PRIVACY POLICY

1) Introduction and contact details of the controller

1.1 We appreciate your visit to our website and thank you for your interest. Below, we inform you about the handling of your personal data when using our website. Personal data is all data with which you can be personally identified.

1.2 The controller who is responsible for data processing on this website within the meaning of the General Data Protection Regulation (GDPR) is Gebetsberger Medizintechnik e.U.
Owner: Clemens Gebetsberger, Walchen 36, 4870 Vöcklamarkt, Austria, Tel.: +436805003736, email: office@gebetsberger.at. The controller is the natural or legal person who, alone or jointly with others, determines the purposes and means of the processing of personal data.

2) Data collection while visiting our website

2.1 When you use our website for informational purposes only—that is, if you do not register or otherwise provide us with information—we collect only the data that your browser transmits to the website server (so-called “server log files”). When you visit our website, we collect data which is technically necessary to display the website to you. This data is as follows:

Our visited website
Date and time at the time of access
Amount of data sent in bytes
Source/reference from which you accessed the website
Browser used
Operating system used
IP address used (in anonymized form, where required)

The processing is carried out in accordance with Art. 6(1)(f) GDPR based on our legitimate interest in improving the stability and functionality of our website. The data will not be disclosed or used for any other purpose. However, we reserve the right to review the server log files at a later date if there are specific indications of unlawful use.

2.2 For security reasons and to protect the transfer of personal data and other confidential content (e.g., orders or inquiries to the controller), this website uses SSL or SSL TLS encryption. The connection is encrypted if you can see the “https://” in the address bar and the lock icon.

3) Cookies

To make your visit to our website more enjoyable and to enable the use of certain features, we use cookies, i.e., small text files that are stored on your device. Some of these cookies are automatically deleted after closing the browser (so-called "session cookies"), some of these cookies remain longer on your device and allow the storage of page settings (so-called "persistent cookies"). You can find the storage time of persistent cookies in the overview of the cookie settings of your web browser.

If personal data is processed through individual cookies we use, such processing is carried out in accordance with Art. 6(1)(b) GDPR for the purpose of performing the contract, in accordance with Art. 6(1)(a) GDPR in the event that consent has been given, or in accordance with Art. 6(1)(f) GDPR to safeguard our legitimate interests in ensuring the best possible functionality of the website and a user-friendly and effective design of the site visit

You can configure your browser to notify you when cookies are set. This allows you to decide on a case-by-case basis whether to accept them or whether to block them in specific cases or in general.

Please note that if you do not accept cookies, the functionality of our website may be limited.

4) Contacting Us

4.1 WhatsApp-Business

We offer our website’s visitors the opportunity to contact us via the messenger service WhatsApp provided by WhatsApp Ireland Limited, 4 Grand Canal Square, Grand Canal Harbour, Dublin 2, Ireland. For this purpose, we use the so-called "business version" of WhatsApp.

If you contact us via WhatsApp regarding a specific matter (such as a placed order), we will store and use the mobile phone number you use on WhatsApp, as well as your first and last name (if provided), in accordance with Art. 6(1)(b) GDPR to process and respond to your inquiry. Based on the same legal grounds, we may ask you to provide further data (order number, customer number, address or email address) via WhatsApp in order to be able to assign your request to a specific process.

If you use our WhatsApp contact option for general inquiries (e.g., regarding our range of services, availability, or our website), we will store and use the mobile phone number you use on WhatsApp as well as—if provided – your first and last name in accordance with Art. 6(1)(f) GDPR based on our legitimate interest in the efficient and timely provision of the requested information.

Your data will only be used to answer your request via WhatsApp. We do not share this data with third parties.

Please note that WhatsApp Business has access to the address book of the mobile device we use for this purpose and automatically transfers phone numbers stored in the address book to a server of the parent company Meta Platforms Inc. in the USA. For the operation of our WhatsApp business account, we use a mobile device in whose address book only the WhatsApp contact details of users are stored who have contacted us via WhatsApp.

This ensures that every person whose WhatsApp contact details are stored in our address book has, upon first using the app on their device, consented to the transmission of their WhatsApp phone number from the address books of their chat contacts by accepting the WhatsApp Terms of Service, in accordance with Art. 6(1)(a) GDPR. The transmission of data from users who do not use WhatsApp and/or have not contacted us via WhatsApp is therefore not permissible.

For information on the purpose and scope of data collection, as well as the further processing and use of data by WhatsApp, and your related rights and settings options for protecting your privacy, please refer to WhatsApp’s privacy policy: https://www.whatsapp.com/legal/?eea=1#privacy-policy

Data may be transferred to servers of Meta Platforms Inc. in the USA as part of the above-described processing.

