Source: https://woodart.at/en/privacy-policy/
Timestamp: 2019-04-23 08:14:42+00:00

Document:
Protection of your personal data is of particular importance to Gertraud Lackner KG. With this privacy notice, we would like to inform you about the nature, extent and purpose of personal data processed by us and inform data subjects affected by the data processing about the rights to which they are entitled.
Your personal data will be protected as best as we can during collecting, processing, storing and visiting our website. The processing of personal data, such as the name, address, e-mail address or telephone number is solely based on the statutory provisions (DSGVO/GDPR, DSG, TKG 2003).
Gertraud Lackner KG has implemented plenty of technical and organizational measures, so-called TOMs, to ensure adequate protection of the personal data processed by the controller. Nevertheless, we would like to point out that, in particular, internet-based or wireless-based data transmissions generally have vulnerabilities that can not fully guarantee absolute protection. In addition, it often eludes the public – and also us as a company – how and where and to what extent globally active companies, such as Facebook, Google, etc., collect, store and exploit data in our networked world. The privacy notce of Gertraud Lackner KG uses those terms defined by the General Data Protection Regulation (GDPR) itself. The GDPR states in Article 12 that the information that has to be provided – such as this privacy statement – must be written in a “clear, transparent, understandable and easily accessible form in a clear and simple language”. Therefore, we would first like to introduce you to the terms used. Confident that the European legislator has formulated the regulations in the sense of his own guidelines – understandable, clear and simple – we refer to the same, essentially to the wording of the law.
Personal data (hereinafter referred to as “pbD”) is any information relating to an identified or identifiable natural person (data subject). A natural person is considered to be identifiable who, directly or indirectly, in particular by association with an identifier such as a name, an identification number, location data, an online identifier or one or more special features, expresses the physical, physiological, genetic, mental, economic, cultural or social identity of this natural person can be identified.
Dat subject is the person who provides their pbD to the responsible person for the purpose of processing. The primary purpose of the GDPR is to protect the rights of data subjects.
Controller or responsible person is the natural or legal person, authority, institution or other body that decides on the purposes and means of processing personal data alone or together with others. Together with the processor, he is the norm addressee of the GDPR and has to ensure that the processing of the pbD is carried out in accordance with the law and that the data subject’s rights are met.
The processor is a natural or legal person, public authority, institution or other body that pbD processes on behalf of the controller. Independent decisions about means and purpose of the processing of pbD are not made. The processor will act solely on behalf of the controller. Example: We process in the sense of capture pbD of our customers (name, address, date of birth, etc.) as “responsible person”. Now let’s give this data to e.g. a printing company to create and send advertising folders to our customers, the print shop is our “processor”.
Recipient is a natural or legal person, public authority, institution or other entity that is disclosed to pbD, regardless of whether the recipient is a natural or legal person, public authority, institution or other entity that is disclosed to pbD, whether or not it is a third party. The recipient may be located in-house (e.g., a department) or an external third party.
Restriction of the processing means to limit stored personal data with the aim to limit future processing.
We process those pbD that we receive from you as part of a business relationship. We also process data that we have legitimately received from publicly available sources. For example, pbD (name, address, date of birth, e-mail address, phone number, IBAN or credit card number) will only be collected and processed on our website if you have actively provided this information, e.g. during registration or as part of the ordering process in our webshop.
Among the pbD processed by us include u.a.
Master data, for example: customer number, name, date of birth, etc.
Within Gertraud Lackner KG, only those bodies or employees receive their data that they need to fulfill their contractual, statutory and regulatory obligations and to safeguard legitimate interests (“need-to-know-basis”). In addition, commissioned by us processors (especially IT and possibly back office service providers) receive your data, if they need them to fulfill their respective task. All processors (including computer administrators, internet and e-mail providers (technical infrastructure), newsletter tool providers, storage and data storage (possibly in the cloud or in a data center), comparison portals, CRM Systems, also for the purpose of legally compliant documentation) are contractually obliged to treat your data confidentially and to process it only in the context of the provision of services.
A transfer of data to third parties does not take place, with the exception of the transmission of the credit card data to the unwinding bank / payment service provider for the purpose of debiting the purchase price, to the transport company commissioned by us (FedEx, Österreichische Post AG) to deliver the goods and to our Tax consultant to fulfill our tax obligations. Your personal information will be shared with third parties (such as shipping / transport companies) only if required for the execution of the contract.
In principle, there is no transfer of your personal data to third countries unless the service provider (e.g., Microsoft) has signed the Privacy Shield Agreement.
The website of Gertraud Lackner KG collects a series of general data and information each time the website is accessed by an affected person or an automated system. This general data and information is stored in the log files of the server. The (1) browser types and versions used, (2) the operating system used by the accessing system, (3) the internet page from which an accessing system accesses our website (so-called referrers), (4) the sub-web pages which can be accessed via (5) the date and time of access to the website, (6) an Internet Protocol address (IP address), (7) the Internet service provider of the accessing system and (8) other similar data and information used in the event of attacks on our information technology systems.
When using this general data and information, Gertraud Lackner KG does not draw any conclusions about the person concerned. Rather, this information is required to (1) correctly deliver the contents of our website, (2) to optimize the content of our website and to advertise it, (3) to ensure the continued functioning of our information technology systems and the technology of our website, and ( 4) to provide law enforcement authorities with the information necessary for law enforcement in the event of a cyberattack. Gertraud Lackner KG evaluates this anonymously collected data and information on the one hand statistically and further with the aim of increasing data protection and data security in our company in order to ultimately ensure an optimal level of protection for the personal data processed by us. The anonymous data of the server log files are stored separately from all personal data provided by an affected person.
