Source: http://genexplain.com/privacy/
Timestamp: 2019-04-18 16:56:44+00:00

Document:
This privacy statement clarifies the nature, scope, and purpose of the processing of personal data (hereinafter “data”) within our online offer and the associated websites, functions and contents as well as external online presences, such as our Social Media Profiles (hereinafter collectively referred to as “online offer”). Regarding the terminology used, such as “processing” or “responsible person”, we refer to the definitions in article 4 of the General Data Protection Regulation (GDPR).
Contact information (e.g., e-mail, telephone numbers).
Meta-/Kommunikationsdaten (e.g., device information, IP addresses).
Visitors and users of the online offer (hereinafter we refer to the persons concerned as “users”).
Provision of the online offer, its functions, and contents.
Answering contact inquiries and communicating with users.
“Personal data” shall be any information relating to an identified or identifiable natural person (hereinafter referred to as “the person concerned”); an identifiable person is considered to be an individual who, directly or indirectly, can be identified in particular by assigning him/her to an identifier such as a name, identification number, to Location data, to an online identifier (e.g. cookie) or to one or more special features, expressing the physical, physiological, genetic, psychological, economic, cultural or social identity of these natural person.
“Processing” means any operation performed with or without the help of automated procedures or any such series of operations in connection with personal data. The term is broadly defined and includes virtually any handling of data.
“Pseudonymisation” means the processing of personal data in such a way that the personal data can no longer be assigned to a specific person without additional information, provided that the additional information is kept separately and technical and organisational measures ensure that the personal data is not assigned to an identified or identifiable natural person.
„Profiling” means any form of automated processing of personal data which consists in the use of these personal data for evaluating certain personal aspects relating to a natural person, especially to analyse or predict aspects relating to work performance, economic situation, health, personal preferences, interests, reliability, behaviour, whereabouts or location of this natural person.
The “person responsible” means the natural or legal entity, authority, institution, or other body which, alone or jointly with others, decides on the purposes and means of processing personal data.
“Processor” means a natural or legal person, authority, institution, or other body that processes personal data on behalf of the responsible party.
In accordance with article 13 of the GDPR, we will inform you of the legal basis of our data processing. If the legal basis is not mentioned in the data protection declaration, the following applies: the legal basis for obtaining consent is Article 6 (1) lit. A and article 7 GDPR, the legal basis for processing in order to fulfil our services and to carry out contractual measures and to respond to inquiries is Article 6 (1) lit. b GDPR, the legal basis for processing in order to comply with our legal obligations is article 6 (1) lit. c GDPR, and the legal basis for processing in order to safeguard our legitimate interests is Article 6 (1) lit. F GDPR. In case that vital interests of the person concerned or of any other natural person require the processing of personal data, article 6 (1) lit. D GDPR serves as a legal basis.
We shall, in accordance with article 32 GDPR, considering the state of the art, the implementation costs and the nature, scope, circumstances and purposes of processing, as well as the varying likelihood of occurrence and severity of the risk for the rights and liberties of natural persons, take appropriate technical and organisational measures to ensure a level of protection appropriate to the risk.
Measures include, in particular, the protection of confidentiality, integrity and availability of data by controlling physical access to the data, as well as the access, input, disclosure, availability and separation. Furthermore, we have established procedures to ensure the exercise of the rights of the concerned persons, the deletion of data and the reaction to the data being compromised. We also consider the protection of personal data in the development and selection of hardware, software and procedures, in accordance with the principle of data protection through technical design and data protection-friendly preferences (art. 25 GDPR).
If we disclose data to other persons and companies (processors or third parties) as part of our processing, transmit them or otherwise grant access to the data, this is only done on the basis of a legal permission (e.g., if a transfer of the data to third parties, as to payment service providers, according to article 6 par. 1 Lit. b GDPR is required for the performance of the contract), if you have consented to a legal obligation to do so or on the basis of our legitimate interests (e.g. in the use of agents, web hosts, etc.).
If we entrust third parties with the processing of data based on a so-called “contract processing contract”, this is done on the basis of article 28 GDPR.
If we process data in a third country (i.e. outside the European Union (EU) or the European Economic Area (EEA)) or if this happens in the context of the use of third party services or disclosure, or transmission of data to third parties, this only occurs when it is done to fulfil our (pre-)contractual obligations, on the basis of your consent, due to a legal obligation or on the basis of our legitimate interests. Subject to legal or contractual permits, we process or leave the data in a third country only in the presence of the special conditions of art. 44 ff. GDPR process. i.e. processing takes place, for example, based on special guarantees, such as the officially recognised determination of a data protection level corresponding to the EU (e.g. for the USA by the “Privacy Shield”) or observance of officially recognised special contractual obligations (so-called “standard contractual clauses”).
