Logo Brigl & Bergmeister

Papierrollen

Privacy policy in accordance with GDPR

I.       Name and address of data controller

The data controller as defined in the GDPR and other national privacy laws of member states as well as other data protection provisions is:

 
Brigl & Bergmeister GmbH
Proleberstrasse 10
8712 Niklasdorf
Austria
Tel.: +43 3842 800-0
Email: marketing@brigl-bergmeister.com
Website: www.brigl-bergmeister.com

II.       Name and address of data protection officer

The Data Protection Officer at the data controller is:

Ing. Stefan Kropej
Proleberstrasse 10
8712 Niklasdorf
Austria
Tel.: +43 664 62 53054
Email: skropej@brigl-bergmeister.com
Website: www.brigl-bergmeister.com

III.    General information on data processing

1.        Scope of processing personal data

We only process our users’ personal data if this is needed in order to create an operational website or our content and services. Processing our users’ personal data is only done with their consent. The only exception is when it is not possible to gather prior consent for practical reasons and when processing data is permitted by law.

2.        Lawful basis for processing personal data

If and when we gather consent from data subjects when processing their personal data, Article 6(1)(a) of the EU General Data Protection Regulation (GDPR) serves as the lawful basis.

When processing personal data required in order to fulfil a contract, where the contractual party is the data subject, Article 6(1)(b) of the GDPR serves as the lawful basis. This also applies where personal data needs to be processed in order to carry out pre-contractual measures.

If and when personal data is processed in order to fulfil a legal obligation with which our company must comply, Article 6(1)(c) of the GDPR serves as the lawful basis.

If personal data needs to be processed due to the vital interests of the data subject or another natural person, Article 6(1)(d) of the GDPR serves as the lawful basis.

If personal data needs to be processed in order to safeguard the legitimate interests of a company or a third party and if the interests, fundamental rights and freedoms of the data subject do not outweigh the aforementioned legitimate interests, Article 6(1)(f) of the GDPR serves as the lawful basis for the processing.

3.        Data erasure and storage period

Personal data of the data subject is deleted or blocked once the purpose for which it was stored has lapsed. Data may be stored if this is provided for in Union regulations by European or national legislators, laws or other legislation with which the data controller must comply. Data is also deleted or blocked if a storage period permitted by the standards referred to lapses unless the data needs to continue to be stored in order to conclude or fulfil a contract.

IV.    Setting up the website and creating log files

1.        Description and scope of data processing

Every time our website is viewed, our system automatically gathers data and information from the accessing computer’s system.

This includes the following data:

  1. )   The type and version of the browser used
  2. )   The user’s operating system
  3. )   The user’s internet service provider
  4. )   The user's IP address
  5. )   Date and time of access
  6. )   Websites from which the user's system reaches our website
  7. )   Websites accessed via our website from the user’s system

This data is also stored in our system’s log files. This does not include the user's IP address or other data that would enable data to be matched to a user. This and other personal data relating to the user is not stored.

2.        Lawful basis for data processing

The lawful basis for the temporary storage of data is Article 6(1)(f) of the GDPR.

3.        Purpose of data processing

The system needs to temporarily store the IP address in order for the user’s computer to access the website. The user’s IP address needs to be stored for the duration of the access period.

Our legitimate interest in data processing for these purposes is in accordance with Article 6(1)(f) of the GDPR.

4.        Storage period

Data is erased once it is no longer needed for the purpose for which it was gathered. Where data is gathered in order to provide the website, the purpose ends at the same time as the respective internet session.

5.        Opt-out and removal

It is essential to gather data to provide the website and store data in log files in order for the website to operate correctly. The user does therefore not have an opt-out option.

