Source: https://lorenz-snackworld.at/en/node/80
Timestamp: 2019-04-25 08:55:58+00:00

Document:
We, The Lorenz Bahlsen Snack-World GmbH (hereinafter also referred to as „Controller“), take the protection of personal data very seriously and adhere to the pertinent data protection law provisions, in particular the provisions of the EU General Data Protection Regulation (GDPR). Below, we should like to inform you, in particular, what data we collect when in the context of using our website, and how we use it.
It is, principally, only to the extent necessary for the provision of a functioning website and of our contents and services that we collect and use personal data of our users. The collection and use of the personal data of our users takes place only where the processing of data is permitted by statutory provisions or after consent has been granted by the user.
Where the consent of the user for processes in relation to the processing of personal data is obtained by us on our website, Art. 6 (1) lit. a GDPR serves as a legal basis for the processing of personal data.
Art. 6 (1) lit. b. GDPR serves as a legal basis for the processing of personal data required for performance of a contract of which the user is a contractual party. This applies also to processing processes necessary for the performance of a quasi contract obligation or for precontractual measures.
If and when the processing of personal data is required for the fulfilment of a legal obligation to which our company is subject, Art. 6 (1) lit. c GDPR serves as a legal basis.
Where processing is necessary for the protection of a legitimate interest of our company or a third party and the first-mentioned interest is not overridden by the interests, basic rights and the fundamental freedoms of the user concerned, Art. 6 (1) lit. f GDPR serves as a legal basis for processing of the data (so-called weighing of interests).
Apart from that, there are other statutory provisions for the processing of personal data, which – to the extent pertinent - are concretely specified by us below.
The users’ personal data will be deleted or blocked as soon as the purpose of storage has ceased to exist. Apart from that, storage may be made where this has been provided for in regulations, laws or other provisions of the European Union to which our company is subject. Blocking or deletion of the data will also take place when a period for storing of the data prescribed by the above-mentioned norms has expired, unless there is a necessity for the continued storage of the data for the conclusion or fulfilment of a contract.
Apart from that, there is no passing on of personal data to third parties.
Processing of your personal data stored takes place in countries of the European Economic Area, exclusively.
Whenever our website is called up, our system automatically collects data and information from the system of the computer calling up the website.
The data are also stored in the logfiles of our system. There is no storing of these data together with other personal data of the user.
Art. 6 (1) lit. f GDPR is the legal basis for the temporary storage of data and logfiles.
The storage in logfiles is done to ensure the functionality of the website. In addition, the data is used to optimise the website and to ensure the security of our information technology systems. An evaluation of data for marketing purposes does not take place in this context. These are the purposes wherein our legitimate interest in the processing of data in accordance with Art. 6 (1) lit f GDPR lies.
The data will be deleted as soon as it is no longer required for achieving the purpose for which it was collected. Where the data is stored in logfiles, deletion will take place after two days at the latest. Storage beyond this point is possible. In such case, the IP addresses of the user will be deleted or anonymised so that it is no longer possible to attribute the client calling up the website.
The collection of data for the provision of the website and the storage of data in logfiles is absolutely necessary for operating of the website. Consequently, there is no possibility of objection on the part of the user.
Alternatively, contact may be made via the e-mail address made available by us. In this case, the user’s personal data transmitted together with the e-mail will be stored.
No passing on of data to third parties takes place in this context. The data is used for processing the conversation, exclusively.
The legal basis for processing of the data is Art. 6 (1) lit. f GDPR. Where the e-mail contact is aimed at the conclusion of a contract or serves a quasi contract obligation, Art. 6 (1) lit. b GDPR is an additional legal basis for the processing.
The processing of personal data from the input mask serves us to process the communication, exclusively. This is also where the required legitimate interest in the processing of data lies in the event of contact.
The data will be deleted as soon as it is no longer required for achieving the purpose for which it was collected. As regards personal data from the input mask of the contact form and those transmitted by e-mail, this is the case when the respective conversation with the user has been terminated. The conversation has been terminated when it can be inferred from the circumstances that the respective facts have been clarified conclusively.
Where users contact us by contact form or e-mail, they may object to the storage of their data, at any time. The objection may be made by notifying the contact information at the end of our Data Privacy Statement. In the event of objection, the conversation with the user cannot be continued and all the personal data stored within the course of making the contact will be deleted by us.
We use “cookies” to make your visit to our website more attractive and to enable the use of certain functions. Cookies are small text files stored in the browser or from the browser to the user’s terminal. When a website is called up by a user, a cookie may be stored on the user’s operating system. This cookie contains a characteristic character string which allows the browser to be identified unambiguously when the website is called up again.
Most browsers are set in a way that they automatically accept cookies. The user may, however, prevent the storing of cookies on his/her computer by adjusting the browser settings accordingly. This may, however, restrict the function scope of our website.
The legal basis for the processing of personal data is Art. 6 (1) lit. a GDPR, where the user has given his/her consent.
As for the rest, the legal basis for the processing of personal data using cookies is Art. 6 (1) lit. f GDPR.
The purpose of the use of technically necessary cookies is to make it easier for the user to use the website. Some of the functions of our website cannot be offered without using cookies. For these functions it is necessary that the browser can be recognised again after a page change.
The purpose of the use of the technically unnecessary cookies is to improve the quality of our website and its contents.
The user data collected on our website using cookies are not used for the creation of user profiles.
The above-mentioned purposes are also the ones wherein our legitimate interest in the processing of data in accordance with Art. 6 (1) lit f GDPR lies.
