Information on data processing in accordance with Articles 13 and 14 of the General Data Protection Regulation (GDPR)
2. Which data are processed and from what sources do these data originate?
We process the personal data that we receive from you in the course of the initiation of business transactions and the business relationship with you. In addition, we also process data that we have received legitimately from publicly accessible sources (e.g. company register, register of associations, land register, media) or from other companies with whom we have a permanent business relationship.
The personal data include:
- Your main/contact details such as: first and last name, title, address, contact details (email address, telephone number, fax), date of birth, data from proof of identity provided (identification document), bank details, company, company register number, VAT ID, company number, address, contact person’s contact details (email address, telephone number, fax), bank details
- Beyond this, we also use the following additional personal data: information on the nature and content of our business relationship such as contractual data, order data, sales and document data, customer and supplier history, consultation documentation, documentation data (e.g. consultation records), image data, information from your electronic correspondence with our company (e.g. IP address, login details), other data that we have received from you in the context of our business relationship.
3. For which purposes and on what legal basis are the data processed?
We process your personal data in accordance with the provisions of the General Data Protection Regulation and the Austrian Data Protection Act in the amended version:
- to fulfil (pre)contractual obligations (Art. 6 (1) (b) GDPR):
The processing of personal data takes place for the statutory performance of our services, for procurement purposes or for membership administration. The data are processed in particular for the initiation of business transactions and for the performance of the contracts as well as for the fulfilment of the statutory purposes.
- to fulfil legal obligations (Art. 6 (1) (c) GDPR):
The processing of personal data is necessary for the purpose of fulfilling various legal obligations (e.g. arising from the Cooperatives Act, Austrian Banking Act, Austrian Commercial Code or the Federal Fiscal Code).
- to protect legitimate interests (Art. 6 (1) (f) GDPR):
Based on a weighing up of interests, data processing may take place beyond the actual fulfilment of the contract for the protection of legitimate interests of ours or of third parties. In any case, in the following cases, data processing takes place to protect legitimate interests:
- Video monitoring of the publicly accessible rooms for the protection of employees and visitors
- Measures regarding business management and the continued development of services
- Running the functionary and information database as part of the membership service
- Measures to protect the Ennstal Alpine Cooperative and its subsidiaries from behaviour that violates the contract or the law, e.g. access controls
- As part of the assertion, exercise or defence of legal claims
- Within the scope of your consent (Art. 6 (1) (a) GDPR):
If you have granted us your consent to process your personal data, processing will take place only in accordance with the purposes stated in the declaration of consent and to the extent agreed upon therein. Any consent granted may be revoked at any time with effect for the future, e.g. the consent to the sending of our newsletter or to the transmission of data to third parties. To this end, please write to our email address provided in Point 1.
4. Who receives my data?
If we commission a processor, we will nevertheless remain responsible for the protection of your data. All processors are bound by contract to handle your data confidentially and to process them only in the context of rendering the service. The processors commissioned by us will receive your data if they require the data for the fulfilment of their respective service. These are IT service providers who we require for the operation and security of our IT system.
In the event that a legal obligation exists or in the context of legal proceedings, authorities and courts as well as external auditors may be the recipients of your personal data.
Furthermore, for the purpose of fulfilling the contract, insurance companies, banks, lawyers and tax advisers and service providers may be the recipients of your personal data.
5. How long will my data be stored?
We will process your personal data until the termination of the business relationship or until the expiry of the applicable warranty, limitation and legal retention periods (arising, for example, from the Commercial Code or Federal Fiscal Code); beyond this, until the termination of any legal disputes in which the data are required as evidence.
6. What data protection rights do I have?
At all times, you have a right to information, rectification, erasure or restriction of the processing of your stored data, a right of objection to the processing as well as a right to data portability and to complaints in accordance with the requirements of the Data Protection Act.
6.1 Right to information
You may request information from us regarding whether and to what extent we process your data. ;
6.2 Right to rectification
If we process your personal data and these are incomplete or inaccurate, you may request that we rectify or complete these data at any time.
