Information Obligations under the General Data Protection Regulation (GDPR)

Preamble

Protecting your privacy and personal data is very important to us and is always taken into account in all business transactions.

By using this website, you agree to the processing of your personal data (hereinafter referred to as “data”) as described in this Privacy Policy. All references to personal designations are to be understood as gender-neutral.

In principle, you can use our website without providing any personal data. However, certain services may be subject to different regulations, which we will point out to you separately below.

General Information

The purpose of processing your personal data (hereinafter referred to as “data”) on this website is to provide information about services and the trade of garden equipment, as well as to present and offer related goods and services. In this Privacy Policy, we inform you, among other things, about:

the name and contact details of the data controller
all purposes for which your data is processed
the legal basis on which the processing activities are carried out, including, if applicable, our legitimate interests
all recipients of your data
any transfer of your data to a third country and the legal basis for such transfer
the storage period of your data or the criteria used to determine that period
the categories of your data that are processed
the source of your data
the rights of the data subjects

Data Protection Officer / Responsible for Data Protection

AWService GmbH, Managing Directors: Jürgen Wörndl & Alexander Wörndl
Eisenstraße 4, A-4502 St. Marien, Austria
Phone: +43-7229-78012
Email: office@awservice.at

No Data Protection Officer has been appointed, as this is not legally required.

Your Rights

You have the following rights regarding your personal data that concerns you:

Right of access
Right to rectification or erasure
Right to restriction of processing
Right to object to processing
Right to data portability
Right to withdraw your consent

In addition, you have the right to lodge a complaint with a data protection supervisory authority regarding the processing of your personal data by us.

For this purpose, and for any other questions regarding personal data, you may contact us at any time.

Right of Access

You have the right to obtain from us, free of charge and at any time, information about the personal data we store concerning you, as well as a copy of this information, including details about:

the purposes of processing
the categories of personal data being processed
the recipients or categories of recipients to whom the personal data has been or will be disclosed, especially recipients in third countries or international organizations
where possible, the planned storage period of the personal data, or if this is not possible, the criteria used to determine that period
the existence of a right to rectification or erasure of your personal data, or a right to restriction of processing or to object to such processing
the existence of a right to lodge a complaint with a supervisory authority
if the personal data was not collected from you: all available information about its origin
the existence of automated decision-making, including profiling, according to Article 22(1) and (4) GDPR, and — at least in these cases — meaningful information about the logic involved, as well as the significance and expected consequences of such processing for you

Furthermore, you have the right to know whether personal data has been transferred to a third country or an international organization, and if so, the appropriate safeguards related to such transfer.

Right to Rectification

You have the right to request the immediate correction of inaccurate personal data concerning you.

You also have the right to request the completion of incomplete personal data — including by means of a supplementary statement — taking into account the purposes of processing.

Right to Erasure

You have the right to request that your personal data be deleted immediately if one of the following reasons applies and processing is not required:

The personal data was collected for purposes for which it is no longer necessary.
You withdraw consent on which the processing is based pursuant to Art. 6(1)(a) or Art. 9(2)(a) GDPR, and no other legal basis for processing exists.
You object to processing pursuant to Art. 21(1) GDPR and there are no overriding legitimate grounds for processing, or you object pursuant to Art. 21(2) GDPR.
The personal data has been unlawfully processed.
Deletion of the personal data is required to comply with a legal obligation under Union or Member State law to which the controller is subject.
The personal data was collected in relation to services offered by the information society under Art. 8(1) GDPR.

Right to be Forgotten

If your personal data has been made public by us and our company, as the controller, is obliged to delete the personal data under Art. 17(1) GDPR, we will take reasonable measures, considering available technology and implementation costs, including technical measures, to inform other controllers processing the published personal data that you have requested deletion of all links to, copies, or replications of your personal data, unless processing is required.

