Notes:

A privacy policy can only be created if all tools and applications used in the course of data processing (for marketing purposes), and thus all categories of personal data and their use, are known. The following sample declaration therefore represents a framework that must be supplemented in individual points depending on the processing. Source reference: This sample declaration was created, in particular, by drawing on the Form Handbook Data Protection Law² (Koreng/Lachenmann) and the WEKA work Practical Knowledge Data Protection, loose-leaf edition.

To find out which cookies, plugins, or other applications are active on your webpage, it is recommended to check whether cookies are being stored using various tools (Cookie Viewer or similar) – if this is the case, you should consult with the website designer and obtain appropriate information. Some of the most common tools and plugins are included in this sample privacy policy.

No liability can be assumed for the completeness and accuracy of this privacy policy in the event of uncritical use, as it must always be evaluated and adapted based on the actual functions of a website or a company’s data processing. This template can therefore only offer a guideline on how to design a legally compliant privacy policy for your own homepage.

PRIVACY POLICY

This website is operated by Anton Bauer GmbH, hereinafter referred to as “we,” “us,” and “Anton Bauer,” with its registered office at 3483 Feuersbrunn, Neufang 42 | Austria. In this privacy policy, we, as the controller according to Art. 4 Para. 7 GDPR, describe what data we collect when you visit our website and for what purpose we process it. We also inform you about how we generally process data of our customers, suppliers, and interested parties, and finally explain what rights and safeguards we offer in the course of data processing. All relevant contact details can be found in Section 11 of this privacy policy.

Since the protection of your personal data is of particular concern to us, we strictly adhere to the legal requirements of the DSG and the GDPR when collecting and processing your personal data.

In the following, we will inform you in detail about the scope and purpose of our data processing, as well as your rights as a data subject. Please read our privacy policy carefully before continuing to use our website and, if applicable, giving your consent to data processing.

1. Personal Data

The use of our website is generally possible without providing personal data. However, for the use of individual services, different regulations may apply, which we will inform you about separately.

Therefore, apart from the cookies described in detail below, we generally only collect and store data that you provide to us yourself by entering it into our input forms or by actively interacting with our website in any other way.

Personal data is any information relating to an identified or identifiable natural person. This includes, for example, your name, address, phone number, or date of birth, but also your IP address or geolocation data that allows conclusions to be drawn about you.

2. Use of Cookies

1. If you only use our website for informational purposes, i.e., if you do not register for a service or otherwise transmit information to us – for example, via a contact form – we only collect the (personal) data that your browser transmits to our server. If you wish to visit our website, we collect the data listed below, which are technically necessary for us to display the website to you and to ensure its stability and security in accordance with Art. 6 Para. 1 S. 1 lit. f GDPR:

• IP address
• Date and time of the request
• Time zone difference to Greenwich Mean Time (GMT)
• Content of the request
• Access status / HTTP status code
• Amount of data transferred in each case
• Website from which the request originates
• Browser used
• Operating system and its interface
• Language and version of the browser software

However, these data are not processed beyond the purpose of displaying our website.

1. In addition to the aforementioned data, first- and third-party cookies are stored on your computer when you use our website; these are small text files that are stored on your hard drive, assigned to the browser you are using. The party that sets a cookie (this is done either by us or an explicitly named third party) thereby receives certain information.

We need these cookies, on the one hand, to recognize you as a user of the website and, on the other hand, to make the use of our services traceable. Finally, we may use cookies for marketing purposes to analyze your user behavior and to send you targeted advertising if necessary.

1. A basic distinction can be made between first-party cookies, third-party cookies, and third-party requests.

• First-Party Cookies

First-party cookies are stored by us or our website itself in your browser to provide you with the best possible user experience. These are primarily functional cookies, such as shopping cart cookies. We may also use cookies to identify you for subsequent visits if you have an account with us – otherwise, you would have to log in again with each visit.

• Third-Party Cookies

Third-party cookies are stored in your browser by a third-party provider. These are mostly tracking or marketing tools that, on the one hand, evaluate your user behavior and, on the other hand, offer the third-party provider the possibility to recognize you on other websites you visit. For example, retargeting marketing is generally based on the function of such cookies.

• Third-Party Requests

Third-party requests are all requests that you, as a page user, make to third parties via our site – for example, when you interact with social network plugins or use the services of a payment provider. In this case, no cookies are stored in your browser, but it cannot be ruled out that personal data may be sent to this third-party provider through the interaction. For this reason, we also inform you in detail in our privacy policy about the tools & applications we use.

