Privacy Policy

Last Update: October 12, 2026

Controller

KNAPP respects your privacy and is committed to protecting your personal data. When processing your personal data, we comply with applicable data protection laws, including the General Data Protection Regulation (“GDPR”), and applicable U.S. state privacy laws.

Processing personal data always takes place in accordance with the principles of lawfulness, fairness, transparency, purpose limitation, data minimization, accuracy, storage limitation as well as integrity and confidentiality. To fulfil our obligations under Article 13 et seq. of the GDPR, we provide the following information about data protection.

For purposes of applicable data protection laws, the following entities may act as controllers or joint controllers depending on the processing activity:

KNAPP Inc.
2124 Barrett Park Drive, Suite 100
Kennesaw, GA 30144, United States

and

KNAPP AG
Günter-Knapp-Straße 5-7
8075 Hart bei Graz/Austria

KNAPP Inc. operates this website and collects personal data in the United States, while certain processing, storage, and centralized IT services may be performed by KNAPP AG in Austria. Accordingly, the GDPR applies to the activities described in this Privacy Policy. KNAPP Inc. also complies with applicable U.S. state privacy laws, including those of California, Colorado, Connecticut, Utah, and other jurisdictions where applicable.

Personal data collected via this website may be transferred to, stored, and processed in Austria and other jurisdictions where KNAPP AG or its service providers operate. Such transfers are conducted in compliance with Chapter V of the GDPR, including the use of Standard Contractual Clauses or other appropriate safeguards, and applicable U.S. laws.

An IT and data protection advisory board (IDB) has been established as an internal advisory and decision-making body.

Questions, suggestions or reports can be sent to the IDB at any time. 

E-mail: datenschutz@knapp.com

Phone: +43 5 04952 0

Legal Notice: knapp.com/home/impressum

Overview of processing operations

The following table summarizes the types of data processed, the purposes for which they are processed and the data subjects concerned.

Categories of Processed Data

  • Location data.
  • Contact data.
  • Content data.
  • Usage data.
  • Meta, communication and process .
  • Event Data (Facebook).

Categories of Data Subjects

  • Communication partner.
  • Users.

Purposes of Processing

  • Provision of contractual services and customer support.
  • Contact requests and communication.
  • Security measures.
  • Direct marketing.
  • Web Analytics.
  • Targeting.
  • Office and organizational procedures.
  • Remarketing.
  • Conversion tracking.
  • Affiliate Tracking.
  • Managing and responding to inquiries.
  • Feedback.
  • Marketing.
  • Profiles with user-related information.
  • Provision of our online services and usability.
  • Information technology infrastructure.

Legal Bases for Processing

Below is an overview of the legal basis of the GDPR upon which we process personal data. Please note that in addition to the provisions of the GDPR, national data protection regulations may apply in your or our country of residence or domicile. If more specific legal bases are applicable in individual cases, we will inform you in this data protection declaration.

  • Consent (Article 6 (1) (a) GDPR) – The data subject has given consent to the processing of their personal data for one or more specific purposes.
  • Performance of a contract and prior requests (Article 6 (1) (b) GDPR) – Performance of a contract to which the data subject is a party or in order to take steps at the request of the data subject prior to entering into a contract.
  • Legitimate Interests (Article 6 (1) (f) GDPR) – Processing is necessary for the purposes of the legitimate interests pursued by the controller or by a third party, except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject which require protection of personal data.

In addition to the data protection regulations of the GDPR, national regulations may apply depending on the location of the data subject, including laws in Austria, the United States, and other applicable jurisdictions. This includes the Federal Act on the Protection of Individuals regarding the Processing of Personal Data (Data Protection Act – DSG). The Data Protection Act contains special provisions on the right of access, rectification or cancellation, processing of special categories of personal data, processing for other purposes, and data transfers and automated decision making in individual cases.

For users located in the United States, additional rights may apply under state-specific privacy laws. Where applicable, such rights are described in separate or supplemental notices (e.g., a California Privacy Notice).

Security Precautions

We take appropriate technical and organizational measures in accordance with legal requirements, taking into account the state of the art, the costs of implementation and the nature, scope, context and purposes of processing, as well as the risk of varying likelihood and severity to the rights and freedoms of natural persons, to ensure a level of security appropriate to the risk.

The measures include safeguards to protect confidentiality, integrity, and availability of data by controlling physical and electronic access to the data, as well as access to, input, transmission, storage of, and separation of the data. In addition, we have established procedures to ensure that data subjects’ rights are respected, that data is deleted, and that we are prepared to respond quickly to data security incidents. Furthermore, we take the protection of personal data into account during the development and selection of hardware, software, and service providers, in accordance with the principle of privacy by design and privacy by default.

TLS encryption (HTTPS): To protect your data transmitted via our online services, we use TLS encryption. You can recognize encrypted connections by the prefix “https://” in the address bar of your browser.

Transmission of Personal Data

In the context of our processing of personal data, personal data may be transferred to other locations, companies or individuals, or disclosed to them.

