Source: http://www.berndserafinthaler.com/privacy-policy/
Timestamp: 2019-04-19 19:05:54+00:00

Document:
The present version is published in English for convenience purposes only. In case of any discrepancies between this version and the German version, the German version shall prevail.
When you view our website, we collect the data stated in section 1. which is required for technical purposes in order to display our website correctly and to guarantee the stability and security of the system. Data is stored in logfiles in order to ensure the functionality of the website. In addition, this data helps us to optimise the website and to ensure the security of our IT-systems. These purposes also establish our legitimate interest in the data processing pursuant to Art. 6 para. 1 lit. f GDPR.
When your data is transmitted to us, it is encrypted using the latest security standard – SSL 256bit encryption (SSL = Secure Socket Layer). The security certificate is issued by AlphaSSL.
Credit cards, PayPal and SofortBanking Data is not stored, but is instead collected and processed by our payment service provider, “mPay24”. We use technical and organisational measures to secure our website and other systems against the loss, destruction, unauthorised access, alteration or dissemination by unauthorised persons of your personal information.
a) The legal basis for the processing of your data in the course of placing an order and shopping in our online shop is Art. 6 para. 1 lit. b GDPR.
b) The legal basis for the transmission of your data to external payment services providers is Art. 6 para. 1 lit. a and b GDPR.
c) The legal basis for the parcel tracking is Art. 6 para. 1 lit. b GDPR.
Your name, address, items purchased and order data are furthermore stored until the warranty period under product liability law expires (10 years). The data processing is carried out based on the statutory provisions set forth in Section 96 (3) Telecommunications Act (Telekommunikationsgesetz, TKG) as well as Art 6 para. 1 lit. a (consent) and/or lit. b (necessary for the performance of a contract) of the GDPR.
This website features social media plug-ins to allow users to recommend and share articles on social media, such as Facebook, Instagram, Twitter and Pinterest. We use a two-phase procedure; data intended for third parties is transmitted only when you, the website visitor, click on one of the icons displayed in the social media bar. Bernd Serafin Thaler has no influence over or access to the cookies used by Facebook, Twitter, etc.
If you consented to this pursuant to Art. 6 para. 1 sentence 1 lit. a GDPR, this website uses Google (Universal) Analytics, a web analysis service provided by Google LLC (www.google.at). Google (Universal) Analytics uses various methods that allow it to analyse your use of the website, such as, for example, cookies. The automatically collected information on your use of this website is as a rule transmitted to our Google server in the USA, where it is then stored. As a result of the activation of IP-anonymisation on this website, the IP-address is abbreviated prior to transmission within the member states of the European Union and in EEA states. Only in exceptional cases is the full IP-address transmitted to a Google server in the USA and abbreviated there. The anonymized IP address transmitted by your browser in the course of Google Analytics is as a rule not combined with other data held by Google. Where the intended purpose ceases to apply and when our use of Google Analytics comes to an end, the data collected in this connection will be deleted.
Without your consent, analysis data is collected only in anonymised or pseudonymised form. We are then unable to personally identify you. These purposes establish our legitimate interest in the processing of personal information pursuant to Art. 6 para. 1 lit. f GDPR.
Our website features a contact form and an e-mail address. You can also contact us via various social media platforms (Facebook, Instagram). This means you can contact our customer service team directly. If and insofar as you contact us using the contact form provided on our website by e-mail or through social media platforms and wish to find out about your orders or customer status, to enable us to properly process your request you may need to provide certain personal information, such as name, address, e-mail address, date of birth, order or invoice number. This data is used solely to verify and process your request. In the event that you contact us via a social media platform, please note that these platforms are not owned or controlled by Bernd Serafin Thaler, meaning that it is not possible to protect and maintain the confidentiality of the information provided via the social media platform. Should you have any questions concerning data protection, please contact the owner and operator of the social media platform in question.
The legal basis for the processing of the data you provide in the course of submitting your request is Art. 6 para. 1 lit. f GDPR. If the contact has the intent of concluding a contract, the additional legal basis for the processing is Art. 6 para. 1 lit. b GDPR.
The data is deleted as soon as it is no longer required for the attainment of the purpose. This applies to the personal data from the input screen for the contact form, as well as the information sent by e-mail if the conversation with the user concerned has ended. The conversation has ended if it can be concluded from the circumstances that the issue concerned has been conclusively resolved. Under certain circumstances, however, we may need to store certain personal information from the communication for longer (e.g. as evidence if in the course of the conversation agreements are reached concerning purchases made, goodwill decisions by Bernd Serafin Thaler, agreements on payments, claims based on defects, etc.).
– Right to withdraw consent: if you consented to certain types of processing activities, you can at any time withdraw such consent for the future. Such withdrawal of consent does not, however, have any effect on the lawfulness of the processing prior to the withdrawal of consent or insofar as the processing is justified on a different legal basis.
– Right to information: Pursuant to Art. 15 GDPR, you have the right to obtain information on which of your personal information we store.
– Right to rectification: Pursuant to Art. 16 GDPR, we will on request rectify any inaccurate or erroneous personal information.
– Right to erasure: If you wish, we will delete your data pursuant to the basic principles set forth in Art. 17 GDPR.
– Right to restriction of processing: Taking account of the prerequisites set forth in Art. 18 GDPR, you can request that we restrict the processing of your data.
– Right to objection: In addition, pursuant to Art. 21 GDPR you can object to the processing of your data. This right to object applies where there are grounds relating to your particular situation and only with respect to data processing that is lawful based on an overriding interest, concerning profiling or for the purposes of direct marketing. If you object, we will no longer process your data, unless we are entitled by law to reject your objection. An objection to direct marketing, including profiling, is binding for us, which means that we are no longer permitted to process your data for these purposes.
– Right to data portability: You also have the right to obtain your data pursuant to the rules set forth in Art. 20 GDPR in a structured, customary, machine-readable format or to transmit it to a third party.
– Complaint to the Data Protection Authority: Furthermore, you have the right to lodge a complaint with any competent data protection supervisory authority (Art. 77 GDPR). If you think there has been an infringement of data protection law or that your data protection rights have otherwise been contravened, you can lodge a complaint with the data protection supervisory authority.
Bernd Serafin Thaler has access to your data only insofar as this is necessary for the attainment of the objectives in line with the internal allocation of tasks. To this end, within the company only those departments that require access will be permitted to access your data.
International data transfer: Although all recipients are currently based in the EU/EEA, it cannot be excluded that recipients will, in future, be located in a country outside the EU/EEA that does not provide a level of data protection comparable to that in Europe. In particular, service providers may, in future, be located in the USA. In this case, Bernd Serafin Thaler will either select service providers certified under the US-EU Privacy Shield Program (Art. 45(1) GDPR) or which have agreed with Bernd Serafin Thaler the EU standard data protection clauses adopted by the EU Commission (Art. 46 (2) (c) or (d) GDPR).

References: Art. 6
 Art. 6
 Art. 6
 Art. 6
 Art 6
 Art. 6
 Art. 6
 Art. 6
 Art. 6
 Art. 15
 Art. 16
 Art. 17
 Art. 18
 Art. 21
 Art. 20