1. To comprehensively inform you about the cookies we use, we have designed a cookie banner, in accordance with the judgment of the ECJ of October 1, 2019, C-673/17 (Planet 49) and other relevant decisions, which is displayed to you when you first access our website. This cookie banner shows all cookies used, including their function, storage duration, and origin. Only if you agree to the use of some or all cookies will they be stored by us; an exception to this may be technically essential cookies, without which our website could not be displayed correctly.

1. You can change your browser settings at any time to, for example, refuse the acceptance of third-party cookies or all cookies. In this case, however, we must point out that you may no longer be able to use all functions of our website.

3. Collection and Processing of Personal Data

1. Website

Personal data beyond the information stored by cookies is processed by us within the operation of our website only if you voluntarily provide it to us, for example, when you register with us, enter into a contractual relationship with us, or otherwise contact us. This exclusively concerns contact data and information about the matters you bring to us.

We use the personal data you provide exclusively to the extent necessary for the fulfillment of the respective processing purpose (e.g., registration, newsletter dispatch, order processing, sending of information material and advertising, processing of a competition, answering a question, enabling access to certain information) and to the extent legally permissible (in particular, pursuant to Art. 6 or Art. 9 GDPR) (e.g., sending advertising and information material to existing customers pursuant to Art. 6 Para. 1 S. 1 lit. f GDPR).

The purpose of processing your data is to operate our website and to provide targeted company-specific information, including the presentation of our goods and services (marketing).

Any further use of your data will only take place if you have previously given your express consent, if we need your data to fulfill a contract concluded with you, or if we are obliged to store it due to a legal provision. Any given consent can be revoked at any time for the future, as explained in detail below.

1. Contract Processing, Marketing, and More

Generally, we use personal data of our customers, suppliers, and other contractual and cooperation partners, e.g., contact persons, their contact details, and marketing-relevant information, for the purpose of contract processing and within the scope of legal retention obligations (e.g., accounting), and furthermore also out of legitimate interest, for example, for marketing and customer care purposes.

In addition, we collect personal data from interested parties (e.g., contact persons, their contact details, and marketing-relevant information) in the course of our acquisition and sales activities. We are constantly searching the internet, at trade fairs, and other events for potential contractual partners and maintain a marketing database for this purpose to enable targeted advertising for our products and services. All measures listed here are carried out in our legitimate interest for marketing purposes pursuant to Art. 6 Para. 1 S. 1 lit. f GDPR in conjunction with Recital 47 for a period of three years from the end of a contractual relationship (customers & suppliers) or our initial (unsuccessful) contact (interested parties), unless there is an additional express consent from the data subject.

If we do not collect personal data for marketing purposes directly from the data subject, we will inform the data subject, in accordance with Art. 14 GDPR, where we obtained their data when first contacting them.

1. Application Management

We collect data from applicants for job openings with us for the purpose of initiating a possible employment relationship, Art. 6 Para. 1 S. 1 lit. b GDPR, or, if applicable, based on explicit consent for evidentiary purposes.

4. Storage Period

Data that you have provided to us exclusively for customer service or for marketing and information purposes will generally be stored until three years after our last contact. However, if you wish, we will delete your data even before this period expires, provided there is no legal impediment.

In the event of contract initiation or conclusion, we process your personal data after complete contract processing until the expiry of the warranty, guarantee, limitation, and statutory retention periods applicable to us, and furthermore until the termination of any legal disputes for which the data are required as evidence.

Data that you may submit to us as part of an application process will be stored for a period of 6 months without separate consent.

If retention is legally required, we comply with the prescribed period. If we process your personal data – for example, out of legitimate interest – beyond the purposes described in this privacy policy, we will inform you separately before commencing processing.

5. Data Transfer

1. General

Your data will generally not be transferred to third parties, unless we are legally obliged to do so, the data transfer is necessary for the performance of a contract concluded between us, or you have previously expressly consented to the transfer of your data.

External processors or other cooperation partners will only receive your data if this is necessary for contract processing, if we have a legitimate interest that we will always announce separately in the specific case, or if this is required due to special regulations, with your consent.

Your personal data will not be sold or otherwise marketed by us to third parties. If our contractual partners or processors are based in a third country, i.e., a state outside the European Economic Area (EEA), we will inform you about the consequences of this circumstance in the description of the offer.

Insofar as one of our processors comes into contact with your personal data, we ensure that they comply with the provisions of data protection laws in the same way as we do.

