Source: https://www.bmd.com/en/siteservice/data-protection.html
Timestamp: 2019-04-21 18:05:00+00:00

Document:
IP addresses are needed for problem diagnostics, website administration, and demographic information. When you visit our website, we only recognize your domain name, not your e-mail address. We will only see your e-mail address if you let us know it by filling out a form or sending an e-mail.
Cookies are used for personalized content, to avoid repeated password entries or to adapt the information offered to user behaviour.
When you register, we will send you the requested information and/or products as well as other product information, news or promotional material.
If you provide your e-mail address, we will communicate with you via e-mail. We will not share your email address with anyone outside of BMD. If you no longer want to receive e-mails from us, you can unsubscribe at any time. When sending an e-mail to BMD, depending on the setting of your e-mail programme, personal data may be transmitted automatically. BMD will also treat this data as confidential.
Our website contains registration forms that you can fill out to request information, products and services. The data transmitted to BMD will only be used by us for this specific process.
For orders via our webshop (seminars, software requests) your data will be forwarded to the webshop operator. The data is stored within the EEC only.
Our website also contains links to other third-party websites. BMD is not responsible for the privacy practices or the content of other websites.
BMD regularly sends out user and seminar newsletters that you can subscribe to for free, so that you are always well-informed about the latest programme updates and changes, events, seminars and BMD advertising campaigns. If you no longer wish to receive e-mails from BMD, you may unsubscribe at any time. In order to be removed from the BMD e-mail list or BMD web registration database, an e-mail to newsletter@bmd.at is sufficient. Registered users can exercise their right of withdrawal at any time in the BMD user profile. You will also find details on the cancellation of the respective newsletter in each newsletter.
If no purchase contract is concluded, your data will be saved for advertising purposes. You always have the option of having your data deleted by BMD.
A transfer of data to third parties (e.g. licensors, mail order companies, banks, legal representatives in case of business, public accountants, courts if required, administrative authorities in case of action, participating contract and business partners, providers (IT service providers), insurances if required) only takes place if necessary for the fulfilment of the contract.
§ 6 Data Protection Act (DSG) and art. 28 par. 3 GDPR in the current version. A separate confidentiality declaration can be requested from BMD.
All information about the processing of personal data can be found in the order processing agreement. Should BMD act as a processor, a contract data processing agreement must be signed.
When using services from the maintenance contract, data on the traceability of the questions or problems reported, fault analyses and related support information etc. are electronically stored by BMD (telephone calls, tickets).
For billable services, a work report will be generated and sent to you by e-mail or the designated contact for confirmation of service provision. In addition, you can lodge a general e-mail address for the transmission of job tickets from BMD.
BMD is not obliged to check the admissibility of the data processing commissioned by the customer in terms of data privacy regulations. In particular, the customer himself is responsible for obtaining the consent, reporting and / or confidentiality requirements that may be mandatory under the terms of the Data Protection Act (DPA, GDPR) for the use of the services by the customer and his contract partners.
If you use the BMD Cloud, your data will be stored on the contractor's hardware, depending on how the order is handled. The data is stored exclusively within the EEC (in accordance with Chapter 5 GDPR).
This includes training for the implementation of software at the customer and other services that are carried out on site.
To be able to process a request through BMD, you grant direct access to your system.
To be able to process a request, BMD will create an online session on your workstation. Before performing the service, you must confirm access before transferring the content of the screen.
If your data is required for error analysis or for the performance of services, you should transmit it to BMD via a secure FTP server. If it is not possible to transmit the data online, you can request a password-protected and secure data medium from BMD against reimbursement of costs.
BMD collects and stores your data for the purpose of processing applications.
In the course of the application (online, by e-mail, post or in person) BMD collects personal data such as: name, address, date of birth or data you have voluntarily provided to us. This data is used exclusively for the application process and is only accessible to a limited group of people at BMD.
In exceptional cases, BMD works together with external HR recruiters. If so, you would be informed of this separately.
If an employment contract is established, the data stored in the course of the application process will be used for pre-contractual measures (preparation of employment contract).
After the application process, you will be informed about the status of your application. If your application is negative, your data will be kept in evidence and you will be notified of future job offers that match your application profile. If you do not want this, your data will of course be completely deleted.
If you would like to have your application data deleted, please send an e-mail to jobs@bmd.at.
