Source: https://rheosol.com/company/privacy-statement/?L=1
Timestamp: 2019-04-25 12:03:57+00:00

Document:
This Data Protection Declaration clarifies the type, scope, and purpose of the processing of personal data (hereinafter referred to as "data") within our online offer and the associated websites, functions, and content as well as external online presences, such as our social media profile (hereinafter referred to collectively as "online offer"). With regard to the terms used, such as "processing" or "controller", we refer to the definitions in Art. 4 of the General Data Protection Regulation (GDPR).
Visitors and users of the online offer (hereinafter also referred to collectively as "users").
In accordance with Art. 13 of the GDPR we inform you about the legal basis of our data processing operations. If the legal basis is not specifically mentioned in the Privacy Statement, the following applies: The legal basis for obtaining consent is Art. 6 (1) a and Art. 7 of the GDPR; the legal basis for processing operations to provide our services, perform contractual measures, and answer inquiries is Art. 6 (1) b of the GDPR; the legal basis for processing operations to fulfil our legal obligations is Art. 6 (1) c of the GDPR; and the legal basis for processing operations to safeguard our legitimate interests is Art. 6 (1) f of the GDPR. In the event that vital interests of the data subject or another natural person necessitate the processing of personal data, Art. 6 (1) d of the GDPR is the legal basis.
Insofar as we, within the scope of our processing, disclose data to other persons and companies (contract processors or third parties), transfer them to such other parties or otherwise grant them access to the data, this shall only take place on the basis of legal permission (e.g. if a transfer of the data to third parties, such as payment service providers, is necessary for the performance of the contract pursuant to Art. 6 (1) b of the GDPR), or if you have consented to this, or if a legal obligation provides for this, or on the basis of our legitimate interests (e.g. when using agents, web hosts, etc.).
If we commission third parties with the processing of data on the basis of a so-called "processing contract", this is done on the basis of Art. 28 of the GDPR.
If we process data in a third country (i.e. outside the European Union (EU) or the European Economic Area (EEA)) or if this is done in the context of the use of third-party services or disclosure or the transfer of data to third parties, this will only occur if it is done to fulfil our (pre)contractual obligations, on the basis of your consent, a legal obligation or on the basis of our legitimate interests. Subject to legal or contractual permissions, we process the data or have the data processed in a third country only if the special requirements of Art. 44 et seq. of the GDPR are met. This means that the processing takes place, for example, on the basis of special guarantees, such as the officially recognised determination of a data protection level corresponding to that of the EU (e.g. through "Privacy Shield” in the USA) or the observance of officially recognised special contractual obligations (so-called "standard contractual clauses").
You have the right to request confirmation as to whether the data in question will be processed and to be informed of this data and to receive further information and a copy of the data in accordance with Art. 15 of the GDPR.
In accordance with Art. 16 of the GDPR, you have the right to request the completion of data concerning you or the correction of incorrect data concerning you.
Pursuant to Art. 17 of the GDPR, you have the right to demand that the relevant data be deleted immediately or, alternatively, to demand a restriction on the processing of the data pursuant to Art. 18 of the GDPR.
You have the right to demand that you receive the data concerning you that you have provided to us in accordance with Art. 20 od the GDPR and to demand that it be transferred to other controllers.
Pursuant to Art. 77 of the GDPR, you also have the right to file a complaint with the competent supervisory authority.
You have the right to revoke consents granted pursuant to Art. 7 (3) of the GDPR with effect for the future.
You may object at any time to the future processing of the data concerning you in accordance with Art. 21 of the GDPR. The objection may, in particular, be lodged against processing for the purposes of direct marketing.
