PRIVACY POLICY
We are very pleased about your interest in our company. Data protection is of particularly high importance to the management of Holzmann Feines vom Land GmbH. In general, it is possible to use the websites of Holzmann Feines vom Land GmbH without providing any personal data. However, if a data subject wishes to use special services offered by our company via our website, processing of personal data may become necessary. If the processing of personal data is necessary and there is no legal basis for such processing, we generally obtain the data subject’s consent.
The processing of personal data—such as a data subject’s name, address, email address, or telephone number—shall always be carried out in accordance with the General Data Protection Regulation (GDPR) and in compliance with the applicable national data protection regulations for Holzmann Feines vom Land GmbH. By means of this privacy policy, our company would like to inform the public about the nature, scope, and purpose of the personal data we collect, use, and process. Furthermore, this privacy policy informs data subjects about their rights.
As the controller responsible for processing, Holzmann Feines vom Land GmbH has implemented numerous technical and organizational measures to ensure the most complete protection possible of personal data processed via this website. Nevertheless, internet-based data transmissions may in principle contain security gaps, so absolute protection cannot be guaranteed. For this reason, every data subject is free to transmit personal data to us via alternative means, e.g., by telephone.
Types of Data Processed
Inventory data (e.g., names, addresses)
Contact data (e.g., email addresses, telephone numbers)
Content data (e.g., text entries, photographs, videos)
Usage data (e.g., visited pages, interest in content, access times)
Meta/communication data (e.g., device information, IP addresses)
Categories of Data Subjects
Visitors and users of the online offering (hereinafter collectively referred to as “users”).
Purpose of Processing
Provision of the online offering, its functions, and content
Responding to contact inquiries and communicating with users
Security measures
Reach measurement/marketing
Definitions
The privacy policy of Holzmann Feines vom Land GmbH is based on the terminology used by the European legislator when adopting the GDPR. Our privacy policy is intended to be easy to read and understand for the public as well as for our customers and business partners. To ensure this, we explain the terminology used.
We use, among others, the following terms:
a) Personal Data
Personal data means any information relating to an identified or identifiable natural person (“data subject”). A natural person is considered identifiable if they can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier, or one or more factors specific to the physical, physiological, genetic, mental, economic, cultural, or social identity of that natural person.
b) Data Subject
A data subject is any identified or identifiable natural person whose personal data is processed by the controller.
c) Processing
Processing means any operation or set of operations performed on personal data, whether or not by automated means, such as collection, recording, organization, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure, or destruction.
d) Restriction of Processing
Restriction of processing means the marking of stored personal data with the aim of limiting its processing in the future.
e) Profiling
Profiling means any form of automated processing of personal data to evaluate certain personal aspects relating to a natural person, in particular to analyze or predict aspects concerning work performance, economic situation, health, personal preferences, interests, reliability, behavior, location, or movements.
f) Pseudonymization
Pseudonymization means processing personal data in such a way that it can no longer be attributed to a specific data subject without the use of additional information, provided that such additional information is kept separately and is subject to technical and organizational measures ensuring that the personal data is not attributed to an identified or identifiable natural person.
g) Controller
Controller means the natural or legal person, public authority, agency, or other body which alone or jointly determines the purposes and means of processing personal data. Where the purposes and means of processing are determined by Union or Member State law, the controller or the criteria for its designation may be provided for by Union or Member State law.
h) Processor
Processor means a natural or legal person, public authority, agency, or other body which processes personal data on behalf of the controller.
i) Recipient
Recipient means a natural or legal person, public authority, agency, or another body to which personal data is disclosed, whether a third party or not. Public authorities which may receive personal data in the framework of a particular inquiry in accordance with Union or Member State law shall not be regarded as recipients.
j) Third Party
Third party means any natural or legal person, public authority, agency, or body other than the data subject, the controller, the processor, and persons who, under the direct authority of the controller or processor, are authorized to process personal data.
k) Consent
Consent means any freely given, specific, informed, and unambiguous indication of the data subject’s wishes by which the data subject, by a statement or a clear affirmative action, signifies agreement to the processing of personal data relating to them.
Relevant Legal Bases
In accordance with Art. 13 GDPR, we inform you about the legal bases for our data processing. Unless otherwise stated in this privacy policy, the following applies:
Legal basis for obtaining consent: Art. 6(1)(a) and Art. 7 GDPR
Legal basis for processing to perform our services, contractual measures, and to answer inquiries: Art. 6(1)(b) GDPR
Legal basis for processing to comply with legal obligations: Art. 6(1)(c) GDPR
Legal basis for processing to safeguard legitimate interests: Art. 6(1)(f) GDPR
If vital interests make processing necessary: Art. 6(1)(d) GDPR
Security Measures
Please review the content of this privacy policy regularly. We will adapt it whenever changes to our processing activities make this necessary. We will inform you as soon as changes require your cooperation (e.g., consent) or another individual notification.
