Legal

Política de Privacidad

Introduction and Overview

We have drafted this privacy policy (version 13.05.2024-122786140) to explain to you, in accordance with the provisions of the General Data Protection Regulation (EU) 2016/679 and applicable national laws, which personal data we, as data controllers, and the processors we commission process, and what legitimate options you have. The terms used are to be understood in a gender-neutral manner.

In short: We provide comprehensive information about the data we process about you. This privacy policy aims to describe important matters simply and transparently. Where transparency is beneficial, technical terms are explained in a reader-friendly manner, links to further information are provided, and graphics are used.

We only process personal data within the scope of our business activities when there is a corresponding legal basis. If you have questions, we ask you to contact the responsible office listed below or in the imprint, to follow the existing links, and to view further information on third-party sites.

Scope

This privacy policy applies to all personal data processed by us in the company and to all personal data processed by companies commissioned by us (processors). Personal data means information such as name, email address and postal address of a person. The processing of personal data ensures that we can offer and bill our services and products, whether online or offline.

The scope of this privacy policy includes:

All online presences (websites, online shops) that we operate
Social media presences and email communication
Mobile apps for smartphones and other devices

In short: The privacy policy applies to all areas in which personal data is processed within the company via the channels mentioned. Should we enter into legal relationships with you outside of these channels, we will inform you separately.

Legal Basis

In this privacy policy, we provide transparent information about the legal principles and regulations that allow us to process personal data. With regard to EU law, we refer to REGULATION (EU) 2016/679 OF THE EUROPEAN PARLIAMENT AND OF THE COUNCIL of 27 April 2016.

We only process your data if at least one of the following conditions applies:

Consent (Article 6(1)(a) GDPR): You have given us your consent to process data for a specific purpose. An example would be storing the data you entered in a contact form.
Contract (Article 6(1)(b) GDPR): To fulfill a contract or pre-contractual obligations with you, we process your data. For example, if we conclude a purchase contract with you, we need personal information beforehand.
Legal Obligation (Article 6(1)(c) GDPR): If we are subject to a legal obligation, we process your data. For example, we are legally obliged to keep invoices for accounting purposes.
Legitimate Interests (Article 6(1)(f) GDPR): In the case of legitimate interests that do not restrict your fundamental rights, we reserve the right to process personal data. For example, we need to process certain data to operate our website securely and economically efficiently.

In addition to the EU regulation, national laws also apply:

In Austria, this is the Federal Act concerning the Protection of Personal Data (Data Protection Act), abbreviated as DSG.
In Germany, this is the Federal Data Protection Act, abbreviated as BDSG.

Contact Details of the Controller

If you have any questions about data protection or the processing of personal data, you will find below the contact details of the responsible person or body:

Mr. Marcovici Michael
Email: [email protected]
Phone: +43 699 1 5852 848

Storage Duration

It is a general criterion for us that we only store personal data for as long as it is absolutely necessary to provide our services and products. This means that we delete personal data as soon as the reason for processing the data no longer exists. In some cases, we are legally obliged to store certain data even after the original purpose has ceased, for example, for accounting purposes.

If you wish to have your data deleted or withdraw your consent to data processing, the data will be deleted as soon as possible and to the extent that there is no obligation to store it. We will inform you about the specific duration of the respective data processing below, if we have further information about it.

Rights under the GDPR

According to Articles 13 and 14 GDPR, we inform you about the following rights that you are entitled to so that data processing is fair and transparent:

According to Article 15 GDPR, you have the right to information as to whether we process data about you. If this is the case, you have the right to receive a copy of the data.
According to Article 16 GDPR, you have the right to correction, which means that we must correct data if you find errors.
According to Article 17 GDPR, you have the right to erasure(“right to be forgotten”), which means that you can request the erasure of your data.
According to Article 18 GDPR, you have the right to restrict processing, which means that we may only store the data but not use it further.
According to Article 20 GDPR, you have the right to data portability, which means that we will provide you with your data in a common format upon request.
According to Article 21 GDPR, you have a right to object, which, when enforced, brings about a change in the processing.
According to Article 22 GDPR, under certain circumstances, you have the right not to be subject to a decision based solely on automated processing (e.g., profiling).
According to Article 77 GDPR, you have the right to lodge a complaint. That means you can complain to the data protection authority at any time if you believe that the processing of personal data violates the GDPR.