Right to Restriction of Processing

You have the right to request the restriction of processing when one of the following applies:

You contest the accuracy of the personal data, for a period that allows us to verify its accuracy.
Processing is unlawful, and you oppose the erasure of the personal data and request restriction instead.
We no longer need the personal data for processing purposes, but you require it to assert, exercise, or defend legal claims.
You have objected to processing under Art. 21(1) GDPR, and it has not yet been determined whether our legitimate grounds override yours.

Right to Data Portability

You have the right to receive your personal data provided to us in a structured, commonly used, and machine-readable format.

You also have the right to transmit this data to another controller without hindrance from us, provided that the processing is based on consent under Art. 6(1)(a) or Art. 9(2)(a) GDPR or on a contract under Art. 6(1)(b) GDPR and the processing is carried out by automated means, unless required for the performance of a task carried out in the public interest or in the exercise of official authority vested in us.

Furthermore, when exercising your right to data portability, you have the right to request that the personal data be transmitted directly from us to another controller, where technically feasible, provided that this does not adversely affect the rights and freedoms of others.

Right to Object

You have the right to object at any time, on grounds relating to your particular situation, to the processing of your personal data carried out under Art. 6(1)(e) or (f) GDPR, including profiling based on these provisions.

In case of objection, we will no longer process the personal data unless we can demonstrate compelling legitimate grounds for the processing that override your interests, rights, and freedoms, or the processing is necessary for the establishment, exercise, or defense of legal claims.

If personal data is processed for direct marketing purposes, you have the right to object at any time to the processing of your personal data for such marketing purposes, including profiling to the extent it relates to such direct marketing.

Upon objection, we will cease processing your personal data for these purposes.

You also have the right to object, on grounds relating to your particular situation, to processing of personal data for scientific or historical research purposes or statistical purposes under Art. 89(1) GDPR, unless processing is necessary for the performance of a task carried out in the public interest.

Automated Individual Decision-Making, Including Profiling

You have the right not to be subject to a decision based solely on automated processing — including profiling — which produces legal effects concerning you or similarly significantly affects you, unless the decision:

is necessary for entering into or performing a contract between you and us, or
is authorized by Union or Member State law to which we are subject, and that law contains suitable measures to safeguard your rights, freedoms, and legitimate interests, or
is based on your explicit consent.

Right to Withdraw Consent

You have the right to withdraw consent to the processing of personal data at any time. The withdrawal of consent does not affect the lawfulness of processing based on consent before its withdrawal.

Minors

Our website and services are not intended for use by minors, and we do not wish to collect data from minors. If a parent or guardian believes that their child may have provided us with personal data, please contact us using the contact details provided below, and we will delete such personal data in accordance with applicable law and this Privacy Policy.

Data Security

We implement appropriate technical and organizational measures (TOMs) and security precautions designed to prevent unauthorized access, unlawful processing, and accidental or unlawful loss of your data.

This includes, for example, the encryption of your communication with us via this website using the Secure Socket Layer (SSL) encryption protocol.

You can check the quality of our encryption here: https://www.ssllabs.com/ssltest

Please note that data transmission over the Internet may have security vulnerabilities, as complete protection against access by unauthorized third parties is not possible.

Web Hosting

The server hosting this website is located in a data center in Vienna and is operated by IPAX GmbH (ipax.at), with whom we have concluded a data processing agreement.

Server Log Files

Our website automatically collects a range of general data and information with each of your visits.

The data collected may include:

the types and versions of browsers used
the operating system used by the accessing system
the website from which an accessing system reaches our website (so-called referrer)
the subpages accessed on our website by the accessing system
the date and time of access to the website
an Internet Protocol (IP) address
the Internet service provider of the accessing system
other similar data and information used for the prevention of risks in the event of attacks on our information technology systems

We do not draw any conclusions about you from the use of this general data and information.