The references (links) are marked by the respective logo of the social network; no use is made of the social plugins of the above-mentioned social networks.
If following the links to the social networks, please be aware that the respective social network is responsible for the processing and use of personal data and that we have or get no knowledge whatsoever of the actual extent of use of your data by the respective provider. For information on the extent of processing of your personal data by the providers of the social networks and the possibilities of adjusting settings for the protection of your privacy, please see the data protection guidelines of the respective provider.
You may request from the controller a confirmation on whether personal data concerning you are processed by us.
the existence of automated decision-making, including profiling, pursuant to Art. 22 (1) and (4) GDPR and – at least in those cases – meaningful information on the logic involved and the significance and the intended consequences of such processing for the data subject.
You are entitled to request information on whether the personal data concerning you is transferred to a third country or an international organisation. In this context, you may request to be informed about the appropriate safeguards in connection with the transfer in accordance with Art. 46 GDPR.
You have a right to rectification and/or supplementation towards the controller, where the processed personal data concerning you are incorrect or incomplete. The controller shall perform the rectification, immediately.
where you have objected to the processing pursuant to Art. 21 (1) GDPR pending the verification whether the legitimate grounds of the controller override your reasons.
Where processing of the personal data concerning you has been restricted such data shall – with the exception of storage – only be processed with your consent or for the assertion, exercise or defence of legal claims or for the protection of the rights of another natural or legal person or for reasons of important public interest of the Union or of a Member State.
Where processing has been restricted in accordance with the above-mentioned requirements, you will be informed by the controller before the restriction of processing is lifted.
The personal data concerning you is no longer needed for the purposes for which it was collected or processed otherwise.
You withdraw your consent on which the processing was based pursuant to Art. 6 (1) lit. a or Art. 9 (2) lit. a GDPR, and no other legal ground for processing exists.
Deletion of the personal data concerning you is required for compliance with a legal obligation under the Union law or the law of the Member States the controller is subject to.
The personal data concerning you have been collected in relation to the offer of information society services pursuant to Art. 8 (1) GDPR.
Where the controller has made the personal data concerning you public and is obliged pursuant to Art. 17 (1) GDPR to delete it, the controller, taking account of available technology and the cost of implementation, shall take reasonable measures, including technical ones, to inform controllers processing the personal data that you as the data subject have requested from them the deletion of any and all links to such personal data or of copies or replications of such personal data.
for the assertion, exercise or defence of legal claims.
Where you have asserted the right to rectification, deletion or the restriction of processing towards the controller, the controller shall be obligated to communicate such rectification or deletion of data or restriction of processing to the recipients to whom the personal data concerning you have been disclosed, unless this proves impossible or involves disproportionate effort.
You have a right towards the controller to be informed of such recipients.
processing is carried out using automated techniques.
In exercising this right you also have the right to obtain the transmission of the personal data concerning you from one controller to another directly, where technically feasible. Freedoms and rights of other persons must not be affected thereby.
The right to data portability shall not apply to the processing of personal data necessary for the performance of a task carried out in the public interest or in the exercise of official authority bestowed on the controller.
You have the right to object, on grounds resulting from your particular situation, at any time to the processing of personal data concerning you which is based on Art. 6 (1) lit. e or f GDPR; this applies also to profiling based on such provisions.
The controller shall no longer process the personal data concerning you, unless the controller is able to demonstrate compelling legitimate grounds for the processing which override your interests, rights, and freedoms, or the processing is for the purpose of asserting, exercising, or defending legal claims.
Where personal data concerning you are processed for direct marketing purposes, you have the right to object at any time to the processing of the personal data concerning you for such marketing; this includes profiling to the extent that it is related to such direct marketing.
In the context of the use of information society services – notwithstanding Directive 2002/58/EC - you may exercise your right to object by means of automated techniques using technical specifications.
You have the right to revoke at any time your declaration of consent under data protection law. Revoking the consent does not affect the legitimacy of the processing based on the consent performed until the revocation.
However, such decisions shall not be based on special categories of personal data referred to in Art. 9 (1) GDPR, unless Art. 9 (2) lit. a or g applies and suitable measures to protect the rights and freedoms and your legitimate interests have been taken.
As regards the cases referred to in the above points (1) and (3), the controller shall implement suitable measures to safeguard your rights and freedoms and your legitimate interests, including, at least, the right to obtain intervention by one person on the part of the controller, to express his/her point of view and to contest the decision.
Without prejudice to any other administrative or judicial remedy, you have the right to lodge a complaint with a supervisory authority, in particular in the Member State of your place of residence, your place of work or place of the alleged infringement if you are of the opinion that processing of the personal data concerning you infringes the GDPR.
Our website may contain links referring to the pages of third parties. Where this is not obvious we point out that these are external links. We have no influence on the contents and design of the pages of external providers. Insofar, this data protection statement does not apply there.
The continuous development of the internet and the related frequent amendments to the applicable legal norms require our Data Privacy Statement to be adjusted from time to time. We will keep you informed here about any corresponding alterations.
For the full imprint see here.

References: Art. 6

Art. 6
 Art. 6
 Art. 6

Art. 6
 Art. 6
 Art. 6
 Art. 6
 Art. 6
 Art. 6
 Art. 6
 Art. 22
 Art. 46
 Art. 21
 Art. 6
 Art. 9
 Art. 8
 Art. 17
 Art. 6
 Art. 9
 Art. 9