In short:You have rights – do not hesitate to contact the responsible office listed above with us! If you believe that the processing of your data violates data protection law or your data protection rights have been violated in any other way, you can complain to the supervisory authority. For Austria, this is the Data Protection Authority, whose website you can find at https://www.dsb.gv.at/.

Austrian Data Protection Authority

Head: Dr. Matthias Schmidl
Address:Barichgasse 40–42, 1030 Vienna
Phone number: +43 1 52 152-0
Website: https://www.dsb.gv.at/

Data Processing Agreement (DPA)

In this section, we would like to explain to you what a Data Processing Agreement is and why it is needed. Because the term “Data Processing Agreement” is quite a mouthful, we will also use the acronym DPA frequently in this text.

Like most companies, we do not work alone, but also avail services from other companies or individuals. By involving various companies or service providers, we may share personal data for processing. These partners then act as data processors, with whom we enter into a contract, the so-called Data Processing Agreement (DPA). The most important thing for you to know is that the processing of your personal data is carried out exclusively according to our instructions and must be governed by the DPA.

Who are Data Processors?

As a company and website owner, we are responsible for all data we process from you. In addition to the data controllers, there may also be so-called data processors. This includes any company or person who processes personal data on our behalf. Data processors can therefore be service providers such as hosting or cloud providers, payment or newsletter providers, or large companies such as Google or Microsoft.

For a better understanding of the terminology, here's an overview of the three roles in the GDPR: Data Subject(you as a customer or prospect) → Data Controller(us as a company and data controller) → Data Processor (service providers such as web hosts or cloud providers).

Cookies

Our website uses HTTP cookies to store user-specific data. Cookies are small text files stored in your browser that almost all websites use. A cookie consists of a name and a value and may store certain user data such as language or personal page settings. When you revisit our site, your browser sends the “user-related” information back to our site. Thanks to cookies, our website knows who you are and offers you the settings you are used to.

There are both first-party cookies and third-party cookies. First-party cookies are created directly by our site, while third-party cookies are created by partner websites (e.g., Google Analytics). Each cookie must be evaluated individually, as each cookie stores different data. Cookies are not software programs and do not contain viruses, trojans, or other “malware”. Cookies also cannot access information on your PC.

Types of Cookies

Essential Cookies: necessary to ensure basic functions of the website.
Functional Cookies: collect information about user behavior and whether the user receives any error messages.
Performance Cookies: ensure a better user experience (e.g., stored locations, font sizes, or form data).
Advertising Cookies: used to deliver individually tailored advertising to the user.

Right to Object – How Can I Delete Cookies?

Whether and how you want to use cookies is up to you. Regardless of which service or website the cookies come from, you always have the option to delete, deactivate, or only partially allow cookies. For example, you can block third-party cookies but allow all other cookies.

If you want to find out which cookies have been stored in your browser, change cookie settings, or delete them, you can do this in your browser settings (Chrome, Safari, Firefox, Internet Explorer, Microsoft Edge).

Legal Basis for Cookies

Since 2009, there have been the so-called “Cookie Directives”. These state that storing cookies requires consent(Article 6 para. 1 lit. a GDPR) from you. In Austria, these directives were implemented in § 165 para. 3 of the Telecommunications Act (2021). For strictly necessary cookies, even if no consent is given, there are legitimate interests (Article 6 para. 1 lit. f GDPR), which are mostly of an economic nature.

Web Analytics Introduction

We use software on our website to analyze the behavior of website visitors, commonly referred to as web analytics. Data is collected, stored, managed, and processed by the respective analytics tool provider. The data is used to create analyses of user behavior on our website and provided to us as website operators. With the help of web analytics tools, we can take a closer look at the behavior of our website visitors and then improve our web offering for you and us accordingly.

Exactly what data is stored depends on the analytics tools used. In general, data such as which content you view, which buttons or links you click on, when you access a page, which browser you use, and your IP address are usually stored. According to the GDPR, IP addresses are personal data. However, your IP address is usually stored pseudonymously (i.e., in unrecognizable and shortened form).