Name and Address of the Controller
Controller within the meaning of the GDPR and other applicable data protection laws is:
Holzmann Thomas
Falkenau 11
A-4690 Schwanenstadt
Austria
Phone: 07673 / 2377-0
Fax: 07673 / 2377-18
E-mail: office@holzmann-fvl.at
Cookies
The websites of Holzmann Feines vom Land GmbH use cookies. Cookies are text files stored on a computer system via an internet browser.
Many websites and servers use cookies. Many cookies contain a so-called cookie ID—an identifier consisting of a string of characters that enables websites and servers to associate the cookie with the specific browser in which it is stored. This allows visited websites and servers to distinguish the individual browser of the data subject from other browsers containing different cookies.
By using cookies, Holzmann Feines vom Land GmbH can provide users with more user-friendly services that would not be possible without cookies.
Cookies enable us to optimize the information and offers on our website in the interest of the user. Cookies also allow us to recognize users, making it easier to use our website. For example, users do not have to re-enter login data every time they visit a site that uses cookies. Another example is the cookie for a shopping cart in an online store: the online store remembers the items placed in the cart via a cookie.
The data subject may prevent the setting of cookies at any time by means of an appropriate setting in the internet browser and may thus permanently object to the setting of cookies. Furthermore, already set cookies may be deleted at any time via a browser or other software programs. This is possible in all common browsers. If cookies are disabled in the browser, some functions of this website may not be fully usable.
Collection of General Data and Information
Each time the website of Holzmann Feines vom Land GmbH is accessed by a data subject or an automated system, a series of general data and information is collected and stored in the server log files. This may include:
browser types and versions used
operating system used by the accessing system
referring website (referrer)
subpages accessed on our website
date and time of access
IP address
internet service provider of the accessing system
other similar data used for security purposes in the event of attacks on our IT systems
When using these general data and information, Holzmann Feines vom Land GmbH does not draw any conclusions about the data subject. This information is required to:
deliver website content correctly
optimize website content and advertising
ensure the long-term functionality of our IT systems and technology
provide law enforcement authorities with information necessary for prosecution in the event of a cyberattack
These anonymously collected data are evaluated statistically and for the purpose of increasing data protection and data security in our company to ensure the highest possible level of protection for personal data processed by us. The anonymous server log data are stored separately from any personal data provided by a data subject.
Subscription to Blog Comments
Comments submitted in the blog of Holzmann Feines vom Land GmbH may be subscribed to by third parties. In particular, a commenter may subscribe to follow-up comments for a specific blog post.
If a data subject chooses to subscribe to comments, the controller will send an automatic confirmation email using the double opt-in procedure in order to verify that the owner of the specified email address has indeed chosen this option. The option to subscribe to comments can be cancelled at any time.
Routine Erasure and Blocking of Personal Data
The controller processes and stores personal data only for as long as necessary to achieve the purpose of storage or as required by European directives and regulations or other legislators in laws and regulations applicable to the controller.
If the purpose of storage no longer applies, or if a legally prescribed retention period expires, the personal data will be routinely blocked or erased in accordance with legal requirements.
Rights of the Data Subject
a) Right to Confirmation
Each data subject has the right to obtain confirmation from the controller as to whether personal data concerning them is being processed.
b) Right of Access
Each data subject has the right to obtain free information about their stored personal data and a copy of such information at any time. In addition, the data subject has the right to obtain information about:
the purposes of processing
the categories of personal data concerned
recipients or categories of recipients
where possible, the envisaged storage period or the criteria used to determine it
the existence of rights to rectification, erasure, restriction, or objection
the right to lodge a complaint with a supervisory authority
where data are not collected from the data subject: any available information about the source
the existence of automated decision-making, including profiling (Art. 22(1) and (4) GDPR), and meaningful information about the logic involved as well as the significance and consequences for the data subject
The data subject also has the right to be informed whether personal data have been transferred to a third country or international organization and, if so, about appropriate safeguards relating to such transfers.
c) Right to Rectification
Each data subject has the right to request the correction of inaccurate personal data without undue delay, and to request completion of incomplete personal data.