This information is required to:

correctly deliver the content of our website
optimize the content of our website and the advertising for it
ensure the permanent functionality of our information technology systems and website technology
provide law enforcement authorities with the information necessary for prosecution in the event of a cyberattack

Starting from 01.05.2018, the last octet of IP addresses is no longer recorded.
Instead of logging the full IP address (e.g., 192.168.0.77), only a portion (e.g., 192.168.0.0) is stored. While this reduces the level of detail in the statistics, it ensures that the remaining truncated IP address is no longer personal data and therefore does not require processing under the GDPR.

These anonymized data and information are analyzed both statistically and with the aim of improving data protection and data security in our company, ultimately ensuring an optimal level of protection for you. We are allowed to process this data on the basis of our legitimate interest pursuant to Art. 6(1)(f) GDPR.

The logs are stored separately from all personal data provided by you and are deleted after a maximum of 2 months.

Cookies

When accessing and using this website, cookies (Google Maps, session) are processed. By clicking the “Accept” button, you consent to this processing. By clicking the “Decline” button, no cookies will be set; however, proper use of the website cannot be guaranteed.

Cookies are small text files stored on your local device.

This website uses the following types of cookies, whose scope and functionality are explained below:

Transient cookies are automatically deleted when you close your browser. These include, in particular, session cookies, which store a so-called session ID that allows different requests from your browser to be assigned to the same session. This enables your device to be recognized when you return to our website. Session cookies are deleted when you log out or close your browser.
Persistent cookies are automatically deleted after a predefined period, which may vary depending on the cookie. You can delete cookies at any time in your browser’s security settings.

You can configure your browser settings according to your preferences, for example, to reject third-party cookies or all cookies. Please note that you may not be able to use all features of this website if you do so.

More detailed information on Google Maps cookies is provided below.

For detailed information on the names, purposes, and deletion periods of the cookies used, please see: www.awservice.gmbh/cookies.pdf

How We Collect Your Data Online

Our website contains information that, in accordance with legal requirements, allows for quick electronic contact with our company as well as direct communication with us, including an email address.

You can visit our website without providing any personal information.

Please note that unencrypted emails sent over the Internet are not sufficiently protected against unauthorized access by third parties.

Why We Process Your Data

If you contact us, for example, simply to request information from us, we process your data for this purpose.

If you contact us, for example, to conclude a contract, we process your data for that purpose.

For the processing of your order, including customer support

If you provide your order data via email, the data you provide, including your personal data, will be processed by us and the recipients listed below for the purpose of (pre-)contractual processing within the scope of our business relationship with you. This is done to execute and manage your order as well as to provide customer support.

Legal Basis for Processing Your Data

If you contact us, for example, simply to request information from us, we may process your data based on your consent pursuant to Art. 6(1)(a) GDPR or on the basis of our legitimate interest pursuant to Art. 6(1)(f) GDPR.

If you contact us, for example, to conclude a contract, we may process your data pursuant to Art. 6(1)(b) GDPR and, if applicable, store it pursuant to Art. 6(1)(c) GDPR.

For the processing of your order

The processing of your data, including the personal data you provide as well as any special categories of personal data you voluntarily provide without being requested, is carried out by us and the recipients listed below on the legal basis of Art. 6(1)(b) and Art. 9(2)(a) GDPR. This processing allows us to identify you as a customer, properly execute the respective order, and correspond with you. The data processing is carried out at your request and is necessary for the proper handling of your order for the purposes stated above.

Marketing (general)

Legitimate interest pursuant to Art. 6(1)(f) GDPR. The legitimate interest is our interest in initiating and intensifying business relationships with existing and potential customers.

What Data We Process

Information Requests

If you contact us solely to request information, we process the data you provide.

Providing information is entirely voluntary. However, we expressly ask that you do not disclose any data that is likely to have little or no relevance to the purpose you intend; this applies in particular to special categories of personal (“sensitive”) data.