Recipients of this data may include, for example, service providers commissioned with IT tasks or providers of services and content integrated into our website. In such cases, the legal requirements will be respected, and in particular, data processing agreements and/or other legally required safeguards will be implemented with the recipients of your data.

To the extent required under applicable U.S. privacy laws, we will ensure that such disclosures qualify as “service provider” or “processor” relationships and are subject to contractual restrictions on use, retention, and disclosure of personal information.

Data Transmission within KNAPP Group

We may transfer personal data to other companies within our group or otherwise grant them access to such data.

This transfer is for administrative purposes, and the disclosure of personal data is based on our legitimate business interests or, where it is necessary to fulfill our contractual obligations, based on the consent of the data subjects, or where otherwise permitted by applicable law.

Data Processing in Third Countries

If we process data in a third country (i.e., outside the European Union (EU) or the European Economic Area (EEA)), or if processing takes place in the context of the use of third-party services or disclosure or transfer of data to other persons, authorities, or companies, this will only take place in accordance with applicable legal requirements.

Subject to express consent or a transfer that is necessary for the performance of a contract or law, we process, or have processed data only in third countries with a recognized level of data protection, on the basis of special safeguards, such as the European Commission’s Standard Contractual Clauses (“SCCs”),  or where certifications or binding internal data protection rules justify the processing (Article 44 to 49 GDPR, information page of the EU Commission: https://ec.europa.eu/info/law/law-topic/data-protection/international-dimension-data-protection_en).

 Where personal data is transferred to the United States, such transfers are carried out in compliance with applicable transfer mechanisms, including the EU Standard Contractual Clauses (“SCCs”) and, where applicable, participation in the EU-U.S. Data Privacy Framework (DPF).

Deletion of Personal Information

The data processed by us will be deleted in accordance with applicable statutory provisions as soon as the purpose for processing data no longer applies or the applicable legal basis ceases to exist.

If the data is not deleted because it is required for other legally permissible purposes, its processing will be restricted to those purposes. This means that the data will be limited and will not be processed for other purposes. This applies, for example, to data that must be stored for commercial or tax reasons or where storage is necessary to assert, exercise, or defend legal claims, or to protect the rights of another natural or legal person. Further information on individual processing operations may also contain additional specific information on data retention and deletion applicable to the respective processing operations.

Use of Cookies

Cookies are small text files or other data records that store information on end devices and read information from those devices. They may be used for functionality, security, analytics, and user experience, as well as for the creation of analyses of visitor traffic and usage patterns.

For users located in the United States (including California), cookies and similar tracking technologies may constitute the “sharing” or “selling” of personal information under applicable U.S. privacy laws. Where required, users are provided with a “Do Not Sell or Share My Personal Information” mechanism and the ability to opt out of targeted advertising.

Consent

We use cookies in accordance with applicable laws. Therefore, we obtain prior consent from users, except when such consent is not required by applicable law.

Consent is not required where cookies are strictly necessary to provide services explicitly requested by the user. Any consent provided may be withdrawn at any time. Information regarding the use of cookies and the means of withdrawing consent will be clearly communicated to the user.

Information on Legal Bases Under Data Protection Law

The legal basis under data protection law on which we process users’ personal data using cookies depends on whether we obtain consent. If users consent, the legal basis for processing their data is such consent. Otherwise, the data processed through cookies is processed based on our legitimate interests (e.g. operating, maintaining, securing, and improving our online services and their usability) or, where the use of cookies is necessary to perform our contractual obligations, on the basis of contract performance. The purposes for which cookies are processed are described in this privacy policy or in the context of our consent and processing procedures.

Retention period: Regarding the retention period, a distinction is drawn between the following types of cookies:

  • Temporary cookies (also known as “session cookies”): Temporary cookies are deleted no later than when a user leaves an online service and closes their end device (i.e. browser or mobile application).
  • Permanent cookies: Permanent cookies remain stored even after the user’s device is closed. For example, the login status can be saved, or preferred content can be displayed directly when the user visits a website again. Likewise, user data collected through cookies can be used for analytics and audience measurement purposes. Unless we provide users with explicit information about the type and storage duration of cookies (e.g., as part of obtaining consent), users should assume that cookies are permanent and that the storage period can be up to two years.

General information on Revocation and Objection (Opt-Out): Users can revoke their consent at any time and object to processing in accordance with the legal requirements in Article 21 GDPR. Users can also object through their browser settings, for example, by disabling the use of cookies (although this may limit the functionality of our online services). An objection to the use of cookies for online marketing purposes, can also be made through the website https://optout.aboutads.info and https://www.youronlinechoices.com/.

