Privacy

Introduction

This privacy policy explains which personal data (“data”) we as the data controller and our processors process, will process in the future and what lawful options you have. The terms used are to be understood as gender-neutral.

We try to describe the most important things to you as simple and transparent as possible. If you still have any questions, we would ask you to contact the responsible body named in the legal notice, to follow the links provided and to look at further information on third-party websites.

Applicability

This privacy policy applies to all personal data processed by us and to all personal data processed by companies commissioned by us (processors). By personal data, we mean information within the meaning of Art. 4 No. 1 GDPR, such as a person's name, email address and postal address. The scope of this privacy policy includes

• all online presences (websites, online shops) that we operate
• Social media presence and e-mail communication
• Mobile apps for smartphones and other devices.

Legal basis

The legal basis upon which we process your data is the Federal Act on the Protection of Natural Persons with regard to the Processing of Personal Data (Data Protection Act), or DSG for short, grounded on the General Data Protection Regulation. You can find the respective EU legislation here General Data Protection Regulation (EU) 2016/679.

We only process your data if at least one of the following conditions applies:

1.    Consent: You have given us your consent to process data for a specific purpose.

2.    Contract: In order to fulfil a contract or pre-contractual obligations with you, we process your data.

3.    Legal obligation: If we are subject to a legal obligation, we process your data. In such cases you will usually find separate, more detailed DPAs, i.e. for our eIDAS services.

4.    Legitimate interests: In the case of legitimate interests that do not restrict your fundamental rights, we reserve the right to process personal data.

Contact details of the person responsible

If you have any questions about data protection or the processing of personal data, you will find the contact details of the person or organisation responsible below:

IDCanopy FlexCo
Dr Karl-Lueger-Platz 5, 1010 Vienna, Austria

E-mail: gdpr@idcanopy.com

Storage duration

We only store personal data for as long as is absolutely necessary and we delete personal data as soon as the reason for the data processing no longer exists.

If you wish your data to be deleted or revoke your consent to data processing, the data will be deleted as quickly as possible and insofar as there is no obligation to store it.

Rights under the General Data Protection Regulation

In accordance with Articles 13, 14 GDPR, we inform you of the following rights to which you are entitled in order to ensure fair and transparent processing of data:

• According to Article 15 GDPR, you have a right to information about whether we process your data. If this is the case, you have the right to receive a copy of the data and the following information: the purpose for which we carry out the processing; the categories, i.e. the types of data that are processed; who receives this data and, if the data is transferred to third countries, how security can be guaranteed; how long the data will be stored; the existence of the right to rectification, erasure or restriction of processing and the right to object to processing; that you can lodge a complaint with a supervisory authority (links to these authorities can be found below); the origin of the data if we have not collected it from you; whether profiling is carried out, i.e. whether data is automatically analysed in order to create a personal profile of you.
• According to Article 16 GDPR, you have a right to rectification of data, which means that we must correct data if you find errors.
• According to Article 17 GDPR, you have the right to erasure ("right to be forgotten"), which specifically means that you may request the erasure of your data.
• According to Article 18 GDPR, you have the right to restriction of processing, which means that we may only store the data but no longer use it.
• According to Article 20 GDPR, you have the right to data portability, which means that we will provide you with your data in a commonly used format upon request.
• According to Article 21 GDPR, you have the right to object, which will result in a change in the processing after enforcement. If the processing of your data is based on Article 6(1)(e) (public interest, exercise of official authority) or Article 6(1)(f) (legitimate interest), you can object to the processing. We will then check as quickly as possible whether we can legally honour this objection. If data is used for direct marketing purposes, you can object to this type of data processing at any time. We may then no longer use your data for direct marketing. If data is used for profiling purposes, you can object to this type of data processing at any time. We may then no longer use your data for profiling.
• Under Article 22 GDPR, you may have the right not to be subject to a decision based solely on automated processing (e.g. profiling).
• According to Article 77 GDPR, you have the right to lodge a complaint. This means that you can lodge a complaint with the data protection authority at any time if you believe that the processing of your personal data is in breach of the GDPR.

