Privacy Policy
PRIVACY POLICY
We process your personal data exclusively on the basis of the applicable legal provisions (GDPR, TKG 2003). In this privacy policy, we inform you about the most important aspects of data processing on our website.
If you contact us via newsletter subscription on our website or by email, the data you provide will be stored for six months for the purpose of processing your request and in case of follow-up questions. We will not share this data without your consent.
Data processing is carried out on the basis of the legal provisions of § 96 (3) TKG and Article 6 (1) (a) (consent) and/or (f) (legitimate interest) of the GDPR.
Data transmission takes place via an SSL-encrypted connection, recognizable by “https://” in your browser’s address bar. This ensures that no third party can read the transmitted data.
NEWSLETTER
With the following information, we inform you about the content of our newsletter, the subscription, dispatch and statistical evaluation procedures, as well as your rights of objection. By subscribing to our newsletter, you agree to receive it and to the procedures described.
Content of the Newsletter: We send newsletters, emails, and other electronic notifications containing promotional information only with the consent of recipients or on the basis of legal permission. Our newsletters contain information about our products, offers, promotions, and our company.
Double Opt-In and Logging: Subscription to our newsletter takes place via a double opt-in procedure. After registration, you will receive an email asking you to confirm your subscription. This confirmation is necessary to prevent misuse of email addresses.
Subscriptions are logged to provide proof of the registration process in accordance with legal requirements. This includes storing the registration and confirmation time and the IP address.
Subscription Data: To subscribe, it is sufficient to provide your email address. Optionally, you may provide your name for personalized communication.
The newsletter is sent on the basis of consent pursuant to Article 6 (1) (a) GDPR and Article 7 GDPR in conjunction with § 107 (2) TKG, or on the basis of legitimate interests pursuant to Article 6 (1) (f) GDPR.
The logging of the subscription process is carried out on the basis of our legitimate interests pursuant to Article 6 (1) (f) GDPR. Our interest lies in the use of a user-friendly and secure newsletter system that serves both our business interests and the expectations of users, and also enables us to provide proof of consent.
You may unsubscribe from our newsletter at any time, i.e. withdraw your consent. A link to unsubscribe can be found at the end of each newsletter. We may store unsubscribed email addresses for up to three years on the basis of our legitimate interests before deleting them, in order to be able to prove that consent was previously given. The processing of this data is limited to the purpose of a possible defense against legal claims. An individual request for deletion is possible at any time, provided that the prior existence of consent is confirmed.
The service provider may process recipient data in pseudonymous form for optimization and statistical purposes but will not contact recipients directly or pass data to third parties.
CONTACT
If you contact us by email, your details will be stored for the purpose of processing your request and any follow-up questions.
DELETING OR BLOCKING OF DATA
We adhere to the principles of data minimization and data economy. Personal data is stored only as long as necessary for the stated purposes or as required by law. After the purpose ceases or legal retention periods expire, the data will be deleted or blocked in accordance with legal requirements.
YOUR RIGHTS TO ACCESS , RECTIFICATIONS, RESTRICTION, ERASURE AND OBJECTION
You have the right at any time to obtain information about the personal data we have stored about you. You also have the right to rectification, restriction, or—except where data retention is required for business transactions—erasure of your personal data. To exercise these rights, please contact our data protection officer. You can find the contact details at the bottom of this page.
In order to ensure that a restriction of data can be implemented at any time, such data must be retained in a blocking file for control purposes. You may also request the deletion of your data, provided that no legal obligation to retain it exists. Where such an obligation exists, we will restrict the processing of your data upon request.
You may notify us at any time of changes to your data or withdraw your consent with effect for the future.
ONLINE SHOP ORDER PROCESSING AND CUSTOMER ACCOUNTS
We process the data of our customers within the scope of order processes in our online shop in order to enable them to select and order the chosen products and services, as well as their payment and delivery or execution.
The processed data includes master data, communication data, contract data, and payment data. The persons affected by processing include our customers, prospective customers, and other business partners. Processing is carried out for the purpose of providing contractual services within the operation of an online shop, billing, delivery, and customer services. In this context, we use session cookies to store the contents of the shopping cart and persistent cookies to store the login status.
Processing is based on Article 6 (1) (b) GDPR (performance of contract) and Article 6 (1) (c) GDPR (legal obligations). The data marked as required is necessary for the establishment and fulfillment of the contract. We disclose data to third parties only within the scope of delivery, payment, or legal obligations (e.g. to legal advisors or authorities). Data is only processed in third countries if this is necessary for contract fulfillment (e.g. at the customer’s request for delivery or payment).
