Legal information and data protection

Preamble

Protecting the personal data of its associates is of great importance to Swietelsky AG, Edlbacherstraße 10, 4020 Linz, Austria and its subsidiaries (together Swietelsky). For this reason, Swietelsky processes personal data in accordance with the applicable legal directives for the protection of personal information and data protection.

The terminology used in this policy is based around the definitions given in article 4 of the EU General Data Protection Regulation (GDPR).

    1.  Scope

Factual: This Privacy Policy regulates the handling and processing of personal data in the Swietelsky corporate group.

Personal: This Privacy Policy is applicable for all employees of the Swietelsky corporate group, as well as their partners, clients, and suppliers, and for other persons involved in Swietelsky operations.

Temporal: This Privacy Policy is valid from 25.5.2018 and applies as the minimum standard for processing personal data.

    2.  Processing Policies

Swietelsky’s processing of personal data is regulated by strict policies, which highly value the protection and security of data and the rights of the data subjects.

Legitimacy and Transparency: Data is processed in a lawfully, reasonable and fair manner.

Purpose Limitation: Data will be processed and complied for specified, clear and legitimate purposes. Data will not be processed in any manner that is incompatible with these purposes.

Data Minimisation: Data will only be processed and compiled when it is necessary to do so. Where the purpose of the data processing permits, the data will be anonymised.

Storage Limitation and Deletion: Personal data will be deleted as soon as the purpose for which it was compiled expires and legal retention periods do not prohibit deletion. If in individual cases there are interests in this data that are worthy of protection, they will continue to be stored until the interest worthy of protection has been legally clarified.

Data Protection: Data secrecy is applicable for personal data. The data shall be treated confidentially and shall be protected by appropriate organisational and technical measures against unauthorised access, unlawful manipulation or disclosure as well as against loss and destruction.

Factual Accuracy: Personal data must be kept accurate, complete and up to date. Reasonable measures are taken to correct outdated, incorrect or incomplete data.

    3.  Data Protection

The protection of data confidentiality, availability and integrity is an essential task of Swietelsky. This applies equally for corporate secrets, client information, personal data and other critical information.

For this purpose, technical and organisational security measures have been established and continue to be improved according to internationally recognised Best Practices.

    4.  Data Secrecy

All employees of Swietelsky corporate group and of its contractual partners are obliged to maintain secrecy and are regularly instructed and trained on the secure handling of personal data and other critical data.

    5.  Continuing Checks and Improvement

Swietelsky highly values continuing quality and process improvement. There are defined processes for continuingly increasing quality, which have been in place for years and are certified according to ISO 9001. Compliance with data protection guidelines and applicable legislation, as well as the effectiveness of data protection and data security measures, is continuously measured and improved with the help of these processes in order to be able to guarantee optimal data protection measures.

II.  Data Processing, Purpose and Legal Basis

Swietelsky processes the personal information of employees, partners, clients and suppliers for the purpose of providing the business activity and fulfilling related legal and contractual requirements.

    1.  Processing the Data of Business Partners

Swietelsky processes the personal data provided by interested parties, clients, suppliers, etc. in order to prepare offers and process orders as well as to fulfil the associated contractual/pre-contractual and legal obligations.

    2.  Contact

When you contact us, the personal data you provide us with will be used to process and handle your enquiry in accordance with Art. 6 para. 1 subpara. a and b of the GDPR. It is necessary to process your data in order to process and respond to your enquiry, otherwise we would not be able to respond to your enquiry or would only be able to respond to it to a limited extent.

We will delete your enquiry and your contact details once your enquiry has been conclusively answered and there are no legal retention periods preventing deletion, e.g. in the context of subsequent contract processing. This is usually the case if we have not had any contact with you for three years.

    3.  Job Applicants

When submitting your application to SWIETELSKY, you expressly agree to SWIETELSKY processing your personal data, and that SWIETELSKY is entitled to transmit, process and use this information within the SWIETELSKY group. The transfer, processing and use of the data is limited to the purposes of searching for personnel or staff administration.

