Data protection

The data controller pursuant to Article 4(7) of the EU General Data Protection Regulation (GDPR) is Feratel Media Technologies AG, Maria Theresien Straße 8, Innsbruck, Austria, email: info@feratel.at. We are legally represented by the Executive Board: Dr. Markus Schröcksnadel and Dr. Ferdinand Hager.

Our Data Protection Officer can be reached via heyData GmbH, Schützenstraße 5, 10117 Berlin, www.heydata.eu, email: datenschutz@heydata.eu.

Insofar as we transfer data to service providers or other third parties outside the EEA, adequacy decisions of the EU Commission pursuant to Art. 45 para. 3 GDPR guarantee the security of the data during transfer, insofar as these exist, as is the case for the UK, Canada and Israel, for example.

In the case of data transfer to service providers in the USA, the legal basis for data transfer is an adequacy decision by the EU Commission if the service provider is also certified under the EU-US Data Privacy Framework.

In other cases (e.g. if there is no adequacy decision), the legal basis for data transfer is usually standard contractual clauses, unless we indicate otherwise. These are a set of rules adopted by the EU Commission and form part of the contract with the respective third party. According to Art. 46 para. 2 lit. b GDPR, they guarantee the security of data transfer. Many of the providers have issued contractual guarantees that go beyond the standard contractual clauses and protect the data beyond the standard contractual clauses. These are, for example, guarantees regarding the encryption of the data or regarding the obligation of the third party to inform the data subject if law enforcement agencies wish to access data.

Data subjects have the following rights vis-à-vis us with regard to their personal data:

• Right of access,
• Right to rectification or erasure,
• Right to restriction of processing,
• Right to object to processing,
• Right to data portability,
• right to withdraw consent at any time.

Data subjects also have the right to complain to a data protection supervisory authority about the processing of their personal data.

Contact details of the data protection supervisory authority can be found at https://dsb.gv.at/

In principle, we do not use fully automated decision-making in accordance with Article 22 GDPR to establish and implement a business relationship or other relationship. If we use these procedures in individual cases, we will provide separate information about this if this is required by law.

We occasionally offer competitions via our website or in other ways. We process the data requested to determine and notify the winners. No further processing/use of the participants' data takes place. It is in our legitimate interest to offer competitions to attract customers or to interact with our existing customers.

The legal basis for data processing is Art. 6 para. 1 sentence 1 lit. f GDPR.

Our website uses technologies such as cookies or similar storage technologies to store information on users’ devices or to access information that is already stored (e.g., IP addresses or device identifiers). The specific types of information involved are explained in more detail in the following sections.

The storage of and access to information are based on the following legal provisions:

• Necessity for the service: If the storage or access is technically essential to provide the explicitly requested service (e.g., to use a chat function or to ensure the security and stability of the website), processing is based on Art. 5(3), second sentence, of the ePrivacy Directive in conjunction with Art. 6(1)(f) of the GDPR (legitimate interest) or—depending on national implementation—on the corresponding provisions in the respective EU member state.
• Processing Requiring Consent: In all other cases, data is stored and accessed only if the user has given their express prior consent. The legal basis for this is Article 5(3), first sentence, of the ePrivacy Directive in conjunction with Article 6(1)(a) of the GDPR.

The subsequent processing of personal data is carried out exclusively on the basis of the provisions of the GDPR and, where applicable, supplementary national data protection laws.

Our website is hosted by Hetzner. The provider is Hetzner Online GmbH, Industriestr. 25, 91710 Gunzenhausen, Germany. The provider processes the personal data transmitted via the website—such as content data, usage data, meta/communication data, or contact information—within the EU. Further information can be found in the provider’s privacy policy at https://www.hetzner.com/de/rechtliches/datenschutz (opens in new window).

It is in our legitimate interest to provide a website; therefore, the legal basis for data processing is Article 6(1)(f) of the GDPR.

Our website uses the Cookiebot consent management system to obtain and manage your consent to the storage of cookies and the use of external services. We classify the cookies and services we use into the following categories:

• Essential: Technically necessary cookies and services required for the basic operation and functionality of the website (Legal basis: Art. 6(1), sentence 1, lit. f of the GDPR in conjunction with § 165(3) of the TKG 2021).
• Statistics & Marketing: Cookies and services for analyzing user behavior, measuring reach, and displaying targeted advertising (Legal basis: Art. 6(1), sentence 1, lit. a GDPR in conjunction with § 165(3) TKG 2021).
• External Media: Services for embedding external content such as maps, videos, or widgets (Legal basis: Article 6(1), first sentence, (a) of the GDPR in conjunction with Section 165(3) of the TKG 2021).