1. Data Transfer to the USA?

We occasionally offer some services that involve or may involve data transfer to the USA. To use these services – unless there is another justification, such as the fulfillment of contractual obligations – it is necessary that you agree to the use of your data collected via these services, potentially also in the USA (Art 49 Para. 1 lit. a GDPR).

Depending on the service, we obtain this consent via our cookie banner or separately through a corresponding declaration of consent directly before using an offered service.

Your consent is required because, according to recent official and court decisions and the jurisprudence of the ECJ, the USA is not certified as having an adequate level of data protection for the processing of personal data (C-311/18, Schrems II). These official and court decisions particularly highlight that access by US authorities (FISA 0702) is not comprehensively restricted by law, does not require approval by an independent body, and no relevant legal remedies are available to data subjects in the event of such interventions.

Apart from the contracts concluded with US service providers, we have no direct influence on the access of US authorities to personal data transferred to service providers in the USA when using these services. Even if we assume that our service providers take the necessary steps to ensure the promised level of protection in accordance with the agreements made with us, access by US authorities to data processed in the USA is still conceivable.

Therefore, we ask for your consent to the processing of data in the USA before using such services. For each service or application, we will specifically point out the possibility of data transfer to the USA.

6. Newsletter

You have the option to subscribe to our free newsletter. With this newsletter, you will regularly receive all the latest news and information about our company, as well as tailored advertising. To receive our newsletter, you need a valid email address.

We verify the email address you entered in our registration form to ensure that you actually wish to receive newsletters. This is done by sending an email to the email address you provided, which you can confirm by clicking on a provided link. After confirming the email, you will be subscribed to our newsletter. (Double Opt-In)

With your initial newsletter registration, we store your IP address, the date, and time of your registration. This is done for security reasons in case a third party misuses your email address and subscribes to our newsletter without your knowledge. No further data is collected and processed by us for the newsletter subscription; the data is used exclusively for receiving the newsletter.

Unless you object, we may transfer your data to companies affiliated with our company for analysis purposes and for sending information for advertising purposes. Within the corporate group, the data you provided to us for receiving the newsletter will be compared with data that may have been collected by us otherwise (e.g., when purchasing goods or booking a service).

Your data for newsletter registration will not be passed on to third parties who do not belong to the corporate group. You can unsubscribe from our newsletter at any time; details on how to unsubscribe can be found in the confirmation email and in every newsletter.

7. Tools and Applications Used

1. We use Google Analytics, a web analytics service provided by Google Inc., 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA. This service uses cookies, whose functionality has already been explained in detail. The information generated by these cookies about your use of this website is usually transmitted to a Google server and stored there.

On our behalf, Google will use this information to evaluate your use of our website, to compile reports on website activity, and to provide other services related to website and internet usage to the website operator. The IP address transmitted by your browser as part of Google Analytics will not be merged with other Google data.

You can prevent the storage of cookies required by Google Analytics by adjusting your browser software settings accordingly, which may, however, result in you not being able to fully use all functions of this website. You can also prevent Google from collecting and processing the data generated by the cookie and related to your use of the website (including your IP address) by downloading and installing the browser plugin available at the following link: http://tools.google.com/dlpage/gaoptout?hl=de

If you would like further information on the type, scope, and purpose of the data collected by Google, we recommend that you read their privacy policy. https://support.google.com/analytics/answer/6004245?hl=de

Google also processes your data in the USA. Before you give your consent to the storage of cookies through the use of Google Analytics, please read the relevant information in our privacy policy.

1. We also use Google Maps services on our website. This allows us to display interactive maps directly on our website and enables you to conveniently use the map function to find our location and facilitate your arrival.

By visiting our website, Google receives the information that you have accessed the corresponding subpage of our website and the personal data listed under point 2. This happens regardless of whether you are logged in with a Google account or not. If you are logged in to Google, your data will be directly associated with your account. If you do not wish this, you must log out of Google before using this service. Google uses your data for advertising, market research, and needs-based website design. You have a right to object to this use of your data, which you must address directly to Google.

Further information on the purpose and scope of data collection can be found in Google’s privacy policy, which you can access at http://www.google.de/intl/de/policies/privacy. Google also processes your data in the USA. Before you give your consent to the storage of cookies through the use of Google Analytics, please read the relevant information in our privacy policy.

1. On our website, we also include links to other websites; this is for informational purposes only. These websites are not under our control and therefore are not covered by the provisions of this privacy policy. However, if you activate a link, it is possible that the operator of that website collects data about you and processes it according to their privacy policy, which may differ from ours. Please always inform yourself about the current data protection provisions on the websites we link to.