Google Analytics

We use the analysis tracking tool Google Analytics version Google Analytics 4 (GA4) from the American company Google Inc. For the European region, the company responsible for all Google services is Google Ireland Limited (Gordon House, Barrow Street, Dublin 4, Ireland).

Google Analytics collects data about your actions on our website. By combining various technologies such as cookies, device IDs, and login information, you can be identified as a user across different devices. Google Analytics is a tracking tool used for traffic analysis of our website. The basis of these measurements and analyses is a pseudonymous user identification number. This number does not contain personal data such as name or address.

GA4 uses an event-based model that captures detailed information about user interactions such as page views, clicks, scrolling, and conversion events. According to Google, IP addresses are not logged or stored in Google Analytics 4. The IP addresses are anonymized immediately after processing and before they are stored.

The data collected by us is automatically deleted after 14 months. You can prevent Google from collecting the data generated by the cookie and related to your use of the website (including your IP address) by downloading and installing the browser plug-in available at https://tools.google.com/dlpage/gaoptout.

The use of Google Analytics requires your consent, which we have obtained through our cookie popup. According to Art. 6 para. 1 lit. a GDPR (Consent), this consent constitutes the legal basis for the processing of personal data. In addition, we have a legitimate interest in analyzing the behavior of website visitors to improve our offering technically and economically (Art. 6 para. 1 lit. f GDPR).

Google is an active participant in the EU-US Data Privacy Framework. In addition, Google uses so-called standard contractual clauses (Art. 46 para. 2 and 3 GDPR) provided by the EU Commission. For more information about data processing by Google, see https://policies.google.com/privacy.

Google Site Kit

We have integrated the WordPress plugin Google Site Kit from the American company Google Inc. into our website. With Google Site Kit, we can quickly and easily view statistics directly in our WordPress dashboard that come from various Google products such as Google Analytics, Google Search Console, Page Speed Insights, Google AdSense, Google Optimize, and Google Tag Manager.

If you have actively consented to tracking tools in the cookie notice, Google products such as Google Analytics set cookies and send data from you, such as your user behavior, to Google, where it is stored and processed. This also includes personal data such as your IP address. Google stores collected data on its own Google servers, which are distributed worldwide. Data collected by Google Analytics is kept for a standard period of 26 months.

The use of Google Site Kit requires your consent according to Art. 6 para. 1 lit. a GDPR. In addition, we have a legitimate interest in analyzing the behavior of website visitors to improve our offering technically and economically (Art. 6 para. 1 lit. f GDPR).

AI Sales Assistant (Chat)

Our website offers an AI-powered sales assistant (a chat widget) that answers questions about our freeze dryers and helps you find a suitable machine. When you use it, the messages you send are processed to generate a reply and are stored on our behalf to improve the assistant and to follow up on inquiries. If you ask us to prepare an offer and provide your name and email address, those details are forwarded to our sales team so that we can contact you.

The legal basis is our legitimate interest in answering inquiries and improving our service (Art. 6 para. 1 lit. f GDPR) and, where you provide contact details for an offer, steps prior to entering into a contract (Art. 6 para. 1 lit. b GDPR). Conversation logs are deleted automatically after 90 days. You can ask us at any time to access or delete your data using the contact details listed above.

Explanation of Terms

We always strive to make our privacy policy as clear and understandable as possible. Below are short explanations of the most important terms used in this policy, based on the definitions in Article 4 of the GDPR:

Personal Data— any information relating to an identified or identifiable natural person (name, address, email, phone number, IP address, etc.).
Processing— any operation performed on personal data (collection, storage, use, disclosure, erasure, etc.).
Controller— the entity that determines the purposes and means of the processing of personal data. In our case, this is WAVE Trockensysteme GmbH.
Processor— a natural or legal person that processes personal data on behalf of the controller (e.g., hosting or cloud providers).
Consent— any freely given, specific, informed and unambiguous indication of the data subject's wishes, typically obtained via a cookie consent tool.
Profiling— any form of automated processing of personal data used to evaluate certain personal aspects relating to a natural person.