Privacy Policy
Under Articles 13 and 14 of Regulation (EU) 2016/679 (General Data Protection Regulation; “GDPR”), the controller must inform data subjects about the processing of personal data. With this document, we inform you about the personal data we process.
Definitions
For better readability of this privacy policy, a brief explanation of the terms used follows below.
Personal data (“data”) means all data containing information relating to the personal or material circumstances of an identified or identifiable natural person, such as name, address, email address, phone number, date of birth, age, gender, social security number, video recordings, photos etc. Data relating to legal entities is not subject to the provisions of the GDPR.
Processing means any operation or set of operations performed on personal data, whether or not by automated means, such as collection, recording, organisation, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure or destruction.
Controller means the natural or legal person, public authority, agency or other body which, alone or jointly with others, determines the purposes and means of the processing of personal data.
Processor means a natural or legal person, public authority, agency or other body which processes personal data on behalf of the controller.
Recipient means a natural or legal person, public authority, agency or another body to which the personal data are disclosed, whether a third party or not.
Our contact details
Should you have any further questions, we, as the controller of the data processing described herein, are happy to help at the following contact details:
Sauber-Zauber Reinigungs KG
Liechtensteinstraße 110/15
1090 Wien, Austria
Phone: +43 1 332 00 52
Email: office@sauberzauber.at
Purposes and legal basis of processing
Data may only be processed for a specific purpose and only if the processing can be based on an appropriate legal basis. Processing may be justified for the following reasons:
| Justification | Legal basis |
|---|---|
| based on your voluntary consent for a specific purpose | Art. 6(1)(a) GDPR |
| for the performance of a contract to which you are a party, or to take steps at your request prior to entering into a contract | Art. 6(1)(b) GDPR |
| due to a legal obligation to which we are subject | Art. 6(1)(c) GDPR |
| to protect your vital interests or those of another natural person | Art. 6(1)(d) GDPR |
| for the performance of a task carried out in the public interest or in the exercise of official authority vested in us | Art. 6(1)(e) GDPR |
| based on a balancing of interests between our interests or those of a third party in the processing on the one hand, and your interests or fundamental rights and freedoms on the other | Art. 6(1)(f) GDPR |
We process your data for the following purposes based on the following legal grounds:
| Categories of data collected | Purpose of processing | Legal basis |
|---|---|---|
| Applicant data (name, date of birth, place of birth, address, email address, phone number, other data from CVs) | This data is necessary to use our services and to initiate a contract, and is collected from you. | Art. 6(1)(a) and (b) GDPR |
| Contact data (name, address, email address, phone number) | This data is necessary to use our services or to initiate a contract and is collected from you when you contact us. | Art. 6(1)(a) and (b) GDPR |
| Technical information (IP address, operating system) | This data is required so that the website you opened can be displayed to you correctly. | Art. 6(1)(f) GDPR |
Recipients
Recipients support us in complying with statutory or legal obligations, in initiating and performing contracts, in providing services that require your consent, or in carrying out processing activities that are in our legitimate interest. We partially transmit or disclose data, in particular, to the following recipients (processors or controllers):
| Recipient | Description |
|---|---|
| IT service providers | Operation of our IT systems, in particular email services, hosting services etc. |
| Subcontractors | Where services are not provided by us directly and a valid legal basis exists |
| Tax advisors, accountants | Processing of data for tax or accounting purposes |
| Lawyers, courts, debt collection agencies | Where applicable, to assert or defend legal claims |
We only transmit your data to other recipients if you have given your explicit consent under Art. 6(1)(a) GDPR, if this is legally permissible and necessary to fulfil a contractual relationship with you under Art. 6(1)(b) GDPR, if we are subject to a legal obligation to do so under Art. 6(1)(c) GDPR, or if disclosure is necessary under Art. 6(1)(f) GDPR to safeguard our legitimate interests and to assert, exercise or defend legal claims, and there is no reason to assume that you have an overriding, legitimate interest in your data not being disclosed.
We intend to transfer data to the following third countries: the United States of America.
An adequacy decision by the European Commission exists for the United States of America. By decision of 10 July 2023 on C(2023) 4745 final, available here, the European Commission decided that the United States of America offers an adequate level of data protection within the meaning of Art. 45 GDPR, provided that our contractual partner is listed on the EU-U.S. Data Privacy Framework list, available here. Information on whether individual providers are listed can be found in the relevant section of this privacy policy.
Where no adequacy decision exists, we may only transfer data on the basis of appropriate safeguards, such as standard contractual clauses, binding corporate rules, approved codes of conduct, approved certification mechanisms etc. Under the conditions set out in Art. 49 GDPR, a transfer may nevertheless be permissible. We are happy to provide you with a copy of the relevant safeguards for your specific case upon request.
There is no intention to transfer data to an international organisation.