1. Our website also offers the possibility to interact with various social networks via plugins. These are:

• Facebook, operated by Meta Platforms Ireland Limited, 4 Grand Canal Square, Grand Canal Harbour, Dublin 2, Ireland
• YouTube, operated by YouTube LLC, 901 Cherry Avenue, San Bruno, CA 94066 USA
• Instagram, operated by Meta Platforms Ireland Limited, 4 Grand Canal Square, Grand Canal Harbour, Dublin 2, Ireland

When you click on a plugin of one of these social networks, it is activated and a connection to the respective server of that network is established, as described above.

If you activate these plugins, you agree to the use of your data collected via these plugins, potentially also in the USA.

We have no influence on the scope and content of the data transmitted to the respective operator of this social network by clicking on the plugin, or which may subsequently be subject to access by US authorities.

If you wish to obtain information on the type, scope, and purpose of the data collected by the operators of these social networks, we recommend that you read the privacy policy of the respective social network.

Subject to your consent, our website uses a pixel or first-party cookie provided by Teads to optimize our advertising campaigns. This Teads tracking technology collects information about the URL address, the type of device, the browser and operating system you are currently using, and your IP address. For more information, please read Teads’ privacy policy. Please also note that you have the right to obtain information about the personal data stored by Teads about you and to request that your personal data be corrected, deleted, or transferred. You may also have the right to object to certain processing or to request that Teads restrict it. You can exercise these rights by contacting Teads at dpo@teads.com.

8. Joint Controllership pursuant to Art. 26 GDPR

1. Facebook – Fan Page

We operate a Facebook fan page at https://www.facebook.com/AuszeitGesundheitszentrum. The purpose of this fan page is to share information about our company’s activities, implement marketing measures, and provide another communication channel with us.

In this context, we are “joint controllers” with Facebook, operated by Meta Platforms Ireland Limited, 4 Grand Canal Square, Grand Canal Harbour, Dublin 2, Ireland, which provides us with this service. Generally, Facebook allows you to select in your settings which personal data is shared with us. If you do not wish this, we receive all information regarding the use of our fan page and personal data about visitors in anonymized form.

For this purpose, we have concluded a so-called Art. 26 GDPR agreement with Facebook, which regulates the mutual rights and obligations between us and Facebook. You can find this at https://www.facebook.com/-legal/EU_data_transfer-_addendum/update. In this context, we also ask you to read Facebook’s privacy policy, which you can find at https://www.facebook.com/policy.php.

In the Art. 26 GDPR agreement we concluded, Facebook undertakes to be the first point of contact for data subjects regarding the processing of insights data and to fulfill the associated duties and tasks.

You can therefore assert your data subject rights both against us, in accordance with Section 10 of this privacy policy, and against Meta Platforms Ireland Limited, 4 Grand Canal Square, Grand Canal Harbour, Dublin 2, Ireland.

1. Instagram – Profile

We operate an Instagram profile at https://www.instagram.com/auszeit_st.lambrecht/. With this profile, we aim to implement marketing measures, draw attention to our products and services, and create another communication channel with our customers.

In this context, too, we are “joint controllers” with Instagram, operated by Meta Platforms Ireland Limited, 4 Grand Canal Square, Grand Canal Harbour, Dublin 2, Ireland, which provides us with this service. Generally, Instagram allows you to select in your settings which personal data is shared with us. If you do not wish this, we receive all information regarding the use of our fan page and personal data about visitors in anonymized form.

For this purpose, we have concluded a so-called Art. 26 GDPR agreement with Instagram, which regulates the mutual rights and obligations between us and Instagram. You can find this at https://www.facebook.com/-legal/EU_data_transfer-_addendum/update. In this context, we also ask you to read Instagram’s privacy policy, which you can find at https://help.instagram.com/519522125107875.

In the Art. 26 GDPR agreement we concluded, Instagram undertakes to be the first point of contact for data subjects regarding the processing of insights data and to fulfill the associated duties and tasks.

You can therefore assert your data subject rights both against us, in accordance with Section 10 of this privacy policy, and against Meta Platforms Ireland Limited, 4 Grand Canal Square, Grand Canal Harbour, Dublin 2, Ireland.

9. Security

We implement numerous technical and organizational security measures to protect your data against manipulation, loss, destruction, and against access by third parties. Our security measures are continuously improved in line with technological developments on the internet. Should you require more detailed information on the type and scope of the technical and organizational measures we have taken, we are always happy to answer written inquiries in this regard.

