Notes:

A privacy policy can only be drafted if all tools and applications used in the course of data processing (for marketing purposes)—and thus all categories of personal data and their uses—are known. The following sample policy therefore provides a framework that must be supplemented in specific areas depending on the nature of the processing. Source: This sample policy was prepared primarily with reference to the “Formularhandbuch^{Datenschutzrecht2”} (Koreng/Lachenmann) and the WEKA publication “Praxiswissen Datenschutz,” loose-leaf edition.

To find out which cookies, plugins, or other applications are active on your website, it is recommended that you use various tools (such as a cookie viewer) to check whether cookies are being stored—if this is the case, you should consult with the website designer and obtain the relevant information. Some of the most common tools and plugins are included in this sample privacy policy.

We cannot assume liability for the completeness and accuracy of this privacy policy in the event of its uncritical use, especially since it must always be evaluated and adapted based on a website’s actual functions or a company’s data processing practices. This template can therefore only serve as a guide on how to draft a legally compliant privacy policy for your own website.

PRIVACY POLICY

This website is operated by the AUSZEIT St. Lambrecht GmbH (FN: 540296 d), hereinafter referred to as “we,” “us,” and “AUSZEIT – Rehazentrum St. Lambrecht GmbH,” with its registered office at Hauptstraße 38–40, A-8813 St. Lambrecht, Styria | Austria. In this Privacy Policy, we—as the data controller pursuant to Article 4(7) of the GDPR—describe what data we collect when you visit our website and for what purposes we process it. In addition, we inform you about how we generally process data from our customers, suppliers, and prospective clients, and conclude by explaining the rights and safeguards we provide in connection with data processing. Please refer to Section 11 of this Privacy Policy for all relevant contact information.

Since the protection of your personal data is of particular concern to us, we strictly adhere to the legal requirements of the DSG and the DSGVO when collecting and processing your personal data.

Below, we provide detailed information about the scope and purpose of our data processing, as well as your rights as a data subject. Please read our Privacy Policy carefully before continuing to use our website and, if applicable, before giving your consent to data processing.

1. Personal data

In general, you can use our website without providing any personal information. However, different rules may apply to the use of certain services, in which case we will notify you separately.

Apart from the cookies described in detail below, we therefore only collect and store the data that you yourself provide to us by entering it in our input masks or actively interacting with our website in any other way.

Personal data is any information relating to an identified or identifiable natural person. This includes, for example, your name, address, phone number, or date of birth, as well as your IP address or geolocation data that can be used to identify you.

2. Use of cookies

1. If you use our website solely for informational purposes—that is, if you do not register for a service or otherwise provide us with information (such as via a contact form)—we collect only the (personal) data that your browser transmits to our server. Therefore, when you visit our website, we collect the following data, which is technically necessary for us to display the website to you and to ensure its stability and security in accordance with Article 6(1)(f) of the GDPR:

• IP address
• Date and time of the request
• Time zone difference to Greenwich Mean Time (GMT)
• Content of the request
• Access status / http status code
• Amount of data transferred in each case
• Website from which the request comes
• Browser used
• Operating system and its interface
• Language and version of the browser software

However, this data is not processed beyond the purpose of displaying our website.

1. In addition to the information mentioned above, when you use our website, first- and third-party cookies are stored on your computer; these are small text files that are stored on your hard drive and associated with the browser you are using. The entity that sets a cookie (either us or an explicitly named third party) thereby receives certain information.

We need these cookies, on the one hand, to recognize you as a user of the website and, on the other hand, to track how our services are used. Finally, we may use cookies for marketing purposes to analyze your usage behavior and, where appropriate, to provide you with targeted advertising.

1. A basic distinction can be made between first party cookies, third party cookies and third party requests.

• First party cookies

First-party cookies are stored in your browser by us or our website itself to provide you with the best possible user experience. These are primarily functional cookies, such as shopping cart cookies. We may also use cookies to identify you on subsequent visits if you have an account with us—otherwise, you’ll need to log in again each time you visit.

• Third party cookies

Third-party cookies are stored in your browser by a third-party provider. These are mostly tracking or marketing tools that analyze your user behavior and also allow the third-party provider to recognize you on other websites you visit. Retargeting marketing, for example, is generally based on the functionality of such cookies.