“Cookies” are small files that are stored on the user's computer. Cookies can be used to store different data. A cookie is primarily used to store information about a user (or the device on which the cookie is stored) during or after the user's visit to a website. Temporary cookies, or "session cookies" or "transient cookies", are cookies that are deleted after a user leaves a website and closes his/her browser. Examples for data that can be stored in a cookie are the contents of a shopping basket in an online shop or a login status. Cookies that are referred to as "permanent" or "persistent" remain stored even after the browser has been closed. For example, the login status can be saved and reactivated if users revisit a website after several days. The interests of users can also be stored in such a cookie and then used for range measurement or marketing purposes. “Third-party cookies” are cookies that are offered by providers other than the controller who operates the website (cookies of the operator of a website themselves are referred to as "first-party cookies”).
We may use both temporary and permanent cookies and explain this in our Data Protection Declaration.
If users do not wish cookies to be stored on their computer, they are asked to deactivate the corresponding option in the system settings of their browser. Stored cookies can be deleted via the system settings of the browser. The exclusion of cookies can lead to functional restrictions of this website.
The data processed by us will be deleted or their processing restricted in accordance with Art. 17 and 18 of the GDPR. Unless expressly stated in this Data Protection Declaration, the data stored by us will be deleted as soon as they are no longer required for their intended purpose and there are no legal obligations to retain them. If the data are not deleted because they are required for other and legally permissible purposes, their processing will be restricted. This means that the data will be blocked and not processed for other purposes. This applies, for example, to data that must be stored for reasons concerning commercial or tax law.
In accordance with legal requirements applicable in Germany, documents are retained either for 6 years in accordance with Art. 257 (1) of the German Commercial Code (commercial books, inventories, opening balance sheets, annual financial statements, commercial letters, accounting records, etc.) or for 10 years in accordance with Art. 147 (1) of the German Tax Code (books, records, management reports, accounting records, commercial and business letters, documents relevant for taxation, etc.).
According to legal requirements in Austria, retention is required for 7 years in accordance with Art. 132 (1) of the Austrian Federal Tax Code (accounting documents, receipts/invoices, accounts, receipts, business papers, income and expense reports, etc.), for 22 years in connection with real estate, and for 10 years for documents in connection with electronically provided services, telecommunications, radio and television services which are provided to non-entrepreneurs in EU member states and for which the regulations of the Mini One Stop Shop (MOSS) concept are used for tax purposes.
We, or our hosting provider, collect data on each access to the server on which this service is located (so-called server logfiles) on the basis of our legitimate interests within the meaning of Art. 6 (1) f of the GDPR. The access data include the name of the website accessed, file, date and time of access, amount of data transferred, notification of successful access, browser type and version, the user's operating system, referrer URL (the previously visited site), IP address and the requesting provider.
Log file information is stored for security reasons (e.g. for the clarification of abuse or fraud) for a maximum duration of 7 days and deleted afterwards. Data, the further storage of which is necessary for evidence purposes, are excluded from deletion until the respective incident has been finally clarified.
Users can optionally register by creating a user account. During the registration process, the necessary mandatory information will be requested from the users. The data entered during registration will be used for the purpose of using our online services. Users may be informed by e-mail of information relevant to the service or registration, such as changes in the scope of services or technical changes. If users have cancelled their user account, their data will be deleted with regard to the user account – subject to retention for commercial or tax reasons pursuant to Art. 6 (1) c of the GDPR. It is the responsibility of the users to save their data before the end of the contract (registration) in the event of cancellation. We are entitled to irretrievably delete all user data stored during the term of the contract (registration).
Within the scope of the use of our registration and login functions and the use of the user account, we store the IP address and the time of the respective user action. The storage of these data is based on our legitimate interests, as well as the user's protection against misuse and other unauthorized use. The data will not be passed on to third parties unless it is necessary to pursue our claims or there is a legal obligation to do so pursuant to Art. 6 (1) c of the GDPR. The IP addresses are anonymized or deleted after 7 days at the latest.
