Personal data protection policy
1. About personal data protection policy
The purpose of the personal data protection policy (hereinafter: Policy) is to inform users and other persons (hereinafter: Users) about the purpose and basis of the processing of personal data by AlpVent GmbH) (hereinafter: AlpVent GmbH) and the rights of Users in this area. At the same time, this Policy further explains the consensus for data processing. In the Policy in accordance with the Regulation (EU) 2016/679 of the European and of the Council on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/ES (hereinafter: General Data Protection Regulation), the following information is covered:contact information of AlpVent GmbH and contact information of the data protection officer
purposes, bases and types of processing of various types of User’s personal data, including the profiling of personal data of users,
the transmission of data to third parties and to third countries,
retention periods of individual types of personal data,
the rights of Users in relation to the processing of personal data,
the right to lodge a complaint concerning the processing of personal data.
Where appropriate, the provisions relating to Users shall also apply to matters of confidentiality of communications by users who are legal entities.
2. The controller and data protection officer
The controller of personal data of the Users, which is processed in accordance with the personal data protection policy is AlpVent GmbH In AlpVent GmbH, an authorized data protection officer has been appointed, who can be contacted by e-mail at info@alpvent.com.
3. The purpose and basis for data processing
Processing on the basis of a contract
AlpVent GmbH processes personal data of Users for the sale of goods and/or services. In the context of the exercise of rights and the fulfilment of contractual obligations, AlpVent GmbH processes the personal data of the Users for the following purposes: identification of the User, preparation of an offer, conclusion of a contract, the supply of services or products, delivery of products and/or documentation to the home, notification of changes in legislation in a particular field, contractual relations, billing of services, resolution of possible technical problems, objections or reclamations of the Users, sending notices to the Users regarding the performance of the contractual relationship, implementation of possible recovery procedures, sale of receivables and other purposes necessary for the execution or conclusion of a contractual relationship between AlpVent GmbH and the User.
Processing under the law
AlpVent GmbH processes the personal data of the Users for the purpose of concluding, implementing, monitoring and terminating the contract.
Processing based on the legitimate interest pursued by AlpVent
AlpVent GmbH may also process the data on the basis of the legitimate interest pursued by AlpVent GmbH or a third party, except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject which require the protection of personal data, in particular where the data refers to a child. In the case of further use of data collected on the User, AlpVent GmbH shall make an assessment in accordance with the General Data Protection Regulation Such further use of data in a pseudonymized or aggregated form represents, for example, the lawful use of data for marketing and other business or technical analysis of AlpVent GmbH Deletion of certain data may also be used as an additional measure in some forms of further use of traffic data. According to the General Data Protection Regulation, direct marketing is also one of the legitimate interests. For the purposes of direct marketing, AlpVent GmbH, may also, without consent, create user profiles based on basic information, such as subscribed services or products, or past marketing contacts with the User, in particular with regard to expressed interest or lack of interest in certain services or products. The user may object to such processing in accordance with point 6 / iv of the Policy. On the basis of a legitimate interest, AlpVent GmbH can contact the Users for the purpose of improving the services by determining their satisfaction with the services or user experience even in cases where this is not strictly necessary for the performance of the contract. AlpVent GmbH, for the purpose of weighing this interest with the interests of the User, does not contact the Users who objected to this again. AlpVent GmbH has a legitimate interest to anonymize or aggregate the data up to the expiry of the legal retention period and continue to use it for analysis and research purposes for marketing, network planning and the like. Other legitimate interests may include the enforcement of claims or defence against claims in administrative and judicial proceedings. AlpVent GmbH may, in the event of a suspicion of misuse, process, in an appropriate and proportionate manner, user data on the Users for the purpose of identifying and preventing any fraud or misuse, and may, where appropriate, also forward this information to other operators, business partners, the police, the public prosecutor or other competent authorities .