  • Processed data types: Location data (information on the geographical position of a device or person); Usage data (e.g. websites visited, interest in content, access times); Meta, communication, and process data (e.g. IP addresses, time information, identification numbers, and consent status); Content data (e.g. text input, photographs, and videos); Event Data (Facebook) (“Event Data” is data that can be transmitted from us to Facebook, e.g. via Facebook pixels (via apps or other means) and relates to persons or their actions; the data includes, for example, information about visits to websites, interactions with content, functions, installations of apps, and products purchases.; Event data is processed for the purpose of creating target groups for content and advertising information (Custom Audiences); Event Data does not include the actual content (such as written comments), login information, or Contact Information (such as names, email addresses, and phone numbers). Event Data is deleted by Facebook after a maximum of two years. Custom Audiences created from such data are deleted upon the deletion of our Facebook account).
  • Data subjects: Users (e.g. website visitors, users of online services).
  • Purposes of Processing: Provision of our online services and usability; Web Analytics (e.g. access statistics, recognition of returning visitors); Targeting (e.g. profiling based on interests and behavior, use of cookies); Conversion tracking (measurement of the effectiveness of marketing activities); Affiliate Tracking; Marketing; Profiles with user-related information (creating user profiles); Provision of contractual services and customer support.
  • Legal Basis: Legitimate Interests (Article 6 (1) (f) GDPR); Consent (Article 6 (1) (a) GDPR).

Further Information on Processing Methods, Procedures, and Services Used:

  • Processing Cookie Data Based on Consent: We use a cookie management solution through which users’ consent to the use of cookies, or the procedures and providers mentioned in the cookie management solution, can be obtained, managed, and revoked by users. The declaration of consent is stored so that it does not have to be requested again, and the consent can be proven in accordance with applicable legal requirements. Storage can take place on the server side and/or in a cookie (so-called opt-out cookie or with the aid of comparable technologies) to assign the consent to a user and/or the user’s device. Subject to specific details of providers of cookie management services, the following information applies: The duration of the consent can be up to two years. In this case, a pseudonymous user identifier is created and stored with the date/time of consent, information on the scope of consent (e.g. which categories of cookies and/or service providers) as well as the browser, system and end device used.
  • BorlabsCookie: Cookie-Consent Manager; Service provider: Hosted locally on our server, no data transfer to third parties; Website: https://borlabs.io/borlabs-cookie/; Further Information: An individual user ID, language, types of consent, and the time of submission are stored on the server and in the cookie on the user’s device.
  • WPML: Essential cookie for the multilingual functionality of the website. Cookies are used by the WPML plugin to identify the preferred user language, as the website is offered in multiple languages. Further information: https://wpml.org/documentation/support/browser-cookies-stored-wpml/
  • Google Maps: We integrate the maps of the “Google Maps” service provided by Google. The data processed may include, in particular, IP addresses and location data of users; Service provider: Google Cloud EMEA Limited, 70 Sir John Rogerson’s Quay, Dublin 2, Ireland; Legal Basis: Legitimate Interests (Article 6 (1) (f) GDPR); Website: https://mapsplatform.google.com/; Privacy Policy: https://policies.google.com/privacy.
  • We use GA4, a web analytics service provided by Google, to help us understand how visitors interact with our website, evaluate website performance, improve functionality, and enhance the user experience. Information collected may include IP-derived geographic information, browser and device information, operating system data, pages visited, referring URLs, usage statistics, and interactions with website content. GA4 uses cookies and similar technologies to collect and analyze this information. Service Provider: Google LLC, 1600 Amphitheatre Parkway, Mountain View, California 94043, USA. Website: https://marketingplatform.google.com/about/analytics/. Privacy Policy: https://policies.google.com/privacy.
  • Facebook Pixel and Custom Audiences (Custom Audiences): With the help of the Facebook pixel (or equivalent functions, used to transfer Event-Data or Contact Information via interfaces or other software in apps), Facebook is able to determine the visitors of our online services as a target group for the presentation of ads (so-called “Facebook ads”). Accordingly, we use Facebook pixels to display Facebook ads placed by us only to Facebook users and within the services of partners cooperating with Facebook (so-called “audience network” https://www.facebook.com/audiencenetwork/ ) who have shown an interest in our online services or who have certain characteristics (e.g. interests in certain topics or products that are determined on the basis of the websites visited) that we transmit to Facebook (so-called “custom audiences”). With the help of Facebook pixels, we also ensure that our Facebook ads correspond to the potential interest of users and do not appear intrusive. The Facebook pixel also enables us to track the effectiveness of Facebook ads for statistical and market research purposes by showing whether users were referred to our website after clicking on a Facebook ad (known as “conversion tracking”); Service provider: Meta Platforms Ireland Limited, 4 Grand Canal Square, Grand Canal Harbour, Dublin 2, Ireland; Legal Basis: Consent (Article 6 (1) (a) GDPR); Website: https://www.facebook.com; Privacy Policy: https://www.facebook.com/about/privacy; Data Processing Agreement: https://www.facebook.com/legal/terms/dataprocessing; Further Information: User event data, i.e. behavioral and interest data, is processed for the purposes of targeted advertising and audience building on the basis of the joint controllership agreement (“Controller Addendum”, https://www.facebook.com/legal/controller_addendum). The joint controllership is limited to the collection and transfer of the data to Meta Platforms Ireland Limited, located in the European Union. Further processing of the data is the sole responsibility of Meta Platforms Ireland Limited, which concerns in particular the transfer of the data to the parent company Meta Platforms, Inc. in the USA (based on standard contractual clauses concluded between Meta Platforms Ireland Limited and Meta Platforms, Inc.).
  • OpenStreetMap: We integrate the maps of the service “OpenStreetMap”, which are offered based on the Open Data Commons Open Database License (ODbL) by the OpenStreetMap Foundation (OSMF). OpenStreetMap uses user data exclusively for the purpose of displaying map functions and temporarily storing the selected settings. This data may include, in particular, IP addresses and location data of users, which are not collected without their consent (usually within the context of the settings of their mobile devices); Service provider: OpenStreetMap Foundation (OSMF); Legal Basis: Legitimate Interests (Article 6 (1) (f) GDPR); Website: https://www.openstreetmap.de; Terms & Conditions: https://wiki.osmfoundation.org/wiki/Privacy_Policy; Privacy Policy: https://wiki.osmfoundation.org/wiki/Privacy_Policy.
  • Vimeo: Social network and video platform; Service provider: Vimeo Inc., Attention: Legal Department, 555 West 18th Street, New York, New York, 10011, USA; Legal Basis: Legitimate Interests (Article 6 (1) (f) GDPR); Website: https://vimeo.com; Privacy Policy: https://vimeo.com/privacy.
  • YouTube: Social network and video platform; Service provider: Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland; Legal Basis: Legitimate Interests (Article 6 (1) (f) GDPR); Privacy Policy: https://policies.google.com/privacy; Opt-Out: https://adssettings.google.com/authenticated.
  • HubSpot: Marketing software for lead generation, marketing automation and analysis of marketing activities; Service provider: HubSpot, Inc., 25 First St., 2nd floor, Cambridge, Massachusetts 02141, USA; Legal Basis: Consent (Article 6(1)(a) GDPR), legitimate interest (Article 6(1)(f) GDPR); Website: https://www.hubspot.de; Privacy Policy: https://legal.hubspot.com/privacy-policy; Data Processing Agreement: https://legal.hubspot.com/dpa; Standard Contractual Clauses (Safeguarding the level of data protection when processing data in third countries): https://legal.hubspot.com/dpa.
  • Instagram: Social network; Service provider: Meta Platforms Ireland Limited, 4 Grand Canal Square, Grand Canal Harbour, Dublin 2, Ireland; Legal Basis: Legitimate Interests (Article 6 (1) (f) GDPR); Website: https://www.instagram.com; Privacy Policy: https://instagram.com/about/legal/privacy.