If you believe that the processing of your data violates data protection law or that your data protection rights have been violated in any other way, you can lodge a complaint with the supervisory authority. For Austria, this is the data protection authority, whose website can be found at https://www.dsb.gv.at/.

Security of data processing

We have implemented both technical and organisational measures to protect personal data. Where possible, we encrypt or pseudonymise personal data. In this way, we make it as difficult as possible for third parties to infer personal information from our data.

We adhere to the principles of "data protection by design and by default", meaning that all our software and hardware are designed with security in mind.

Cookies

What are cookies?

Like most websites, our website uses HTTP cookies to store user-specific data. HTTP cookies are small files that are stored on your computer by our website.

Cookies store certain user data about you, such as language or personal page settings. When you visit our site again, your browser transmits the "user-related" information back to our site. Thanks to cookies, our website knows who you are and offers you the settings you are used to.

There are both first-party cookies and third-party cookies. First-party cookies are created directly by our website, third-party cookies are created by partner websites (e.g. Google Analytics). Each cookie must be evaluated individually, as each cookie stores different data. The expiry time of a cookie also varies from a few minutes to a few years. Cookies are not software programs and do not contain viruses, Trojans or other "malware". Cookies also cannot access information on your PC.

What data is processed?

Cookies are little helpers for many different tasks. Unfortunately, it is not possible to generalise which data is stored in cookies, but we will inform you about the processed or stored data in the following privacy policy.

Storage duration of cookies

The storage period depends on the cookie in question and is specified below. Some cookies are deleted after less than an hour, others can remain stored on a computer for several years.

You can also influence the storage period yourself. You can delete all cookies manually at any time via your browser (see also "Right to object" below). Furthermore, cookies that are based on consent will be deleted at the latest after you withdraw your consent, whereby the legality of the storage until then remains unaffected.

Right to object - how can I delete cookies?

You decide how and whether you want to use cookies. Regardless of which service or website the cookies originate from, you always have the option of deleting, deactivating or only partially allowing cookies. For example, you can block third-party cookies but allow all other cookies.

If you generally do not want to have cookies, you can set up your browser so that it always informs you when a cookie is to be set. You can then decide for each individual cookie whether or not to allow it. The procedure differs depending on the browser. It is best to search for the instructions in Google using the search term "delete cookies Chrome" or "deactivate cookies Chrome" in the case of a Chrome browser.

Legal basis

The so-called "Cookie Guidelines" have been in place since 2009. These state that the storage of cookies requires your consent (Article 6(1)(a) GDPR). In Austria, this directive was implemented in Section 165 (3) of the Telecommunications Act (2021).

Explanation of terms used

Definitions according to Article 4 of the GDPR

·        "Processor" means a natural or legal person, public authority, agency or other body which processes personal data on behalf of the controller.

·        "Consent" of the data subject means any freely given, specific, informed and unambiguous indication of the data subject's wishes by which he or she, by a statement or by a clear affirmative action, signifies agreement to the processing of personal data relating to him or her;

·        "personal data" means any information relating to an identified or identifiable natural person (hereinafter "data subject"); an identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person;

Personal data is therefore all data that can identify you as a person. This is usually data such as name, address, email, phone number, date of birth or similar as well a special categories. In case we process special categories as part of our services i.e. rendered to our customers, you will find special data protection agreements on such services integrated into our customers terms or referenced to special processing terms at our end.

·        "Profiling" means any form of automated processing of personal data consisting of the use of personal data to evaluate certain personal aspects relating to a natural person, in particular to analyse or predict aspects concerning that natural person's performance at work, economic situation, health, personal preferences, interests, reliability, behaviour, location or movements.

·        "controller" means the natural or legal person, public authority, agency or other body which, alone or jointly with others, determines the purposes and means of the processing of personal data; where the purposes and means of such processing are determined by Union or Member State law, the controller or the specific criteria for its nomination may be provided for by Union or Member State law;

·        "Processing" means any operation or set of operations which is performed on personal data or on sets of personal data, whether or not by automated means, such as collection, recording, organisation, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure or destruction;