advantage especially for use on mobile devices. When you visit our site, the small file size ensures fast loading times. Furthermore, Google Fonts are secure web fonts. Different rendering systems in various browsers, operating systems and mobile devices can lead to errors. Such errors can partially distort text or entire web pages visually. Thanks to the fast Content Delivery Network (CDN), there are no cross-platform problems with Google Fonts. Google Fonts supports all common browsers (Google Chrome, Mozilla Firefox, Apple Safari, Opera) and works reliably on most modern mobile operating systems, including Android 2.2+ and iOS 4.2+ (iPhone, iPad, iPod). We therefore use Google Fonts so that we can present our entire online service as attractively and consistently as possible.

What data does Google store?

When you visit our website, the fonts are fetched from a Google server. Because of this external request, data is transmitted to Google’s servers. In this way, Google can also detect that you or your IP address visited our website. The Google Fonts API was developed to limit the use, storage, and collection of end-user data to what is necessary for the proper provision of fonts. By the way, API stands for 'Application Programming Interface' and is used, among other things, to transmit data in the software field.

Google Fonts stores CSS and font requests securely with Google and is therefore protected. From the collected usage statistics, Google can determine how popular individual fonts are. Google publishes the results on internal analytics pages, such as Google Analytics. Google also uses data from its own web crawler to determine which websites use Google Fonts. These data are published in the Google Fonts BigQuery database. Businesses and developers use the Google web service BigQuery to analyze and process large amounts of data.

However, it should be noted that with every Google Font request information such as language settings, IP address, browser version, browser screen resolution and browser name are automatically transmitted to Google's servers. Whether these data are also stored is not clearly ascertainable and is not communicated unambiguously by Google.

How long and where are the data stored?

Google stores requests for CSS assets on its servers for one day; these servers are mainly located outside the EU. This allows us to use the fonts via a Google stylesheet. A stylesheet is a template that lets you easily and quickly change, for example, the design or font of a website.

The font files are stored by Google for one year. Google's aim with this is to fundamentally improve the loading time of websites. If millions of websites reference the same fonts, they are cached after the first visit and appear immediately on all other websites visited later. Sometimes Google updates font files to reduce file size, increase language coverage and improve design.

How can I delete my data or prevent data storage?

The data that Google stores for one day or one year cannot simply be deleted. The data are automatically transmitted to Google when the page is accessed. To be able to delete this data prematurely, you must contact Google Support at https://support.google.com/?hl=de&tid=111824141 kontaktieren. You can prevent data storage in this case only by not visiting our site.

Unlike other web fonts, Google allows us unrestricted access to all fonts. So we can access an unlimited sea of fonts and thus get the optimum for our website. For more on Google Fonts and other questions, see https://developers.google.com/fonts/faq?tid=111824141. There Google does address data protection–relevant matters, but truly detailed information about data storage is not included. It is relatively difficult to obtain really precise information from Google about stored data.

Legal basis

If you have consented to the use of Google Fonts, the legal basis for the corresponding data processing is that consent. This consent constitutes, according to Art. 6(1)(a) GDPR (consent) die Rechtsgrundlage für die Verarbeitung personenbezogener Daten, wie sie bei der Erfassung durch Google Fonts vorkommen kann, dar.

From our side there is also a legitimate interest in using Google Font to optimize our online service. The corresponding legal basis for this is Art. 6(1)(f) GDPR (Legitimate interests). We nevertheless only use Google Font to the extent that you have given consent.

Google processes data about you, among other places, in the USA. We point out that, in the opinion of the European Court of Justice, there is currently no adequate level of protection for data transfers to the USA. This can involve various risks to the lawfulness and security of data processing.

As the basis for data processing with recipients located in third countries (outside the European Union, Iceland, Liechtenstein, Norway — in particular the USA) or for transfers of data to such countries, Google uses so‑called Standard Contractual Clauses (= Art. 46(2) and (3) GDPR). Standardvertragsklauseln (Standard Contractual Clauses – SCC) are template clauses provided by the European Commission and are intended to ensure that your data comply with European data protection standards even when they are transferred to and stored in third countries (for example, the USA). By these clauses, Google undertakes, when processing your relevant data, to observe the European level of data protection, even if the data are stored, processed, and managed in the USA. These clauses are based on an implementing decision of the European Commission. You can find the decision and the corresponding Standard Contractual Clauses, among other places, here: https://eur-lex.europa.eu/eli/dec_impl/2021/914/oj?locale=de

The Google Ads Data Processing Terms (Google Ads Data Processing Terms), which also correspond to the Standard Contractual Clauses for Google Fonts, are available at https://business.safety.google/adsprocessorterms/.