Provision of Online Services and Web Hosting

We process user data to provide our online services to users. For this purpose, we process the IP address of the user, which is necessary to transmit the content and functions of our online services to the user’s browser or terminal device.

  • Processed data types: Usage data (e.g. websites visited, interest in content, and access times); Meta, communication and process data (e.g. IP addresses, time information, identification numbers, and consent status).
  • Data subjects: Users (e.g. website visitors, users of online services).
  • Purposes of Processing: Provision of our online services and usability; Information technology infrastructure (including the operation and provision of information systems and technical devices, such as computers, servers, etc.); Security measures.
  • Legal Basis: Legitimate Interests (Article 6 (1) (f) GDPR).

Further Information on Processing Methods, Procedures and Services Used:

  • Provision of online offer on rented hosting space: For the provision of our online services, we use storage space, computing capacity, and software that we rent or otherwise obtain from a corresponding server provider (also referred to as a “web hoster”); Legal Basis: Legitimate Interests (Article 6 (1) (f) GDPR).
  • Collection of Access Data and Log Files: Access to our online services is logged in the form of “server log files”. Server log files may include the address and name of the web pages and files accessed, the date and time of access, the volume of data transferred, notification of successful access, browser type and version, the user’s operating system, the referrer URL (the previously visited page) and, as a general rule, IP addresses and the requesting provider. The server log files can be used for security purposes, e.g. to avoid overloading the servers (especially in the case of abusive attacks, such as DDoS attacks) and to ensure the stability and optimal load balancing of the servers; Legal Basis: Legitimate Interests (Article 6 (1) (f) GDPR); Retention period: Log file information is stored for a maximum period of 30 days and then deleted or anonymized. Data, the further storage of which is necessary for evidence purposes, is excluded from deletion until the respective incident has been finally clarified.

Contact and Inquiry Management

When contacting us (e.g. via mail, contact form, e-mail, telephone, or social media) as well as in the context of existing user and business relationships, the information provided by the individuals making inquiries is processed to the extent necessary to respond to contact requests and implement any requested measures.

  • Processed data types: Contact data (e.g. e-mail addresses and telephone numbers); Content data (e.g. text input, photographs, and videos); Usage data (e.g. websites visited, interest in content, and access times); Meta, communication and process data (e.g. IP addresses, time information, identification numbers, and consent status).
  • Data subjects: Communication partners (Recipients of e-mails, letters, etc.).
  • Purposes of Processing: Contact requests and communication; Managing and responding to inquiries; Feedback (e.g. collecting feedback via online forms); Provision of our online services and usability.
  • Legal Basis: Legitimate Interests (Article 6 (1) (f) GDPR); Performance of a contract and prior requests (Article 6 (1) (b) GDPR).

