Privacy policy of the probefahrtenbutler.com website
Introduction and overview
We have prepared this privacy policy (version 30.10.2023-122328430) in order to provide you with information in accordance with the requirements of the General Data Protection Regulation (EU) 2016/679 and applicable national laws to explain which personal data (data for short) we as the controller – and the processors (e.g. providers) we commission – will process in the future and what lawful options you have. The terms used are to be understood as gender-neutral.
In short, we provide you with comprehensive information about data we process about you.
Privacy statements usually sound very technical and use legal terminology. This privacy policy, on the other hand, is intended to describe the most important things to you as simply and transparently as possible. To the extent that it is conducive to transparency, technical terms are explained in a reader-friendly manner, links to further information are provided and graphics are used. We thus inform you in clear and simple language that we only process personal data in the course of our business activities if there is a corresponding legal basis. This is certainly not possible by making the most concise, unclear and legalistic statements possible, as is often standard practice on the Internet when it comes to data protection. I hope you find the following explanations interesting and informative, and perhaps there is one or two pieces of information you did not know.
If you still have questions, we would like to ask you to contact the responsible office mentioned below or in the imprint, to follow the existing links and to look at further information on third party sites. Of course, you will also find our contact details in the imprint.
Scope
This data protection declaration applies to all personal data processed by us in the company and to all personal data processed by companies commissioned by us (order processors). By personal data, we mean information within the meaning of Art. 4 No. 1 DSGVO, such as a person’s name, e-mail address and postal address. The processing of personal data ensures that we can offer and invoice our services and products, whether online or offline. The scope of this privacy policy includes:
- all online presences (websites, online stores) that we operate
- Social media appearances and e-mail communication
- mobile apps for smartphones and other devices
- the applications “Test drive butler” see below.
In short, the data privacy statement applies to all areas in which personal data is processed in a structured manner within the company via the aforementioned channels. If we enter into legal relations with you outside of these channels, we will inform you separately if necessary.
Legal basis
In the following privacy policy, we provide you with transparent information on the legal principles and regulations, i.e. the legal basis of the General Data Protection Regulation, which enable us to process personal data.
As far as EU law is concerned, we refer to REGULATION (EU) 2016/679 OF THE EUROPEAN PARLIAMENT AND OF THE COUNCIL of 27 April 2016. You can, of course, read this EU General Data Protection Regulation online at EUR-Lex, the gateway to EU law, at https://eur-lex.europa.eu/legal-content/DE/ALL/?uri=celex%3A32016R0679.
We only process your data if at least one of the following conditions applies:
- Consent (Article 6(1) lit. a DSGVO): You have given us your consent to process data for a specific purpose. An example would be the storage of your entered data of a contact form.
- contract (Article 6(1)(b) DSGVO): In order to fulfill a contract or pre-contractual obligations with you, we process your data. For example, if we enter into a purchase agreement with you, we require personal information in advance.
- Legal obligation (Article 6(1)(c) DSGVO): If we are subject to a legal obligation, we process your data. For example, we are required by law to keep invoices for accounting purposes. These usually contain personal data.
- Legitimate interests (Article 6(1)(f) DSGVO): In the case of legitimate interests that do not restrict your fundamental rights, we reserve the right to process personal data. For example, we need to process certain data in order to operate our website in a secure and economically efficient manner. This processing is therefore a legitimate interest.
Other conditions, such as the performance of recordings in the public interest and the exercise of public authority and the protection of vital interests, do not usually arise in our case. If such a legal basis should be relevant, it will be indicated at the appropriate place.
In addition to the EU regulation, national laws also apply:
- In Austria, this is the Federal Act on the Protection of Individuals with regard to the Processing of Personal Data(Data Protection Act), or DSG for short.
- In Germany, the Federal Data Protection Act, or BDSG for short, applies.
If other regional or national laws apply, we will inform you about them in the following sections.