Processing on the basis of consent to the processing of personal data
Data processing can be based on a consent given by an individual to AlpVent GmbH Consent may for example relate to the provision of information about the offer and services, the preparation of an offer tailored to the individual’s user habits or the provision of value added services. The notification is carried out via channels that have been selected by the User by consent. Email-based notification can include the transmission of the e-mail address to an external processor, in order to display creative ads of AlpVent GmbH while browsing the web. The data subject may at any time withdraw his consent or alter the consent in the same manner as the consent was given or otherwise determined by AlpVent GmbH, where AlpVent GmbH reserves the right to identify the customer. The change of consent can also be arranged through a contact centre. The withdrawal or change of consent refers only to data processed on the basis of consent. The last given consent of the User to AlpVent GmbH is valid. The possibility of revoking consent does not constitute the right to withdrawal in the User’s business relationship with AlpVent GmbH
Consent can be given by one of the parents, a foster parent or a guardian of a minor child who, in accordance with the applicable legislation, cannot give the consent him/herself. Such consent shall be valid until one of the parents, foster parent or guardian or the child him/herself, when in accordance with applicable legislation, obtains this right, does not revoke or change it.
4. Transmission of data to third parties and transmission of data to third countries (countries which are not members of the European Union or the European Economic Area)
AlpVent GmbH may, insofar as this complies with the purpose for which personal data is processed under EU law and Slovenian regulations, provide personal data about the Users to:
(i) persons who perform individual processing tasks for AlpVent GmbH such as preparing and sending invoices or data analytics;
(ii) persons who perform sales and marketing services for AlpVent GmbH including sales and marketing in the field, or cooperate with AlpVent GmbH in the marketing and sales of their own services or services by third parties, to the extent necessary for such tasks as part of the purposes and the bases defined in this Policy;
Traffic data within AlpVent GmbH is allowed to be processed only by authorized persons who, under the supervision of AlpVent GmbH take charge of billing or traffic management, answer questions of Users, discover fraud, market, provide value added services, or perform other tasks requiring the processing of personal data, where this processing must be restricted to the extent necessary for the purposes such activities.
Transmission of data to third countries is provided in accordance with the legal bases for the output of data to third countries prescribed by EU law and valid Slovenian regulations. Possible bases include:an implementing act of the European Commission on the adequacy of protection in a third country;
binding corporate rules in accordance with the General Data Protection Regulation, if they are appropriately approved;
standard data protection provisions;
another mechanism permitted by the General Data Protection Regulation.
5. Retention of personal data
The invoices are kept for 10 years after the expiration of the year to which the invoice relates to, in accordance with the law governing value added tax. If traffic data is processed under the User’s consent for the purpose of marketing services, the sale of goods or the provision of value added services, such data may be processed in the extent necessary for as long as it is necessary for such marketing or services.
6. The rights of Users in relation to the processing of personal data
AlpVent GmbH provides Users with the exercise of their rights without undue delay and in any case within one month after receiving the request. AlpVent GmbH may extend the deadline for the exercise of the User’s rights for up to two additional months, taking into account the complexity and number of the requests. If AlpVent GmbH extends the deadline, every such extension shall be notified to the User within one month of the receipt of the request, together with the reasons for the delay.
AlpVent GmbH accepts requests regarding User’s rights to e-mail info@alpvent.com, or by post to AlpVent GmbH, Toppelsdorf 49, 9161 Maria Rain, Austria.
Where there is reasonable doubt as to the identity of the User who submits a request relating to one of his rights, AlpVent GmbH may request the provision of additional information necessary to confirm the identity of the data subject. If the requests of the Data User are manifestly unfounded or excessive, especially as they are repeated, AlpVent GmbH can:charge a reasonable fee, taking into account the administrative costs of transmitting information or communication or implementing the requested action, or
refuse to act on the request.