You have the right to request confirmation as to whether relevant data will be processed and the right to information on this data as well as to further details and to a copy of the data in accordance with article 15 GDPR.
You have according to Art. 16 GDPR the right to request the completion of data or the correction of incorrect data concerning you.
You have, in accordance with article 17 GDPR, the right that data shall be deleted immediately or, alternatively, in accordance with article 18 GDPR, the right to require a restriction on the processing of the data.
You have the right to demand to receive the data relating to you which you have provided to us in accordance with article 20 of the GDPR and demand their transmission to other persons responsible.
You shall also have the right, pursuant to article 77 GDPR, to submit a complaint to the competent supervisory authority.
You have the right to revoke your consent pursuant to article 7 (3) of the GDPR with effect for the future.
You may at any time object to the future processing of the data relating to you in accordance with article 21 GDPR. The objection may in particular be directed against processing for direct marketing purposes.
“Cookies” are small files that are stored on users ‘ computers. Within the cookies, different data can be stored. The primary purpose of a cookie is to store information about a user (or the device on which the cookie is stored) during or after his/her visit within an online offer. Temporary cookies, also called “session-cookies” or “transient cookies”, are deleted after a user leaves an online offer and closes his/her browser. In such a cookie e.g., the contents of a shopping cart in an online shop or a login status can be stored. “Permanent” or “persistent” are cookies that remain stored even after the browser is closed. For example, the login status can be saved if the users visit the online offer after several days. Similarly, in such a cookie, the interests of users can be stored, which can be used for range measurement or marketing purposes. “Third-party-cookie” means cookies that are offered by other providers than the person in charge of the online offer (otherwise, if it is only their cookies, they are called “first-party cookies”).
If users do not want that cookies are stored on your computer, the will be asked to deactivate the corresponding option in their browser’s system preferences. Stored cookies can be deleted in the system settings of the browser. The exclusion of cookies can lead to functional limitations of the online offer.
A general objection against the use of the information for the purposes of online marketing cookies for a variety of services, especially in the case of tracking, can be declared via the US-American site http://www.aboutads.info/choices/ or the EU side http://www.youronlinechoices.com/. Furthermore the storage of cookies can be avoided by means of their shutdown in the settings of the browser. Please note that you may not be able to use all the functions of this online offer.
According to legal requirements in Austria, the storage is in particular for 7 J according to § 132 para 1 bao (accounting documents, documents/invoices, accounts, documents, business documents, statement of revenue and expenses, etc.), for 22 years in connection with Land and for 10 years for documents relating to electronically supplied services, telecommunications, radio and television services provided to non-entrepreneurs in EU member States and for which the mini-One-Stop-Shop (MOSS) is used.
contract data (e.g., object of contract, term, customer category).
from our customers, prospects, and business partners for the purpose of providing contractual services, service and customer care, marketing, advertising and market research.
We process the data of our contractual partners and interested parties as well as other purchasers, customers, principals, clients or contractors (uniformly referred to as “contract partners”) according to article 6 (1) Lit. B. GDPR to provide them with our contractual or pre-contractual services. The data processed, the nature, the scope and the purpose and the necessity of its processing, are determined by the underlying contractual relationship.
The processed data include the core data of our contractual partners (e.g., names and addresses), contact data (e.g. e-mail addresses and telephone numbers) as well as contract data (e.g., services used, contract contents, contractual communication, names of contact persons) and payment data (e.g., bank details, payment history).
We process data necessary for the establishment and fulfilment of the contractual services and point to the necessity of the processing, if this is not evident to the contracting parties. Disclosure to external persons or companies is only necessary if it is required under a contract. When processing the data transferred to us within the framework of an order, we act in accordance with the instructions of the client and the legal requirements.
As part of the use of our online services, we may store the IP address and the time of the respective user action. The storage takes place based on our legitimate interests, as well as the interests of the users in protecting against abuse and other unauthorized use. These data are in principle not passed on to third parties, unless it is required for the pursuit of our claims pursuant to Article 6 (1) lit. F. GDPR or there is a legal obligation pursuant to Article 6 (1) lit. C. GDPR.
The data will be deleted if they are no longer necessary to fulfil contractual or legal obligations of care, as well as for the handling of any warranty and similar obligations; the necessity of keeping the data is reviewed every three years; otherwise the statutory retention obligations apply.
We process data in the context of administrative tasks as well as organization of our operations, financial accounting, and compliance with legal obligations, such as archiving. We process the same data that we process in the context of providing our contractual services. The processing is based on article 6 (1) lit. C. GDPR, article 6 (1) lit. F. GDPR. Processing affects customers, prospects, business partners, and site visitors. The purpose of and our interest in the processing lies in the administration, financial accounting, office organization, archiving of data, i.e. tasks related to the maintenance of our business activities, the performance of our tasks and the provision of our services. The deletion of data regarding contractual services and the contractual communication corresponds to the information mentioned in these processing activities.
