PRIVACY POLICY
1.

General

We at Maetzler Rechtsanwalts GmbH & Co KG (“PRIGHTER”) value your privacy and are committed totake care of your data, and we take this responsibility very seriously. Please take the time to carefully
read our Privacy Policy, which explains why we collect your Personal Data and how we process it when
you

▪
▪
▪
▪

express an interest in our services (see, in particular, Section 3.1),
are our client (see, in particular, Section 3.2 below)
are our supplier or business partner (see, in particular, Section 3.3 below), or
apply for a position with us (see, in particular, Section 3.4 below).

PRIGHTER also has a DPO, that
(i)
(ii)
(iii)
(iv)

monitors the compliance of Processing with applicable standards,
is a point of connection with the Data Subject for clarification of issues concerning theProcessing of their information,
collaborates with the supervisory authority,
provides information and advises the Processor or subcontractor of its obligations
regarding privacy and data protection.

Controller

Data Protection Officer (DPO)

Maetzler Rechtsanwalts GmbH & Co KG (“PRIGHTER”)
Schellinggasse 3/10
1010 Vienna
Austria
DPO of Maetzler Rechtsanwalts GmbH & Co KG
Email: dpo@prighter.com

2.

Definitions

Unless otherwise indicated, capitalized terms used in this Privacy Policy are defined in Annex 1. Mostof the definitions are derived from the General Data Protection Regulation (GDPR) which you canaccess from https://eur-lex.europa.eu/eli/reg/2016/679/oj.

3.

How do we process your Personal Data?

We process your data in different ways depending on whether you visit our website or express aninterest in our services, or whether you are our client, supplier, business partner or job applicant:3.1. Processing of Personal Data relating to potential clients
Purpose and legal basis
When you contact us to inquire about our service offering, we process the Personal Data you include
in such a message, especially the contact form on our website, or included in the meta data of such

message to answer and process such inquiry in a precontractual stadium. Such processing is based on
Art 6 para 1 lit (b) GDPR in order to take steps at your request prior to entering into a contract.
Furthermore, we process your Personal Data provided with an inquiry for direct marketing purposes
to convert a potential client into an actual client. Such processing is based on a legitimate interest
according to Art 6 para 1 lit (f) GDPR. You have the right, at all times, to object to the Processing ofyour Personal Data for the purpose of direct marketing, without being required to state your reasons,and can do so by sending us a letter or emailing us at dpo@prighter.com. The Processing of your
Personal Data for the purpose of direct marketing is not required in order to conduct our contractual
relationship.
Upon your request we help you find a suitable partner in your region for privacy related services which
we do not provide. According to such request we forward Personal Data to partners in the region
where the client is looking for assistance.
Personal Data processed
We mainly process the Personal Data you provide us with in a precontractual phase. For all data wecollect from other sources please have a look at point 4.
We collect:
▪
▪
▪
▪
▪
▪
▪
▪
▪

Name
E-mail address
Employment
Other Personal Data a Data Subjects includes in a free text field
IP Address and IP location
Referring (exit pages and URLs)
Number, duration and time of visits (your interaction with the Website)
Search engines, keyphrases and keywords used to find our site
Browser type, type of device, screen size, internet service provider and operating system

RecipientsTo achieve the objectives described above, it may be necessary to disclose your Personal Data to thefollowing Recipients in certain cases. Personal Data may be disclosed by being transferred,disseminated, or provided by other means to:
Recipient
1
2

Data Location

SMAARC GmbHEU
Partners such as law firms or Region requested
privacy consultantspotential client.

byRetention period
The Personal Data will be deleted 6 months after the lead is lost.

Basis for transfer to third
party country
n/a
the Depending on the requestof the potential client.

