PRIVACY POLICY
PRIVACY POLICY
The protection of your data is very important to us, which is why we observe the applicable provisions on data protection, in particular those set forth in the GDPR and the national data protection law, while processing your personal data. Below you will find more detailed information on the data processing activities carried out by us:
1. Controller
BG-Graspointner GmbH
Gessenschwandt 39
4882 OBERWANG
+43 6233 8900 – 0
office@bg-graspointner.com
As we are not legally obliged to do so, we have not appointed a data protection officer/appointed one with the data protection authority. If you have any questions, you can contact us at the above (email) address.
The controller is member of a group of undertakings within the meaning of Art. 4 (19) GDPR. The data listed below are only transferred to other members of the group of undertakings where this is expressly mentioned. The legal basis is our legitimate interest in transferring the data for internal administrative purposes (point (f) of Art. 6 (1) in conjunction with Recital 48 GDPR).
2. Rights of the data subject/Right to object and withdraw consent/Right to lodge a complaint
2.1. You can exercise the following rights against us in respect of the personal data concerning you:
- Right of access (Art. 15 GDPR),
- Right to rectification (Art. 16 GDPR) or erasure (Art. 17 GDPR),
- Right to restriction of processing (Art. 18 GDPR),
- Right to data portability (Art. 20 GDPR),
- Right to object to processing (Art. 21 GDPR).
Right to object: Where the processing of your personal data is based on the balancing of interests (point (f) of Art. 6 (1) GDPR: legitimate interests), you have the right to object, on grounds relating to your particular situation, at any time to processing of personal data concerning you. When you exercise your right to object, we will ask you to state the reasons why you do not wish your personal data to be processed the way we previously did. We will review the circumstances and will either discontinue the processing, modify the processing or demonstrate to you our compelling legitimate grounds for continuing the processing. We will continue to process data even if it is for the purpose of asserting, exercising or defending legal claims. You can object to data processing for the purposes of direct advertising and data analysis at any time. In this case, we will discontinue the data processing. Where you have consented to the processing of your personal data, you can withdraw your consent at any time. The withdrawal of your consent will not affect the lawfulness of processing carried out before the withdrawal. To exercise the rights listed, you must inform us in person, by telephone or in writing:
BG-Graspointner GmbH
Gessenschwandt 39
4882 OBERWANG
ÖSTERREICH
+43 6233 8900 – 0
office@bg-graspointner.com
Please note that we are only able to provide information if you provide proof of your identity. This is mainly to protect you and prevent the disclosure of your data to unauthorised third parties.
2.2. If you believe that the data processing breaches the applicable data protection regulations or that we have violated your rights under the data protection legislation, you also have the right to lodge a complaint with the supervisory authority in the member state of your habitual residence, place of work or place of the alleged infringement.
If you wish to file a complaint with the local supervisory authority, please address your complaint to:
Austrian Data Protection Authority
Barichgasse 40-42
1030 Vienna
3. Information on the processing of your personal data
3.1. When visiting the website merely for information purposes
- Purpose: When using our website for information purposes only (no registration or transmission of other information), we collect those personal data which are transmitted to our server by your browser. This is technically necessary to be able to display to you our website as well as to ensure the stability and security of the website.
- Legal basis: Legitimate interests (point (f) of Art. 6 (1) GDPR)
- The following data are processed: IP address, date and time of the request, time zone difference to GMT, content of the request (specific page), access status/HTTP status code, transmitted data in each case.
- Data volume, requesting website, browser, operating system and interface, language and version of the browser software
- Duration of storage: As long as you use our website.
- Recipients/Categories of recipients: None
3.2. Electronic contact requests via the website
- Purpose: Processing of contact requests sent via email or the website contact form.
- Legal basis: Performance of a contract, taking steps prior to entering into a contract (point (b) of Art. 6 (1) GDPR), legitimate interests (point (f) of Art. 6 (1) GDPR)
- The following data are processed: Master data, content of request
- Duration of storage: Until the request is answered. If statutory retention requirements exist, the processing will be limited to the period from answering the request to the end of the retention period.