AlpVent GmbH entitles Users to the following rights regarding the processing of personal data:right to withdraw consent,
right of withdrawal,
right to rectification,
right to restriction of processing,
right to data portability.
right to object,
right to lodge a complaint and
right to erasure (“right to be forgotten”)
The data subject has the right to receive confirmation from AlpVent GmbH that his personal data is processed and, where appropriate, access to personal data and additional information concerning the processing of personal data, including:purpose of processing;
types of personal data;
users or categories of users to whom personal data have been or will be disclosed, in particular users in third countries or international organizations;
where possible, the foreseen period of retention of personal data or, if that is not possible, the criteria used to determine that period;
the existence of the right to request from the controller to correct or delete personal data or limit the processing of personal data relating to the data subject or the existence of the right to object to such processing;
right to lodge a complaint with a supervisory authority;
where personal data is not collected from the User, any available information relating to their source;
the existence of automated decision-making, including profiling, and meaningful information on the reasons for it, as well as the significance and intended consequences of such processing for the User.
On the basis of the User’s request, AlpVent GmbH provides a copy of his personal data being processed. For additional copies of the data requested by the User, AlpVent GmbH may charge a reasonable fee, taking into account administrative costs.
Right to withdraw consent
Where the processing of your personal data is based on your consent, you can withdraw this consent at any time. You can withdraw your consent in writing to AlpVent GmbH, Toppelsdorf 49, 9161 Maria Rain, Austria, for the attention of the DPO.
Right of access
You can, at any time, request information from AlpVent GmbH, about the personal data that the company keeps about you, including information about what kind of personal data is stored, what it is used for, where it is collected (if not directly from you), to whom it is disclosed (if it is appropriate), the period of retention of your personal data, what your rights are related to your personal data and information about the possible existence of automated decision-making (including profiling), the reasons for it, and the significance and intended consequences of such processing for you.
Right to rectification
At any time, you can request from AlpVent GmbH, the rectification of inaccurate personal data that it has about you.
Right to restriction
You can request from AlpVent GmbH, a restriction on the processing of your personal data if:you challenge the accuracy of your personal data for the period that AlpVent GmbH, needs to verify the accuracy of the data;
the processing is illegal and you request a restriction of the processing instead of deletion of your personal data;
your information is no longer needed by AlpVent GmbH, but it must be kept for the enforcement, implementation or defence of your legal claims;
you object to the processing, while AlpVent GmbH, checks whether its legal basis prevails over yours.
Right to data portability
At your request, AlpVent GmbH, will, when technically feasible, transfer your personal data to another controller if the processing is based on your consent or is relevant to the performance of the contract and if the processing is carried out using automated means.
Right to object
If the processing is based on your consent or is relevant to the performance of the contract, and if the processing is carried out with automated means, you may at any time object to the processing of personal data relating to these reasons for any reason related to your particular situation. When your personal data is processed for direct marketing purposes, you have the right to object at any time to the processing of personal data for the purposes of such marketing, including the creation of profiles. In addition, you have the right to object, for reasons related to your particular situation, to the processing of personal data relating to these reasons where personal data is processed for scientific or historical research or statistical purposes, unless the processing is necessary for the performance of the task, which is carried out in the public interest.
Automated decision-making, including profiling.
You have the right to request from AlpVent GmbH, that you are not subject of the decision based solely on the automated processing of your personal data if this decision has legal effects for you or has a significant effect on you.
Right to lodge a complaint
In the event of an alleged violation of applicable privacy laws, you may file a complaint with the data protection supervisory authority in your country of residence or where the alleged violation occurred.
Right to erasure
You can request from AlpVent GmbH, the erasure of personal data concerning you if:the personal data is no longer necessary in relation to the purposes for which they were collected or otherwise processed;
processing is based on your consent and you withdraw your consent and there is no other legal basis for processing;
processing is based on your consent and you object to the processing, and there is no other legal basis for processing;
the personal data has been processed unlawfully;
this is necessary for the fulfilment of legal obligations;
the personal data was collected in connection with the offer of information society services offered directly to the child. The processing of personal data of a child is lawful when the child is at least 16 years old. Where the child is
below the age of 16 years, such processing shall be lawful only if and to the extent that consent is given or authorised
by the holder of parental responsibility over the child.
7. Validity of the Policy
This Policy is published on 21th of May and it enters into force on 25th May 2018.