When contacting us (e.g. via contact form, e-mail, telephone or via social media), the user's details will be processed for the purpose of responding to the contact enquiry and processing it in accordance with Art. 6 (1) b of the GDPR. The user data can be stored in a customer relationship management system ("CRM system") or a comparable enquiry processing system.
We will delete enquiry-related data if they are no longer necessary. We review the necessity every two years; furthermore, the statutory archiving obligations apply.
In the following, we inform you about the contents of our newsletter and also about the registration, dispatch and statistical evaluation procedures and your rights of objection. By subscribing to our newsletter, you agree to the receipt and procedures described.
Content of the newsletter: We send newsletters, e-mails and other electronic notifications containing advertising information (hereinafter referred to as "newsletter") only with the consent of the recipients or a legal permission. Insofar as the contents of the newsletter are specifically described in the registration process, they are decisive for the consent of the user. Besides this, our newsletters contain information about our services and our company.
Double-opt-in and logging: The registration to our newsletter is performed via a so-called double-opt-in procedure. This means that you will receive an e-mail after registration asking you to confirm your registration. This confirmation is necessary to prevent registrations using third-party e-mail addresses. The registrations for the newsletter are recorded in logfiles so that we are able to provide evidence for the registration process according to the legal requirements. This includes storing the login and confirmation times as well as the IP address. Likewise, the changes of your data stored with the e-mail marketing service provider are logged.
Germany: The dispatch of the newsletter and the performance measurement associated with it is based on the consent of the recipients pursuant to Art. 6 (1) a, Art. 7 of the GDPR in conjunction with Art. 7 (2) 3 of the German Unfair Competition Act [Gesetzgegen den unlauterenWettbewerb (UWG)] or on legal permission pursuant to Art. 7 (3) of the same act.
The registration procedure is recorded on the basis of our legitimate interests pursuant to Art. 6 (1) f of the GDPR. We are interested in using a user-friendly and secure newsletter system that serves our business interests, meets users' expectations, and allows us to provide evidence of consent.
Cancellation/revocation – You can cancel the receipt of our newsletter at any time, i.e. revoke your consent. You will find a link to cancel the newsletter at the end of each newsletter. We may store the unsubscribed e-mail addresses for up to three years on the basis of our legitimate interests before deleting them for newsletter mailing purposes in order to be able to provide evidence for a previously given consent. The processing of these data is limited to the purpose of a possible defence against claims. An individual deletion request is possible at any time, provided that the former existence of a consent is confirmed at the same time.
The newsletters are sent by the e-mail marketing service "MailChimp", a marketing automation platform of the US-based Rocket Science Group, LLC, 675 Ponce De Leon Ave NE #5000, Atlanta, GA 30308, USA. You can view the data protection regulations of the service provider here: mailchimp.com/legal/privacy/. The Rocket Science Group LLC d/b/a MailChimp is certified under the Privacy Shield Agreement and thereby provides a guarantee of compliance with European data protection requirements (https://www.privacyshield.gov/participant?id=a2zt0000000TO6hAAG&amp;status=Active). The e-mail marketing service provider is appointed on the basis of our legitimate interests pursuant to Art. 6 (1) f of the GDPR and a contract processing agreement pursuant to Art. 28 (3) phrase 1 of the GDPR.
The e-mail marketing service provider can use the data of the recipients in pseudonymous form, i.e. without allocation to a user, to optimise or improve their own services, e.g. for technical optimisation of the dispatch and presentation of the newsletter or for statistical purposes. However, the service provider does not use the data of our newsletter recipients to contact them in their own name or to pass the data on to third parties.
The newsletters contain a so-called "web-beacon", i.e. a file the size of a pixel, which is retrieved from our server when the newsletter is opened or, if we use a dispatch service provider, from their servers. Within the scope of this retrieval, technical information such as information about the browser and your system, as well as your IP address and time of retrieval are first collected.