The personal data collected in the context of registering for the newsletter will be used exclusively to send our newsletter. Subscribers to the newsletter may also be notified by e-mail if this is necessary for the operation of the newsletter service or registration, as might be the case in the event of changes to the newsletter or technical changes. The subscription of our newsletter and thus the consent to the processing pbD can be revoked at any time by the data subject. For the purpose of revoking the consent, there is a corresponding link in each newsletter. It is also possible to unsubscribe from the newsletter at any time on our website or to inform the controller in a different way (by letter or e-mail).
Gertraud Lackner KG processes pbD of the data subject as far as necessary for the duration of the entire business transaction (from initiation, fulfillment to termination / performance of a contract) as well as in accordance with the statutory retention and documentation obligations arising, for example, from the Austrian Commercial Code (UGB ) or the Federal Tax Code (BAO) or as long as limitation periods of potential legal claims have not yet been expired. – So your pbD will be stored e.g. 7 years after the end of the financial year in which the data was collected (§ 132 BAO) and in addition kept to the assertion or defense of claims (including tax issues); furthermore 3 years after the last contact with newsletter / advertising measures.
If you register in our webshop, we will store your pbD as long as your account exists and thereafter only for as long as this is necessary for legal obligations. After expiry of the respective retention or limitation periods, the pbD are routinely blocked and deleted in accordance with the statutory provisions (§ 4 para. 2 DSG, Art. 23 DSGVO).
Any person affected by the processing of personal data has the right to obtain information from the controller at any time as to whether the pbD concerned is being processed. Furthermore, there is the right to obtain free information about the pbD stored on his person and a copy of this information.
Every person affected by the processing pbD has the right to demand the immediate correction of any incorrect pbD concerning them. Furthermore, the data subject has the right, subject to the purposes of the processing, to demand the completion of incomplete pbD, also by means of a supplementary declaration.
The pbD were collected for such purposes or otherwise processed, for which they are no longer necessary.
The pbD were processed unlawfully.
The deletion of the pbD is necessary to fulfill a legal obligation under the European Union law or the law of the member states, to which the person responsible is subject.
The pbD were collected in relation to information society services offered pursuant to Art. 8 (1) GDPR.
The accuracy of the pbD is denied by the data subject, and for a period of time that allows the person responsible to verify the accuracy of the pbD.
The processing is unlawful, the data subject refuses to delete the pbD and instead requires the restriction of the use of pbD.
The person responsible no longer needs the pbD for processing purposes, but the data subject needs them to assert, exercise or defend legal claims.
Each person affected by the pbD processing has the right to receive the pbD pertaining to it, which has been provided by the data subject to a responsible person, in a structured, common and machine-readable format. It also has the right to transfer this data to another person in charge without hindrance by the person responsible to whom the pbD was provided, provided that the processing is based on the consent pursuant to Art. 6 (1) (a) GDPR or Art. 9 (2) lit. a GDPR or on a contract pursuant to Art. 6 (1) (b) GDPR and the processing is carried out by automated means, unless the processing is necessary for the performance of a task in the public interest or in the exercise of official authority which was transferred to the person responsible.
Every person affected by the processing pbD has the right to object at any time for reasons arising from its particular situation against the processing of pbD pertaining to it, which occurs on the basis of Article 6 (1) lit e or f GDPR. This also applies to profiling based on these provisions. Gertraud Lackner KG will no longer process the pbD in the event of an objection, unless we can prove that there are compelling legitimate reasons for processing that outweigh the interests, rights and freedoms of the data subject, or the processing is for assertion, exercise or defense of legal claims.
If Gertraud Lackner KG processes pbD in order to operate direct marketing then the data subject has the right to appeal at any time against the processing of the pbD for the purpose of such advertising. This also applies to the profiling, as far as it is associated with such direct mail. If the data subject objects to Gertraud Lackner KG for the purpose of direct marketing, Gertraud Lackner KG will no longer process the pbD for these purposes.
In addition, the data subject has the right, for reasons arising from his or her particular situation, against processing pbD, or at Gertraud Lackner KG for scientific or historical research purposes or for statistical purposes pursuant to Art. 89 (1) DSGVO objection, unless such processing is necessary to fulfill a public interest task.
If the decision (1) is required for the conclusion or performance of a contract between the data subject and the controller or (2) it takes place with the express consent of the data subject, Gertraud Lackner KG shall take appropriate measures to safeguard the rights and freedoms as well as the legitimate interests of the data subject, including at least the right to obtain the intervention of a person by the controller, to express his / her own position and to contest the decision.
As explained in point 4 above, the provision of personal data is partly required by law (such as tax regulations) or arises from legal and contractual requirements (such as details of the contractor). For the conclusion of the contract and the fulfillment of the contract, it is therefore necessary that pbD be made available to us, which are subsequently processed by us. If you do not provide us with this data, we will generally have to refuse to conclude the contract or to execute the order or to be unable to carry out an existing contract and therefore not justify or terminate the business relationship. It is not necessary to give consent for data processing with regard to the fulfillment of relevant or legally and / or legally required data processing.

References: Art. 23
 Art. 8
 Art. 6
 Art. 9
 Art. 6
 Art. 89