For data transfers to the USA, the provider has joined the EU-US Data Privacy Framework, which ensures compliance with European data protection standards based on an adequacy decision by the European Commission.

4.2 Whenever you contact us (e.g., via contact form or email), personal data will be processed exclusively for the purpose of processing and answering your request and only to the extent necessary for this purpose.

The legal basis for processing this data is our legitimate interest in responding to your inquiry in accordance with Art. 6(1)(f) of the GDPR. If the purpose of making contact is to enter into a contract, the additional legal basis for the processing is Art. 6(1)(b) of the GDPR. Your data will be deleted once the circumstances clearly show that the affected matter has been fully resolved and provided that there are no legal retention obligations.

5) Use of customer data for direct marketing

Direct mail advertising (Advertising via mail)
Based on our legitimate interest in personalized direct marketing, we reserve the right to store your first and last name, your mailing address, and—to the extent we have received additional information from you as part of our contractual relationship—your title, academic degree, year of birth, as well as your occupational title, industry or business name in accordance with Art. 6(1)(f) GDPR in order to use this data to send you interesting offers and information about our products by mail.
You may object to the storage and use of your data for this purpose at any time.

6) Processing data within the scope of order handling

6.1 Submission of image files via email for order processing

On our website, we offer customers the opportunity to request the personalization of products by sending image files via email. The submitted image will be used as a template for personalizing the selected product.

Using the email address provided through the website, the customer can send us one or more image files from the storage of the device being used. We collect, store, and use the files submitted in this manner solely for the purpose of producing the personalized product as described in the relevant service description on our website. If the submitted image files are shared with specific service providers for the purpose of fulfilling and processing your order, you will be explicitly informed about this in the following paragraphs. No further disclosure of your image files will take place. If the files or digital images you submit contain personal data (in particular images of identifiable individuals), all of the aforementioned processing steps are carried out exclusively for the purpose of processing your online order in accordance with Art. 6(1)(b) GDPR.

Once the order has been fully processed, the submitted image files will be automatically and completely deleted.

6.2 To the extent necessary for the performance of the contract serving delivery and payment purposes, the personal data we collect will be disclosed to the contracted shipping company and the contracted financial institution in accordance with Art. 6(1)(b) GDPR.

If we are bound by contract to provide you with updates on digital products or on goods containing digital elements, we will process the contact details you provided when placing your order (name, address, email address) to personally inform you about upcoming updates via an appropriate communication channel (such as by mail or email) within the legally prescribed timeframe, in accordance with our statutory information obligations under Art. 6(1)(c) GDPR. Your contact details will be used strictly for the purpose of sending you notifications on updates we are required to provide and will be processed by us solely for this purpose to the extent necessary to provide the relevant information.

To process your order, we also collaborate with the following service provider(s), who assist us, either fully or partially, in fulfilling the contracts we have entered into. Certain personal data will be disclosed to these service providers in accordance with the following information.

6.3 Disclosure of personal data to shipping service providers

– Deutsche Post

We cooperate with the following company as transport services provider: Deutsche Post AG, Charles-de-Gaulle-Straße 20, 53113 Bonn, Germany

We will share your email address and/or phone number with the provider in accordance with Art. 6(1)(a) GDPR prior to shipping the goods, for the purpose of coordinating a delivery date or notifying you of the delivery, provided that you have given your explicit consent for this purpose during the ordering process. If you have not given your consent, we will provide the transport services provider only with your name and delivery address in accordance with Art. 6(1)(b) GDPR for the delivery to take place. The disclosure of this data shall only take place if this is necessary for the delivery of goods. In this case, it is not possible to coordinate the delivery date with the supplier in advance or to provide an advice note.

Consent may be revoked at any time, with future effect, by notifying the data controller named above or the provider.
– DHL

As a transport services provider, we cooperate with the following company: DHL Paket GmbH, Sträßchensweg 10, 53113 Bonn, Germany

Consent may be revoked at any time, with future effect, by notifying the data controller named above or the provider.
– DHL Express

We cooperate with the following company as transport services provider: DHL Express Germany GmbH, Heinrich-Brüning-Str. 5, 53113 Bonn, Germany

Consent may be revoked at any time, with future effect, by notifying the data controller named above or the provider.
– Österreichische Post

We cooperate with the following company as transport services provider: Österreichische Post Aktiengesellschaft, Rochusplatz 1, 1030 Vienna, Austria

Consent may be revoked at any time, with future effect, by notifying the data controller named above or the provider.