We disclose or transmit data to the financial administration, consultants, such as tax advisors or auditors, as well as other fee offices and payment service providers.
We also store information on suppliers, organizers, and other business partners on the basis of our business interests, e.g. for the purpose of later contact. We store these mainly business-related data in principle permanently.
Users can create user accounts. As part of the registration process, the required mandatory information is communicated to users and processed based on article 6 (1) Lit. b GDPR for providing the user account. The processed data include in particular the login information (name, password as well as an e-mail address). The data entered as part of the registration will be used for using the user account.
Users can be informed by e-mail about information relevant to their user account, such as technical changes. If users have terminated their user account, their data will be deleted with respect to the user account, subject to a statutory retention obligation. It is the responsibility of the users to secure their data in the event of termination before the end of the contract. We are entitled to permanently delete all data stored by the user during the duration of the contract.
When using our registration functions as well as during the usage of the user account, the IP address and the time of the respective user action will be saved. The storage takes place on the basis of our legitimate interests, as well as the user’s protection against abuse and other unauthorized use. These data are not passed on to third parties in principle, unless it is necessary for the pursuit of our claims or there is a legal obligation pursuant to Article 6 (1) Lit. C GDPR. The IP addresses will be anonymized or deleted after 7 days at the latest.
When contacting us (e.g. via contact form, e-mail, telephone or via social media), the information provided by the user for the processing of the contact request is processed according to article 6 para. 1 lit. b) GDPR. User information can be stored in a customer relationship management system (“CRM system”) or similar system.
The hosting services we use are designed to provide the following services: infrastructure and platform services, computing capacity, storage space and database services, e-mail delivery, security services, and technical maintenance services that we use for operating this online offer.
We, or our hosting provider, process inventory data, contact data, content data, contract data, usage data, meta and communication data of customers, interested parties and visitors of this online offer based on our legitimate interests in an efficient and secure provision of this online offer in accordance with article 6 (1) lit. F GDPR I. V. m. Article 28 GDPR (conclusion order processing contract).
We, or our hosting provider, on the basis of our legitimate interests according to article 6 (1) of the Lit. F. GDPR, collects data about each access to the server on which this service resides (so-called server log files). The access data include the name of the retrieved web page, file, date, and time of retrieval, transferred data quantity, message about successful retrieval, browser type and version, the operating system of the user, referrer URL (the previously visited page), IP address, and the requesting provider.
LogFile information is used for security reasons (e.g. for the clarification of abuse or fraud), will be stored for a maximum of 7 days and then deleted. Data for which further storage is required for evidence is excluded from the deletion until the final clarification of the respective incident.
We maintain online presences within social networks and platforms in order to communicate with the active customers, interested parties and users and to inform them about our services there. When calling up the respective networks and platforms, the terms and conditions as well as the data processing guidelines of their respective operators apply.
Unless otherwise stated in the context of our data protection declaration, we process the data of the users if they communicate with us within the social networks and platforms, e.g. write articles on our online presences or send us messages.
geneXplain as operator does not make any decision with regard to handling Insights data and all other information arising from Art. 13 GDPR, among them legal basis, identity of the responsible person, and duration of storage of cookies on end user devices.
We use within our online offer based on our legitimate interests (i.e. interest in the analysis, optimization and economic operation of our online offer according to article 6 (1) lit. F. GDPR) third-party content or service offerings to incorporate their content and services, such as videos or fonts (hereinafter referred to as “content”).
This always requires that the third party providers of this content, recognise the IP address of the users, since they could not send the contents to their browser without the IP address. The IP address is therefore required to display this content. We endeavour to use such content, whose provider uses the IP address only to deliver the content. Third parties can also use so-called pixel tags (invisible graphics, also known as Web Beacons) for statistical or marketing purposes. These “pixel tags” can be used to evaluate the visitor traffic on the pages of this website. The pseudonymous information may also be stored in cookies on the user’s device, including technical information on the browser and operating system, referring web pages, visiting time and other information on the use of our online offer, and also be linked to such information from other sources.
geneXplain als Betreiber trifft keine Entscheidungen hinsichtlich der Verarbeitung von Insights-Daten und aller weiteren sich aus Art. 13 DSGVO ergebenden Informationen, darunter Rechtsgrundlage, Identität des Verantwortlichen und Speicherdauer von Cookies auf Nutzerendgeräten.
Die vollständige Seiten-Insights-Ergänzung der Facebook-AGB, auf die wir uns hier beziehen, finden Sie hier (heruntergeladen am 08.10.2018).

References: art. 44
 Art. 16
 § 132
 V. 
 Art. 13
 Art. 13