Privacy Policy
In accordance with Articles 13 and 14 of Regulation (EU) 2016/679 (General Data Protection Regulation; "GDPR"), the controller must inform the data subject about the processing of personal data. With this document, we inform you about the personal data being processed.
Definitions
To make this privacy policy easier to understand, you will find a brief explanation of the terms used below.
Personal data ("data") means any information relating to the personal or material circumstances of an identified or identifiable natural person, such as name, address, email address, telephone number, date of birth, age, gender, social security number, video recordings, photos, etc. Data of legal entities are not subject to the provisions of the GDPR.
Processing means any operation or set of operations which is performed on personal data or on sets of personal data, whether or not by automated means, such as collection, recording, organization, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure, or destruction.
A controller is the natural or legal person, public authority, agency, or other body which, alone or jointly with others, determines the purposes and means of the processing of personal data.
A processor is a natural or legal person, public authority, agency, or another body which processes personal data on behalf of the controller.
A recipient is a natural or legal person, public authority, agency, or another body to which personal data are disclosed, whether or not it is a third party.
Our contact details
Should you have any further questions, we, as the controller responsible for the data processing described herein, are happy to assist you at the following contact details:
Teiritzhof SK GmbH
Bahnweg 1, 2100 Stetten, Austria
+436763284671
office@teiritzhof.at
Purposes and legal basis for processing
Data may only be processed for a specific purpose and only if the processing can be based on an appropriate legal ground. Processing may be justified for the following reasons:
We process your data for the following purposes based on the following legal grounds:
Recipients
Recipients support us in complying with statutory or legal obligations, in initiating and fulfilling contracts, in providing services that require your consent, or in carrying out processing activities that are in our legitimate interest. We disclose or transfer data, in particular, to the following recipients (processors or controllers):
We only transfer your data to other recipients if you have given your express consent pursuant to Art. 6(1)(a) GDPR, if it is legally permissible and necessary for the performance of a contractual relationship with you pursuant to Art. 6(1)(b) GDPR, if we are subject to a legal obligation to do so pursuant to Art. 6(1)(c) GDPR, or if the disclosure is necessary pursuant to Art. 6(1)(f) GDPR for the purposes of our legitimate interests and for the establishment, exercise, or defense of legal claims, and there is no reason to assume that you have an overriding interest in the non-disclosure of your data that requires protection.
We intend to transfer data to the following third countries: United States of America.
For the United States of America, an adequacy decision by the European Commission is in place. In its decision of July 10, 2023, C(2023) 4745 final, the European Commission determined that the United States of America provides an adequate level of data protection within the meaning of Art. 45 GDPR, provided our contractual partner is included in the EU-U.S. Data Privacy Framework list. Information regarding the registration of individual providers in this list can be found in the respective section of this privacy policy.
In the absence of an adequacy decision, we may only transfer data based on appropriate safeguards, such as standard contractual clauses, binding corporate rules, approved codes of conduct, approved certification mechanisms, etc. Under the conditions of Art. 49 GDPR, a transfer may nevertheless be permissible. You are welcome to request a copy of these safeguards for your specific case from us.
There is no intention to transfer the data to an international organization.
Retention period
As a general rule, data is only stored for as long as required by statutory retention obligations. Furthermore, data may be stored if this is necessary for the assertion of or defense against third-party claims. Important retention periods are listed below:
dogado
We use the web hosting provider World4You for our website. The service provider is the German company dogado GmbH, Antonio-Segni-Straße 11, D-44263 Dortmund.
You can learn more about the data processed through the use of dogado in the privacy policy at https://www.dogado.de/legal/datenschutz.
Webflow
We use Webflow as our website hosting provider. The provider is Webflow, Inc., 398 11th Street, 2nd Floor, San Francisco, CA 94103, USA (hereinafter: Webflow).
Type of data: IP address, date and time of access, browser type, operating system, and device data.
Purpose: Provision and error-free delivery of the website, as well as ensuring security.
Legal basis: Our legitimate interest in the technically flawless presentation and security of our website (Art. 6(1)(f) GDPR).
Data transfer: Webflow is certified under the EU-U.S. Data Privacy Framework. In addition, standard contractual clauses have been concluded to ensure an adequate level of data protection.
Further information: https://webflow.com/legal/privacy
Fonts
We use Google Fonts and other fonts on our website to ensure our content is visually appealing. These fonts are hosted locally on our server (provided via Webflow). This avoids a direct connection to Google's servers or those of other external providers, and no IP address or other data is transmitted to these providers. The use of these locally hosted fonts serves our legitimate interest in maintaining an attractive and user-friendly website design (Art. 6(1)(f) GDPR).
Google Services
General
The provider of the following services is Google Ireland Limited, Gordon House, Barrow Street, Dublin, D04 E5W5, Ireland. You can find Google's privacy policy here https://policies.google.com/privacy?hl=en
However, some services (such as Google Search or Google Maps) are provided by or transmitted to the following company: Google LLC, 1600 Amphitheatre Pkwy, Mountain View, California 94043-1351, USA. Google LLC is based in a third country. Google LLC is included on the list, meaning that data transfers to the USA are compliant with data protection regulations under Art. 45 GDPR. Further information on Google LLC's certification can be found here https://www.dataprivacyframework.gov/s/participant-search/participant-detail?id=a2zt000000001L5AAI&status=Active
Some Google services use cookies. An overview of the cookies used, their purpose, and their storage duration can be found in the cookie section of this privacy policy. Your consent, as defined by Art. 6(1)(a) GDPR and § 165(3) TKG, is obtained prior to the use of Google services and the setting of the necessary cookies. You may withdraw your consent at any time.