Summary
PurposeAnswer inquiry
Direct marketing
Referring partners

Legal BasisContract Performance
Legitimate interest
Contract Performance

Recipients1
1
2

Retention
7 years
7 years
7 years3.2. Processing of Personal Data relating to clients:
Purpose and legal basis
Your Personal Data as a client is processed, first and foremost, for the purpose of performing andproviding our PRIGHTER Services. Such processing is based on the performance of a contract according
to Art 6 para 1 lit (b) GDPR.
Besides that, we use your contact information to send you information on our services and invitations
to events as a form of direct marketing. The processing activity is based on legitimate interest (Art 6
para. 1 lit (f) GDPR). You have the right, at all times, to object to the Processing of your Personal Datafor the purpose of direct marketing, without being required to state your reasons, and can do so bysending us a letter or emailing us at dpo@prighter.com. The Processing of your Personal Data for the
purpose of direct marketing is not required in order to conduct our contractual relationship.
When working together with one of your partners or advisors upon your request we may share
Personal Data with such partners.
Processed Personal Data
We mainly process the Personal Data you provide us with. For all data we collect from other sources
please have a look at point 4.
We collect:
▪
▪
▪
▪

Name
E-mail address and other contact details
Employment
Role and function in the company

RecipientsTo achieve the objectives described above, it may be necessary to disclose your Personal Data to thefollowing Recipients in certain cases. Personal Data may be disclosed by being transferred,disseminated, or provided by other means to:
Recipient
1
2

SMAARC GmbH
Partners of the client

Data Location

Basis for transfer to third
party country
EEA
n/a
Region requested by the client. Depending on the requestof the client.

3Stripe Payments
LimitedEurope, EEA

n/a

Retention period
All Data necessary for tax purposes, especially contracts, invoices and other bookkeeping documents
as well as relevant correspondence in relation to our contractual relationship we store for a period often years.
All other data we keep according to commercial law for a period of 7 years.
Summary
PurposeContract
Direct marketing
Client’s partners

Legal BasisContract Performance
Legitimate interest
Contract Performance

Recipients
1-3
1-2
2

Retention
7-10 years
7 years
7-10 years

3.3. Processing of Personal Data relating to suppliers and business partners
Purpose and legal basis
Your Personal Data is processed, first and foremost, for the purpose of concluding, maintaining, andcompleting our contracts regarding PRIGHTER Services. We may refer clients to you or you may referclients to us. We do so based on a cooperation agreement and the processing is based on theperformance of such cooperation agreement (Art 6 para 1 lit (b) GDPR)
Processed Personal Data
We mainly process the Personal Data you provide us with. For all data we collect from other sources
please have a look at point 4.
We collect:
▪
▪
▪
▪
▪

Name
E-mail address and other contact details
Employment
Role and function in the company
Business activity

If your company details include a name of an individual, we may be required that you provide us withyour Personal Data to enable us to enter into a business relationship with you.

RecipientsTo achieve these desired objectives, it may be necessary to disclose your Personal Data to the following
Recipients in certain cases. Personal Data may be disclosed by being transferred, disseminated, or
provided by other means to:1
2
3

Recipient

Registered Office (Country)

SMAARC GmbH
Stripe Payments Europe,
LimitedClients, suppliers andother business partners

EEA
EEA

Basis for transfer to third
party country
n/an/aWorldwide, depending on the explicit consent; necessary toregistered office
perform a contract

Retention period
All Data necessary for tax purposes, especially contracts, invoices and other bookkeeping documents
as well as relevant correspondence in relation to our contractual relationship we store for a period often years.
All other data we keep according to commercial law for a period of 7 years.
Summary
PurposeCooperation

Legal BasisContract Performance

Recipients
1-3

Retention
7-10 years

3.4. Processing of Personal Data relating to applicants:
Purpose and legal basis
We process your Personal Data either▪

to take steps prior to entering into a contract (conclusion of an employment agreement, Art.
6 para. 1 letter b GDPR),▪

on the basis of your explicit consent (Art. 6 para. 1 letter a GDPR) if we would like to keep yourapplication on file for future consideration,▪

and to fulfil our legal obligations (registering you as an employee in the social security system,
Art. 6 para. 1 letter c GDPR).

Your Personal Data are processed for the purpose of completing the application process andregistering you with the social security system when we hire you. If you do not provide us with your
Personal Data, we cannot process your application.

RecipientsTo achieve these desired objectives, it may be necessary to disclose your Personal Data to the following
Recipients in certain cases. Data may be disclosed by being transferred, disseminated, or provided byother means.