Contact details of the person responsible
If you have any questions about data protection or the processing of personal data, you will find the contact details of the person or body responsible below:
We have appointed an external data protection officer for our company:
DPO Consult GmbH
Karl Pusch (GF)
Joanneumring 18
8010 Graz
Austria
Phone: AT: 0800224488 DE: 08002244880
E-mail: dpo@dpo.at
Register court: GRAZ
Responsible data protection authority
The Data Protection Authority is the supervisory authority for data protection established in accordance with the General Data Protection Regulation (GDPR) and the Data Protection Directive for the law enforcement sector in Austria.
Austrian Data Protection Authority
Barichgasse 40-42
1030 Vienna
Phone: +43 1 521 52-25 69
E-mail: dsb@dsb.gv.at
Storage duration
The fact that we only store personal data for as long as is absolutely necessary for the provision of our services and products applies as a general criterion at our company. This means that we delete personal data as soon as the reason for the data processing no longer exists. In some cases, we are required by law to store certain data even after the original purpose has ceased to exist, for example for accounting purposes.
Should you wish your data to be deleted or revoke your consent to data processing, the data will be deleted as soon as possible and insofar as there is no obligation to store it.
We will inform you about the specific duration of the respective data processing below, provided that we have further information on this.
Rights under the General Data Protection Regulation
In accordance with Articles 13, 14 of the GDPR, we inform you about the following rights you have to ensure that data processing is fair and transparent:
- According to Article 15 of the GDPR, you have a right to information about whether we process data about you. If this is the case, you have the right to obtain a copy of the data and to know the following information:
- the purpose for which we carry out the processing;
- the categories, i.e. the types of data that are processed;
- who receives this data and, if the data is transferred to third countries, how security can be guaranteed;
- how long the data will be stored;
- the existence of the right to rectification, erasure or restriction of processing and the right to object to processing;
- that you can complain to a supervisory authority (links to these authorities can be found below);
- the origin of the data if we have not collected it from you;
- whether profiling is carried out, i.e. whether data is automatically evaluated to arrive at a personal profile of you.
- You have a right to rectify data according to Article 16 of the GDPR, which means that we must correct data if you find errors.
- According to Article 17 of the GDPR, you have the right to erasure (“right to be forgotten”), which specifically means that you may request the deletion of your data.
- According to Article 18 of the GDPR, you have the right to restriction of processing, which means that we may only store the data but not use it any further.
- According to Article 20 DSGVO, you have the right to data portability, which means that we will provide you with your data in a common format upon request.
- According to Article 21 of the GDPR, you have a right to object, which, once enforced, entails a change in processing.
- If the processing of your data is based on Article 6 para. 1 lit. e (public interest, exercise of official authority) or Article 6 para. 1 lit. f (legitimate interest), you may object to the processing. We will then check as quickly as possible whether we can legally comply with this objection.
- If data is used to conduct direct advertising, you can object to this type of data processing at any time. We may not use your data for direct marketing thereafter.
- If data is used to perform profiling, you can object to this type of data processing at any time. We may not use your data for profiling thereafter.
- According to Article 22 of the GDPR, you may have the right not to be subject to a decision based solely on automated processing (for example, profiling).
- You have the right to complain according to Article 77 of the GDPR. This means that you can complain to the data protection authority at any time if you believe that the data processing of personal data violates the GDPR.
In short, you have rights – do not hesitate to contact the responsible party listed above with us!
If you believe that the processing of your data violates data protection law or your data protection rights have been violated in any other way, you can complain to the supervisory authority. For Austria, this is the data protection authority, whose website can be found at https://www.dsb.gv.at/. In Germany, there is a data protection officer for each federal state. For more information, you can contact the Federal Commissioner for Data Protection and Freedom of Information (BfDI). The following local data protection authority is responsible for our company:
Data processing agreement (DPA)
In this section, we would like to explain what a data processing agreement is and why it is needed. Because the word “data processing agreement” is quite a mouthful, we will often only use the acronym DPA in this text. Like most companies, we do not work alone, but also use the services of other companies or individuals. Due to the involvement of various companies or service providers, we may pass on personal data for processing. These partners then act as processors with whom we conclude a contract, the so-called data processing agreement (DPA). The most important thing for you to know is that the processing of your personal data takes place exclusively in accordance with our instructions and must be regulated by the DPA.