V.       Use of cookies

a) Description and scope of data processing

Our website uses cookies. Cookies are text files stored by the browser on the user’s computer system. When a user views a website, a cookie can be stored on the user's operating system. This cookie contains a character string that clearly identifies the browser next time the website is viewed.

b) Lawful basis for data processing

The lawful basis for processing personal data and using cookies is Article 6(1)(f) of the GDPR.

c) Purpose of data processing

Our legitimate interest in processing personal data for these purposes is in accordance with Article 6(1)(f) of the GDPR.

e) Storage period, opt-out and removal

Cookies are stored on the user’s computer and then sent to our website. As the user, you have full control over how cookies are used. By changing the settings in your browser, you can deactivate or restrict the transfer of cookies. Cookies that have already been stored can be deleted at any time. This can also be done automatically. If cookies for our website are deactivated, this may affect some of the website’s functions and they may not work fully.

VI.    Newsletter

1.        Description and scope of data processing

If you contact us on our website using the email addresses provided and list your email address, this may subsequently be used by us to send you a newsletter. In this case, the newsletter will only contain direct advertising for similar goods or services.

With regard to data processing required to send the newsletter, the data will not be passed on to third parties. Data will be only be used to send the newsletter.

2.        Lawful basis for data processing

The lawful basis for sending the newsletter following the sale of goods or services is Section 7(3) of the Act against Unfair Competition (UWG).

3.        Purpose of data processing

The user’s email address is gathered in order deliver the newsletter.

4.        Storage period

Data is erased once it is no longer needed for the purpose for which it was gathered. The user’s email address is stored for the period of time the newsletter subscription is active.

5.        Opt-out and removal

The user can cancel their subscription to the newsletter at any time. There is a link for this purpose in every newsletter. 

VII.  Registration

1.        Description and scope of data processing

On our website, we occasionally offer users the opportunity to register for events by entering their personal data. This data is entered into a text field using an input mask, sent to us and stored. Data is not passed on to third parties. The following data is gathered as part of the registration process:

First name, surname
Address
Email address
Telephone number
Company
Date and time of registration
 
As part of the registration process, the user’s consent to process this data is obtained.

2.        Lawful basis for data processing

The lawful basis for processing data where the user gives their consent is Article 6(1)(a) of the GDPR.

If the registration is needed to fulfil a contract where the user is the contractual party or to carry out pre-contractual measures, the additional lawful basis for processing data is Article 6(1)(b) of the GDPR.

3.        Purpose of data processing

The user needs to be registered in order to fulfil a contract with the user or to carry out pre-contractual measures.

4.        Storage period

Data is erased once it is no longer needed for the purpose for which it was gathered.

When data is gathered during the registration process in order to fulfil a contract or to carry out pre-contractual measures, the aforementioned purpose ends when the data is no longer required in order to carry out the contract. Even once the contract has been concluded, it may be necessary to store the contractual partner’s personal data in order to comply with contractual or legal obligations.

5.        Opt-out and removal

As the user, you can cancel the registration at any time. You can request at any time that data stored about you is amended. To do this, please contact our marketing department on marketing@brigl-bergmeister.com.

If data is required in order to fulfil a contract or to carry out pre-contractual measures, data can only be erased early if this does not conflict with contractual or legal obligations.

VIII.    Contacting by email

1.             Description and scope of data processing

Users can contact us via the email addresses listed on the homepage. When they do so, the user's personal data transmitted in the email is stored.

This data is not passed on to third parties. Data will only be used to process the email conversation.

2.        Lawful basis for data processing

The lawful basis for processing data transmitted in an email is Article 6(1)(f) of the GDPR. If the purpose of the email contact is to conclude a contract, then the additional lawful basis for processing the data is Article 6(1)(b) of the GDPR.

3.        Purpose of data processing

Personal data from the email sent to us is only processed in order to facilitate the communication. If contact is made by email, this facilitation is also the legitimate interest required in order to process the data.

4.        Storage period

Data is erased once it is no longer needed for the purpose for which it was gathered. Personal data sent by email is no longer needed when the conversation with the user has finished. The conversation is deemed to be finished when it can reasonably be understood from the circumstances that the matter in question has been conclusively settled.