• Third Party Requests

Third-party requests are all requests that you, as a site user, make to third parties via our site—for example, when you interact with social media plugins or use a payment provider’s service. In this case, although no cookies are stored in your browser, it cannot be ruled out that personal data may be sent to these third-party providers as a result of your interaction. For this reason, we also provide detailed information in our Privacy Policy about the tools and applications we use.

1. To provide you with comprehensive information about the cookies we use, we have designed a cookie banner—in accordance with the European Court of Justice’s ruling of October 1, 2019, C-673/17 (Planet 49), as well as other relevant rulings, designed a cookie banner that appears when you first visit our website. This cookie banner lists all cookies used, along with their function, storage duration, and origin. We will only store some or all of these cookies if you consent to their use; an exception to this may be cookies that are technically necessary, without which our website could not be displayed correctly.

1. You can change your browser settings at any time to, for example, refuse third-party cookies or all cookies. In that case, however, we must point out that you may no longer be able to use all the features of our website.

3. Collection and processing of personal data

1. Website

We process personal data beyond the information stored by cookies in connection with the operation of our website only if you voluntarily provide it to us—for example, when you register with us, enter into a contractual relationship with us, or otherwise contact us. This data consists exclusively of contact information and details regarding the matters for which you contact us.

We only use the personal data you provide to the extent that this is necessary to fulfill the respective purpose of the processing (e.g. registration, sending newsletters, processing an order, sending information material and advertising, processing a competition, answering a question, providing access to certain information) and this is permitted by law (in particular pursuant to Art. 6 or Art. 9 GDPR). in accordance with Art. 6 or Art. 9 GDPR) (e.g. the sending of advertising and information material to existing customers in accordance with Art. 6 para. 1 sentence 1 lit. f GDPR).

The purpose of processing your data is the operation of our website and the targeted provision of company-specific information, including the presentation of our range of goods and services (marketing).

Your data will not be used for any other purpose unless you have expressly consented to such use in advance, we need your data to fulfill a contract concluded with you, or we are required by law to retain it. You may revoke any consent you have given at any time with future effect, as explained in more detail below.

1. Contract processing, marketing and more

In general, we use personal data of our customers, suppliers and other contractual and cooperation partners, e.g. contact persons, their contact details and marketing-relevant information, for the purpose of contract processing and within the scope of statutory retention obligations (e.g. accounting), and also for legitimate interests, such as for marketing and customer care purposes.

In addition, we collect personal data from prospective clients (e.g., contact persons, their contact information, and marketing-related information) as part of our business development and sales activities. We are constantly on the lookout for potential business partners online, at trade shows, and at other events, and for this purpose we maintain a marketing database to enable targeted advertising for our products and services. We carry out all of the measures listed here in our legitimate interest for marketing purposes pursuant to Art. 6(1)(f) of the GDPR in conjunction with Recital 47 for a period of three years from the end of a contractual relationship (customers and suppliers) or from our initial (unsuccessful) contact (prospective clients), unless the data subject has provided explicit consent beyond this period.

If we do not collect personal data for marketing purposes directly from the data subject, we will also inform the data subject, in accordance with Article 14 of the GDPR, of the source of their data when we first contact them.

1. Application management

We collect data from applicants for open job positions at our company for the purpose of initiating a potential employment relationship (Art. 6(1), sentence 1, letter b of the GDPR) or, where applicable, based on explicit consent for record-keeping purposes.

4. Storage duration

We generally retain data that you have provided to us solely for customer service, marketing, or informational purposes until three years have elapsed since our last contact. However, if you wish, we will delete your data even before this period expires, provided there are no legal obstacles preventing us from doing so.

In the event of contract initiation or conclusion, we process your personal data after complete contract processing until the expiry of the guarantee, warranty, limitation and statutory retention periods applicable to us, and beyond that until the end of any legal disputes in which the data is required as evidence.

We will only store data that you may send us as part of an application process for a period of 6 months without separate consent.

If retention is required by law, we will comply with the retention period specified therein. If we process your personal data—for example, based on a legitimate interest—for purposes other than those described in this Privacy Policy, we will inform you separately before we begin processing it.

5. Data transmission

1. General

Your data will not be transferred to third parties unless we are legally obliged to do so, the transfer of data is necessary for the execution of a contractual relationship concluded between us or you have previously expressly consented to the transfer of your data.