BMD undertakes to process data and processing results only in the context of a written order or contract. If BMD is obliged by an authority to release your data, BMD is obliged to inform you at once.
All employees of the BMD are required to observe confidentiality pursuant to Art. 28 par. 3 GDPR and § 6 DPA in the current version.
In the event of a breach of data protection, BMD will inform you immediately, at the latest within 24 hours of the breach becoming known. BMD will promptly notify of any inspections or measures by the supervisory authorities, insofar as these relate to your data.
BMD declares that sufficient technical and organizational security measures have been taken in accordance with Art. 32 GDPR and that they must always be kept up to date with the latest technology. In addition, ISO 27001 certification was successfully carried out.
The server rooms of the contractor are guarded by access control and can only be entered by authorized employees.
All systems are secured by extensive password protection and are subject to an authorization concept, which ensures that only authorized persons have access to data.
Data is transferred via secure routes (e.g. a VPN-connection).
Personal data can only be collected, altered and deleted by authorized persons. Entries in the customer master data of BMD are logged.
The contractor shall act to the extent agreed upon with the customer (software order, service requests, maintenance contract etc.).
BMD confirms regular data backups and the monitoring of operating conditions. If necessary, emergency plans are available in order to minimize any possible failure of the operating requirements.
You are entitled to check compliance with the data protection regulations at BMD to an appropriate extent yourself or have this done by a third party.
The processing of the interested party data is done by BMD. If interested party data is transmitted to BMD by third parties (partners, etc.), the third party is responsible for obtaining the consent of the interested party regarding the disclosure of personal data.
The processing takes place to create the offer requested by the Storage period: Until the termination of the business relationship or until expiry of the statute of limitations and statutory retention periods applicable to the person responsible; in addition, until the termination of any legal disputes in which the data is required as proof about products and services of BMD and to the transmission of information and advertising material.
The data provided serves as the basis for the preparation of a purchase contract. If no purchase contract is concluded, the data of the prospective customer is stored for advertising purposes.
Storage period: until the termination of the business relationship or until expiry of the statute of limitations and statutory retention periods applicable to the person responsible; in addition, until the termination of any legal disputes in which the data is required as proof.
The processing of customer data is done by BMD. If customer data are transmitted to BMD by third parties (partners, etc.), the third party is responsible for obtaining the consent for the transfer of personal data from the customer.
The processing takes place for the fulfilment of the order, subsequent customer care and for the transmission of information and advertising material.
The processing takes place to carry out inquiries and orders with the supplier.
Applicant data is processed by BMD. If applicant data is collected via the online application, the applicant is responsible for the accuracy of the data. If applicant data is collected by third parties, the one who enters data is responsible for ensuring that the applicant agrees to the disclosure of the data.
The processing takes place in order to be able to carry out the application process or to inform the applicant about further vacancies that correspond to his profile.
Duration of storage: according to the agreed retention period of five years after the last contact with the applicant.
According to Art. 15 GDPR you have the right at any time to request information about all data stored by BMD about you. In case of doubt, BMD may request additional information to confirm the identity. The e-mail address furnished by BMD is: datenschutz@bmd.at.
If BMD processes personal data that is incomplete or incorrect, you may demand that it be corrected or completed.
a) The personal data is no longer required for the purposes for which it is collected or processed.
b) You revoke your consent and there is no longer a legal basis for further processing / storage.
c) You object to the processing and there are no legitimate grounds for further processing.
d) Your data has been unlawfully processed.
a) You dispute the correctness of the processing for the duration for which it allows the contractor to verify the accuracy of the data.
b) The processing of the data is unlawful, but you decline to delete.
c) The data is no longer needed by BMD for the intended purpose, but you still need this data to assert or defend legal claims.
d) You have filed an objection against the processing of the data.
You have the right to receive your personal information in a structured, normal and machine-readable format, provided the data has been stored by BMD as a result of your consent or to fulfil a contract, and the processing is done automatically.
If your personal data is processed by BMD based on art. 6 par. 1 lit. b or f, you have the right to object at any time, provided there is no overriding protecting interest in the data. You may object to receiving unsolicited advertising at any time without any reason.
You have the right to appeal to the designated supervisory authority if you believe that BMD violates Austrian or European data protection law.

References: § 6
 art. 28
 Art. 28
 § 6
 Art. 32
 Art. 15
 art. 6