The consent you provide when accessing the website, or your settings, are stored in a cookie. This information is retained for up to 3 months. You may adjust or revoke your consent at any time with future effect via the cookie settings on our website.

2.7.1 OpenStreetMaps

We use OpenStreetMap for maps on our website. The provider is the OpenStreetMap Foundation, St. John’s Innovation Centre, Cowley Road, Cambridge CB4 0WS, UK. The provider processes location data, meta/communication data (e.g., device information, IP addresses), and usage data (e.g., websites visited, content interests, access times) within the EU.

The legal basis for the processing is Article 6(1)(a) of the GDPR. Processing is based on consent. Data subjects may revoke their consent at any time, for example, by contacting us using the contact information provided in our Privacy Policy. Withdrawal does not affect the lawfulness of the processing prior to withdrawal.

The data will be deleted once the purpose for which it was collected no longer applies and there is no conflicting retention requirement. Further information is available in the provider’s privacy policy at https://wiki.osmfoundation.org/wiki/Privacy_Policy (opens in new window).

2.7.2 feratel Deskline

We use feratel Deskline. The provider is feratel media technologies AG, Maria-Theresien-Straße 8, A-6020 Innsbruck, Austria. The provider processes usage data (e.g., websites visited, interest in content, access times), contact data (e.g., email addresses, phone numbers), location data, and meta/communication data (e.g., device information, IP addresses) within the EU.

The legal basis for the processing is Art. 6(1)(f) of the GDPR. We have a legitimate interest in promoting tourism offerings.

The data will be deleted once the purpose for which it was collected no longer exists and there is no obligation to retain it. Further information is available in the provider’s privacy policy at https://www.feratel.at/datenschutz/ (opens in new window).

2.7.3 Pixelpoint

We use Pixelpoint for website design and development. The provider is pixelpoint multimedia werbe GmbH, Rosentaler Straße 150, 9020 Klagenfurt am Wörthersee, Austria. The provider processes usage data (e.g., websites visited, interest in content, access times) and meta/communication data (e.g., device information, IP addresses) within the EU.

The legal basis for this processing is Article 6(1)(f) of the GDPR. We have a legitimate interest in setting up and maintaining a website to present ourselves to the public.

The data is deleted once the purpose for which it was collected no longer applies and there is no conflicting retention requirement. Further information is available in the provider’s privacy policy at https://www.pixelpoint.at/datenschutz/ (opens in new window).

2.7.4 Google Analytics

We use Google Analytics for analysis. The provider is Google LLC, 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA. The provider processes usage data (e.g., websites visited, interest in content, access times) and meta/communication data (e.g., device information, IP addresses) in the United States. The legal basis for the processing is Art. 6(1)(a) of the GDPR. Processing is based on consent. Data subjects may withdraw their consent at any time by contacting us, for example, using the contact information provided in our Privacy Policy. The withdrawal does not affect the lawfulness of the processing prior to the withdrawal.

The transfer of personal data to a country outside the EEA is based on an adequacy decision. The security of the data transferred to the third country (i.e., a country outside the EEA) is guaranteed because the European Commission has determined, within the framework of an adequacy decision pursuant to Article 45(3) of the GDPR, that the third country provides an adequate level of protection.

The data will be deleted once the purpose for which it was collected no longer applies and there is no retention obligation to the contrary. Further information is available in the provider’s privacy policy at https://business.safety.google/privacy/ (opens in new window).

2.7.5 Google Tag Manager

We use Google Tag Manager for advertising and analytics. The provider is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. The provider processes usage data (e.g., websites visited, content interests, access times) in the United States.

The legal basis for the processing is Art. 6(1)(a) of the GDPR. The processing is based on consent. Data subjects may revoke their consent at any time by contacting us, for example, using the contact information provided in our Privacy Policy. The withdrawal does not affect the lawfulness of the processing prior to the withdrawal.

The transfer of personal data to a country outside the EEA is based on an adequacy decision. The security of the data transferred to the third country (i.e., a country outside the EEA) is guaranteed because the European Commission has determined, pursuant to Article 45(3) of the GDPR, that the third country offers an adequate level of protection.