Users may optionally create a user account, in which they can view their orders. During registration, required fields are indicated to users. User accounts are not public and cannot be indexed by search engines. If users terminate their account, their data relating to the account will be deleted, unless retention is required for legal reasons in accordance with Article 6 (1) (c) GDPR. Data in the customer account is retained until deletion and archived if legally required. Users are responsible for backing up their data before termination.
As part of registration and subsequent logins, as well as use of our online services, we store the IP address and the time of the respective user action. Storage is based on our legitimate interests as well as the users’ interest in protection against misuse and unauthorized access. This data is not disclosed to third parties unless necessary to pursue our claims or required by law in accordance with Article 6 (1) (c) GDPR.
Data is deleted after the expiration of statutory warranty and comparable obligations. The necessity of data retention is reviewed every three years. In the case of statutory archiving obligations, deletion takes place after their expiration (end of commercial retention period of 6 years and tax retention period of 10 years).
EXTERNAL PAYMENT SERVICE PROVIDERS
We use external payment service providers through whose platforms users and we can carry out payment transactions e.g. PayPal (https://www.paypal.com/de/webapps/mpp/ua/privacy-full), Klarna (https://www.klarna.com/de/datenschutz/), Skrill (https://www.skrill.com/de/fusszeile/datenschutzrichtlinie/), Giropay (https://www.giropay.de/rechtliches/datenschutz-agb/), Visa (https://www.visa.de/datenschutz), Mastercard (https://www.mastercard.de/de-de/datenschutz.html), American Express (https://www.americanexpress.com/de/content/privacy-policy-statement.html).
Within the scope of contract fulfillment, we use payment service providers on the basis of Article 6 (1) (b) GDPR. Otherwise, we use them on the basis of our legitimate interests pursuant to Article 6 (1) (f) GDPR in order to provide secure and efficient payment options.
The data processed by payment service providers includes master data (e.g. name, address), banking data (e.g. account or credit card numbers), passwords, TANs, checksums, and transaction-related information. This data is necessary to carry out transactions.
However, the entered data is processed and stored only by the payment service providers. We do not receive any account or credit card information, but only confirmation or rejection of a payment. In some cases, data may be transmitted to credit agencies for identity and credit checks. Please refer to the terms and privacy policies of the respective providers for further information.
The respective terms and conditions and privacy policies of the payment service providers apply to payment transactions.
ADMINISTRATION, ACCOUNTING, AND BUSINESS ORGANIZATION
We process data as part of administrative tasks, business organization, financial accounting, and compliance with legal obligations (e.g. archiving).
The legal basis for processing is Article 6 (1) (c) and (f) GDPR. Affected persons include customers, prospective customers, business partners, and website visitors. The purpose of processing is the maintenance of business operations, fulfillment of our tasks, and provision of services.
We may disclose data to tax authorities, advisors (e.g. tax consultants or auditors), and other relevant bodies.
We also store information about suppliers, event organizers, and business partners on the basis of our legitimate business interests, e.g. for future contact. This data is generally stored on a long-term basis.
CONTACTING US
When contacting us (e.g. via contact form, email, telephone, or social media), user data is processed for the purpose of handling the inquiry and its processing in accordance with Article 6 (1) (b) GDPR.
User data may be stored in a Customer Relationship Management (CRM) system or a comparable system.
We delete inquiries once they are no longer required. We review necessity every two years. Legal archiving obligations remain unaffected.
Functions and content of the Instagram service (Meta Platforms Inc., 1601 Willow Road, Menlo Park, CA 94025, USA) may be integrated into our online offering.
This may include content such as images, videos, or text and buttons that allow users to share content via Instagram. If users are members of Instagram, Instagram may associate access to the above content with user profiles. Privacy Policy: http://instagram.com/about/legal/privacy/
GOOGLE+
Functions and content of Google services (Google LLC, 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA „Google“) may be integrated into our website.
If users are members of Google, Google may associate access to such content with user profiles.
Google is certified under applicable data protection frameworks and ensures compliance with European data protection law.
Google is certified under the Privacy Shield framework and thereby provides a guarantee to comply with European data protection law (https://www.privacyshield.gov/participant?id=a2zt000000001L5AAI&status=Active).
Further information on Google’s use of data, as well as settings and options to object, can be found in Google’s Privacy Policy (https://policies.google.com/technologies/ads)and in the settings for the display of advertisements by Google (https://adssettings.google.com/authenticated).
ONLINE PRESENCE IN SOCIAL MEDIA
We maintain online presences on social networks and platforms in order to communicate with customers, prospective customers, and users and to inform them about our services. When accessing these networks and platforms, the terms and conditions and data processing policies of the respective operators apply. Unless otherwise stated in this privacy policy, we process user data when users communicate with us on social networks (e.g. posts, messages).
Lombardi—Kargl
Schleifmühlgasse 5
1040 Wien
office@lombardi-kargl.com
+43 1 585 41 99