d) Right to Erasure (“Right to be Forgotten”)
Each data subject has the right to request the erasure of personal data without undue delay where one of the following grounds applies and processing is not necessary:
data are no longer necessary for the purposes collected
consent is withdrawn and there is no other legal basis
objection is made and there are no overriding legitimate grounds
data were unlawfully processed
erasure is required for compliance with a legal obligation
data were collected in relation to information society services (Art. 8(1) GDPR)
If the personal data have been made public and the controller is obliged to erase them, the controller shall take reasonable measures (including technical measures) to inform other controllers processing the data that the data subject has requested deletion of links or copies, insofar as processing is not required.
e) Right to Restriction of Processing
Each data subject has the right to request restriction of processing where:
accuracy of the data is contested
processing is unlawful and erasure is opposed
data are no longer needed by the controller, but required by the data subject for legal claims
an objection has been lodged and verification is pending
f) Right to Data Portability
Each data subject has the right to receive personal data provided to a controller in a structured, commonly used, machine-readable format and to transmit them to another controller, where processing is based on consent or a contract and carried out by automated means.
g) Right to Object
Each data subject has the right to object at any time, on grounds relating to their particular situation, to processing based on Art. 6(1)(e) or (f) GDPR, including profiling. If an objection is raised, we will no longer process the data unless we demonstrate compelling legitimate grounds overriding the interests, rights, and freedoms of the data subject, or the processing serves the establishment, exercise, or defense of legal claims.
Where personal data are processed for direct marketing, the data subject has the right to object at any time. This also applies to profiling related to direct marketing.
The data subject also has the right to object to processing for scientific or historical research purposes or statistical purposes pursuant to Art. 89(1) GDPR, unless such processing is necessary for a task carried out in the public interest.
h) Automated Individual Decision-Making Including Profiling
Each data subject has the right not to be subject to a decision based solely on automated processing, including profiling, that produces legal effects concerning them or similarly significantly affects them—unless the decision is necessary for a contract, authorized by law, or based on explicit consent, with appropriate safeguards.
i) Right to Withdraw Consent
Each data subject has the right to withdraw consent to processing at any time.
Data Protection in Applications and Recruitment
The controller collects and processes personal data of applicants for the purpose of handling the application process. Processing may also take place electronically, e.g., if applications are submitted by email or via a web form.
If an employment contract is concluded, the transmitted data will be stored for the purpose of processing the employment relationship in compliance with legal requirements. If no employment contract is concluded, application documents are automatically deleted two months after notification of the rejection decision, unless deletion is prevented by other legitimate interests (e.g., burden of proof under the General Equal Treatment Act (AGG)).
Hosting
The hosting services we use serve to provide the following services: infrastructure and platform services, computing capacity, storage space and database services, security services, and technical maintenance services for the operation of this online offering.
In doing so, we (or our hosting provider) process inventory data, contact data, content data, contract data, usage data, and meta/communication data of customers, interested parties, and visitors based on our legitimate interests in an efficient and secure provision of this online offering pursuant to Art. 6(1)(f) GDPR in conjunction with Art. 28 GDPR (conclusion of a data processing agreement).
Access Data and Log Files
We (or our hosting provider) collect data on each access to the server (server log files) based on our legitimate interests pursuant to Art. 6(1)(f) GDPR. Access data include: name of the accessed web page, file, date and time of access, data volume transferred, report of successful access, browser type and version, operating system, referrer URL, IP address, and requesting provider.
Log file information is stored for security reasons (e.g., to investigate misuse or fraud) for a maximum of 7 days and then deleted. Data required for evidentiary purposes are excluded from deletion until the incident has been finally clarified.
Performance of Contractual Services
We process inventory data, contact data, contract data, and other required data for fulfilling contractual obligations and services pursuant to Art. 6(1)(b) GDPR. Mandatory form fields are required for contract conclusion.
When using our online services, we store the IP address and the time of the respective user action based on legitimate interests and user interests in protection against misuse. Data are generally not disclosed to third parties unless required to enforce claims or there is a legal obligation.
We process usage and content data for advertising purposes in a user profile in order to display product information based on previously used services.
Data are deleted after statutory warranty and comparable obligations expire; the need for storage is reviewed every three years. In the event of statutory archiving obligations, deletion occurs after the retention period. Data in a customer account remain until the account is deleted.
Administration, Accounting, Office Organization, Contact Management
We process data within administrative tasks and the organization of our operations, financial accounting, and compliance with legal obligations (e.g., archiving). Legal bases are Art. 6(1)(c) and Art. 6(1)(f) GDPR. The purpose is administration, accounting, office organization, and archiving—tasks necessary for maintaining business activities and providing our services.