5.        Opt-out and removal

The user may withdraw at any time their consent for their personal data to be processed. If the user contacts us by email, they can object at any time to their personal data being stored. If this is the case, the conversation can not be continued.

All personal data stored in connection with the contact will then be erased.

IX.     Rights of the data subject

If personal data about you is processed, you are the data subject as defined in the GDPR and you have the following rights against the data controller:

1.        Right to information

You can request confirmation from the data controller of whether personal data about you is processed by us.

If this is the case, you can request the following information from the data controller:

  1. )        the purposes for which the personal data is processed;
  2. )        the categories of personal data being processed;
  3. )       the recipient and/or categories of recipients to whom your personal data has been or will be revealed;
  4. )       the intended storage period of your personal data or, if this cannot be specified, the criteria for determining the storage period;
  5. )       that you have the right to request that your personal data is rectified or erased, to limit the amount of processing by the data controller or to retract your consent to your data being processed;
  6. )        that you have the right to complain to a supervisory authority;
  7. )       all available information about the origin of the data, if the personal data is not gathered from the data subject;
  8. )       that there is automated decision-making including profiling pursuant to Article 22(1) and (4) of the GDPR and, at least in these cases, significant information about the logic involved and the significance, as well as the envisaged consequences of this processing for the data subject.

You have the right to request information about whether your personal data has been transferred to a third country or international organisation. In this context, you can request to be informed of the appropriate safeguards pursuant to Article 46 of the GDPR with regard to the data transfer.

2.        Right to rectification

You have a right to ask the data controller to rectify and / or complete processed personal data about you that is incorrect or incomplete. The data controller must carry out the rectification immediately.

3.        Right to restriction of processing

You can request restriction of processing of personal data about you where one of the following applies:

  1. )       if you are contesting the accuracy of the personal data for a period enabling the controller to verify the accuracy of the personal data;
  2. )       the processing is unlawful and you oppose the erasure of the personal data and request the restriction of its use instead;
  3. )       the data controller no longer needs the personal data for the purposes of the processing, but you require it for the establishment, exercise or defence of legal claims, or
  4. )       you have objected to processing pursuant to Article 21(1) of the GDPR pending the verification of whether the legitimate grounds of the controller override yours.

If the processing of your personal data was restricted, this data, with the exception of storage, can only be processed with your consent or for the establishment, exercise or defence of legal claims or to defend the rights of another natural or legal person or for reasons of important public interest of the Union or a member state.

If processing was restricted according to these conditions, you will be informed by the controller before the restriction of processing is lifted.

4.        Right to erasure

a)        Right to be forgotten

You have the right to obtain from the data controller the erasure of your personal data without undue delay and the data controller is obligated to erase these data without undue delay where one of the following grounds applies:

  1. )       your personal data is no longer required in relation to the purposes for which they were gathered or otherwise processed.
  2. )       you withdraw your consent on which the processing is based pursuant to Article 6(1)(a) or Article 9(2)(a) of the GDPR and where there is no other legal ground for the processing.
  3. )       you object to the processing pursuant to Article 21(1) of the GDPR and there are no overriding legitimate grounds for the processing, or you object to the processing pursuant to Article 21(2) of the GDPR.
  4. )        your personal data has been unlawfully processed.
  5. )       your personal data has to be erased for compliance with a legal obligation in Union or member state law to which the data controller is subject.
  6. )       your personal data has been gathered in relation to the offer of information society services referred to in Article 8(1) of the GDPR.

b)        Information to third parties

Where the data controller has made your personal data public and is obliged pursuant to Article 17(1) of the GDPR to erase the personal data, the data controller, taking account of available technology and the cost of implementation, shall take reasonable steps, including technical measures, to inform data controllers processing the personal data that the data subject has requested the erasure by such data controllers of any links to, or copy or replication of, this personal data.

c)        Exceptions

The right to erasure does not exist if processing is necessary:

  1. )        for exercising the right of freedom of expression and information;
  2. )       for compliance with a legal obligation which requires processing by Union or member state law to which the data controller is subject or for the performance of a task carried out in the public interest or in the exercise of official authority vested in the data controller;
  3. )       for reasons of public interest in the area of public health pursuant to Article 9(2)(h) and (i) as well as Article 9(3) of the GDPR;
  4. )       for archiving purposes in the public interest, scientific or historical research purposes or statistical purposes pursuant to Article 89(1) of the GDPR in so far as the right referred to in section a) is likely to render impossible or seriously impair the achievement of the objectives of that processing; or
  5. )        for the establishment, exercise or defence of legal claims.