We delete the data once the purpose for which it was collected no longer applies. Further information is available in the provider’s privacy policy at https://business.safety.google/privacy/ (opens in new window).

2.7.6 Meta Pixel

We use Meta Pixel for analytics. The provider is Meta Platforms Ireland Ltd., 4 Grand Canal Square, Grand Canal Harbour, Dublin 2, Ireland. The provider processes usage data (e.g., websites visited, interest in content, access times) in the United States.

The legal basis for the processing is Art. 6(1)(a) of the GDPR. Processing is based on consent. Data subjects may withdraw their consent at any time, for example, by contacting us using the contact information provided in our Privacy Policy. The withdrawal does not affect the lawfulness of the processing prior to the withdrawal.

The transfer of personal data to a country outside the EEA is based on an adequacy decision. The security of the data transferred to the third country (i.e., a country outside the EEA) is guaranteed because the European Commission has determined, within the framework of an adequacy decision pursuant to Article 45(3) of the GDPR, that the third country provides an adequate level of protection.

The data will be deleted once the purpose for which it was collected no longer applies and there is no conflicting retention requirement. Further information is available in the provider’s privacy policy at https://www.facebook.com/policy.php (opens in new window).

2.6.7 Google Ads

We use Google Ads for advertising. The provider is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. The provider processes usage data (e.g., websites visited, interest in content, access times) and meta/communication data (e.g., device information, IP addresses) in the United States. The legal basis for the processing is Article 6(1)(a) of the GDPR. The processing is based on consent. Data subjects may withdraw their consent at any time by contacting us, for example, using the contact information provided in our Privacy Policy. The withdrawal does not affect the lawfulness of the processing prior to the withdrawal.

The transfer of personal data to a country outside the EEA is based on an adequacy decision. The security of the data transferred to the third country (i.e., a country outside the EEA) is guaranteed because the European Commission has determined, within the framework of an adequacy decision pursuant to Article 45(3) of the GDPR, that the third country provides an adequate level of protection.

We delete the data once the purpose for which it was collected no longer applies. Further information is available in the provider’s privacy policy at https://business.safety.google/privacy/ (opens in new window).

2.7.8 heyData

We have integrated a privacy seal on our website. The provider is heyData GmbH, Schützenstraße 5, 10117 Berlin, Germany. The provider processes metadata and communication data (e.g., IP addresses) within the EU.

The legal basis for the processing is Article 6(1)(f) of the GDPR. We have a legitimate interest in providing website visitors with confirmation of our compliance with data protection regulations. At the same time, the provider has a legitimate interest in ensuring that only customers with existing contracts use its seals, which is why a mere image copy of the certificate does not constitute a viable alternative to the confirmation.

The data is anonymized after collection so that it can no longer be linked to specific individuals. Further information is available in the provider’s privacy policy at https://heydata.eu/datenschutzerklaerung (opens in new window).

We are represented on social media networks in order to present our organization and our services. The operators of these networks regularly process their users' data for advertising purposes. Among other things, they create user profiles from their online behavior, which are used, for example, to display advertising on the pages of the networks and elsewhere on the Internet that corresponds to the interests of the users. For this purpose, the network operators store information on user behavior in cookies on the user's computer. It is also possible that the operators may combine this information with other data. Users can find further information and information on how users can object to processing by the site operators in the privacy policies of the respective operators listed below. It is also possible that the operators or their servers are located in non-EU countries, meaning that they process data there. This may result in risks for users, e.g. because the enforcement of their rights is made more difficult or government agencies gain access to the data.

When users of the networks contact us via our profiles, we process the data provided to us in order to respond to the inquiries. This is our legitimate interest, so the legal basis is Art. 6 para. 1 sentence 1 lit. f GDPR.

We maintain a profile on Instagram. The operator is Meta Platforms Ireland Ltd, 4 Grand Canal Square, Grand Canal Harbour, Dublin 2, Ireland. The privacy policy is available here: help.instagram.com/519522125107875. (opens in new window)

We maintain a profile on LinkedIn. The operator is LinkedIn Ireland Unlimited Company, Wilton Place, Dublin 2, Ireland. The privacy policy is available here: www.linkedin.com/legal/privacy-policy?_l=de_DE. (opens in new window) You can object to data processing via the settings for advertisements: www.linkedin.com/psettings/guest- (opens in new window) controls/retargeting-opt-out.

If you have any questions or comments regarding this privacy policy, please do not hesitate to contact us using the contact details above.