Data Privacy

I. Overview

 

 If we may welcome you as a customer or business partner, please read from point III onwards.

 When you visit our website, please read from point II onwards.

II. What data do we process when you visit our website?

 

Welcome to our website! Please familiarize yourself with how we process your personal data when you visit our website (Articles 13 and 14 GDPR; Section 165 Paragraph 3 TKG).

 

When you visit our website, the following data may be processed:

 

• browser type,
• operating system,
• Land,
• Datum,
• Time and duration of access,
• IP address* and pages visited on our website, including entry and exit pages,
• Contact page on website,
• Device data: We may store personal data from your device. Such data includes geolocation data, IP address, unique identifiers (e.g., MAC address),
• Newsletter,
• Agreed appointment

 

The processing of this data is necessary to ensure the security of the website's operation and its technical functionality. This data is collected partly via technical cookies. These technical cookies are only used to the extent necessary (Section 165 Paragraph 3 of the German Telecommunications Act). The processing of this data is justified by our legitimate interest in operating our website (Article 6 Paragraph 1 Letter f of the GDPR).

 

For the operation of our website, it may be necessary for us to disclose your data to the following recipients:

 

Recipient data: Duda, Inc.

• Purpose of data processing: CRM system and hosting provider
• Legal basis for data processing: Predominantly legitimate interest in providing the website (Art. 6 para. 1 lit. f GDPR) and consent pursuant to Art. 6 para. 1 lit. a GDPR
• Headquarters: USA
• Secure third-country transfer: Duda, Inc. is listed under the EU-US Data Privacy Framework.

 

Recipient data: Pipedrive Inc

• Purpose of data processing: CRM system and newsletter
• Legal basis for data processing: Consent pursuant to Art. 6 para. 1 lit. a GDPR and overriding legitimate interest (Art. 6 para. 1 lit. f GDPR)
• Headquarters: USA
• Secure third-country transfer: Pipedrive Inc. is listed under the EU-US Data Privacy Framework.

 

Recipient data: Sevdesk GmbH

• Purpose of data processing: Invoice management tool
• Legal basis for data processing: Overriding legitimate interest (Art. 6 para. 1 lit. f GDPR), data processing agreement pursuant to Art. 28 GDPR
• Registered office: Germany
• Safe transfer to a third country: Within the EU

 

Recipient of data: Google LLC

• Purpose of data processing: Statistical analysis
• Legal basis for data processing: Consent (Art. 6 para. 1 lit. a GDPR)
• Headquarters: USA
• Secure third-country transfer: Google LLC is listed under the EU-US Data Privacy Framework.

 

Recipient of data: Usercentric (CookieBot)

Purpose of data processing: Cookie management tool

Legal basis for data processing: Overriding legitimate interest (Art. 6 para. 1 lit. f GDPR)

Registered office: Copenhagen

Safe transfer to a third country: Within the EU

II.1. Overview of the “technical” cookies used

 

The data mentioned above is stored using so-called mmmmm6 Cookies are text files that are stored on your computer and enable analysis of website usage. They serve to recognize and store temporary data about website visitors. We generally only use cookies to the extent necessary to communicate with you via the website.

 

 These technical cookies are activated as soon as you visit our website.

 

 The following cookies are used on our website based on our overriding legitimate interest (Art. 6 para. 1 lit. f GDPR):

 See our cookie policy.

 

II.2. Overview of the “advertising cookies” used

 

In addition to the "technical cookies" described above, we also use so-called advertising cookies (including "statistical cookies"). These advertising cookies allow us to better understand and analyze your interests. With the help of advertising cookies, we can combine your browsing behavior across our website with data from other websites. This enables us to better understand the interests of our website visitors and to target them more effectively.

 

We respect that not every website visitor wants this. Therefore, we only process your data using advertising cookies if you consent to it (Art. 6 para. 1 lit. a GDPR). You can withdraw this consent at any time, although data processing carried out up to the point of withdrawal remains justified.

A list of advertising cookies can be found here:

See our cookie policy.

III. For what purposes do we process your data if you are a customer of ours and have a business relationship with us?

In the course of our business relationship with customers and business partners, as well as the provision of the software, we process data based on contractual (processing of the contractual relationship with you, pre-contractual obligations, invoicing of services, sending of documents, communication for the execution of the contract, provision of the software) and legal obligations (legally required retention within the meaning of Section 132 BAO) (Art. 6 para. 1 lit. b and c GDPR) as well as based on our legitimate interests or on the legitimate interests of third parties (Art. 6 para. 1 lit. f GDPR), namely:

 

• for the purpose of internal administration and management of your case to the necessary extent (e.g.: processing your case, forwarding your case to an assistant, filing, archiving, correspondence with you);
• during software maintenance;
• Due diligence review by potential investors;
• Assertion and defense of legal claims

 

Your data will be processed to the extent necessary. The processing of your data serves the purpose of initiating, maintaining, and handling our business relationships. If you do not provide us with this data, we unfortunately cannot process your business transaction.