- Recipients/Categories of recipients: Members of our group of undertakings
3.3. Cookies/Web analytics service
- Purpose: Improvement of services offered, web presence and direct marketing
- Legal basis: Legitimate interest, in particular in maintaining the functionality of the website and improving its own services for the benefit of users (point (f) of Art. 6 (1) GDPR)
- The following data are processed: IP address
- Duration of storage: 14 months
- Cookie guideline
- Recipients/Categories of recipients: members of our group of undertakings
- Recipients/Categories of recipients: Google Analytics
3.4. Customer management, accounting, logistics and bookkeeping
- Purpose: Processing of personal data as part of business relationships with customers and suppliers in the context of the manufacture of products produced by our company and the provision of services, including systematic recording of all business operations relating to income and expenses
- Legal basis: Performance of a contract, taking steps prior to entering into a contract (point (b) of Art. 6 (1) GDPR), for processing (in particular storage) after compliance with the contractual obligations: legitimate interests, in particular establishment, exercise and defence of legal claims (point (f) of Art. 6 (1) GDPR), explicit consent (point (a) of Art. 9 (2) GDPR)
- Duration of storage: Until termination of the business relationship or until expiry of the guarantee, warranty, limitation and statutory retention periods applicable to the customer (in particular BAO – Austrian Federal Fiscal Code); in addition, until resolution of any legal disputes for which the data is required as evidence
- Recipients/Categories of recipients: Revenue office, courts and public authorities, suppliers, debt collection agencies, banks entrusted with the payment to the data subject or a third party, legal representatives, public accountants, payroll accountants, members of our group of undertakings
The provision of your personal data is required for the performance of the contract and/or to take steps prior to entering into the contract. Without these data, we cannot conclude a contract with you.
3.5. Customer support and marketing for own purposes
- Purpose: Processing of our own or purchased data of customers and prospective customers to initiate business contact concerning our own products or services as well as to implement advertising campaigns and to send newsletters; customer relationship management, in particular information of customers/interested parties about requested and related products and services.
- Legal basis: for newsletters: Legal basis: For newsletter: consent (point (a) of Art. 6 (1) GDPR), for existing customers and during the initial phase: legitimate interests, (point (f) of Art. 6 (1) GDPR), in particular direct marketing (Recital 47 GDPR)
- The following data are processed for sending the newsletter via our website: Master data
- Duration of storage: The data are retained until the end of the third year following the last contact with the customer, unless longer contractual or statutory retention periods exist.
- Recipients/Categories of recipients: CleverReach GmbH & Co. KG (processor), members of our group of undertakings
3.6. Applicant management
- Purpose: Use and keeping on file of personal data provided by applicants, provided that these data were provided by the data subject
- Legal basis: in the case of evidence retention: Legal basis: When keeping the personal data on file: consent (point (a) of Art. 6 (1) GDPR), when transferring sensitive data within the meaning of Art. 9 GDPR to us (e.g. religious confession, social insurance number): explicit consent (point (a) of Art. 9 (2) GDPR), after receipt of applicant data (initial phase): taking steps prior to entering into a contract (point (b) of Art. 6 (1)
- Duration of storage: Applicant data will be deleted immediately after filling the advertised position or after expiry of deadline for asserting claims according to the Austrian Equal Treatment Act, unless consent to keeping the application on file for future reference is available. Speculative applications will be kept on file according to their purpose until withdrawal of consent by the data subject.
- Recipients/Categories of recipients: Applicant data will not be passed on to third parties.
4. Information on data transfer to third countries or international organisations
The data processed by us will only be transferred to the following members of our group of undertakings (Art. 4 (19) GDPR):
- BG-Graspointner AG, Industriering 17, 3250 Lyss, Switzerland
- BG-Graspointner Inc., 642 De Courcelle, Suite 206, Montréal (QC), H4C 3C5, Canada
- BG-Graspointner USA Inc., 134 Boynton Ave, Plattsburgh, NY 12901, USA
- BG-Graspointner UK Ltd, Magenta Building, 2 Brookhill Way, Banbury, Oxon, OX16 3ED, United Kingdom
In the case of Canada, this transfer takes place on the basis of an adequacy decision (Art. 45 (3) GDPR) and in other cases on the basis of standard data protection clauses (point (c) of Art. 46 (2) GDPR) adopted by the European Commission in accordance with the examination procedure referred to in Art. 93 (2) GDPR.