1 General
1.1 Controller
The “controller” within the meaning of the GDPR is:
ENTECO CONCEPT GmbH
Burggasse 104 / Top 10, 1070 Vienna
+43 1 5224788
gdpr [at] lofy.wien
1.2 Changes and Updates to the Privacy Policy
We ask that you regularly inform yourself about the content of our privacy policy, as only the current version is valid. If changes to our data processing become necessary, we will adapt our privacy policy to our data processing. If an act of cooperation, for example consent, or other individual notification is required, we will contact you in this regard.
2 Processing of Personal Data
2.1 Categories of Personal Data Processed
We process various types of data. These are “inventory data,” “contact data,” “content data,” and “usage data.” “Inventory data” is any master data relating to a person, legal or natural, as understood in the sense of data management in computer science. “Contact data” refers to contact options such as email, telephone, fax, etc. Photos, videos, text entries, audios, and the like are referred to as “content data.” “Usage data” includes all types of data that record your usage data, such as the access time of a website or the websites you visit. “Metadata” is, simply put, data about data. This includes, for example, the access date to the website.
2.2 Purposes of Processing
| Purpose of processing | Legal basis |
| General administration of the company | Art. 6 para. 1 lit. c and f GDPR; Art. 9 para. 2 lit. b |
| Ensuring the legal compliance of the company and its actions | Art. 6 para. 1 lit. c and f GDPR |
| Optimization of the customer experience and business processes | Art. 6 para. 1 lit. a and f GDPR |
| Processing and transmission of data within the framework of a business relationship with customers and suppliers, including automatically created and archived text documents (e.g., correspondence) in these matters | Art. 6 para. 1 lit. a, b, c and f GDPR |
| To fulfill the sale and distribution of services and products | Art. 6 para. 1 lit. a and b GDPR |
| Electronic communication via the Internet using technologies such as email or messenger platforms or via contact form on websites, communication in forums on company-owned websites with interested parties, customers, business partners and others for informative or economic reasons, as well as to fulfill pre-contractual and contractual obligations | Art. 6 para. 1 lit. a, b, c, d and f GDPR |
| Operation of a website for external presentation and marketing of the company and for contacting, including contact form, blog, advertising and external presence. Collection of personal data in log files on servers and, if applicable, in the CMS | Art. 6 para. 1 lit. a and f GDPR |
| Regular information and current offers and offers from third-party providers to interested parties and customers | Art. 6 para. 1 lit. a and f GDPR |
| Marketing/advertising for goods or services and for the company, external presentation through processing of own or purchased customer and prospect data for business initiation regarding own supply or service offer as well as for carrying out advertising measures and newsletter dispatch as well as processing in Customer Relation Management | Art. 6 para. 1 lit. a and f GDPR |
| Operating a social media presence for external advertising, customer loyalty and brand building. External presentation for business initiation regarding own supply or service offer as well as for carrying out advertising measures and messenger newsletter dispatch. | Art. 6 para. 1 lit. a and f GDPR |
| Creating statistics to optimize marketing for goods/services, the social media presence, the regular information about current offers to interested parties and customers | Art. 6 para. 1 lit. a and f GDPR |
2.2.1 Legitimate Interests Pursuant to Art. 6 Para. 1 Lit. F GDPR
Our legitimate interests in the above-mentioned points of our data processing are as follows:
- If the legal basis is the legitimate interest and the fulfillment of our legal obligations, our interest lies in maintaining the legal compliance of our actions.
- If the legal basis is the legitimate interest and the fulfillment of a contract or implementation of pre-contractual measures, our interest lies in the fact that according to the general principle “pacta sunt servanda” (agreements must be kept) we are obliged to adhere to the contract.
- With regard to advertising, marketing, etc., our legitimate interest lies in optimizing the customer experience of our products/services but also in optimizing our external presentation. Here, data, except for essential data which is needed to function, is only processed with the consent of the data subject.
2.3 Categories of Recipients
We strive to process your data personally as much as possible, but this is not always possible. Therefore, we must resort to processors who process your data on our behalf. Therefore, we resort to the following recipients or categories of recipients:
- Google Ireland Limited, Google Building Gordon House, Barrow St, Dublin 4, Ireland
- Facebook Ireland Limited, 4 Grand Canal Square Dublin 2 Dublin, Ireland
- Crisp IM SARL, 2 Boulevard de Launay, 44100 Nantes, France
- Expo-IP GmbH, Robert-Bosch-Straße 7, 64293 Darmstadt, Germany
- Sendinblue GmbH, Köpenicker Straße 126, 10179 Berlin, Germany
- Zapier Inc., 548 Market St. #62411, San Francisco, CA 94104-5401, United States of America
- Tax advisors
- Possibly lawyers
- Possibly authorities
- Possibly companies affiliated with us
- Within the framework of Erste Wohnmesse/Erste Wohnmesse digital” – exhibitors, if you have consented to the data transfer to these persons.