6.3 Right to erasure
You may request that we erase your personal data if we are processing these unlawfully or if the processing disproportionately impinges on your legitimate protection interests. Please note that there may be reasons preventing immediate erasure, e.g. in the event of legally stipulated retention obligations.
6.4 Right to restriction of processing
You may request that we restrict the processing of your data if
- you contest the accuracy of the data, namely for a duration that enables us to check the accuracy of the data,
- the processing of the data is unlawful, but you reject its erasure and instead request a restriction of data use,
- we no longer require the data for the intended purpose, but you still require these data for the assertion or defence of legal claims, or
- you have objected to the processing of the data.
6.5 Right to data portability
You may request that we make the data you have provided to us available to you in a structured, common and machine-readable format, and that you may transmit these data to another data controller without impediment by us, if
- we process these data on the basis of revocable consent granted by you or for the fulfilment of a contract between us, and
- this processing takes place with the aid of automated procedures.
- Where technically feasible, you may request that we transmit your data to another data controller directly.
6.6 Right to objection
If we process your data due to legitimate interests, you may object to this data processing at any time for reasons arising from your particular situation; this also applies to profiling based on these provisions. We will then stop processing your data, unless we are able to prove compelling legitimate grounds for the processing that outweigh your interests, rights and freedoms or if the processing serves the assertion, exercise or defence of legal claims. You may object to the processing of your data for the purpose of direct advertising at any time without providing reasons.
6.7 Right to lodge a complaint
If you believe that we are in violation of Austrian or European data protection law in the processing of your data, we ask that you get in contact with us to clarify any questions you may have. Naturally, you also have the right to lodge a complaint with the Austrian Data Protection Authority, Wickenburggasse 8, 1080 Vienna, or with a supervisory authority within the EU.
7. With whom do I get in touch to assert these rights?
If you wish to assert one of the rights listed against us, please write to our email address provided in Point 1. In case of doubt, we may require additional information in order to confirm your identity. This serves to protect your rights and your privacy.
8. Am I obligated to provide data?
The processing of personal data is necessary for the conclusion and fulfilment of the contract you have entered into with us. If you do not provide us with these data, generally, we will have to reject the conclusion of the contract or the performance of the order, or will no longer be able to implement an existing contract and will thus have to terminate it. However, you are not obligated to grant your consent to the processing of data that are not relevant or are not legally required for the fulfilment of the contract.
9. Does profiling occur?
“Profiling” is any kind of automated processing of personal data that consists of these personal data being used to evaluate certain personal aspects regarding a natural person, in particular to analyse or predict aspects regarding work performance, economic situation, health, personal preferences, interests, reliability, behaviour, place of residence or a change of residence of this natural person. In the sense of the GDPR, no automated decision-making, including profiling, takes place.
10. Are the personal data transmitted to a third country, or is the transmission thereof planned?
In principle, we do not transmit any data to a third country. Transmission takes place only in individual cases based on an adequacy decision by the European Commission, on standard contractual clauses, on appropriate safeguards or on your express consent.
11. Application data
If you send us your application, your application data will be made available only to the persons involved in and authorised for the application process. Your application data will be stored for a maximum of nine months, in order to also be able to offer you alternative positions where applicable.
12. Cookies and tracking tools
12.2 Tracking tools and traffic analysis
The website uses analytical tools to collect general information on how visitors behave when they use the website. This includes, for example, pages called up, length of stay, referring pages as well as general information on your computer system such as operating system, screen resolution, browser used and so on. All data collected are saved anonymously and cannot be associated with your person. If you do not agree with this anonymised recording of your usage behaviour, you may prevent this by deactivating cookies in your browser.
Without your express consent, we will not use tracking tools to do the following without being detected:
- collect personal data on you,
- transmit such data to third-party providers and marketing platforms or
- associate the data with your personal data (name, address etc.).
You have the option to subscribe to our newsletter by registering. If you have registered for the newsletter on our website, we will send you a message via email with a link to confirm the registration. You may cancel the newsletter subscription at any time via a link embedded directly within the newsletter. We will then immediately delete your data from our newsletter mailing list.