Further Information on Processing Methods, Procedures and Services Used:

  • Contact form: When users contact us via our contact form, e-mail, or other communication channels, we process the data provided to us in this context to process the communicated request; Legal Basis: Performance of a contract and prior requests (Article 6 (1) (b) GDPR), Legitimate Interests (Article 6 (1) (f) GDPR).

Communication via

We use messenger services for communication purposes and therefore ask you to observe the following information regarding the functionality of messenger services, encryption, the use of communication metadata, and your objection options.

You can also contact us by alternative means, e.g. telephone or e-mail. Please use the contact options provided to you or the contact options provided within our online services.

In the case of encryption of content (i.e. the content of your message and attachments), we point out that the communication content (i.e. the content of the message and attachments) is encrypted end-to-end. This means that the content of the messages is not visible, not even by the messenger service providers themselves. You should always use the current version of the messenger service with activated encryption, so that the encryption of message contents is guaranteed.

However, we would like to point out to our communication partners that although messenger service providers do not see the content, they can find out whether and when communication partners communicate with us and process technical information on the communication partner’s device and, depending on the settings of the device, also location information (so-called metadata).

Information on Legal basis: If we ask communication partners for permission before communicating with them via messenger services, the legal basis for processing their data is their consent. Otherwise, if we do not request consent and you contact us, for example, voluntarily, we use messenger services to communicate with our contractual partners and as part of the contract initiation process, and, in the case of other interested parties and communication partners, on the basis of our legitimate interests in providing fast and efficient communication and meeting the needs of our communication partners via messenger services. We would also like to point out that we do not transmit the contact data provided to us to messenger service providers without your consent.

Withdrawal, objection and deletion: You can withdraw your consent or object to communication with us via messenger services at any time. In the case of communication via messenger services, we delete messages in accordance with our general data retention policy (i.e. as described above, after the end of contractual relationships, archiving requirements, etc.) and otherwise as soon as we can assume that we have answered any information provided by the communication partners, if no reference to a previous conversation is to be expected and there are no legal obligations to store the messages to prevent their deletion.

Reservation of reference to other means of communication: Finally, we would like to point out that we reserve the right, for your safety, not to answer inquiries submitted via messenger services. This is the case if, for example, internal contractual matters require confidentiality or if an answer via messenger services does not meet the formal requirements. In such cases, we may direct you to more appropriate communication channels.

  • Processed data types: Contact data (e.g. e-mail addresses and telephone numbers); Usage data (e.g. websites visited, interest in content, and access times); Meta, communication, and process data (e.g. IP addresses, time information, identification numbers, and consent status).
  • Data subjects: Communication partners (Recipients of e-mails, letters, etc.).
  • Purposes of Processing: Contact requests and communication; Direct marketing (e.g. by e-mail or post).
  • Legal Basis: Consent (Article 6 (1) (a) GDPR); Legitimate Interests (Article 6 (1) (f) GDPR). 

Web Analysis, Monitoring, and Optimization

Web analysis is used to evaluate visitor traffic on our website and may include behavior interests, or demographic information of users, such as age or gender, as pseudonymous values. With the help of web analysis, we can determine when our online services or their functions or contents are most frequently used and identify areas that require optimization.

In addition to web analysis, we can also use test procedures, e.g., to test and optimize different versions of our online services or their components.

Unless otherwise stated below, profiles, i.e., data aggregated for a usage process, can be created for these purposes and information can be stored in a browser or in a terminal device and read from it. The information collected includes websites visited and elements used there, as well as technical information such as the browser used, the computer system used and information on usage times. If users have agreed to the collection of their location data from us or from the providers of the services we use, location data may also be processed.

Such profiles may also be stored in a browser or terminal device (so-called “cookies”), or similar technologies may be used for the same purpose. The information collected includes websites visited, and elements used there, as well as technical information such as the browser used, the computer system used and information on usage times. If users have consented to the collection of their location data or profiles to us or to the providers of the services we use, these may also be processed, depending on the provider.

The IP addresses of the users are also stored. However, we use any existing IP masking procedure (i.e. pseudonymization by shortening the IP address) to protect users. In general, within the framework of web analysis, A/B testing and optimization, no user data (such as e-mail addresses or names) is stored, but pseudonyms. This means that we, as well as the providers of the software used, do not know the actual identity of the users, but only the information stored in their profiles for the purposes of the respective processes.

  • Processed data types: Usage data (e.g. websites visited, interest in content, access times); Meta, communication and process data (e.g. IP addresses, time information, identification numbers, consent status).
  • Data subjects: Users (e.g. website visitors, users of online services).
  • Purposes of Processing: Remarketing; Web Analytics (e.g. access statistics, recognition of returning visitors); Profiles with user-related information (Creating user profiles).
  • Security measures: IP Masking (Pseudonymization of the IP address).
  • Legal Basis: Consent (Article 6 (1) (a) GDPR).

Matomo: Reach measurement, web analysis, and content optimization. We use Matomo to perform usage analysis. This tracking tool enables analysis of website traffic. The IP address is processed exclusively for statistical evaluation and to determine the approximate geographical origin (e.g., the country). The IP address is anonymized immediately after collection by Matomo by masking two bytes of the IP address. This anonymization means that personal identification is no longer possible.