1

Recipient

Registered Office (Country)

SMAARC GmbH

EEA

Basis for transfer to third
party country
n/aRetention period
The data of applicants who are not hired will be erased 6 months after the closure of the application.
If the applicant consents to their data being kept on file for future consideration, we do not deletesuch Personal Data.
Summary
PurposeApplication

4.

Legal BasisContract Performance

Recipients1

Retention
6 months

Collection of Personal Data from sources other than the Data Subject
himself or herself (Art 14 GDPR)

Purpose and legal basis
If we process your Personal Data we usually collect Personal Data from you, and it is usually you who
provides us with this Personal Data. Nevertheless, in individual cases, we may also obtain Personal
Data from other sources. These other sources are publicly available, such as information we obtainfrom the Internet. The information we obtain from third sources about you which is stored in oursystems is limited to contact information (e-mail address and telephone number, postal address), yourfunction in the company, your professional career, and your assignment to or responsibility for aparticular company (usually your employer, any affiliated company or for another reason with thisrelated company), if you have not disclosed that information to us as part of the communication. If
you are an applicant, we can also process information about your school history, professional andacademic career as well as about works written by you, from publicly available sources.
However, we usually ask you directly if you can provide us with this information if we could not find it
in your application documents.
This Processing is based on our legitimate interest in a complete set of Personal Data required for
professional communication, the Processing of our mandate, our business relationships and theapplication process, depending on the relationship we have with you (Art 6 para 1 (f) GDPR).

5.

Data security

We handle Personal Data only as permitted by data protection regulations. We use a variety oftechnical and organizational measures to help protect your Personal Data from unauthorized access,disclosure, modification, loss or destruction in accordance with applicable data protection laws.
If we store or process Personal Data, it occurs in a high-security data center. In order to protect the
security of your Personal Data during transfer, we use encryption techniques (e.g., SSL) over HTTPS.
Our servers are secured by firewall and virus protection. Back-up and recovery procedures as well as
roles and authorization policies are a given for us.
When handling Personal Data, our employees are obliged to comply with the regulations of the GDPR.

6.

What are your rights with respect to Processing of Personal Data?

GDPR and other applicable data protection laws protect certain rights for Data Subjects. In particular:
Right of Access - right to obtain confirmation of which of your Personal Data is processed andinformation about it, for instance, which are the purposes of the Processing, what are the conservation
periods, among others.
Right of Rectification - right to request modification of your Personal Data that is inaccurate or request
incomplete Personal Data, such as the address, VAT, email, telephone contacts, or others.
Right to Erasure or "right to be forgotten" - right to erase your Personal Data, provided that there areno valid grounds for its retention, for example in cases where we have to keep the Personal Data tocomply with legal obligation or because a court case is in progress.
Right to Data Portability - right to receive the Personal Data you have provided us in a digital format
of current use and automatic reading or to request the direct transmission of your Personal Data to
another entity that becomes the new responsible for your Personal Data, however only if technicallypossible.
Right to Withdraw Consent or Right of Opposition - right to object or withdraw consent at any timeto Processing, for example in the case of Processing for marketing purposes, provided that nolegitimate interests exist prevailing over your interests, rights and freedoms, such as defending a rightin a judicial process.
Right of Limitation - right to request the limitation of the Processing of your Personal Data, in the formof: (i) suspension of Processing or (ii) limitation of the scope of Processing to certain categories of
Personal Data or purposes of Processing.
Right to object and automated individual decision-making - When the Processing of Personal Data,
including the Processing for the definition of profiles, is exclusively automatic (without humanintervention) and may have effects in your legal sphere or significantly affect it, the Client shall havethe right not to remain subject to any decision based on such automatic Processing, except asotherwise provided by law and shall have the right that we take appropriate measures to safeguard its
rights and freedoms and legitimate interests, including the right to have human intervention indecision making by us, the right to express its point of view or contest the decision taken on the basisof automated individual information Processing.
Right to complain - right to complain to the supervisory authority, in addition to us.
The exercise of rights is free of charge, except in the case of a manifestly unfounded or excessive
request, in which case a reasonable fee may be charged regarding its costs.
The information must be provided in writing but may be given orally if requested. In this case, weshould verify your identity by means other than oral.
The response to requests should be provided within a maximum of 30 days, unless it is a particularlycomplex request.
For Data Subjects in the EU:
We value your data subject rights under GDPR and provide you with an easy way to submit us privacy
related request like a request to access or erase your personal data. If you want to make use of yourdata subject rights, please visit: https://prighter.com/q/16145647
Contact Prighter
Prighter
Maetzler Rechtsanwalts GmbH & Co KG
Attorneys at Law
c/o PRIGHTER
Schellinggasse 3/10, 1010 Vienna, Austria
Please add the following subject to all correspondence:
Prighter ID: 16145647

7.