External processors or other cooperation partners will only receive your data if this is necessary for the execution of the contract, if we have a legitimate interest in this, which we always disclose separately in the event of an incident, or if this is necessary due to special standards, with your consent.

We do not sell your personal data to third parties or market it in any other way. If our contractual partners or data processors are based in a third country—that is, a country outside the European Economic Area (EEA)—we will inform you of the implications of this in the description of the offer.

If one of our processors comes into contact with your personal data, we ensure that they comply with the provisions of the data protection laws in the same way as we do.

1. Data transfer to the USA?

We occasionally offer certain services that involve or may involve the transfer of data to the United States. However, in order to use these services—unless there is another legal basis, such as the fulfillment of contractual obligations—you must consent to the use of your data collected through these services, including, where applicable, in the United States (Art. 49(1)(a) of the GDPR).

We collect this consent – depending on the service – via our cookie banner or separately by means of a corresponding declaration of consent directly before using a service offered.

Your consent is required because, according to the most recent administrative and court decisions and the case law of the European Court of Justice, the United States is not deemed to provide an adequate level of data protection when processing personal data (C-311/18, Schrems II). In particular, these administrative and judicial decisions critically highlight that access by U.S. authorities (FISA 0702) is not comprehensively restricted by law, do not require authorization by an independent body, and do not provide affected individuals with relevant legal remedies in the event of such intrusions.

Apart from the contracts we have entered into with U.S. service providers, we have no direct influence over U.S. government access to personal data that is transferred to service providers in the United States when these services are used. Although we assume that our service providers take the necessary steps to ensure the promised level of protection in accordance with the agreements we have entered into with them, it is nevertheless conceivable that U.S. authorities could access data processed in the United States.

We therefore ask for your consent to the processing of your data in the United States before you use such services. For each service or application, we will specifically note that data may be transferred to the United States.

6. Newsletter

You have the option to subscribe to our free newsletter. With this newsletter, you’ll receive regular updates on the latest news and information about our company, as well as personalized advertising. To receive our newsletter, you’ll need a valid email address.

We verify the email address you entered in our registration form to ensure that you actually wish to receive newsletters. We do this by sending an email to the address you provided, which you can confirm by clicking on a link included in the email. Once you’ve confirmed the email, you’ll be subscribed to our newsletter. (Double opt-in)

When you first sign up for the newsletter, we store your IP address, as well as the date and time of your registration. We do this for security reasons in case a third party misuses your email address and subscribes to our newsletter without your knowledge. We do not collect or process any other data in connection with the newsletter subscription; the data is used exclusively for the purpose of receiving the newsletter.

Unless you object, we may share your data with companies affiliated with ours under corporate law for the purpose of analysis and to send you promotional information. Within the corporate group, the data you have provided to us to subscribe to the newsletter will be cross-referenced with data that we may have collected from other sources (e.g., when purchasing a product or booking a service).

We will not share your information provided during newsletter registration with third parties that are not part of our corporate group. You can unsubscribe from our newsletters at any time; details on how to unsubscribe can be found in the confirmation email and in each individual newsletter.

7. Tools and applications used

1. We use Google Analytics, a web analytics service provided by Google Inc, 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA. This service uses cookies, the functionality of which has already been explained in detail above. The information generated by these cookies about your use of this website is generally transmitted to a Google server and stored there.

On our behalf, Google uses this information to evaluate your use of our website, to compile reports on website activity, and to provide other services to the website operator related to website and Internet usage. The IP address transmitted by your browser as part of Google Analytics is not combined with any other data held by Google.

You can prevent the storage of cookies required by Google Analytics by adjusting your browser settings accordingly; however, this may mean that you are unable to fully use all features of this website. You can also prevent the collection of data generated by the cookie and related to your use of the website (including your IP address), as well as its transmission and processing by Google, by downloading and installing the browser plugin available at the following link: http://tools.google.com/dlpage/gaoptout?hl=de

If you would like more information about the type, scope, and purpose of the data collected by Google, we recommend that you read their privacy policy. https://support.google.com/analytics/answer/6004245?hl=de

Google also processes your data in the United States. Before you consent to the storage of cookies through the use of Google Analytics, please read the relevant information in our Privacy Policy.

1. We also use Google Maps on our website. This allows us to display interactive maps directly on our website and enables you to easily use the map feature to find our location and make your trip here easier.