Who are processors?
As a company and website owner, we are responsible for all data that we process from you. In addition to the responsible parties, there may also be so-called processors. This includes any company or person that processes personal data on our behalf. More precisely and according to the GDPR definition: any natural or legal person, public authority, agency or other body that processes personal data on our behalf is considered a processor. Processors can therefore be service providers such as hosting or cloud providers, payment or newsletter providers or large companies such as Google or Microsoft.
To make the terminology easier to understand, here is an overview of the three roles in the GDPR:
Data subject (you as a customer or interested party) → Controller (we as a company and client) → Processor (service provider such as web host or cloud provider)
Content of an order processing contract
As mentioned above, we have concluded a DPA with our partners who act as processors. Above all, it states that the processor processes the data to be processed exclusively in accordance with the GDPR. The contract must be concluded in writing, although the electronic conclusion of a contract is also deemed to be “in writing” in this context. Personal data is only processed on the basis of the contract. The contract must contain the following:
- Commitment to us as the responsible party
- Obligations and rights of the controller
- Categories of affected persons
- Type of personal data
- Nature and purpose of data processing
- Purpose and duration of data processing
- Place of data processing
Furthermore, the contract contains all obligations of the processor. The most important duties are:
- To ensure data security measures
- take possible technical and organizational measures to protect the rights of the data subject
- to maintain a data processing directory
- cooperate with the data protection supervisory authority at its request
- carry out a risk analysis in relation to the personal data received
- Sub-processors may only be commissioned with the written consent of the controller
You can see what an AVV looks like in concrete terms at https://www.wko.at/service/wirtschaftsrecht-gewerberecht/eu-dsgvo-mustervertrag-auftragsverarbeitung.html, for example. A sample contract is presented here.
Web hosting introduction
| Web hosting summary
👥 Data subjects: Visitors to the website |
What is web hosting?
Nowadays, when you visit websites, certain information – including personal data – is automatically created and stored, including on this website. This data should be processed as sparingly as possible and only with justification. By the way, by website we mean the entirety of all web pages on a domain, i.e. everything from the home page (homepage) to the very last subpage (like this one). By domain we mean, for example, example.de or sampleexample.com.
When you want to view a website on a computer, tablet, or smartphone, you use a program called a web browser to do so. You probably know a few web browsers by name: Google Chrome, Microsoft Edge, Mozilla Firefox, and Apple Safari. We say browser or web browser for short.
To view the website, the browser must connect to another computer where the website’s code is stored: the web server. Operating a web server is a complicated and costly task, which is why it is usually handled by professional providers. These offer web hosting and thus ensure reliable and error-free storage of website data. A whole lot of technical terms, but please stay tuned, it gets better!
When the browser connects to your computer (desktop, laptop, tablet or smartphone) and during data transfer to and from the web server, personal data may be processed. On the one hand, your computer stores data, on the other hand, the web server also needs to store data for a while to ensure proper operation.
A picture is worth a thousand words, so the following graphic illustrates the interaction between the browser, the Internet and the hosting provider.
Why do we process personal data?
The purposes of data processing are:
- Professional hosting of the website and securing its operation
- to maintain operational and IT security
- Anonymous evaluation of access behavior for the improvement of our offer and, if necessary, for criminal prosecution or the pursuit of claims
What data is processed?
Even while you are visiting our website right now, our web server, which is the computer on which this website is stored, usually automatically stores data such as
- the complete Internet address (URL) of the accessed web page
- Browser and browser version (e.g. Chrome 87)
- the operating system used (e.g. Windows 10)
- the address (URL) of the previously visited page (referrer URL) (e. g. B. https://www. beispielquellsite.de/vondabinichgekommen/)
- the hostname and IP address of the device being accessed from (e.g. COMPUTERNAME and 194.23.43.121)
- Date and time
- in files, the so-called web server log files
How long is data stored?
As a rule, the above data is stored for two weeks and then automatically deleted. We do not pass on this data, but we cannot rule out the possibility that this data may be viewed by the authorities in the event of unlawful conduct.