We may disclose or transmit data to the tax authorities, advisors (e.g., tax consultants or auditors), fee offices, and payment service providers.
We also store information about suppliers, organizers, and other business partners based on business interests (usually company-related data) generally on a long-term basis.
Social Media
We maintain online presences within social networks and platforms to communicate with customers, interested parties, and users active there and to inform them about our services. When accessing these networks and platforms, the terms and data processing policies of the respective operators apply.
Unless otherwise stated, we process user data when users communicate with us on social networks and platforms, e.g., by posting on our pages or sending us messages.
Business Analyses and Market Research
To operate our business economically and identify market trends and user needs, we analyze data relating to business transactions, contracts, inquiries, etc. We process inventory data, communication data, contract data, payment data, usage data, and metadata based on Art. 6(1)(f) GDPR.
Analyses serve business evaluations, marketing, and market research. Profiles of registered users may include information about purchasing behavior. These analyses serve to improve user-friendliness, optimize our offering, and increase efficiency. They are for internal use only and are not disclosed externally unless anonymized and aggregated.
Where analyses or profiles are personal, they are deleted or anonymized upon termination of the user relationship; otherwise, after two years from contract conclusion.
Integration of Third-Party Services and Content
Within our online offering, we use third-party content or service offers based on our legitimate interests (analysis, optimization, and economic operation pursuant to Art. 6(1)(f) GDPR), such as videos or fonts (“content”).
This requires that third-party providers perceive users’ IP addresses, as they cannot deliver content to the user’s browser without the IP address. The IP address is therefore required for displaying content. We endeavor to use only content whose providers use the IP address solely for delivery.
Third parties may use so-called pixel tags (“web beacons”) for statistical or marketing purposes. These can be used to evaluate visitor traffic. Pseudonymous information may be stored in cookies on users’ devices and may include technical browser and OS information, referring pages, visit time, and other usage data, possibly combined with information from other sources.
Data Protection Provisions on the Use of Facebook
The controller has integrated components of Facebook on this website. Facebook is a social network.
(Definition and explanations as in the German version.)
Operator: Facebook, Inc., 1 Hacker Way, Menlo Park, CA 94025, USA.
If a data subject lives outside the USA or Canada, the controller for personal data is: Facebook Ireland Ltd., 4 Grand Canal Square, Grand Canal Harbour, Dublin 2, Ireland.
Whenever a page containing a Facebook component (plug-in) is accessed, the browser automatically downloads the Facebook component from Facebook. A full overview of Facebook plug-ins is available at: https://developers.facebook.com/docs/plugins/?locale=de_DE
Through this technical procedure, Facebook receives information about which subpage the data subject visits.
If the data subject is logged into Facebook at the same time, Facebook recognizes which subpage the data subject visits throughout the duration of their stay. This information is collected and assigned to the data subject’s Facebook account. If the data subject clicks a Facebook button (e.g., “Like”) or posts a comment, Facebook associates this with the user account and stores it.
Facebook receives information that the data subject has visited our website whenever the data subject is logged into Facebook—regardless of whether the Facebook component is clicked. If this transmission is not desired, the data subject can prevent it by logging out of Facebook before visiting our website.
Facebook’s data policy (https://de-de.facebook.com/about/privacy/) provides information about the collection, processing, and use of personal data and privacy settings. There are also applications that can suppress data transmission to Facebook.
Data Protection Provisions on the Use of Google Analytics (with Anonymization)
The controller has integrated Google Analytics (with anonymization) on this website. Google Analytics is a web analytics service.
Operator: Google Inc., 1600 Amphitheatre Pkwy, Mountain View, CA 94043-1351, USA.
We use the extension “_gat._anonymizeIp” for web analytics. This shortens and anonymizes the IP address when access originates from an EU Member State or another EEA Contracting State.
Google Analytics uses cookies to enable analysis of website usage. Each time a page with the Google Analytics component is accessed, the browser transmits data to Google for online analysis. Google may receive personal data such as IP addresses to track visitor origins and clicks and enable commission billing.
Personal information (e.g., access time, location of access, frequency of visits) may be stored via cookies. With each visit, these personal data, including the IP address, may be transmitted to Google in the USA and stored there. Google may disclose these data to third parties.