When you visit our website, Google receives information that you have accessed the corresponding subsite of our website, as well as the personal data listed under 2. This occurs regardless of whether you are logged in to a Google account or not. If you are logged in to Google, your data will be directly associated with your account. If you do not wish this to happen, you must log out of Google before using this service. Google uses your data for advertising, market research, and to tailor the website to your needs. You have the right to object to this use of your data, which you must direct to Google.

For more information on the purpose and scope of data collection, please refer to Google’s Privacy Policy, which can be found at http://www.google.de/intl/de/policies/privacy. Google also processes your data in the United States. Before you consent to the storage of cookies through the use of Google Analytics, please read the relevant information in our Privacy Policy.

1. Our website also contains links to other websites; these are provided solely for informational purposes. These websites are not under our control and are therefore not subject to the provisions of this Privacy Policy. However, if you click on a link, the operator of that website may collect data about you and process it in accordance with its privacy policy, which may differ from ours. Please always review the current privacy policies on the websites we link to.

1. Our website also offers the option to interact with various social networks via plugins. These are:

• Facebook, operated by Meta Platforms Ireland Limited, 4 Grand Canal Square, Grand Canal Harbour, Dublin 2, Ireland
• Youtube, operated by Youtube LLC, 901 Cherry Avenue, San Bruno, CA 94066 USA
• Instagram, operated by Meta Platforms Ireland Limited, 4 Grand Canal Square, Grand Canal Harbour, Dublin 2, Ireland

If you click on a plugin of one of these social networks, it is activated and a connection to the respective server of this network is established as described above.

If you activate these plugins, you consent to the use of your data collected via these plugins in the USA.

We have no influence on the scope and content of the data that is transmitted to the respective operator of this social network by clicking on the plugin or which may subsequently be subject to access by US authorities.

If you want to find out about the type, scope and purpose of the data collected by the operators of these social networks, we recommend that you read the data protection provisions of the respective social network.

Subject to your consent, our website uses a pixel or first-party cookie provided by Teads to optimize our advertising campaigns. This Teads tracking technology collects information about the URL, the type of device, the browser, and the operating system you are currently using, as well as your IP address. For more information, please read Teads’ Privacy Policy. Please also note that you have the right to access the personal data Teads has stored about you and to request that your personal data be corrected, deleted, or transferred. You may also have the right to object to certain processing or to request that Teads restrict such processing. You can exercise these rights by contacting Teads at dpo@teads.com.

8. Joint Responsibilities Pursuant to Article 26 of the GDPR

1. Facebook – Fan page

We operate a Facebook fan page at https://www.facebook.com/AuszeitGesundheitszentrum. The purpose of this fan page is to share information about our company’s activities, to implement marketing measures and to provide a further communication channel with us.

In this context, we are “joint controllers” with Facebook, operated by Meta Platforms Ireland Limited, 4 Grand Canal Square, Grand Canal Harbour, Dublin 2, Ireland, which provides this service to us. In general, Facebook allows you to choose in your settings which personal data is shared with us. If you do not wish to do so, we receive all information regarding the use of our fan page and personal data about visitors in anonymized form.

To this end, we have entered into a so-called Article 26 GDPR agreement with Facebook, which governs the mutual rights and obligations of both us and Facebook. You can find this agreement at https://www.facebook.com/-legal/EU_data_transfer-_addendum/update. In this context, we also ask that you read Facebook’s privacy policy, which you can find at https://www.facebook.com/policy.php.

In the Art. 26 GDPR agreement concluded by us, Facebook undertakes to be the first point of contact for data subjects regarding the processing of In-sights data and to fulfill the associated obligations and tasks.

You can therefore assert your data subject rights both against us in accordance with point 10 of this privacy policy and against Meta Platforms Ireland Limited, 4 Grand Canal Square, Grand Canal Harbour, Dublin 2, Ireland.

1. Instagram – Profile

We operate an Instagram profile at https://www.instagram.com/auszeit_st.lambrecht/. We want to use this profile to implement marketing measures, draw attention to our products and services and create another communication channel with our customers.