Service Provider: InnoCraft Limited, 7 Waterloo Quay, PO625, 6140 Wellington, New Zealand; Legal basis: Consent (Art. 6 para. 1 lit. a GDPR); Website: https://matomo.org/ Privacy Policy: https://matomo.org/privacy-policy/

Profiles in Social Networks (Social Media)

We maintain online presences within social networks and process user data in this context to communicate with users active there or to provide information about us.

We would like to point out that user data may be processed outside the European Union and outside the United States. This may entail risks for users, e.g. by making it more difficult to enforce users’ rights.

Where personal data is transferred internationally, appropriate safeguards, including Standard Contractual Clauses or other recognized transfer mechanisms, are implemented where required by applicable law.

In addition, user data is usually processed within social networks for market research and advertising purposes. For example, user profiles can be created on the basis of user behavior and associated interests. The user profiles can then be used, for example, to place advertisements within and outside the networks that are presumed to correspond to the interests of the users. For these purposes, cookies are usually stored on the user’s computer, in which the user’s usage behavior and interests are stored. Furthermore, data can be stored in user profiles independently of the devices used by the users (especially if the users are members of the respective networks or become members later).

For a detailed description of the respective processing operations and opt-out options, please refer to the respective data protection declarations and information provided by the operators of the respective networks.

Also, in the case of requests for information and the exercise of rights of data subjects, we note that these rights can generally be exercised most effectively with the providers themselves. Only the providers have direct access to the users’ data and can take appropriate measures and provide information directly. If you still require assistance, please do not hesitate to contact us.

  • Processed data types: Contact data (e.g. e-mail address and telephone numbers); Content data (e.g. text input, photographs, and videos); Usage data (e.g. websites visited, interest in content, and access times); Meta, communication and process data (e.g. IP addresses, time information, identification numbers, and consent status).
  • Data subjects: Users (e.g. website visitors, and users of online services).
  • Purposes of Processing: Contact requests and communication; Feedback (e.g. collecting feedback via online form); Marketing.
  • Legal Basis: Legitimate Interests (Article 6 (1) (f) GDPR).

Certain social media technologies may constitute “sharing,” “targeted advertising,” or similar regulated processing activities under applicable U.S. state privacy laws. Where required by law, users may exercise applicable opt-out rights through our cookie preference center or by contacting us.

Further Information on Processing Methods, Procedures and Services Used:

  • Instagram: Social network; Service provider: Meta Platforms Ireland Limited, 4 Grand Canal Square, Grand Canal Harbour, Dublin 2, Ireland; Legal Basis: Legitimate Interests (Article 6 (1) (f) GDPR); Website: https://www.instagram.com; Privacy Policy: https://instagram.com/about/legal/privacy.
  • Facebook Pages: Profiles within the social network Facebook. We are jointly responsible (so called “joint controller”) with Meta Platforms Ireland Limited for the collection (but not the further processing) of data from visitors to our Facebook page. This data includes information about the types of content users view or interact with, and the actions they take (see “Things that you and others do and provide” in the Facebook Data Policy: https://www.facebook.com/policy), and information about the devices used by users (e.g., IP addresses, operating system, browser type, language settings, and cookie information; see “Device Information” in the Facebook Data Policy: https://www.facebook.com/policy). As explained in the Facebook Data Policy under “How we use this information?” Facebook also collects and uses information to provide analytics services, known as “Page Insights,” to page operators and help them understand how people interact with their pages and the content associated with them. We have concluded a special agreement with Facebook (“Information about Page-Insights”, https://www.facebook.com/legal/terms/page_controller_addendum), which regulates in particular the security measures that Facebook must observe and in which Facebook has agreed to fulfill the rights of the persons concerned (i.e. users can send information access or deletion requests directly to Facebook). The rights of users (in particular, the rights of access, erasure, objection, and the right to lodge a complaint with a competent supervisory authority) are not restricted by our agreements with Facebook. Further information can be found in the “Information about Page Insights” (https://www.facebook.com/legal/terms/information_about_page_insights_data); Service provider: Meta Platforms Ireland Limited, 4 Grand Canal Square, Grand Canal Harbour, Dublin 2, Ireland; Legal Basis: Legitimate Interests (Article 6 (1) (f) GDPR); Website: https://www.facebook.com; Privacy Policy: https://www.facebook.com/about/privacy; Standard Contractual Clauses (Safeguarding the level of data protection when processing data in third countries): https://www.facebook.com/legal/EU_data_transfer_addendum; Further Information: Joint Controllership Agreement: https://www.facebook.com/legal/terms/information_about_page_insights_data. The joint controllership is limited to the collection and transfer of the data to Meta Platforms Ireland Limited, a company located in the EU. Further processing of the data is the sole responsibility of Meta Platforms Ireland Limited, which concerns in particular the transfer of the data to the parent company Meta Platforms, Inc. in the USA (on the basis of standard contractual clauses concluded between Meta Platforms Ireland Limited and Meta Platforms, Inc.).
  • LinkedIn: Social network; Service provider: LinkedIn Ireland Unlimited Company, Wilton Plaza Wilton Place, Dublin 2, Ireland; Legal Basis: Legitimate Interests (Article 6 (1) (f) GDPR); Website: https://www.linkedin.com; Privacy Policy: https://www.linkedin.com/legal/privacy-policy; Data Processing Agreement: https://legal.linkedin.com/dpa; Standard Contractual Clauses (Safeguarding the level of data protection when processing data in third countries): https://legal.linkedin.com/dpa; Opt-Out: https://www.linkedin.com/psettings/guest-controls/retargeting-opt-out. International Transfers: LinkedIn may rely on Standard Contractual Clauses, the EU-U.S. Data Privacy Framework, or other lawful transfer mechanisms, as applicable.
  • YouTube: Social network and video platform; Service provider: Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland; Legal Basis: Legitimate Interests (Article 6 (1) (f) GDPR); Privacy Policy: https://policies.google.com/privacy; Opt-Out: https://adssettings.google.com/authenticated.

