Source: https://www.posthansl.at/privacypolicy/?lang=en
Timestamp: 2019-04-26 10:11:10+00:00

Document:
'Responsible person' means the natural or legal person, public authority, body or body which, alone or in concert with others, decides on the purposes and means of processing personal data.
Measures include, in particular, ensuring the confidentiality, integrity and availability of data by controlling physical access to the data, as well as their access, input, disclosure, availability and segregation. We have also set up procedures to ensure the enjoyment of data subject rights, data deletion and data vulnerability. Furthermore, we consider the protection of personal data already in the development, or selection of hardware, software and procedures, according to the principle of data protection through technology design and privacy-friendly default settings (Article 25 DSGVO).
If, in the context of our processing, we disclose data to other persons and companies (processors or third parties), transmit them to them or otherwise grant access to the data, this is done only on the basis of a legal permission (eg if a transmission of the data to third parties, as required by payment service providers, pursuant to Art. 6 (1) (b) DSGVO), you have consented to a legal obligation or on the basis of our legitimate interests (eg the use of agents, webhosters, etc.).
If we commission third parties to process data on the basis of a so-called "contract processing contract", this is done on the basis of Art. 28 DSGVO.
If we process data in a third country (ie outside the European Union (EU) or the European Economic Area (EEA)) or in the context of the use of third party services or disclosure, or transmission of data to third parties, this will only be done if it is to fulfill our (pre) contractual obligations, on the basis of your consent, on the basis of a legal obligation or on the basis of our legitimate interests. Subject to legal or contractual permissions, we process or have the data processed in a third country only in the presence of the special conditions of Art. 44 et seq. DSGVO. That the processing is e.g. on the basis of specific guarantees, such as the officially recognized level of data protection (eg for the US through the Privacy Shield) or compliance with officially recognized special contractual obligations (so-called "standard contractual clauses").
In accordance with Art. 17 GDPR, they have the right to demand that the relevant data be deleted without delay, or, alternatively, to require a restriction of the processing of data in accordance with Art. 18 GDPR.
You have the right to demand that the data relating to you which you provide us have to be obtained in accordance with Art. 20 GDPR and to request their transmission to other responsible persons.
The data processed by us are deleted or limited in their processing in accordance with Articles 17 and 18 GDPR. Unless explicitly stated in this privacy statement, the data stored by us will be deleted as soon as they are no longer necessary for their intended purpose and the deletion does not conflict with any statutory storage requirements. Unless the data is deleted because it is required for other and legitimate purposes, its processing will be restricted. That The data is blocked and not processed for other purposes. This applies, for example for data that must be kept for commercial or tax reasons. According to legal requirements in Germany, the storage takes place in particular for 10 years according to §§ 147 Abs. 1 AO, 257 Abs. 1 Nr. 1 and 4, Abs. 4 HGB (books, records, management reports, accounting documents, trading books, relevant for taxation Documents, etc.) and 6 years in accordance with § 257 (1) no. 2 and 3, para. 4 HGB (commercial letters). According to legal regulations in Austria the storage takes place in particular for 7 J according to 132 paragraph 1 BAO (accounting documents, receipts / invoices, accounts, documents, business papers, statement of income and expenses, etc.), for 22 years in connection with land and for 10 years for documents related to electronically supplied services, telecommunications, broadcasting and television services provided to non-EU companies in EU Member States for which the Mini-One-Stop-Shop (MOSS) is used.
We process the data of our customers as part of the ordering process in our online shop to allow them to select and order the selected products and services, as well as their payment and delivery, or execution. The processed data includes inventory data, communication data, contract data, payment data and persons affected by the processing belong to our customers, prospects and other business partners. Processing is for the purpose of providing contractual services in the context of operating an online shop, billing, delivery and customer service. Here we use session cookies for the storage of the shopping cart contents and permanent cookies for the storage of the login status. Processing is based on Art. 6 para. 1 lit. b (execution of order transactions) and c (legally required archiving) DSGVO. The information marked as required for the establishment and fulfillment of the contract is required. We disclose the data to third parties only in the context of extradition, payment or in the context of legal permissions and obligations to legal advisors and authorities. The data will be processed in third countries only if necessary for the fulfillment of the contract (for example, on customer's request upon delivery or payment). Users can optionally create a user account, in particular by being able to view their orders. As part of the registration, the necessary mandatory information will be communicated to the users. The user accounts are not public and can not be indexed by search engines. If users have terminated their user account, their data will be deleted with regard to the user account, subject to their retention is for commercial or tax law reasons according to Art. 6 para. 1 lit. c DSGVO necessary. Information in the customer account remains until its deletion with subsequent archiving in case of a legal obligation. It is the responsibility of the users to secure their data upon termination prior to the end of the contract. As part of the registration and re-registration and use of our online services, we store the IP address and the time of the respective user action. The storage is based on our legitimate interests, as well as the user's protection against misuse and other unauthorized use. A transfer of these data to third parties does not take place, unless it is necessary for the prosecution of our claims or there is a legal obligation in accordance with. Art. 6 para. 1 lit. c DSGVO. The deletion takes place after the expiration of legal warranty and comparable obligations, the necessity of keeping the data is checked every three years; in the case of legal archiving obligations, the deletion takes place after its expiration (end of commercial law (6 years) and tax law (10 years) retention obligation).