The data subject can prevent cookies by browser settings and can delete cookies at any time. The data subject can also prevent data collection and processing by Google Analytics by installing a browser add-on: https://tools.google.com/dlpage/gaoptout
Installation is regarded by Google as an objection. If the system is later deleted/reinstalled, the add-on must be installed again.
Further information and Google’s privacy policy:
https://www.google.de/intl/de/policies/privacy/
Terms for Analytics: http://www.google.com/analytics/terms/de.html
More about Google Analytics: https://www.google.com/intl/de_de/analytics/
Data Protection Provisions on the Use of Google+
(English translation as per German text; note: Google+ was discontinued—text retained because it appears in the original.)
Operator: Google Inc., 1600 Amphitheatre Pkwy, Mountain View, CA 94043-1351, USA.
(Details and logout recommendation as in German.)
Data Protection Provisions on the Use of Jetpack for WordPress
Jetpack is a WordPress plug-in by Automattic Inc., 132 Hawthorne Street, San Francisco, CA 94107, USA, using tracking technology by Quantcast Inc., 201 Third Street, San Francisco, CA 94103, USA.
Jetpack sets cookies and transmits data to Automattic for analysis to optimize the website. Data are not used to identify the user without separate explicit consent. Quantcast may also receive the data and uses them for the same purposes.
Opt-out: https://www.quantcast.com/opt-out/
Automattic privacy policy: https://automattic.com/privacy/
Quantcast privacy policy: https://www.quantcast.com/privacy/
Data Protection Provisions on the Use of Xing
Operator: XING SE, Dammtorstraße 30, 20354 Hamburg, Germany.
Plug-in info: https://dev.xing.com/plugins
Privacy policy: https://www.xing.com/privacy
Data Protection Provisions on the Use of YouTube
Operator: YouTube, LLC, 901 Cherry Ave., San Bruno, CA 94066, USA (a subsidiary of Google).
Whenever a page contains a YouTube component, the browser downloads it from YouTube. If the data subject is logged in, YouTube and Google may associate the visit with the YouTube account. To prevent this, log out before visiting the site.
Privacy policy: https://www.google.de/intl/de/policies/privacy/
Google Services
Google Fonts
We integrate fonts (“Google Fonts”) from Google LLC, 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA.
Privacy policy: https://www.google.com/policies/privacy/
Opt-out: https://adssettings.google.com/authenticated
Google reCAPTCHA
We integrate reCAPTCHA (bot detection for online forms) from Google LLC.
Privacy policy: https://www.google.com/policies/privacy/
Opt-out: https://adssettings.google.com/authenticated
Google Maps
We integrate Google Maps. Data processed may include IP addresses and location data, which are generally collected only with consent (typically via mobile device settings). Data may be processed in the USA.
Privacy policy: https://www.google.com/policies/privacy/
Opt-out: https://adssettings.google.com/authenticated
Data Protection Provisions on the Use of DoubleClick
DoubleClick is a brand of Google used for online marketing solutions.
Operator: Google Inc., 1600 Amphitheatre Pkwy, Mountain View, CA 94043-1351, USA.
DoubleClick transmits data to the DoubleClick server and sets cookies to optimize and display advertising, to create reports, and avoid repeated ad impressions. It can also track conversions. A DoubleClick cookie does not contain personal data, but may contain campaign identifiers.
Further information: https://www.google.com/intl/de/policies/
Legal Basis of Processing
Consent: Art. 6(1)(a) GDPR
Contract/performance and pre-contractual measures: Art. 6(1)(b) GDPR
Legal obligation (e.g., tax law): Art. 6(1)(c) GDPR
Vital interests: Art. 6(1)(d) GDPR
Legitimate interests: Art. 6(1)(f) GDPR
Legitimate interests may exist in particular where the data subject is a customer (Recital 47 GDPR).
Legitimate Interests
Where processing is based on Art. 6(1)(f) GDPR, our legitimate interest is the conduct of our business for the benefit of the well-being of all our employees and shareholders.
Storage Duration
The criterion for the storage duration of personal data is the respective statutory retention period. After expiry, the relevant data are routinely deleted unless they are still required for contract fulfillment or initiation.
Statutory/Contractual Requirement to Provide Data
We inform you that the provision of personal data may be required by law (e.g., tax regulations) or may arise from contractual requirements. In some cases, providing personal data is necessary for concluding a contract. Failure to provide data may mean that a contract cannot be concluded. Before providing personal data, the data subject may contact one of our employees, who will clarify whether providing the data is legally/contractually required and the consequences of non-provision.
No Automated Decision-Making
As a responsible company, we do not use automated decision-making or profiling.