6.4 Use of payment service providers (PSP)

– Stripe

This website offers one or more online payment methods from the following provider: Stripe Payments Europe Ltd., 1 Grand Canal Street Lower, Grand Canal Dock, Dublin, Ireland

If you select a payment method offered by the provider that requires you to pay in advance (such as credit card payment), your payment details provided during the ordering process (including your name, address, bank and payment card information, currency, and transaction number), as well as information about the contents of your order, will be shared with the provider in accordance with Art. 6(1)(b) GDPR. In this case, your data will be shared with the provider solely for the purpose of processing payments and only to the extent necessary for this purpose.

If you select a payment method that requires the seller to pay in advance (such as purchase on account, purchase in installments, or direct debit), you will be asked to provide certain personal information during the ordering process (first and last name, street, house number, ZIP code, city, date of birth, email address, phone number, and, if applicable, details for an alternative payment method).

In order to safeguard our legitimate interest in assessing our customers’ creditworthiness, we will forward this data to the provider in accordance with Art. 6(1)(f) GDPR for the purpose of conducting a credit check. The provider uses the personal information you have provided, along with other data (such as your shopping cart, invoice amount, order history, and payment history), to determine whether the payment method you have selected can be approved in terms of payment and/or credit default risks.

The credit rating information may include probability values (so-called score values). If score values are included in the credit rating information, they are based on a scientifically recognized mathematical and statistical method. The calculation of the score values includes, but is not limited to, address data.

You can object to this processing of your data at any time by sending a message to us or to the payment service provider. However, the provider may still be entitled to process your personal data if this is necessary for the contractual processing of payments.

7) Website functionalities

7.1 Youtube

This website uses plugins to show and play videos from the following provider: Google Ireland Limited, Gordon House, 4 Barrow St, Dublin, D04 E5W5, Ireland

Data may also be disclosed to: Google LLC., USA

When you visit a page on our website that contains such a plugin, your browser establishes a direct connection to the provider’s servers to load the plugin. Certain data, including your IP address, is transmitted to the provider.

If playback of embedded videos is initiated via the plugin, the provider also uses cookies to collect information about user behavior, generate playback statistics, and prevent abusive behavior.

If you are logged into your user account with the provider while visiting our website, your data will be directly linked to your account when you click on a video. If you do not want your data to be linked to your account, you must log out before pressing the play button.

All of the processing activities described, in particular the use of cookies to collect data from the device you are using, will only take place if you have given us your explicit consent in accordance with Art. 6(1)(a) GDPR. You may revoke your consent at any time with future effect by disabling this service using the “Cookie Consent Tool” provided on the website.

7.2 Google Maps

This website uses a web mapping platform from the following provider: Google Maps (API) by Google Ireland Limited, Gordon House, 4 Barrow St, Dublin, D04 E5W5, Ireland (“Google”)

Google Maps is a web service for displaying interactive maps to visualize geographic information. By using this service, our location will be displayed to you and it will become easier for you to find us.

As soon as you visit any of the subpages that include a Google Maps embed, information about your use of our website (such as your IP address) is transmitted to Google’s servers and stored there. This process may also involve a transfer to the servers of Google LLC in the USA. This happens regardless of whether Google provides a user account through which you are logged in or whether a user account exists. If you are logged in to Google, your data will be linked directly to your account. If you do not want your profile to be linked to Google, you must log out before clicking the button. Google stores your data (even if you are not logged in) as user profiles and analyzes them.

The collection, storage, and analysis of data are carried out in accordance with Art. 6(1)(f) GDPR, based on Google’s legitimate interest in displaying personalized advertisements, conducting market research, and/or tailoring Google websites to user needs. You have the right to object to the creation of these user profiles. To exercise this right, you must contact Google. If you do not consent to your data being transferred to Google when using Google Maps, you can also completely disable the Google Maps web service by turning off JavaScript in your browser. Google Maps—and the corresponding map display on this website—will then not be available.

To the extent required by law, we have obtained your consent to the processing of your data described above in accordance with Art. 6(1)(a) GDPR. You can revoke your consent at any time with future effect. To revoke your consent, please follow the procedure described above.

7.3 Google Maps API

To check if certain entries in the address form used for our online store’s checkout process contain input errors, we use the services of the following provider: Google Ireland Limited, Gordon House, 4 Barrow St, Dublin, D04 E5W5, Ireland

Data may also be disclosed to: Google LLC., USA

The provider validates the address entered, verifies the spelling and adds any missing data. If an address is ambiguous, correct alternative suggestions will be displayed. To do this, the address data you enter is transmitted to the provider, where it will be stored and analyzed.