Plugins and Embedded Functions and Content

Within our online services, we integrate functional and content elements that are obtained from the servers of their respective providers (hereinafter referred to as “third-party providers”). These may, for example, be graphics, videos, or city maps (hereinafter uniformly referred to as “Content”).

The integration always presupposes that the third-party providers of this content process the IP address of the user, since they could not send the content to the user’s browser without the IP address. The IP address is therefore required for the presentation of these items of Content or functions. We strive to use only content providers that process the user’s IP address only to deliver the requested content or functionality.

Third parties may also use so-called pixel tags (invisible graphics, also known as “web beacons”) for statistical or marketing purposes. The “pixel tags” can be used to evaluate information such as visitor traffic on the pages of this website. The pseudonymous information may also be stored in cookies on the user’s device and may include technical information about the browser and operating system, referring websites, visit times, and other information about the use of our website, as well as be linked to such information from other sources.

  • Processed data types: Usage data (e.g. websites visited, interest in content, and access times); Meta, communication, and process data (e.g. IP addresses, time information, identification numbers, and consent status); Event Data (Facebook) (“Event Data” is data that can be transmitted from us to Facebook, e.g. via Facebook Pixels (via apps or other means) and relates to persons or their actions. The data includes, for example, information about visits to websites, interactions with content, functions, installations of apps, purchases of products, etc. Event data is processed for the purpose of creating target groups for content and advertising information (Custom Audiences). Event Data does not include the actual content (such as written comments), login information, or contact information (such as names, email addresses, and phone numbers). Event Data is deleted by Facebook after a maximum of two years, and the Custom Audiences created from are deleted upon the deletion of our Facebook account).
  • Data subjects: Users (e.g. website visitors, users of online services).
  • Purposes of Processing: Provision of our online services and usability; provision of contractual services and customer support.
  • Legal Basis: Legitimate Interests (Article 6 (1) (f) GDPR); Consent (Article 6 (1) (a) GDPR).

Further Information on Processing Methods, Procedures and Services Used:

  • Facebook plugins and contents: Facebook Social Plugins and content. These may include content such as images, videos, text, and buttons with which users can share content from this online service within Facebook. The list and appearance of the Facebook Social Plugins can be viewed here: https://developers.facebook.com/docs/plugins/. We are jointly responsible (so-called “joint-controllers”) with Meta Platforms Ireland Limited for the collection or transmission (but not further processing) of “Event Data” that Facebook collects or receives as part of a transmission using the Facebook Social Plugins that run on our website for the following purposes: a) displaying content and advertising information that matches users’ presumed interests; b) delivering commercial and transactional messages (e.g., addressing users via Facebook Messenger); and c) improving ad delivery and personalizing features and content (e.g., improving the identification of content or advertising information that may be of interest to users). We have entered into a special agreement with Facebook (“Controller Addendum”, https://www.facebook.com/legal/controller_addendum), which specifically addresses the security measures that Facebook must take (https://www.facebook.com/legal/terms/data_security_terms) and in which Facebook has agreed to comply with the rights of data subjects (i.e., users can, for example, submit access or deletion requests directly to Facebook). Please Note: If Facebook provides us with measurements, analyses, and reports (which are aggregated, i.e., do not contain information on individual users and are anonymous to us), this processing is not carried out within the scope of joint responsibility, but on the basis of a DPA (“Data Processing Terms”, https://www.facebook.com/legal/terms/dataprocessing/update), the “Data Security Terms” (https://www.facebook.com/legal/terms/data_security_terms) and, with regard to processing in the USA, on the basis of Standard Contractual Clauses (“Facebook EU Data Transfer Addendum, https://www.facebook.com/legal/EU_data_transfer_addendum). The rights of users (in particular to access, erasure, objection, and the right to lodge a complaint with the competent supervisory authority) are not restricted by the agreements with Facebook; Service provider: Meta Platforms Ireland Limited, 4 Grand Canal Square, Grand Canal Harbour, Dublin 2, Ireland; Legal Basis: Consent (Article 6 (1) (a) GDPR); Website: https://www.facebook.com; Privacy Policy: https://www.facebook.com/about/privacy.
  • reCAPTCHA: We integrate the “reCAPTCHA” function to recognize whether entries (e.g. in online forms) are made by humans and not by automatically operating machines (“bots”). The data processed may include IP addresses, information on operating systems, devices or browsers used, language settings, location, mouse movements, keystrokes, time spent on websites, previously visited websites, interactions with reCAPTCHA on other websites, possibly cookies, and results of manual recognition processes (e.g. answering questions or selecting objects in images). The processing of personal data through reCAPTCHA is based on our legitimate interest in protecting our website and online services against spam, abuse, fraud, and automated attacks and, where required by applicable law, on user consent; Service provider: Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland, parent company: Google LLC, 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA; Legal Basis: Legitimate Interests (Article 6 (1) (f) GDPR); Website: https://www.google.com/recaptcha/; Privacy Policy: https://policies.google.com/privacy; Opt-Out: Opt-Out-Plugin: https://tools.google.com/dlpage/gaoptout?hl=en, Settings for the Display of Advertisements: https://adssettings.google.com/authenticated.
  • Instagram: Social network; Service provider: Meta Platforms Ireland Limited, 4 Grand Canal Square, Grand Canal Harbour, Dublin 2, Ireland; Legal Basis: Legitimate Interests (Article 6 (1) (f) GDPR); Website: https://www.instagram.com; Privacy Policy: https://instagram.com/about/legal/privacy.
  • HubSpot: Marketing software for lead generation, marketing automation, and analysis of marketing activities; Service provider: HubSpot, Inc., 25 First St., 2nd floor, Cambridge, Massachusetts 02141, USA; Legal Basis: Consent (Article 6(1)(a) GDPR), Legitimate Interests (Article 6(1)(f) GDPR); Website: https://www.hubspot.de; Privacy Policy: https://legal.hubspot.com/privacy-policy; Data Processing Agreement: https://legal.hubspot.com/dpa; Standard Contractual Clauses (Safeguarding the level of data protection when processing data in third countries): https://legal.hubspot.com/dpa.

