Privacy Policy

1. Terms

The following terms are used in this privacy policy:

Personal data is all data containing information about the personal or material circumstances of natural persons, for example name, address, email address, telephone number, date of birth, age, gender, social security number, video recordings, photos etc. Data of legal entities is not subject to the provisions of the GDPR.

Processing is any operation or set of operations performed on personal data, whether or not by automated means, such as collection, recording, organization, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure or destruction.

Controller is the natural or legal person, public authority, agency or other body which, alone or jointly with others, determines the purposes and means of the processing of personal data.

Processor is a natural or legal person, public authority, agency or other body which processes personal data on behalf of the controller.

Recipient is a natural or legal person, public authority, agency or other body to which personal data is disclosed, whether a third party or not.

2. Data processing

2.1 What data we process when you visit our website

When you visit our website, we process your personal data only insofar as this is necessary to make our website available in a functional form together with its content. We therefore process the personal data your browser automatically transmits to our server in so-called server log files. This concerns in particular your IP address.

Beyond that, we do not process personal data when you visit our website, but exclusively technical data, such as

• browser type / browser version
• operating system used
• referrer URL
• host name of the accessing computer
• time of the server request

This data cannot be attributed to specific persons. This data is not merged with other data sources. We reserve the right to check this data retrospectively if we become aware of concrete indications of unlawful use.

As a user of our website you have the possibility to

• create a user account with us,
• contact us via a contact form provided on the website; and
• apply to our company via an online application form.

In these cases we additionally process the following personal data of yours:

Mandatory:

• your name
• your email address,
• a password chosen by you

Optional (processed if provided by you):

• your telephone number
• any company affiliation of yours (company).

With the contact form:

• all further information you send us in a message field provided.

With the application form:

• all details you send us as part of your application. Typically this is information concerning your CV, salary expectations and other details you include in your application.

2.2 What data we process when you engage us

If you engage us to provide our service, we also process your personal data. We collect, process and use it insofar as this is necessary for the initiation or performance of the contract or due to a legal obligation, or if you provide us with this data voluntarily. In particular, the following categories of personal data may be processed by us:

• your name
• further contact details of yours (e.g. address, email address, telephone number)
• payment information disclosed by you (e.g. credit card number, SEPA direct debit or PayPal)

3. Purposes of processing

The purposes of the processing are the following:

When using the website:

• Ensuring a secure and user-friendly design of our website.
• Detecting, preventing and investigating attacks on our website and online services.
• Creating usage statistics for statistical evaluations.

When engaging us:

• The initiation or conclusion of the contract with you.
• The provision of our services to you.
• The fulfilment of statutory or contractual obligations.

4. Legal bases for this data processing

The legal basis for data processing in the context of visiting our website is Art. 6 (1) (f) GDPR, i.e. an overriding legitimate interest, which consists in achieving the purposes stated above. The processing of the data mentioned is necessary for this. It thus serves to safeguard a legitimate interest of ours. No overriding interests of the website user stand against this.

Insofar as you provide us with data so that we can render our services to you, the processing takes place on the legal basis of contract initiation and performance pursuant to Art. 6 (1) (b) GDPR. Where invoicing information is concerned (e.g. name, address, VAT ID, means of payment), Art. 6 (1) (b) GDPR is additionally applicable as a legal basis, since invoicing information must be processed due to accounting and tax regulations.

For data processing beyond this, we obtain your consent before processing. Insofar as our legitimate interest in the data processing outweighs your interest in data protection, processing may also take place without your consent.

We inform you that the provision of personal data is partly required by law (e.g. tax regulations) or may also result from contractual arrangements (e.g. details of the contracting party). Non-provision of the personal data would mean that the contract could not be concluded.

5. Storage period

Your data is stored by us only for as long as is necessary to achieve the processing purposes stated above or as required due to statutory retention obligations or for the assertion or defence of third-party claims. When the data is no longer required for the provision of the website or the fulfilment of our engagement, it is deleted, unless contractual or statutory obligations on our part prevent this.