Processing may also be done electronically. This is the case particularly when your application documents are sent electronically, for example by email or a career portal.

If the application results in an employment contract, the data submitted will be processed in accordance with legal regulations.

However, if it does not result in employment, your information will be deleted 6 months later, pursuant to legal regulations, so long as no other legitimate interests or record-keeping consent prevent deletion.

The processing of the application documents you send takes places on the basis of your consent acc. to Art. 6 para. 1 subpara. a of the GDPR.

In the event that we are provided with special categories of personal data within the meaning of Art. 9 para. 1 of the GDPR voluntarily as part of the application process, this data will be processed pursuant to Art. 9 para. 2 subpara. b of the GDPR (e.g. health data, such as disability, or ethnic background) or, with your consent, pursuant to Art. 9 para. 2 subpara. a of the GDPR (e.g. health data, to the extent that this is necessary for practising the profession).

    4.  Server Log Files (Access Data)

For technical reasons, particularly to guarantee functioning and secure internet access, we process technically useful data regarding access to our website in so called server log files, which are automatically shared with us by your browser. 

We process the following access data:

• Name of the directing website
• Browser type used, incl. version
• Operating system used by the visitor
• Sites previously visited by the visitor (referrer URL)
• Time of the server request
• Amount of transferred data
• Host name of the accessing computer (IP address used, anonymised if necessary)

 The opportunity for us to use this data, within the legal framework of Art. 6 para. 1 subpara. f of the GDPR, for the purposes of

• guaranteeing problem-free connection to the website,
• guaranteeing comfortable use of our website,
• evaluation system security and stability, as well as
• for further administrative purposes

is currently being exercised by us. The compiled data will under no circumstances be used to draw conclusions about your person.

The access data is automatically deleted after 120 days  , so long as no further retention is required for evidentiary purposes. Otherwise, the data is kept until any incident is finally resolved.

IV.  Data Subject Rights

• You have the right:
  according to Art. 15 of the GDPR to request information about which of your personal information we are processing. Specifically, you may request information about the processing purposes, the type of personal data, the types of recipients to whom your data has been or will be disclosed, the planned storage period, the existence of a right to correction, deletion, restriction or objection to processing, the existence of a right to complain, the origin of your data if it has not been collected by us, as well as the existence of automated decision-making, including profiling, and, if applicable, meaningful information about any details thereof;
• according to Art. 16 of the GDPR to immediately request the Correction of incorrect or incomplete personal information stored by us;
• according to Art. 17 of the GDPR to request the Deletion of any of your personal information stored by us, except where such processing is necessary in order to exercise the right to freedom of expression and information, to comply with a legal obligation, for reasons of public interest or to establish, exercise or defend legal claims;
• according to Art. 18 of the GDPR to request the Restriction of the processing of your personal information if its accuracy is disputed by you, if the processing is illegitimate, but you object to its erasure and we no longer need the information, but you need it to assert, exercise or defend legal claims, or you have objected to the processing pursuant to Art. 21 DSGVO;
• according to Art. 20 of the GDPR to request that the personal information you have provided to us be sent to you in a structured, commonly used and machine-readable format, or to request that it be transferred to another responsible party;
• according to Art. 21 of the GDPR to object to the processing of your personal information if it is processed on the basis of our legitimate interest, provided that there are grounds for doing so which arise from your particular situation or if the objection is directed against direct marketing. Regarding the previous case, you have a general right to object, which will be implemented by us without specifying a specific situation.
• according to Art. 7 para. 3 of the GDPR to revoke your consent at any time. This would have the consequence that we may no longer continue the data processing based on this consent for the future.
• according to Art. 77 of the GDPR to complain to a regulatory authority regarding the unlawful processing of your data by us. Generally, you can contact the regulatory authority for your place of residence, workplace or our company's registered office for this purpose.