This processing is carried out in accordance with Art. 6(1)(f) GDPR based on our legitimate interest in properly recording the customer’s correct address information in order to faithfully fulfill our contractual delivery obligations and to prevent issues with contract performance.

The provider processes the relevant data separately and does not merge it with other data sets. The provider deletes the data as soon as its status or accuracy has been confirmed, but no later than 30 days after collection.

7.4 Google Kundenrezensionen (ehemals Google Zertifizierter-Händler-Programm)

We cooperate with Google within the framework of the “Google Customer Reviews” program. The provider of this program is Google Ireland Limited, Gordon House, 4 Barrow St, Dublin, D04 E5W5, Ireland (“Google”). It allows us to collect customer reviews from users of our website. After making a purchase on our website, you will be asked to participate in a Google email survey.

If you give your consent in accordance with Art. 6(1)(a) GDPR, we will share your email address with Google. You will then receive an email from Google Customer Reviews asking you to rate your shopping experience on our website. Your rating will be pooled with ratings from other clients and displayed in our Google Customer Reviews Badge as well as our Merchant Center dashboard. In addition, your rating will be used for Google Seller Ratings. When using Google Customer Reviews, personal data may be transferred to the servers of Google LLC in the USA.

You can withdraw your consent to this transfer at any time by sending a message to the data controller or to Google.

7.5 Microsoft Teams

We use the following provider to conduct online meetings, video conferences and/or webinars: Microsoft Corporation, One Microsoft Way, Redmond, WA 98052-6399 USA

The provider processes various types of data. The scope of the data processed depends on what information you provide before or during your participation in an online meeting, video conference, or webinar. Being a communication participant, your data will be processed and stored on the provider's servers. This may include your login information (name, email address, phone number [optional], and password) and session data (topic, participant IP address, device information, description [optional]).

In addition, participants' video and audio contributions, as well as text entered in chats, may be processed.
The legal basis for the processing of personal data necessary for the performance of a contract with you (this also applies to processing operations necessary for the implementation of pre-contractual measures) is Art. 6(1)(b) GDPR. The processing of your data, to the extent you have given your consent, is based on Art. 6(1)(a) GDPR. You can revoke your consent at any time with future effect.
Furthermore, the legal basis for data processing in connection with the conduct of online meetings, video conferences, or webinars is our legitimate interest, pursuant to Art. 6(1)(f) GDPR, in the effective conduct of the online meeting, webinar, or video conference.

We have entered into a data processing agreement with the service provider that ensures the protection of our website visitors' data and prohibits unauthorized disclosure to third parties.

7.6 Microsoft Power BI

For the internal visualization of business processes and for user-defined business analyses, we use the service “Microsoft Power BI” provided by Microsoft Corporation, One Microsoft Way, Redmond, WA 98052-6399, USA. Personal data (of our customers) may be subject to visualization and analysis processes and may be processed by Microsoft BI for this purpose. In this context, Microsoft processes personal data as data processor bound by our instructions in accordance with Art. 28 GDPR and is bound by contract to protect this data in accordance with legal requirements.

To this end, Microsoft uses state-of-the-art encryption methods and ensures that all data processing takes place exclusively in data centers located within the EU.

8) Tools and miscellaneous

8.1 – DATEV

We use the cloud-based accounting software service from the following provider to handle our bookkeeping: DATEV eG, Paumgartnerstr. 6-14, 90429 Nuremberg, Germany

The provider processes our company’s incoming and outgoing invoices, as well as bank transactions where applicable, in order to automatically file invoices, match them with transactions, and use this data to generate administrative accounting records through a semi-automated process.

Such processing of personal data is carried out in accordance with Art. 6(1)(f) GDPR based on our legitimate interest in the efficient organization and documentation of our business processes.

8.2 Cookie-Consent-Tool

This website uses a “cookie consent tool” to obtain valid user consent for cookies and cookie-based applications that require consent. The “cookie consent tool” is displayed to users by way of an interactive user interface when they access the website. Using this interface, they can grant consent for specific cookies and/or cookie-based applications by checking the appropriate boxes. When using this tool, all cookies and services that require consent are loaded only after the user has given their consent by checking the appropriate boxes. This ensures that such cookies are only placed on the user’s device if consent has been given.

The tool sets strictly necessary cookies to store your cookie preferences. Personal data is generally not processed in this context.