10. Your Rights

According to the General Data Protection Regulation and the Data Protection Act, you, as a data subject of our data processing, have the following rights and legal remedies:

• Right to Information (Art. 15 GDPR)

As a data subject of the data processing described above and other data processing, you have the right to request information about whether, and if so, which personal data about you is being processed. For your own protection – so that no unauthorized person receives information about your data – we will verify your identity in an appropriate manner before providing information.

• Right to Rectification (Art. 16) and Erasure (Art. 17 GDPR)

You have the right to obtain without undue delay the rectification of inaccurate personal data concerning you or – taking into account the purposes of the processing – the completion of incomplete personal data, as well as the erasure of your data, provided that the criteria of Art. 17 GDPR are met.

• Right to Restriction of Processing (Art. 18 GDPR)

Under the statutory conditions, you have the right to obtain restriction of the processing of all collected personal data. From the time of the restriction request, this data will only be processed with your individual consent or for the establishment and enforcement of legal claims.

• Right to Data Portability (Art. 20 GDPR)

You can request the unimpeded and unrestricted transmission of personal data that you have provided to us, either to you or to a third party.

• Right to Object (Art. 21 GDPR)

You have the right to object, on grounds relating to your particular situation, at any time to processing of personal data concerning you which is necessary for the purposes of the legitimate interests pursued by us or by a third party. Your data will no longer be processed after objection, unless there are compelling legitimate grounds for the processing which override your interests, rights, and freedoms, or the processing serves the establishment, exercise, or defense of legal claims. You can object to data processing for direct marketing purposes at any time with effect for the future.

• Withdrawal of Consent

If you have separately given consent for the processing of your data, you can withdraw this at any time. Such a withdrawal affects the lawfulness of processing your personal data after you have expressed it to us.

If you take action to enforce your rights under the GDPR listed above, AUSZEIT – Rehazentrum St. Lambrecht GmbH must respond to the requested measure or comply with the request without undue delay, but no later than one month after receipt of your request.

We will respond to all reasonable requests free of charge and as quickly as possible within the legal framework.

The Data Protection Authority is responsible for requests concerning violations of the right to information, violations of the rights to confidentiality, rectification, or erasure. Their contact details are:

Austrian Data Protection Authority

Barichgasse 40-42

1030 Vienna

dsb@dsb.gv.at

11. Contact Information / Contact Person

1. Contact Information of the Controller

1. Contact Information of the Contact Person for Data Protection Matters

11. Competitions

Participation in the competition requires the provision of personal data.
Participants assure that the information they provide – in particular first name, last name, address, email address, and telephone number – is truthful and complete.

The organizer points out that all personal data of the participant will neither be passed on to third parties nor made available for their use without consent. An exception is the company Österreichische Post AG commissioned for shipping, which must collect, store, and use the data for the purpose of carrying out the shipment.

Legal recourse is excluded. A cash payment of the prize is not possible.
Participation is possible from 18 years of age.

12. Microsoft Clarity

On our website, we use the service Microsoft Clarity, a web analytics service provided by Microsoft Ireland Operations Limited (One Microsoft Place, South County Business Park, Leopardstown, Dublin 18, Ireland; hereinafter “Microsoft”).

Type and Scope of Data Processing

With Microsoft Clarity, we can analyze user behavior on our website. The tool creates, among other things, so-called heatmaps (visualizations of mouse movements, clicks, and scroll behavior) and session recordings (anonymized recordings of individual sessions).

The following data may be processed:

• IP address (anonymized/truncated)

• Location data (at country or city level)

• Click and scroll behavior, mouse movements

• Technical details (screen resolution, browser type, operating system, device type)

• Dwell time and visited subpages

Microsoft Clarity uses technologies such as cookies or unique identifiers (User IDs) to recognize users and aggregate data. The data is usually processed on Microsoft servers and may also be transferred to Microsoft Corp. servers in the USA.

Purpose of Processing

Microsoft Clarity is used for the purpose of needs-based design, optimization, and statistical evaluation of our web offering, as well as for troubleshooting technical errors.

Legal Basis

The processing of your data is based exclusively on your express consent pursuant to Art. 6 Para. 1 lit. a GDPR and § 25 Para. 1 TDDDG (or corresponding national provisions).

Third-Country Transfer

A data transfer to the USA cannot be ruled out. Microsoft Corporation is certified under the EU-U.S. Data Privacy Framework (DPF). This ensures that Microsoft provides an adequate level of data protection in accordance with the requirements of the European Commission.