 

 Where applicable, we process your data based on your voluntary, explicit consent (Art. 6 para. 1 lit. a GDPR).

IV. How long will your data be stored?

 

 We will only store your data for as long as necessary for the purposes for which we collected it. In this context, statutory retention obligations must be observed (for example, for tax reasons, contracts and other documents from our contractual relationship must generally be retained for seven years (§ 132 BAO)). In justified individual cases, such as for asserting and defending legal claims, we may also store your data for up to 30 years after the termination of the business relationship.

 

 We store data from prospective customers for up to one year from the date of their last contact with us.

V. Who might receive your data?

 

As part of our business relationship and the use of the software, it may be necessary for us to transfer your data to the following recipients:

 

Recipient data: Leitner and Leitner Tax Consulting

• Purpose of data processing: Tax consulting and payroll accounting
• Legal basis for data processing: Overriding legitimate interest (Art. 6 para. 1 lit. f GDPR)
• Registered office: Austria
• Secure transfer to a third country: Within the EU

 

Recipient data: Erste Bank

• Purpose of data processing: Bank
• Legal basis for data processing: Overriding legitimate interest (Art. 6 para. 1 lit. f GDPR)
• Registered office: Austria
• Secure transfer to a third country: Within the EU

 

Recipient data: deep In digital (Günther Leucht)

• Purpose of data processing: Marketing agency
• Legal basis for data processing: Overriding legitimate interest (Art. 6 para. 1 lit. f GDPR), data processing agreement
• Registered office: Austria
• Secure transfer to a third country: Within the EU

 

Recipient data: Lawyer based in Austria (Dr. Tobias Tretzmüller Rechtsanwalts GmbH)

• Purpose of data processing: Legal advice
• Legal basis for data processing: overriding legitimate interest (Art. 6 para. 1 lit. f GDPR), assertion and defense of legal claims
• Registered office: Austria
• Basis for transfer to a third country: Within the EEA

 

Recipient data: Software company

• Purpose of data processing: Editing photos and maintenance
• Legal basis for data processing: Overriding legitimate interest (Art. 6 para. 1 lit. f GDPR)
• Registered office: Bosnia
• Secure transfer to third countries: Standard data protection clauses

 

VI. Collection of data from other sources (Art. 14 GDPR)

In the course of initiating business, personal data may be obtained from the following sources:

 

 Source: Cooperation partners based in Germany and Austria

Data affected: Publicly accessible data: Email address, name, job title

Legal basis: Initiation of business relationships; overriding legitimate interest (Art. 6 para. 1 lit. f GDPR)

VII. Is automated decision-making or profiling taking place (Art. 13 para. 2 lit. f GDPR)?

 

Our company does not use automated decision-making or profiling.

VIII. What rights do you have regarding data processing?

 

We would like to inform you that, provided the legal requirements are met:

 

•  You have the right to request information about which of your data is processed by us (see Article 15 GDPR for details).
• You have the right to request the rectification or completion of inaccurate or incomplete data concerning you (see Article 16 GDPR for details).
• You have the right to have your data deleted (see Article 17 GDPR for details).
• You have the right to object to the processing of your data that is necessary for the purposes of our legitimate interests or those of a third party (see Article 21 GDPR for details). This applies in particular to the processing of your data for advertising purposes.
• You have the right to receive the data you have provided in a structured, commonly used and machine-readable format (see Article 20 GDPR for details).

 

 If we process your data based on your consent, you have the right to withdraw this consent at any time by email. This will not affect the lawfulness of the data processing carried out up to that point (Art. 7 para. 3 GDPR).

IX. What rights of appeal do you have?

 

Should your right to lawful processing of your data unexpectedly be violated, please contact us by mail or email. We will endeavor to address your request promptly. You also have the right to lodge a complaint with the data protection supervisory authority responsible for your area.

 

The address of the Austrian Data Protection Authority is:

 

Austrian Data Protection Authority

Barichgasse 40-42,

1030 Vienna

X. How can you contact us?

 

Should you have any further questions regarding the processing of your data, please feel free to contact our data protection coordinator using the contact details provided below.

XI. Responsible Person

 

The controller within the meaning of Article 4(7) GDPR is:

 

CARMERA Software Solutions GmbH

Simmeringer Hauptstraße 4, 1110 Vienna, Austria

Telephone:  43 1 226 44 69

Email: info@carmera.eu

Website: www.carmera.eu