If, in individual cases, personal data (such as the IP address) is processed for the purpose of storing, assigning or logging cookie settings, this is done in accordance with Art. 6(1)(f) GDPR on the basis of our legitimate interest in legally compliant, user-specific, and user-friendly consent management for cookies and, consequently, in the legally compliant design of our website.

Another legal basis for the processing is Art. 6(1)(c) GDPR. Acting as the data controller, we are legally required to allow the use of non-essential cookies only if we obtain the user’s consent.

We have entered into a data processing agreement with the service provider as far as is necessary to ensure the protection of our website visitors’ data and to prohibit its unauthorized disclosure to third parties

For further information on the operator and the settings options for the cookie consent tool, please refer to the relevant user interface on our website.

9) Rights of the data subject

9.1 Under applicable data protection law, you have the following rights as a data subject (rights of access and intervention) towards the controller about the processing of your personal data. Please refer to the following legal bases for the respective requirements for exercising these rights:

Right of access pursuant to Art. 15 GDPR;
Right to rectification pursuant to Art. 16 GDPR;
Right to erasure pursuant to Art.17 GDPR;
Right to restriction of processing pursuant to Art. 18 GDPR;
Notification obligation regarding rectification or erasure of personal data or restriction of processing pursuant to Art. 19 GDPR
Right to data portability pursuant to Art. 20 GDPR;
Right to withdraw consent pursuant to Art. 7(3) GDPR;
Right to lodge a complaint with a supervisory authority pursuant to Art. 7(3) GDPR;

9.2 RIGHT TO OBJECT

IF, AS PART OF A WEIGHING OF INTERESTS, WE PROCESS YOUR PERSONAL DATA BASED ON OUR PREVAILING LEGITIMATE INTEREST, YOU HAVE THE RIGHT TO OBJECT TO SUCH PROCESSING AT ANY TIME ON GROUNDS RELATING TO YOUR PARTICULAR SITUATION, WITH FUTURE EFFECT.

IF YOU EXERCISE YOUR RIGHT TO OBJECT, WE WILL STOP PROCESSING THE RELEVANT DATA. HOWEVER, WE RESERVE THE RIGHT TO CONTINUE PROCESSING YOUR DATA IF WE CAN DEMONSTRATE COMPELLING LEGITIMATE GROUNDS FOR THE PROCESSING THAT OVERRIDE YOUR INTERESTS, FUNDAMENTAL RIGHTS AND FREEDOMS, OR IF THE PROCESSING IS NECESSARY FOR THE ESTABLISHMENT, EXERCISE, OR DEFENSE OF LEGAL CLAIMS.

IF WE PROCESS YOUR PERSONAL DATA FOR DIRECT MARKETING PURPOSES, YOU HAVE THE RIGHT TO OBJECT AT ANY TIME TO THE PROCESSING OF YOUR PERSONAL DATA FOR THE PURPOSE OF SUCH MARKETING. YOU MAY EXERCISE YOUR RIGHT TO OBJECT AS DESCRIBED ABOVE.

IF YOU EXERCISE YOUR RIGHT TO OBJECT, WE WILL STOP PROCESSING THE RELEVANT DATA FOR THE PURPOSE OF DIRECT MARKETING.

10) Retention period for personal data

The retention period for personal data is determined by the applicable legal basis, the purpose of processing, and—where applicable—the relevant statutory retention period (e.g., retention periods according to commercial and tax law).

When processing personal data based on explicit consent pursuant to Art. 6(1)(a) GDPR, the data in question will be stored until you withdraw your consent.

If there are statutory retention periods for data processed in connection with contractual or quasi-contractual obligations pursuant to Art. 6(1)(b) GDPR, such data will be routinely deleted upon the expiration of the retention periods, provided that it is no longer necessary for the performance or initiation of a contract and/or we no longer have a legitimate interest to store it.

When processing personal data on the basis of Art. 6(1)(f) GDPR, this data will be stored until you exercise your right to object under Art. 21(1) GDPR, unless we can demonstrate compelling legitimate grounds for the processing that override your interests, rights, and freedoms, or the processing is necessary for the establishment, exercise, or defense of legal claims.

When processing personal data for the purpose of direct marketing pursuant to Art. 6(1)(f) GDPR, this data will be stored until you exercise your right to object under Art. 21(2) GDPR.

Unless otherwise specified in the information provided in this statement about specific processing situations, stored personal data will be deleted when it is no longer necessary to store it for the purposes for which it was collected or otherwise processed.