Important retention periods (under Austrian law) include:

• Tax retention obligation under § 132 (1) BAO: 7 years (beyond that as long as relevant to the tax authority in pending proceedings)
• Company-law retention obligation under §§ 190, 212 UGB: 7 years
• VAT retention obligation for invoices under § 11 (2) subpara. 3 UStG: 7 years
• VAT retention obligations for export documents under § 7 (7) UStG: 7 years
• Warranty under § 933 ABGB: 2 years
• Purchase-price claims for movable property under § 1062 in conjunction with § 1486 ABGB: 3 years
• Claims for rent and lease payments under § 1486 ABGB: 3 years, period beginning at due date
• Claims from a contract for work under § 1486 ABGB (where the service was provided within a commercial or other business operation): 3 years
• General damages under § 1489 ABGB (compensation claims): 3 years (where damage and damaging party are known) / otherwise 30 years
• Liability claims under § 13 PHG: 10 years

6. Disclosure to third parties

To operate our website we regularly use IT service providers who, acting on our behalf and according to our instructions, may also have access to the personal data obtained through your use of our website in order to render the commissioned services.

In individual cases we may furthermore transmit your personal data to the following categories of recipients:

• external third parties to the necessary extent on the basis of our legitimate interests (e.g. legal representatives where the occasion arises)
• authorities and other public bodies to the legally required extent (e.g. fiscal authorities, courts)

We transmit your data to other recipients only if you have given your express consent pursuant to Art. 6 (1) sentence 1 (a) GDPR, if this is legally permissible and necessary pursuant to Art. 6 (1) sentence 1 (b) GDPR for the performance of a contractual relationship with you, if we are subject to a legal obligation pursuant to Art. 6 (1) sentence 1 (c) GDPR, or if the disclosure pursuant to Art. 6 (1) sentence 1 (f) GDPR is necessary to safeguard our legitimate interests and for the assertion, exercise or defence of legal claims and there is no reason to assume that you have an overriding interest worthy of protection in the non-disclosure of your data.

Your data is not transmitted to a third country.

7. Cookies / server log files

Cookies are small text files that the website stores on your computer in order to recognize it; they may contain information about the use of the website. The information contained in the cookies is used to determine whether you are logged in or which data you have already entered. Most web browsers accept cookies automatically. You can avoid this by changing your browser settings. You can remove cookies stored on your PC at any time by deleting the temporary internet files.

Some cookies are strictly necessary for the functioning of the website (essential cookies), others record visits and the origin of the visitor and measure this data without the cookies being able to relate to your person (performance cookies). Certain cookies are used for marketing purposes (marketing cookies). Some of the cookies used are only stored until you close the website again (session cookies), whereas certain cookies are stored for a longer period and allow you to be recognized (persistent cookies).

Our website also collects data about accesses to it and stores this as “server log files”. Essentially technical information is logged, though possibly also personal data.

Insofar as personal data is also processed through individual cookies or log files we use, the processing takes place pursuant to Art. 6 (1) (b) GDPR either for the performance of the contract, pursuant to Art. 6 (1) (a) GDPR in the case of consent given, or pursuant to Art. 6 (1) (f) GDPR to safeguard our legitimate interests in the best possible functionality of the website as well as a customer-friendly and effective design of the user experience and in marketing.

Via the cookie notice on your first visit you can choose which cookies you want to allow. Your consent is required for marketing cookies. If you want to withdraw consent or change your cookie settings, you can make this change directly in your browser.

8. Google Analytics / Google Maps / Google reCAPTCHA

We use the technology “Google Analytics” to create statistics about accesses to our website. It is a tracking tool for traffic analysis on our website.

Our website also uses Google Maps to display geographical information. When Google Maps is used, Google also collects and processes data about the use of the Maps functions by visitors to the website.

We also use Google reCAPTCHA to verify whether you, as a user of our website, are actually a human and not a robot or spam software. In doing so, reCAPTCHA may collect personal data from you, such as your IP address.

We obtain these services from Google Ireland Limited, Google Building Gordon House, 4 Barrow St, Dublin, D04 E5W5, Ireland.

Google uses cookies for this tracking. Various pieces of information about your visit to our website are recorded, including information about your browser type and version, operating system, previously visited website, time, approximate location and pages viewed, including your IP address. Google processes this data and provides us with reports on certain aspects of your user behaviour. In the course of this, the information is transferred to a Google server and stored there. It is possible that this transfer takes place to a Google server in the USA and the information is stored there. If IP anonymization is activated on this website, however, your IP address is truncated by Google beforehand within member states of the European Union.