Information on which data Google generally collects and what those data are used for can also be found at https://www.google.com/intl/de/policies/privacy/ read more.

Explanation of terms used

We are always committed to drafting our privacy policy as clearly and understandably as possible. However, this is not always easy, especially with technical and legal topics. It often makes sense to use legal terms (e.g., personal data) or certain technical expressions (e.g., cookies, IP address). But we do not want to use these without explanation. Below you will find an alphabetical list of important terms used that we may not have covered sufficiently in the previous privacy policy. If these terms have been taken from the GDPR and are definitions, we will also cite the GDPR texts here and, if necessary, add our own explanations.

Aufsichtsbehörde

Definition pursuant to Article 4 of the GDPR

For the purposes of this Regulation, the expression means:


„Supervisory authority“ an independent public authority established by a Member State pursuant to Article 51;

Explanation:“Supervisory authorities” are always state, independent bodies that are, in certain cases, empowered to issue directives. They serve to carry out the so-called state supervision and are located in ministries, specialized departments, or other authorities. For data protection in Austria there is an Austrian Data Protection Authority, for Germany there is a separate data protection authority for each federal state.

Data processor

Definition pursuant to Article 4 of the GDPR

For the purposes of this Regulation, the expression means:


„Data processor“a natural or legal person, public authority, agency or other body which processes personal data on behalf of the controller;

Explanation: We, as the company and website owner, are responsible for all data that we process about you. In addition to the controllers, there may also be so-called processors. These include any company or person that processes personal data on our behalf. Processors can therefore include, in addition to service providers such as tax advisors, hosting or cloud providers, payment or newsletter providers, or large companies such as Google or Microsoft.

Relevant supervisory authority

Definition pursuant to Article 4 of the GDPR

For the purposes of this Regulation, the expression means:


„competent supervisory authority“ a supervisory authority that is affected by the processing of personal data because

a)

the controller or the processor is established in the territory of the Member State of that supervisory authority,

b)

this processing has or may have a substantial impact on data subjects residing in the Member State of that supervisory authority or

c)

a complaint has been lodged with that supervisory authority;

Explanation: In Germany, each federal state has its own data protection supervisory authority. If your company's registered office (main establishment) is therefore in Germany, the respective supervisory authority of the federal state is generally your point of contact. In Austria there is only one for the entire country "Data Protection Supervisory Authority".

Consent

Definition pursuant to Article 4 of the GDPR

For the purposes of this Regulation, the expression means:


"Consent"of the data subject: any freely given, specific, informed and unambiguous indication of the data subject's wishes by which the data subject, by a statement or by a clear affirmative action, signifies agreement to the processing of personal data relating to him or her;

Explanation: On websites, such consent is usually obtained via a cookie consent tool. You probably know it. Whenever you visit a website for the first time, you are typically asked via a banner whether you agree to or consent to the processing of data. You can usually also make individual settings and thus decide for yourself which data processing you allow and which you do not. If you do not consent, no personal data about you may be processed. In principle, consent can of course also be given in writing, i.e., not via a tool.

Personal data

Definition pursuant to Article 4 of the GDPR

For the purposes of this Regulation, the expression means:


“personal data”

all information relating to an identified or identifiable natural person (hereinafter “data subject”); a natural person is regarded as identifiable if they can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier, or to one or more specific characteristics that are expressions of the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person;

Explanation:Personal data are therefore any data that can identify you as an individual. These typically include data such as:

  • Name
  • Address
  • Email address
  • Postal address
  • Phone number
  • Date of birth
  • Identification numbers such as social security number, tax identification number, ID card number, or matriculation number
  • Bank data such as account number, credit information, account balances, etc.