Storage period
Data is generally only stored for as long as necessary due to statutory retention obligations. Beyond that, data may be stored if necessary to assert or defend claims by third parties. Important retention periods are set out below:
| Retention obligation | Expected storage period |
|---|---|
| Retention obligation under Austrian commercial law (§§ 190, 212 UGB – Austrian Commercial Code) | 7 years |
| VAT retention obligation for invoices (§ 11(2), 3rd subparagraph UStG – Austrian VAT Act) | 7 years |
| VAT retention obligation for export documents (§ 7(7) UStG – Austrian VAT Act) | 7 years |
| Statutory warranty (§ 933 ABGB – Austrian General Civil Code) | 2 years |
| Purchase price claims for movable property (§ 1062 in conjunction with § 1486 ABGB) | 3 years |
| Claims arising from a contract for work and services under § 1486 ABGB (where the service was provided in the course of a commercial or other business operation) | 3 years |
| General claims for damages under § 1489 ABGB (compensation claims) | 3 years / 30 years |
| Liability claims under § 13 PHG (Austrian Product Liability Act) | 10 years |
Web hosting and third-party providers
We use the following provider to make our website available. We currently do not use any further services (e.g. analytics, marketing or appointment-booking tools).
Vercel
We use the cloud platform Vercel for the hosting and delivery of our website. The provider is Vercel Inc., 340 S Lemon Ave #4133, Walnut, CA 91789, USA (hereinafter: Vercel).
- Type of data: IP address, request headers and log data.
- Purpose: Fast delivery of the website via a global network (CDN) and protection against DDoS attacks.
- Legal basis: Art. 6(1)(f) GDPR (legitimate interest in a performant and secure web infrastructure).
- Data transfer: Vercel is certified under the EU-U.S. Data Privacy Framework. The transfer to the USA is therefore based on an adequacy decision of the EU Commission.
- Further information: Further details can be found in the privacy policy available here.
Cookies
Cookies are text files that are stored on your device to recognise it. Cookies may contain information about the use of our offers and services. Following the ruling of the European Court of Justice in the Planet49 GmbH case, consent is obtained for cookies even where they do not process personal data.
Some of the cookies we use are only stored until you close our website (session cookies), while other cookies are stored for a longer period and allow you to be recognised again (persistent cookies). Some cookies are strictly necessary for the website to function (essential cookies), while others record visits and the visitor’s origin and measure this data without the cookies being able to identify you personally (performance cookies). Certain cookies are used for marketing purposes (marketing cookies).
Where individual cookies we use also process personal data, this processing takes place either under Art. 6(1)(b) GDPR to perform the contract, under Art. 6(1)(a) GDPR where consent has been given, or under Art. 6(1)(f) GDPR to safeguard our legitimate interest in the best possible functionality of the website and a customer-friendly, effective user experience.
Via the cookie notice shown on your first visit to the website, you can choose which cookies you want to allow. Your consent is required for marketing cookies. If you wish to withdraw your consent or change your cookie settings, you can make this change directly in your browser.
Your rights
Right of access
You have the right to request confirmation as to whether personal data is being processed; if so, you have a right to access this personal data. This includes the following information: the purposes of processing; the categories of personal data concerned; the recipients or categories of recipients; where possible, the envisaged period for which the personal data will be stored, or, if not possible, the criteria used to determine that period; the existence of a right to rectification or erasure of the personal data concerned, or to restriction of processing by the controller, or a right to object to such processing; the right to lodge a complaint with a supervisory authority; any available information about the source of the data; and the existence of automated decision-making, including profiling.
Right to rectification
You have the right to request that the controller rectify inaccurate personal data and complete incomplete personal data.
Right to erasure
You have the right to request that the controller erase personal data without undue delay, provided one of the statutory grounds applies – for example, where the data is no longer necessary for the purposes for which it was collected, where you withdraw your consent and there is no other legal basis, where you object to the processing and there are no overriding legitimate grounds, or where the data has been processed unlawfully. The right to erasure does not apply where processing is necessary, in particular for exercising the right of freedom of expression and information, for compliance with a legal obligation, or for the establishment, exercise or defence of legal claims.
Right to restriction of processing
You have the right to request the restriction of processing where one of the statutory conditions applies – for example, where you contest the accuracy of the data, where the processing is unlawful and you request restriction instead of erasure, where the controller no longer needs the data but you require it for the establishment, exercise or defence of legal claims, or where you have objected to the processing.
Right to data portability
You have the right to receive the personal data you have provided to a controller in a structured, commonly used and machine-readable format, and to transmit that data to another controller without hindrance from the controller to whom the personal data was provided, provided that the processing is based on consent or on a contract and is carried out by automated means.
Right to object
You have the right to object, on grounds relating to your particular situation, at any time to the processing of personal data carried out on the basis of Art. 6(1)(e) or (f) GDPR; this also applies to profiling based on these provisions. Where personal data is processed for direct marketing purposes, you have the right to object at any time to the processing of personal data for such marketing.
Right to withdraw consent
You have the right to withdraw consent given under Art. 6(1)(a) or Art. 9(2)(a) GDPR at any time, without affecting the lawfulness of processing carried out on the basis of consent before its withdrawal.
Right to lodge a complaint
You have the right to lodge a complaint with the Austrian Data Protection Authority (Österreichische Datenschutzbehörde), Barichgasse 40-42, 1030 Vienna, phone: +43 1 52 152-0, email: dsb@dsb.gv.at, if you believe that the processing violates applicable data protection law.
Additional information
Providing personal data is in part required by law or necessary to enter into a contract. You are generally not obliged to provide the data. If you do not provide the data, it may not be possible to conclude a contract.
There is no automated decision-making, including profiling, within the meaning of Article 22(1) and (4) GDPR.