Orders

Depending on what you voluntarily provide to us, the data we process may include:

Your contact details (name, address, telephone number, email address, etc.)
Content of the order
Any special categories of personal data voluntarily provided by you

Providing this information is entirely voluntary. Nevertheless, we expressly ask that you do not disclose any data that is likely to have little or no relevance to the intended purpose; this applies especially to special categories of personal (“sensitive”) data.

Who We Share Your Data With

Your data may be disclosed in whole or in part, but always only to the extent necessary, to the following controllers:

Banks (payment transactions – Austria)
Tax advisors (accounting – Austria)
Collection agencies (debt collection – Austria)
Legal representatives (legal enforcement – Austria)
Courts (legal enforcement – Austria)
Administrative authorities (Austria)

In addition, your data may be disclosed to the following recipients as data processors. We have concluded a data processing agreement with each of them and have verified the appropriate technical and organizational measures (TOMs):

IPAX GmbH (web hosting, webmail – Austria)
spectory OG (website maintenance – Austria)

How Long We Retain Your Data

Your data is stored in a form that allows identification only for as long as it is necessary for the purpose for which it is processed.

Information Requests

By providing your data to us via email, you explicitly consent to the processing of your data, including the personal data you provide as well as any special categories of personal data voluntarily provided, by us and the recipients listed above for the duration required to handle the specific information request.

If you contact us solely to request information, your data will either be deleted immediately or after a reasonable period corresponding to the content of the communication.

If you withdraw your consent, we will delete all your data — including aggregated data — from all databases.

Orders

Due to commercial and tax law requirements, we are obliged to store your address, payment, and order data for 7 years. If you contact us to conclude a contract, the data will be deleted at the end of the 7th year following the booking of the last document (§ 132 BAO). In the case of a contract, all data related to the contractual relationship will be stored until the end of this period.

However, after 2 years, processing is restricted, meaning your data will only be used to comply with legal obligations.

Legal retention requirements or contractual obligations, for example towards customers for warranty or liability purposes or towards contractual partners, provide an additional basis for continuing to store your data (Art. 6(1)(c) GDPR; Art. 17(3)(e) GDPR).

Marketing (general)

Marketing data is retained for up to 3 years after the last contact.

Facebook

We only provide a link to the Facebook page and do not use any plugins or cookies.

Google Maps

On this website, we use the Google Maps service.

The legal basis for using Google Maps is our legitimate interest under Art. 6(1)(f) GDPR in improving our information and service offerings as well as our website. This allows us to display interactive maps directly on the website and enables you to use the map functions conveniently. You have the right to object to this at any time.

If you use the cookie banner, the legal basis is Art. 6(1)(a) GDPR. You have the right to withdraw your consent at any time.

By clicking the “Accept” button on our cookie banner, you consent to Google placing various cookies on your device.

For detailed information about the names, purposes, and deletion periods of the Google Maps cookies used, please see: www.awservice.gmbh/cookies.pdf .

By clicking the “Decline” button, no Google Maps cookies are set.

When you visit the website, Google receives the information that you have accessed the corresponding subpage of our website. This happens regardless of whether Google provides a user account that you are logged into or if no account exists.

If you are logged into Google, your data will be directly associated with your account. If you do not wish this association with your Google profile, you must log out before activating the button.

Google stores your data as usage profiles and uses it for purposes such as advertising, market research, and/or website customization.

Such evaluation is carried out, in particular (even for users not logged in), to provide targeted advertising and to inform other users of the social network about your activities on our website.

You have the right to object to the creation of these user profiles, which must be exercised directly with Google.

Further information about the purpose and scope of data collection and processing by the plugin provider, as well as your rights and settings to protect your privacy, can be found in the provider’s privacy policies: http://www.google.de/intl/de/policies/privacy . Google also processes your personal data in the USA and has committed to the EU-US Privacy Shield: https://www.privacyshield.gov/EU-US-Framework .

Google Web Fonts

This website uses so-called web fonts to ensure a consistent display of fonts. For GDPR compliance, we have stored these fonts locally on our server and integrated them into our website in such a way that no data is exchanged with Google.