According to the European Court of Justice (ECJ), your IP address is counted among personal data. IT experts can, based on your IP address, determine at least the approximate location of your device and, consequently, you as the subscriber. Therefore, storing an IP address also requires a legal basis within the meaning of the GDPR. There are also so-called „special categories“ of personal data that are also particularly sensitive. These include:

  • racial and ethnic origin
  • political opinions
  • religious or philosophical beliefs
  • trade union membership
  • genetic data, for example data obtained from blood or saliva samples
  • biometric data (that is information about psychological, physical or behavioral characteristics that can identify a person).
    Health data
  • Data concerning sexual orientation or sex life

Profiling

Definition pursuant to Article 4 of the GDPR

For the purposes of this Regulation, the expression means:


„Profiling“ jede Art der automatisierten Verarbeitung personenbezogener Daten, die darin besteht, dass diese personenbezogenen Daten verwendet werden, um bestimmte persönliche Aspekte, die sich auf eine natürliche Person beziehen, zu bewerten, insbesondere um Aspekte bezüglich Arbeitsleistung, wirtschaftliche Lage, Gesundheit, persönliche Vorlieben, Interessen, Zuverlässigkeit, Verhalten, Aufenthaltsort oder Ortswechsel dieser natürlichen Person zu analysieren oder vorherzusagen;

Explanation: Beim Profiling werden verschiedene Informationen über eine Person zusammengetragen, um daraus mehr über diese Person zu erfahren. Im Webbereich wird Profiling häufig für Werbezwecke oder auch für Bonitätsprüfungen angewandt. Web- bzw. Werbeanalyseprogramme sammeln zum Beispiel Daten über Ihre Verhalten und Ihre Interessen auf einer Website. Daraus ergibt sich ein spezielles Userprofil, mit dessen Hilfe Werbung gezielt an eine Zielgruppe ausgespielt werden kann.

Controller

Definition pursuant to Article 4 of the GDPR

For the purposes of this Regulation, the expression means:


„Verantwortlicher“ die natürliche oder juristische Person, Behörde, Einrichtung oder andere Stelle, die allein oder gemeinsam mit anderen über die Zwecke und Mittel der Verarbeitung von personenbezogenen Daten entscheidet; sind die Zwecke und Mittel dieser Verarbeitung durch das Unionsrecht oder das Recht der Mitgliedstaaten vorgegeben, so kann der Verantwortliche beziehungsweise können die bestimmten Kriterien seiner Benennung nach dem Unionsrecht oder dem Recht der Mitgliedstaaten vorgesehen werden;

Explanation:In our case we are responsible for the processing of your personal data and therefore the 'controller'. If we transfer collected data to other service providers for processing, they are 'processors'. A 'Data Processing Agreement (DPA)' must be signed for this.

Processing

Definition pursuant to Article 4 of the GDPR

For the purposes of this Regulation, the expression means:


'Processing'

any operation or set of operations which is performed on personal data or on sets of personal data, whether or not by automated means, such as collection, recording, organization, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure or destruction;

Note: When we refer to processing in our privacy policy, we mean any kind of data processing. As mentioned above in the original GDPR definition, this includes not only collection but also storage and further processing of data.

Closing remarks

Congratulations! If you are reading these lines, you have really 'fought' your way through our entire privacy policy or at least scrolled this far. As you can see from the length of our privacy policy, we take the protection of your personal data by no means lightly.
It is important to us to inform you to the best of our knowledge and belief about the processing of personal data. We not only want to tell you which data is processed, but also explain the reasons for using various software programs. Privacy policies usually sound very technical and legal. Since most of you are not web developers or lawyers, we wanted to take a different linguistic approach and explain the matter in simple and clear language. Of course this is not always possible given the subject matter. Therefore, the most important terms will be explained in more detail at the end of the privacy policy.
If you have any questions about data protection on our website, please do not hesitate to contact us or the data controller. We wish you a pleasant time and hope to welcome you back to our website soon.

All texts are protected by copyright.

Source: Created with the Datenschutz Generator by AdSimple

Anonymous job metrics and firmenwebseiten.at

For job listings published via firmenwebseiten.at, we count per listing and calendar day exclusively page views and clicks to apply. For this purpose we do not store IP addresses, cookies, referrers, user-agent data, applicant data, or application targets.

The aggregated counters are transmitted to firmenwebseiten.at with a signature and displayed there to the respective employer as a reach report. Technical Outbox events that were successfully delivered are deleted after 30 days; events that permanently failed are deleted at the latest after 180 days.