You can prevent the storage of cookies by setting your browser software accordingly; however, we point out that in this case you may not be able to use all functions of this website to their full extent. You can also prevent the collection of the data generated by the cookie and relating to your use of the website (incl. your IP address) by Google and the processing of this data by Google by downloading and installing the browser plugin available at the following link (http://tools.google.com/dlpage/gaoptout).

9. YouTube videos

We have embedded YouTube videos on our website. YouTube is a video portal operated by YouTube, LLC, 901 Cherry Ave., San Bruno, CA 94066, USA. YouTube, LLC is a subsidiary of Google. Google Ireland Limited is therefore responsible for data processing in the European area.

When you access a subpage on our website that has an embedded YouTube video, your browser automatically connects to YouTube’s servers. Various data is transmitted. In particular, YouTube sets a cookie that stores your IP address and records certain further information about your visit to our website, including information about your browser type and version, operating system, previously visited website, time, approximate location and pages viewed. If you are logged into your YouTube account, you enable YouTube to assign your usage behaviour directly to your personal profile. You can prevent this by logging out of your YouTube account.

You can prevent the storage of cookies by setting your browser software accordingly; however, we point out that in this case you may not be able to use all functions of this website to their full extent.

Further information on the handling of user data can be found in YouTube’s privacy policy at https://www.google.com/policies/privacy

10. Amazon Web Services (AWS)

We have integrated the service Amazon Web Services (AWS), a cloud computing service of Amazon Web Services, Inc., 410 Terry Avenue North, Seattle WA 98109, USA, on our website. Amazon Web Services EMEA SARL (“AWS EU”), 38 Avenue John F. Kennedy, L-1855 Luxembourg, is responsible for the related data processing in the EU area.

More information can be found in their privacy policy at https://aws.amazon.com/privacy/

11. Social media plugins

Our website uses social media plugins. These are small buttons with which you, as a user of our website, can share content without leaving the website. The plugins originate from third-party social media websites. As a result, information about your activities on the internet, including on our website, could be logged and cookies could be set. Our website currently uses the following social media plugins: LinkedIn, Facebook, Twitter, Instagram, YouTube.

Via the respective provider’s button implemented on our website, you can communicate directly with them. Only when you click the button and thereby activate it does the plugin provider receive the information that you have accessed the corresponding page of our online offering. Through this activation, your personal data is transmitted to the respective plugin provider and stored there (possibly in the USA). Further information on this as well as on your rights and possible settings to protect your privacy can be found in the privacy policies of the providers mentioned.

12. Newsletter

If you sign up for our newsletter, we process the following personal data of yours:

• name
• email address

We process your personal data only on the basis of your consent pursuant to Art. 6 (1) (a) GDPR. You can withdraw your consent at any time with effect for the future. The purpose of this data processing is so that we can send you the newsletter. Your data for receiving the newsletter is processed for as long as necessary to achieve this purpose and you have not withdrawn your consent.

Registration for our newsletter takes place in a so-called double opt-in procedure; i.e. after registration you receive an email in which you are asked to confirm your registration. This confirmation is necessary so that nobody can register with someone else’s email address.

The newsletter is sent via Mailchimp — a newsletter dispatch platform of the US provider Rocket Science Group, LLC, 675 Ponce De Leon Ave NE 5000, Atlanta, GA 30308, USA.

The email address you provide when registering for the newsletter is stored on Mailchimp’s servers in the USA. Mailchimp uses this information to send and evaluate the newsletter on our behalf. The EU Commission has issued an implementing decision on the adequacy of the level of protection for personal data under the EU–US Data Privacy Framework. On this basis, controllers and processors may again transmit personal data to certified companies and organizations in the USA without having to provide appropriate safeguards and additional measures or rely on specific exemptions. Mailchimp holds such a certification.

13. Data subject rights

13.1 Right of access

You have the right to request confirmation as to whether personal data is being processed; if this is the case, you have a right of access to this personal data. This covers the following information:

• the purposes of processing
• the categories of personal data
• the recipients or categories of recipients
• where possible, the envisaged period for which the personal data will be stored or, if this is not possible, the criteria for determining this period
• the existence of a right to rectification or erasure of the personal data concerned or to restriction of processing by the controller, or of a right to object to this processing
• the existence of a right to lodge a complaint with a supervisory authority
• all available information about the origin of the data
• the existence of automated decision-making, including profiling

13.2 Right to rectification

You have the right to obtain from the controller the rectification of inaccurate personal data and the completion of incomplete personal data.