We process our clients' data as part of our contractual services, which include conceptual and strategic consulting, campaign planning, software and design development / consulting or maintenance, campaign / process / handling implementation, server administration, data analysis / consulting services, and training services. Here we process stock data (eg, customer master data, such as names or addresses), contact data (eg, e-mail, telephone numbers), content data (eg, text inputs, photographs, videos), contract data (eg, subject matter, term), payment data (eg, Bank account, payment history), usage and metadata (eg in the context of the evaluation and success measurement of marketing measures). In principle, we do not process special categories of personal data, unless these are components of a commissioned processing. Those affected include our customers, prospects and their customers, users, website visitors or employees as well as third parties. The purpose of the processing is the provision of contract services, billing and our customer service. The legal basis of the processing results from Art. 6 para. 1 lit. b DSGVO (contractual services), Art. 6 para. 1 lit. f DSGVO (analysis, statistics, optimization, security measures). We process data that are necessary for the establishment and performance of the contractual services and indicate the necessity of their information. Disclosure to external parties will only be made if required by an order. When processing the data provided to us within the scope of an order, we act in accordance with the instructions of the client as well as with the legal requirements of order processing pursuant to Art. Art. 28 DSGVO and process the data for no other purpose than the order. We delete the data after expiry of legal warranty and comparable obligations. the necessity of keeping the data is checked every three years; in the case of legal archiving obligations, the deletion takes place after its expiry (6 years, pursuant to § 257 (1) HGB, 10 J, in accordance with § 147 (1) AO). In the case of data disclosed to us in the context of an order by the client, we delete the data according to the specifications of the order, in principle after the end of the order.
We process the data of our contractual partners and interested parties as well as other clients, customers, clients, clients or contractual partners (uniformly referred to as "contractual partners") in accordance with Art. 6 para. 1 lit. b. DSGVO in order to provide you with our contractual or pre-contractual services. The data processed, the nature, scope and purpose and necessity of their processing are determined by the underlying contractual relationship. The processed data include the master data of our contractual partners (eg, names and addresses), contact data (eg e-mail addresses and telephone numbers) as well as contract data (eg, services used, contract contents, contractual communication, names of contact persons) and payment data (eg, Bank details, payment history). In principle, we do not process special categories of personal data, unless they are part of a commissioned or contractual processing. We process data which are necessary for the establishment and fulfillment of the contractual services and point out the necessity of their indication, if this is not evident for the contractual partners. Disclosure to external persons or companies will only be made if required by a contract. When processing the data provided to us within the framework of an order, we act in accordance with the instructions of the client and the legal requirements. As part of the use of our online services, we can save the IP address and the time of each user action. The storage is based on our legitimate interests, as well as the interests of the user in the protection against misuse and other unauthorized use. A transfer of these data to third parties does not take place, unless it is to pursue our claims acc. Art. 6 para. 1 lit. f. DSGVO required or there is a legal obligation in accordance with. Art. 6 para. 1 lit. c. DSGVO. The data will be deleted if the data is no longer required for the fulfillment of contractual or statutory duties of care and for the handling of any warranty and comparable obligations, whereby the necessity of keeping the data is reviewed every three years; Otherwise, the statutory storage obligations apply.
We disclose or transmit data to the financial administration, consultants such as tax accountants or auditors, and other fee agents and payment service providers.
We delete the requests, provided they are no longer required fully automatically after 12 months. Furthermore, the legal archiving obligations apply.

References: Art. 6
 Art. 28
 Art. 44
 Art. 17
 Art. 18
 Art. 20
 § 257
 Art. 6
 Art. 6
 Art. 6
 Art. 6
 Art. 6
 Art. 28
 § 257
 § 147
 Art. 6
 Art. 6
 Art. 6