Privacy Policy (Website)

4.                 Sharing Your Personal Data

To achieve the processing purposes we pursue, it is sometimes necessary to disclose your personal data to specific recipients. If naming specific recipients isn't feasible, GDPR allows us to specify categories of recipients instead. Data will be shared with the following recipients/categories of recipients:

§  IT service providers we engage (e.g., hosting operators, advertising providers)

As part of transferring your personal data to the recipients mentioned above, there can occasionally be transfers to third countries (those outside the EU/EEA). In section 5, we’ll provide further details on the legal basis that allows us to do so.

4.1             Website and Hosting Operations

The technical hosting of the website is carried out by: Infinity Vertigo GmbH, Bergwald 43, 2812 Hollenthon. Server locations: Amazon Web Services (AWS), USA. We (PHH) are responsible for the content of this website. We have concluded the necessary (data protection) agreements with our hosting provider.

5.                 Cross-Border Data Transfers

Utilizing certain service providers may involve transferring personal data to third countries (outside the EU/EEA). Proof of the appropriate guarantees listed below is available upon request (see contact details according to Section 1).

5.1             PostHog Inc.

Using the analytics tool provided by PostHog involves transferring personal data to and processing by PostHog. The legal basis for such international data transfers and processing is the Adequacy Decision "EU-U.S. Data Privacy Framework" under Article 45 GDPR, concluded between the European Commission and the USA. PostHog is certified under the EU-U.S. Data Privacy Framework and appears on the so-called Data Privacy Framework List (https://www.dataprivacyframework.gov/list). Additionally, standard contractual clauses have been entered into between our hosting provider (see Section 4.1) and PostHog. Further details on PostHog's data protection can be found at: https://posthog.com/privacy.

5.2             Google Analytics

Using Google Analytics by the service provider Google Ireland involves transferring personal data to and processing by Google Ireland. It cannot be excluded that within the usage of Google Analytics, data may be transferred to a third country, e.g., to Google LLC, 1600 Amphitheatre Pkwy, Mountain View, CA 94043, USA. The legal basis for potential international data transfers and processing are Adequacy Decisions concluded between the European Commission and the respective third country (e.g., the Adequacy Decision "EU-U.S. Data Privacy Framework" concluded between the European Commission and the USA) or standard contractual clauses contractually agreed between the respective data processors. Google LLC is certified under the EU-U.S. Data Privacy Framework and appears in the so-called Data Privacy Framework List (https://www.dataprivacyframework.gov/list). Further details on Google’s data protection can be found at: https://policies.google.com/privacy?hl=en.

6.                 Data Retention Period

We retain your data as follows:

§  Data collected for ensuring secure and comfortable website usage and optimization: 1 year

§  Data collected for analyzing user behavior on our website: 1 year

§  Data collected using Google Analytics: 14 months

7.                 Your Rights

Regarding the processing of your data, you have the right to access, correction, deletion, restriction, data portability, revocation, and objection. If you wish to exercise any of these rights, please contact us anytime using the contact details provided in Section 1.

If you believe that the processing of your data violates data protection laws or your data protection claims have otherwise been infringed, you can contact us anytime using the contact details provided in Section 1, or lodge a complaint with the competent supervisory authority.

In Austria, this is the Data Protection Authority:

§  Austrian Data Protection Authority

§  Barichgasse 40-42, 1030 Vienna

§  Phone: +43 1 52 152-0

§  Email: dsb@dsb.gv.at

Your specific rights include the following:

7.1             Right to Access

Upon request, within the legally defined period, we will provide information on the data we have stored about you. This information includes the data itself, among other details like processing purpose, legal basis, and type of processing. Your right to access is legally restricted in certain conditions. If this applies, we will inform you of the reasons.

7.2             Right to Rectification

You have the right to have us correct or complete any inaccurate or incomplete data we have collected about you at any time. We may require proof of identity before fulfilling this right. Until your data is corrected or completed, you can also request restriction of its processing.

7.3             Right to Erasure, Right to Restriction

You have the right to request the deletion of your data if and to the extent that
(i) the data is no longer needed for the purposes for which it was collected,
(ii) the data was collected unlawfully, or (iii) the processing is based on your consent, and you have withdrawn your consent. Should a statutory retention obligation exist, the data will be deleted after this period expires. However, these data will be locked for any further use.

There is no right to deletion if the data must not be deleted due to statutory obligations, or data processing is necessary to assert, exercise, or defend legal claims. In such a case, you have the right that the processing of your data is restricted to use required by law or for legal enforcement.

7.4             Right to Data Portability

You have the right, where technically feasible, to have all data we store about you transferred to a third party you specify.

7.5             Right to Object

You can request us to stop processing your data if the processing is carried out based on our legitimate interest or the legitimate interest of another person, and we cannot demonstrate compelling legal grounds for the processing.

7.6             Right to Withdraw Consent

You can withdraw any consent you have given us to collect and process your personal data in whole or in part at any time. We will then promptly delete your data to the extent requested or, where legally not permissible, restrict its processing beyond the legal requirements. For this, you can contact us using the contact details provided in Section 1. Until the point of withdrawal, the processing of your data remains lawful.

8.                 Changes

We reserve the right to adapt and update this privacy policy if necessary, e.g., due to legal changes. All updates will be published on our website.

9.                 Scope of this Privacy Policy

This privacy statement applies solely to data collection conducted via our website. It does not apply to websites, services, or products offered or advertised by other companies or individuals, or to linked websites.