This information is used for the technical improvement of the services on the basis of technical data or target groups and their reading behaviour on the basis of their retrieval points (which can be determined with the help of the IP address) or access times. Statistical surveys also include determining whether newsletters are opened, when they are opened, and which links are clicked. For technical reasons, this information can be assigned to the individual newsletter recipients. It is, however, neither our endeavour nor, if applicable, that of the dispatch service provider to observe individual users. Instead, the evaluations are used to recognize the reading habits of our users and to adapt our content to them or to send different content that matches the interests of our users.
Google is certified under the Privacy Shield Agreement and thereby provides a guarantee of compliance with European data protection requirements (https://www.privacyshield.gov/participant?id=a2zt000000001L5AAI&status=Active).
Google will use this information on our behalf to evaluate the use of our online services by users, to compile reports on the activities within this online service, and to provide us with other services associated with the use of this online service and the Internet. When doing so, pseudonymous user profiles of the users may be created from the processed data.
We only use Google Analytics with IP anonymization enabled. This means that Google shortens the IP address of the user within member states of the European Union or in other contracting states of the Agreement on the European Economic Area. Only in exceptional cases is the full IP address transmitted to a Google server in the USA and shortened there.
Further information on the use of data by Google, setting and objection options can be found on Google’s website: www.google.com/intl/de/policies/privacy/partners(“How Google uses data when you use our partners' sites or apps”); www.google.com/policies/technologies/ads (“Use of data for advertising purposes"); www.google.de/settings/ads(“Information Google uses to display advertisements").
We maintain online presences within social networks and on social media platforms to communicate with customers, interested parties, and users active there and to inform them about our services. When using the respective networks and platforms, the terms and conditions and the data processing guidelines of their respective operators apply.
Unless otherwise stated in our Data Protection Declaration, we process the data of users who communicate with us within social networks and on social media platforms, e.g. post articles on our online presence or send us messages.
Within our online offer, we use content or service offers from third parties on the basis of our legitimate interests (i.e. interest in the analysis, optimisation and economic operation of our online services within the meaning of Art. 6 (1) f of the GDPR) to integrate their content and services such as videos or fonts (hereinafter uniformly referred to as "content").
This generally presupposes that the third-party providers of this content perceive the IP address of the users, since they would not be able to send the content to their browsers without knowing the IP address. The IP address is therefore required for the presentation of these contents. We strive to use only contents, whose respective providers use the received IP addresses only for the distribution of the relevant contents. Third parties may also use so-called pixel tags (invisible graphics, also known as "web beacons") for statistical or marketing purposes. The "pixel tags" can be used to evaluate information such as visitor traffic on the pages of a certain website. The pseudonymous information may also be stored in cookies on the user's device and may include technical information about the browser and operating system, referring websites, visit times, and other information about the use of our website, and it may also be linked to such information from other sources.
We integrate the videos of the platform "YouTube" of the provider Google LLC, 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA. Privacy Statement www.google.com/policies/privacy/, Opt-out: adssettings.google.com/authenticated.
We integrate the maps of the service "Google Maps" of the provider Google LLC, 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA. Privacy Statement www.google.com/policies/privacy/, Opt-out: adssettings.google.com/authenticated.
We integrate the fonts ("Google Fonts") of the provider Google LLC, 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA. Privacy Statement www.google.com/policies/privacy/, Opt-out: adssettings.google.com/authenticated.

References: Art. 4
 Art. 13
 Art. 6
 Art. 7
 Art. 6
 Art. 6
 Art. 6
 Art. 6
 Art. 6
 Art. 28
 Art. 44
 Art. 15
 Art. 16
 Art. 17
 Art. 18
 Art. 20
 Art. 77
 Art. 7
 Art. 21
 Art. 17
 Art. 257
 Art. 147
 Art. 132
 Art. 6
 Art. 6
 Art. 6
 Art. 6
 Art. 6
 Art. 7
 Art. 7
 Art. 7
 Art. 6
 Art. 6
 Art. 28
 Art. 6