Management, Organization and Utilities

We use services, platforms and software from other providers (hereinafter referred to as  “third-party providers”) for the purposes of organizing, administering, planning, and providing our services. When selecting third-party providers and their services, we comply with the legal requirements.

Within this context, personal data may be processed and stored on the servers of third-party providers. This may include various data that we process in accordance with this privacy policy. This data may include in particular master data and contact data of users, data on processes, contracts, other processes and their contents.

If users are referred to the third-party providers or their software or platforms in the context of communication, business, or other relationships with us, the third-party provider may process usage data and metadata for security purposes, service optimization, or marketing purposes. We therefore ask you to read the data protection notices of the respective third-party providers.

  • Processed data types: Content data (e.g. text input, photographs, videos); Usage data (e.g. websites visited, interest in content, access times); Meta, communication and process data (e.g. IP addresses, time information, identification numbers, consent status).
  • Data subjects: Communication partner (Recipients of e-mails, letters, etc.); Users (e.g. website visitors, users of online services).
  • Purposes of Processing: Provision of contractual services and customer support; Office and organizational procedures.

Rights of Data Subjects

As a data subject, you are entitled to various rights under the GDPR, which arise from Articles 15 to 21 of the GDPR:

  • Right to Object: You have the right from your situation to object at any time to the processing of your personal data which is based on letter (e) or (f) of Article 6(1) GDPR, including profiling based on those provisions. Where personal data are processed for direct marketing purposes, you have the right to object at any time to the processing of personal data concerning you for the purpose of such marketing, which includes profiling to the extent that it is related to such direct marketing.
  • Right of withdrawal for consents: You have the right to revoke consents at any time.
  • Right of access: You have the right to request confirmation as to whether your personal data will be processed and to be informed regarding such processing and to receive further information and a copy of the data in accordance with the applicable legal requirements.
  • Right to rectification: You have the right, in accordance with the law, to request the completion of the data concerning you or the rectification of the incorrect data concerning you.
  • Right to Delete and Right to Restriction of Processing: In accordance with the statutory provisions, you have the right to demand that the relevant data be deleted immediately or, alternatively, to demand that the processing of the data be restricted in accordance with the statutory provisions.
  • Right to data portability: You have the right to receive data concerning you which you have provided to us in a structured, common and machine-readable format in accordance with the legal requirements, or to request its transmission to another controller.
  • Complaint to the supervisory authority: Without prejudice to any other administrative or judicial remedy, you shall have the right to lodge a complaint with a supervisory authority, in particular in the Member State of your habitual residence, place of work, or place of the alleged infringement, if you consider that the processing of personal data relating to you infringes the GDPR.

Supervisory authority competent for us:

Österreichische Datenschutzbehörde
Barichgasse 40-42
1030 Wien
phone +43 1 52 152-0
dsb@dsb.gv.at

Additional Privacy Rights

Residents of California and certain other U.S. states may have additional privacy rights under applicable state privacy laws, including the right to access, correct, delete, obtain a copy of personal information, appeal certain decisions, and opt out of targeted advertising, sales, sharing, and certain profiling activities.

We will not discriminate against individuals for exercising applicable privacy rights.