Prior consent for cookies is only not obtained if the sole purpose is the transmission of a message or if it is strictly necessary for us to provide a service that you have explicitly requested.
Cookies
Cookies are text files stored on your device to recognize it. Cookies may contain information about your use of our offers and services. Based on the Planet49 GmbH ruling by the ECJ, consent is obtained for cookies even if they are not personal in nature.
Some of the cookies used are stored only until you close our website (session cookies), while others are stored for a longer period, allowing you to be recognized (persistent cookies). Some cookies are strictly necessary for the website to function (essential cookies), while others track visits and the visitor's origin to measure data without being able to identify you personally (performance cookies). Certain cookies are used for marketing purposes (marketing cookies).
If personal data are also processed by individual cookies we use, the processing is carried out in accordance with Art. 6(1)(b) GDPR for the performance of a contract, in accordance with Art. 6(1)(a) GDPR if consent has been given, or in accordance with Art. 6(1)(f) GDPR to safeguard our legitimate interests in ensuring the best possible functionality of the website and a user-friendly and effective user experience.
You can select which cookies you wish to allow via the cookie declaration when you first visit the website. Your consent is required for marketing cookies. If you wish to withdraw your consent or change your cookie settings, you can make these changes directly in your browser.
Legal notice
Right of access
You have the right to request confirmation as to whether personal data concerning you are being processed; if this is the case, you have the right to access this personal data. This includes the following information: the purposes of the processing; the categories of personal data concerned; the recipients or categories of recipients; where possible, the envisaged period for which the personal data will be stored, or, if not possible, the criteria used to determine that period; the existence of the right to request rectification or erasure of personal data or restriction of processing by the controller or to object to such processing; the right to lodge a complaint with a supervisory authority; any available information as to the source of the data; and the existence of automated decision-making, including profiling.
Right to rectification
You have the right to request that the controller rectify inaccurate personal data and complete any incomplete personal data.
Right to erasure
You have the right to request that the controller erase your personal data without undue delay if one of the following grounds applies: The personal data are no longer necessary for the purposes for which they were collected. You withdraw your consent on which the processing was based, and there is no other legal ground for the processing. You object to the processing (Art. 21(1) GDPR) and there are no overriding legitimate grounds for the processing, or you object to the processing pursuant to Art. 21(2) GDPR. The personal data have been processed unlawfully. The erasure of the personal data is required for compliance with a legal obligation. The personal data have been collected in relation to the offer of information society services referred to in Article 8(1). The right to erasure does not apply to the extent that processing is necessary for exercising the right of freedom of expression and information; for compliance with a legal obligation; for the performance of a task carried out in the public interest; for reasons of public interest in the area of public health; for archiving purposes in the public interest, scientific or historical research purposes, or statistical purposes; or for the establishment, exercise, or defense of legal claims.
Right to restriction of processing
You have the right to obtain restriction of processing if one of the following applies: the accuracy of the personal data is contested by you, for a period enabling the controller to verify the accuracy of the personal data; the processing is unlawful and you oppose the erasure of the personal data and request the restriction of their use instead; the controller no longer needs the personal data for the purposes of the processing, but they are required by you for the establishment, exercise, or defense of legal claims; or you have objected to processing pursuant to Article 21(1) pending the verification of whether the legitimate grounds of the controller override yours.
Where processing has been restricted, such personal data shall, with the exception of storage, only be processed with your consent or for the establishment, exercise, or defense of legal claims or for the protection of the rights of another natural or legal person or for reasons of important public interest.
Right to data portability
You have the right to receive the personal data you have provided to a controller in a structured, commonly used, and machine-readable format, and you have the right to transmit those data to another controller without hindrance from the controller to whom the personal data have been provided, provided that the processing is based on consent or a contract and the processing is carried out by automated means.
In exercising your right to data portability, you have the right to have the personal data transmitted directly from one controller to another, where technically feasible.
Right to object
You have the right to object, on grounds relating to your particular situation, at any time to the processing of personal data concerning you which is based on Article 6(1)(e) or (f) GDPR; this also applies to profiling based on these provisions. The controller shall no longer process the personal data unless the controller demonstrates compelling legitimate grounds for the processing which override your interests, rights, and freedoms, or for the establishment, exercise, or defense of legal claims.
Where personal data are processed for direct marketing purposes, you have the right to object at any time to the processing of personal data concerning you for such marketing, which includes profiling to the extent that it is related to such direct marketing.
Right to withdraw consent
You have the right to withdraw your consent at any time if the processing is based on Article 6(1)(a) or Article 9(2)(a). This does not affect the lawfulness of processing based on consent before its withdrawal.
Right to lodge a complaint
You have the right to lodge a complaint with the Austrian Data Protection Authority (Österreichische Datenschutzbehörde), Barichgasse 40-42, 1030 Vienna, T: 00431521522569, E: dsb@gsb.gv.at, if you believe that the processing of your data violates applicable data protection law.
Other information
The provision of personal data is partly required by law or necessary for the conclusion of a contract. You are generally not obliged to provide your data. If you choose not to provide the data, it will not be possible to conclude a contract.
There is no automated decision-making, including profiling, as referred to in Article 22(1) and (4).