2.4 Data Transfer to a Third Country
Our carefully selected processors are mostly located in the territory of the European Union. Therefore, for the data transfer within the EU, neither an existing adequacy decision pursuant to Art. 45 para. 1 GDPR nor so-called “standard contractual clauses” are necessary. The data transfer to a third country is mostly regulated by standard contractual clauses. Thus, there is no adequacy decision for the USA, any data processing/transfer therefore takes place on the basis of standard contractual clauses with the respective recipients of the data.
The European Commission has already published a template for standard contractual clauses, these are available here.
We will provide you with standard contractual clauses, which we have agreed with our contractual partners, upon request.
2.5 Duration of Storage / Criteria for Determining this Duration
Basic requirements for determining the storage period are on the one hand § 212 UGB with a storage period of 7 years, from the end of the calendar year. On the other hand, the general limitation period of 30 years pursuant to §§ 1478 – 1485 ABGB or the special limitation period pursuant to §§ 1486 – 1487 ABGB for asserting any legal claims of the controller. If the law provides for a limitation period other than the one mentioned above for certain facts, the storage period is the limitation period pursuant to the corresponding standard.
If the data subject has consented to the data processing, the deletion of their data is excluded until the consent is revoked.
If there is no legal basis for storing the data, we reserve a deletion period of 3 months from the elimination of the legal basis.
3 Rights of Data Subjects
3.1 General Provisions on the Rights of Data Subjects
All communications that you receive in the context of your data subject rights are as precise, transparent and understandable as possible. Furthermore, they are transmitted in an easily accessible form and in a language that is as easy to understand as possible.
If we have reasonable doubts about your identity, we reserve the right to request a copy of your identity card from you in order to eliminate our doubts regarding your identity.
Basically, the information listed below is available to you free of charge. In the case of manifestly unfounded or excessive requests from a data subject, we reserve the following rights:
- Reimbursement of administrative costs in the context of the information or the implementation of the requested measure
- Refusal to act on your request
3.2 Rights of Data Subjects
You have the following rights, which you can assert directly against us. These rights are:
- Right of access by the data subject pursuant to Art. 15 GDPR
- Right to rectification pursuant to Art. 16 GDPR
- Right to erasure pursuant to Art. 17 GDPR
- Right to restriction of processing pursuant to Art. 18 GDPR
- Right to data portability pursuant to Art. 20 GDPR
- Right to object pursuant to Art. 21 GDPR
Furthermore, you have a right to lodge a complaint with a supervisory authority pursuant to Art. 77 GDPR.
3.2.1 Right of Access by the Data Subject Pursuant to Art. 15 GDPR
You have the right at any time, within the framework of an information request to the person responsible for data protection by mail to the address indicated above, to be informed about the facts mentioned in the following.
In particular, you have a right to information about your personal data processed by us, the processing purposes, the categories of personal data processed, the recipients or categories of recipients to whom your data have been or will be disclosed, the planned storage period or the criteria for determining the storage period, the existence of a right to rectification, erasure, restriction of processing, objection to processing, complaint to a supervisory authority, the origin of your data, if these were not collected from you by us, the existence of automated decision-making including profiling and, if applicable, meaningful information about the logic involved and the scope and intended effects of such processing concerning you, as well as your right to be informed about which guarantees exist pursuant to Art. 46 GDPR when transferring your data to third countries.
3.2.2 Right to Rectification Pursuant to Art. 16 GDPR
You have the right to immediate rectification of incorrect data concerning you and/or completion of your incomplete data stored by us.
3.2.3 Right to Erasure Pursuant to Art. 17 GDPR
You have the right to demand the erasure of your personal data if the requirements of Art. 17 para. 1 GDPR are met. However, this right does not exist in particular if the processing is necessary for the exercise of the right to freedom of expression and information, for the fulfillment of a legal obligation, for reasons of public interest or for the assertion, exercise or defense of legal claims.
If you request the deletion of the data even though a contract exists that binds us to an ongoing service, contact must be made with your responsible clerk in individual cases and the further procedure must be discussed, unless corresponding contractual conditions were agreed at the time of the conclusion of the contract.
1.2.4 Right to Restriction of Processing Pursuant to Art. 18 GDPR
You have the right to request the restriction of your data if one of the following conditions is met:
- The accuracy of your personal data is disputed, for the period that allows the controller to verify the accuracy of the personal data
- The processing is unlawful and you refuse the erasure of your data and request the restriction of the use of your data
- We no longer need your data for our purposes of processing, but you need this data for the assertion, exercise or defense of your legal claims
- You have lodged an objection to the data processing; For the period of the balancing of interests, whose interest prevails, you have a right to restriction of processing
If the processing has been restricted, we may nevertheless process your data for the assertion, exercise or defense of our legal claims.
We will inform you when the restriction is lifted.
1.2.5 Right to Data Portability Pursuant to Art. 20 GDPR
You have the right to receive your personal data that you have provided to us in a structured, common and machine-readable format or to request the transfer to another controller, insofar as this is technically feasible.
1.2.6 Right to Object Pursuant to Art. 21 GDPR
In the event of revocation, we will delete the data concerned immediately, unless further processing can be based on a legal basis for processing without consent. The revocation of consent does not affect the lawfulness of the processing carried out on the basis of the consent until revocation.