In this context as well, we are “joint controllers” with Instagram, operated by Meta Platforms Ireland Limited, 4 Grand Canal Square, Grand Canal Harbor, Dublin 2, Ireland, which provides this service to us. Instagram generally allows you to choose in your settings which personal data is shared with us. If you do not wish to do so, we receive all information regarding the use of our fan page and personal data about visitors in anonymized form.

To this end, we have entered into a so-called Article 26 GDPR agreement with Instagram, which governs the mutual rights and obligations of both us and Instagram. You can find this agreement at https://www.facebook.com/-legal/EU_data_transfer-_addendum/update. In this context, we also ask that you read Instagram’s privacy policy, which can be found at https://help.instagram.com/519522125107875.

In the Art. 26 GDPR agreement concluded by us, Instagram undertakes to be the first point of contact for data subjects regarding the processing of In-sights data and to fulfill the associated obligations and tasks.

You can therefore assert your data subject rights both against us in accordance with point 10 of this privacy policy and against Meta Platforms Ireland Limited, 4 Grand Canal Square, Grand Canal Harbour, Dublin 2, Ireland.

9. Security

We employ numerous technical and organizational security measures to protect your data against tampering, loss, destruction, and unauthorized access by third parties. Our security measures are continuously improved in line with technological developments on the Internet. If you would like more detailed information regarding the nature and scope of the technical and organizational measures we have implemented, we are happy to respond to written inquiries at any time.

10. Your rights

In accordance with the General Data Protection Regulation and the Data Protection Act, you are entitled to the following rights and legal remedies as a data subject of our data processing:

• Right to information (Art. 15 GDPR)

As a data subject affected by the data processing described above and any other data processing, you have the right to request information regarding whether—and, if so, which—personal data about you is being processed. For your own protection—to ensure that no unauthorized person obtains access to your data—we will verify your identity in an appropriate manner before providing any information.

• Right to rectification (Art. 16) and erasure (Art. 17 GDPR)

You have the right to obtain without undue delay the rectification of inaccurate personal data concerning you or – taking into account the purposes of the data processing – the completion of incomplete personal data and the erasure of your data, provided that the criteria of Art. 17 GDPR are met.

• Right to restriction of processing (Art. 18 GDPR)

Subject to the statutory requirements, you have the right to restrict the processing of all personal data collected. Once you submit a request for restriction, this data will only be processed with your individual consent or for the purpose of asserting and enforcing legal claims.

• Right to data portability (Art. 20 GDPR)

You may request the unhindered and unrestricted transfer of personal data that you have provided to us to you or a third party.

• Right to object (Art. 21 GDPR)

You may, at any time, object to the processing of your personal data that is necessary to safeguard our legitimate interests or those of a third party, for reasons arising from your particular situation. Your data will no longer be processed after you object, unless there are compelling legitimate grounds for the processing that override your interests, rights, and freedoms, or the processing is necessary for the establishment, exercise, or defense of legal claims. You may object at any time, with future effect, to the processing of your data for direct marketing purposes.

• Revocation of consent

If you have provided separate consent to the processing of your data, you may revoke that consent at any time. Such a revocation will affect the lawfulness of the processing of your personal data after you have notified us of it.

If you take a measure to enforce your above-mentioned rights under the GDPR, AUSZEIT – Rehazentrum St. Lambrecht GmbH must respond to the requested measure or comply with the request immediately, but at the latest within one month of receipt of your request.

We will respond to all reasonable requests within the legal framework free of charge and as promptly as possible.

The Data Protection Authority is responsible for handling requests regarding violations of the right of access, the right to confidentiality, the right to rectification, or the right to erasure. Its contact information is as follows:

Austrian Data Protection Authority

Barichgasse 40-42

1030 Vienna

dsb@dsb.gv.at

11. Contact information / contact person

1. Contact information of the person responsible

1. Contact information of the contact person for data protection matters

11. competitions

Providing personal information is required to enter the contest.
Participants certify that the information they provide—in particular, first name, last name, address, email address, and phone number—is true and complete.

The organizer notes that none of the participant’s personal data will be disclosed to third parties or made available to them for use without the participant’s consent. An exception to this is Österreichische Post AG, the company commissioned to handle shipping, which must collect, store, and use the data for the purpose of carrying out the shipment.

Legal recourse is excluded. The prize cannot be redeemed for cash.
Participants must beat least 18 years old.

The privacy policy and further information can be found at Privacy Policy (bmk.gv.at).

Status: January 2023