5.        Right to notification

If you have exercised your right to request from the data controller the rectification, erasure or restriction of processing, the data controller shall communicate any rectification or erasure of personal data or restriction of processing to each recipient to whom the personal data have been disclosed, unless this proves impossible or involves disproportionate effort.

You have the right to request to be informed by the data controller about these recipients.

6.        Right to data portability

You have the right to receive personal data concerning you, which you have provided to a controller, in a structured, commonly used and machine-readable format. You also have the right to transmit those data to another data controller without hindrance from the data controller to which the personal data have been provided, where

  1. )       the processing is based on consent pursuant to Article 6(1)(a) of the GDPR or Article 9(2)(a) of the GDPR or on a contract pursuant to Article 6(1)(b) of the GDPR and
  2. )        the processing is carried out by automated means.
  3. )        In exercising this right to data portability you also have the right to have the personal data transmitted directly from one data controller to another, where technically feasible. This must not affect the freedoms and rights of others.

The right to data portability does not apply to processing of personal data necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the data controller.

7.        Right to object

You have the right to object, on grounds relating to your particular situation, at any time to processing of personal data concerning you which is based on Article 6(1)(e) or (f) of the GDPR, including profiling based on those provisions.

The data controller will no longer process the personal data concerning you unless the data controller demonstrates compelling legitimate grounds for the processing which override your interests, rights and freedoms or for the establishment, exercise or defence of legal claims.

Where personal data concerning you is processed for direct marketing purposes, you have the right to object at any time to processing of personal data concerning you for such marketing, which includes profiling to the extent that it is related to such direct marketing.

If you object to processing for direct marketing purposes, the personal data concerning you will no longer be processed for such purposes.

In the context of the use of information society services, and notwithstanding Directive 2002/58/EC, you may exercise your right to object by automated means using technical specifications.

8.        Right to withdraw consent under data protection law

You have the right to withdraw your consent under data protection law at any time. Withdrawing your consent does not affect the lawfulness of processing based on consent before its withdrawal.

9.        Automated individual decision-making, including profiling

You have the right not to be subject to a decision based solely on automated processing, including profiling, which produces legal effects concerning you or similarly significantly affects you. This does not apply where the decision

  1. )       is necessary for entering into, or performance of, a contract between you and the data controller,
  2. )       is authorised by Union or member state law to which the data controller is subject and which also lays down suitable measures to safeguard your rights and freedoms and legitimate interests or
  3. )        is based on your explicit consent.

However, these decisions must not be based on special categories of personal data referred to in Article 9(1) of the GDPR, unless Article 9(2)(a) or (g) applies and suitable measures to safeguard your rights and freedoms and legitimate interests are in place.

In the cases referred to in (1) and (3), the data controller will implement suitable measures to safeguard your rights and freedoms and legitimate interests, including at least the right to obtain human intervention on the part of the data controller, to express their point of view and to contest the decision.

10.    Right to lodge a complaint with a supervisory authority

Without prejudice to any other administrative or judicial remedy, you have the right to lodge a complaint with a supervisory authority, in particular in the Member State of your habitual residence, place of work or place of the alleged infringement if you consider that the processing of personal data concerning you infringes the GDPR.

The supervisory authority with which the complaint has been lodged shall inform the complainant on the progress and the outcome of the complaint including the possibility of a judicial remedy in accordance with Article 78 of the GDPR.