13.3 Right to erasure

You have the right to obtain from the controller the erasure of personal data without undue delay where one of the following grounds applies:

• The personal data is no longer necessary for the purposes for which it was collected.
• You withdraw the consent on which the processing was based and there is no other legal basis for the processing.
• You object to the processing (Art. 21 (1) GDPR) and there are no overriding legitimate grounds for the processing, or you object to the processing pursuant to Art. 21 (2) GDPR.
• The personal data has been processed unlawfully.
• The erasure of the personal data is necessary for compliance with a legal obligation.
• The personal data was collected in relation to information-society services offered pursuant to Article 8 (1).

The right to erasure does not exist insofar as the processing is necessary

• for exercising the right of freedom of expression and information
• for compliance with a legal obligation
• for the performance of a task carried out in the public interest
• for reasons of public interest in the area of public health
• for archiving purposes in the public interest, scientific or historical research purposes or statistical purposes
• for the establishment, exercise or defence of legal claims.

13.4 Right to restriction of processing

You have the right to request restriction of processing where one of the following conditions applies:

• the accuracy of the personal data is contested, for a period enabling the controller to verify the accuracy of the personal data
• the processing is unlawful and you oppose the erasure of the personal data and request the restriction of its use instead
• the controller no longer needs the personal data, but you require it for the establishment, exercise or defence of legal claims;
• you have objected to processing pursuant to Article 21 (1) pending verification whether the legitimate grounds of the controller override.

Where processing has been restricted, such personal data may — with the exception of storage — only be processed with your consent or for the establishment, exercise or defence of legal claims or for the protection of the rights of another natural or legal person or for reasons of important public interest.

13.5 Right to data portability

You have the right to receive the personal data you have provided to a controller in a structured, commonly used and machine-readable format, and you have the right to transmit this data to another controller without hindrance from the controller to which the personal data was provided, where the processing is based on consent or on a contract and the processing is carried out by automated means.

In exercising the right to data portability, you have the right to have the personal data transmitted directly from one controller to another controller, where technically feasible.

13.6 Right to object

You have the right to object at any time, on grounds relating to your particular situation, to the processing of personal data carried out on the basis of Art. 6 (1) (e) or (f) GDPR; this also applies to profiling based on these provisions. The controller shall no longer process the personal data unless it demonstrates compelling legitimate grounds for the processing which override your interests, rights and freedoms, or the processing serves the establishment, exercise or defence of legal claims.

Where personal data is processed for direct marketing purposes, you have the right to object at any time to the processing of personal data for the purposes of such marketing; this also applies to profiling insofar as it is related to such direct marketing.

13.7 Right to withdraw consent

You have the right to withdraw consent given pursuant to Art. 6 (1) (a) or Art. 9 (2) (a) at any time, without affecting the lawfulness of processing carried out up to the withdrawal.

13.8 Right to lodge a complaint

You have the right to lodge a complaint with the Austrian Data Protection Authority, Barichgasse 40-42, 1030 Vienna, T: +43 1 52 152-2569, E: dsb@dsb.gv.at, if you are of the opinion that the processing violates applicable data protection law.

13.9 Data security

The protection of your personal data is ensured by appropriate organizational and technical precautions. These precautions relate in particular to protection against unauthorized, unlawful or accidental access, loss, processing, use and manipulation.

14. Our contact details

We can be reached at any time for your questions or your withdrawal of consent using the contact details below:

XBuild GmbH

Eduard-Bodem-Gasse 8

A – 6020 Innsbruck

Contact:

+43 512 25 77 01

+49 89 244 132 67

info@myxbuild.com

15. Information on online dispute resolution pursuant to Art. 14 (1) ODR Regulation

The EU Commission offers the possibility of online dispute resolution on a platform operated by it (the “ODR platform”). The ODR platform can serve as a contact point for the out-of-court settlement of disputes arising from online purchase or service contracts. This platform can be reached via the external link http://ec.europa.eu/consumers/odr.

16. Request for erasure / release of your personal data

Note: the obligations arising for XBuild GmbH from the GDPR do not provide for the deletion of your profile, but of all personal data linked to it. If you wish the complete erasure of all your data, please contact us via our contact page, stating your name and the email address you have used with us, and whether you want your personal data erased or released to you.