    1.  Recognition of the Rights of Data Subjects

Each data subject, whose data is processed by Swietelsky, has the opportunity to invoke any of the aforementioned data subject rights at any time with Swietelsky.

To exercise your rights as a data subject, you can send an email to datenschutz@swietelsky.comat any time.

We cannot process data subject’s requests without first successfully establishing identity. For this reason, we ask that you support us in the identification process.

    2.  Right to complain

If you believe that the processing of your data contravenes data protection regulations or that your data protection rights have been violated in any other way, you can complain to the regulatory authority.

The responsible regulatory authority for Swietelsky Group is:

Austrian Data Protection Authority: Tel.: +43 1 52 152-0, dsb@dsb.gv.at

VI. Google Tools

    1.  Google Analytics

This website uses Google Analytics, a website analysis service from Google Inc. (henceforth: Google). Google Analytics uses so called “Cookies”, or text information, which are saved on your computer and allow for the use of a website to be analysed. The information generated by the cookies about your use of this website is usually transferred to a Google server in the United States and stored there. Due to the activation of the IP anonymisation on this website, however, your IP address will be shortened by Google within the member states of the European Union or in the EEA. Only in exceptional cases is the full IP address transferred to a Google server in the United States and truncated there. On behalf of the operator of this website, Google will use this information to evaluate your website use, to compile reports on website activities and to provide further services to the website operator in connection with the use of the website and the internet. The IP address transmitted by your browser within the scope of Google Analytics is not merged with other Google data.

You can prevent cookies from being saved by changing the preferences of their browser software accordingly; however, we would like to point out that in this case you may not be able to use all the functions of this website to their full extent. Furthermore, you can prevent the data generated by cookies and related to their use of the website (including your IP address) from being gathered by Google and then processed by Google by downloading and installing the browser plug-in available at the following link: Browser Add-On to disable Google Analytics.

Processing is carried out on the basis of our legitimate interests pursuant to Art. 6 para. 1 subpara. f of the GDPR.

IP Anonymisation

We use the function “activate IP anonymisation” on this website. Using this, your IP address will be shortened by Google within the member states of the European Union or in the EEA. Only in exceptional cases is the full IP address transferred to a Google server in the United States and truncated there. On behalf of the operator of this website, Google will use this information to evaluate your website use, to compile reports on website activities and to provide further services to the website operator in connection with the use of the website and the internet. The IP address transmitted by your browser within the scope of Google Analytics is not merged with other Google data.

    2.  Google Tag Manager

The website uses Google Tag Manager. This service allows website tags to be managed via an interface. The Google Tag Manager only implements tags. No cookies are implemented and no personal information is gathered. The Google Tag Manager triggers other tags that may collect data. The Google Tag Manager does not access this data. In the event that there has been an opt-out at the domain or cookie level, it will remain in place for all tracking tags, insofar as these are implemented with the Google Tag Manager. More information on the Google Tag Manager is available at the following link: Google Tag Manager Use Policy | Google Tag Manager – Google

The user has the opportunity to prevent all Google Tag Manager tags from being sent. For this, the user must click on the following opt-out link, to place the Google Tag Manager deactivation cookie in his browser.

Further information can be found in the Use Policy at Google Tag Manager Use Policy | Google Tag Manager – Google

    3.  Google Maps

This website uses Google Maps API in order to visually present geographic information. When using Google Maps, Google also collects, processes and uses data on the use of the map functions by visitors. Precise information about Google’s processing of data can be found in the Google Privacy Policy. There, you can also change you personal information settings in the data protection centre.

Detailed instructions on how to manage your own data in connection with Google products can be found here.

VIII. SSL Encryption

In order to protect the security of your data when it is being transferred, we use current state of the art encryption techniques (e.g. SSL) over HTTPS.  You can recognise an encrypted connection by the text string "https://" and the lock symbol in your URL bar