Changes to our data protection provisions

We reserve the right to modify this Privacy Policy, so it is always in compliance with the current legal
requirements or to implement changes to services in the Privacy Policy, e.g., when introducing newservices. In this case, your future visits to our website will be subject to the updated Privacy Policy.
If you have additional questions regarding the processing of your Personal Data, please feel free tocontact us directly, either by email at dpo@prighter.com or via mail to Maetzler Rechtsanwalts GmbH& Co KG, Schellinggasse 3/10, A-1010 Vienna.

Annex 1
ADM
Consent of theData Subject

Controller

Data Subject

Data Subject
Request (DSR)
General Data
Protection
Regulation(GDPR)

iuro

Personal Data

PRIGHTER
Services
Processing

Processor
Recipient

Automated decision-making
means any freely given, specific, informed and unambiguous indication of theData Subject's wishes by which he or she, by a statement or by a clear affirmative
action, signifies agreement to the Processing of Personal Data relating to him orher;means the natural or legal person, public authority, agency or other body which,alone or jointly with others, determines the purposes and means of theProcessing of Personal Data; where the purposes and means of such Processing
are determined by Union or Member State law, the Controller or the specificcriteria for its nomination may be provided for by Union or Member State law;is any natural person whose Personal Data is being collected, held or processed.
Examples of a Data Subject can be an individual, a customer, a prospect, an
employee, a contact person, etc;
means a formal request by a Data Subject to a Controller to take an action on his
or her Personal Data;
is a regulation in EU law on data protection and privacy in the European Union(EU) and the European Economic Area (EEA); Regulation (EU) 2016/679 of theEuropean Parliament and of the Council of 27 April 2016 on the protection ofnatural persons with regard to the processing of personal data and on the freemovement of such data, and repealing Directive 95/46/EC (General Data
Protection Regulation) https://eur-lex.europa.eu/eli/reg/2016/679/oj
means Maetzler Rechtsanwalts GmbH & Co KG, a company registered under FN
502860a with the companies register of the Vienna commercial court, 1010
Vienna, Austria.
means any information relating to an identified or identifiable natural person('Data Subject'); an identifiable natural person is one who can be identified,directly or indirectly, in particular by reference to an identifier such as a name,an identification number, location data, an online identifier or to one or morefactors specific to the physical, physiological, genetic, mental, economic, culturalor social identity of that natural person;
Means the Data Privacy Request Management tool (PrighterDSR) and further
tools as provided by Maetzler Rechtsanwalts GmbH & Co KG under the
trademark PRIGHTER.
means any operation or set of operations which is performed on Personal Data,
whether or not by automated means, such as collection, recording, organisation,
structuring, storage, adaptation or alteration, retrieval, consultation, use,
disclosure by transmission, dissemination or otherwise making available,alignment or combination, restriction, erasure or destruction;means a natural or legal person, public authority, agency or other body which
processes Personal Data on behalf of the Controller;means a natural or legal person, public authority, agency or another body, towhich the Personal Data are disclosed, whether a third party or not. However,public authorities which may receive personal data in the framework of aparticular inquiry in accordance with Union or Member State law shall not be
regarded as Recipients; the Processing of those Personal Data by those publicauthorities shall be in compliance with the applicable data protection rules
according to the purposes of the Processing;Annex 2
List of Sub-Processors
Our processors reported the following sub-processors:

1
2
3
4

Sub-Processor

Registered Office (Country)

StratoHetzner Online
Salesforce, Inc.
Stripe Sub-Processor list

Data center within EEA
Data center within EEA
USA
multiple

Basis for transfer to third
party country
n/an/aStandard contractual clauses
multiple