In short, your visit is logged by our provider (company that runs our website on special computers (servers)), but we do not share your information without consent!
Legal basis
The lawfulness of the processing of personal data in the context of web hosting results from Art. 6 para. 1 lit. f DSGVO (protection of legitimate interests), because the use of professional hosting with a provider is necessary to present the company on the Internet in a secure and user-friendly manner and to be able to pursue attacks and claims from this if necessary.
As a rule, there is a contract between us and the hosting provider for commissioned processing pursuant to Art. 28 f. DSGVO, which ensures compliance with data protection and guarantees data security.
ALL-INKL privacy policy
We use ALL-INKL, a web hosting provider, for our website. The service provider is the German company ALL-INKL.COM – Neue Medien Münnich, Hauptstraße 68, 02742 Friedersdorf, Germany.
You can find out more about the data processed through the use of ALL-INKL in the privacy policy at https://all-inkl.com/datenschutzinformationen/
.
Order processing contract (AVV) ALL-INKL
We have concluded a data processing agreement (DPA) with ALL-INKL in accordance with Article 28 of the General Data Protection Regulation (GDPR). You can find out exactly what a DPA is and, above all, what must be included in a DPA in our general section “Data processing agreement (DPA)”.
This contract is required by law because ALL-INKL processes personal data on our behalf. This clarifies that ALL-INKL may only process data that it receives from us in accordance with our instructions and must comply with the GDPR.
Web design introduction
| Web design privacy policy summary
👥 Data subjects: Visitors to the website |
What is web design?
We use various tools on our website that serve our web design. Web design is not, as often assumed, just about making our website look pretty, but also about functionality and performance. But of course, the appropriate look of a website is also one of the great goals of professional web design. Web design is a branch of media design and deals with the visual as well as the structural and functional design of a website. The goal is to improve your experience on our website with the help of web design. In web design jargon, this is referred to as user experience (UX) and usability. User experience refers to all impressions and experiences that the website visitor experiences on a website. A sub-item of user experience is usability. This is about the user-friendliness of a website. The main focus here is on ensuring that content, subpages or products are clearly structured and that you can easily and quickly find what you are looking for. To provide you with the best possible experience on our website, we also use so-called third-party web design tools. In this privacy policy, the category “web design” therefore includes all services that improve the design of our website. This can be, for example, fonts, various plugins or other integrated web design functions.
Why do we use web design tools?
How you absorb information on a website depends very much on the structure, functionality and visual perception of the website. Therefore, a good and professional web design became more and more important for us as well. We are constantly working to improve our website and also see this as an extended service to you, the website visitor. Furthermore, a beautiful and functioning website also has economic advantages for us. After all, you will only visit us and take advantage of our offers if you feel completely comfortable.
What data is stored by web design tools?
When you visit our website, web design elements may be embedded in our pages that may also process data. Exactly what data is involved depends, of course, heavily on the tools used. Further below you can see exactly which tools we use for our website. We recommend that you also read the respective privacy policy of the tools used for more detailed information on data processing. In most cases, you will find out there which data is processed, whether cookies are used and how long the data is stored. Through fonts such as Google Fonts, for example, information such as language settings, IP address, browser version, browser screen resolution and browser name are also automatically transmitted to Google servers.
Duration of data processing
How long data is processed is very individual and depends on the web design elements used. For example, when cookies are used, the retention period can be as short as a minute or as long as a few years. Please do your research in this regard. For this purpose, we recommend on the one hand our general text section on cookies as well as the privacy statements of the tools used. There you will usually find out exactly which cookies are used and what information is stored in them. Google font files, for example, are stored for one year. This is to improve the loading time of a website. In principle, data is always kept only as long as is necessary for the provision of the service. In the case of legal requirements, data may also be stored for longer periods.
Right of objection
You also have the right and the possibility to revoke your consent to the use of cookies or third-party providers at any time. This works either via our cookie management tool or via other opt-out functions. You can also prevent data collection through cookies by managing, disabling or deleting cookies in your browser. However, among web design elements (mostly with fonts) there is also data that cannot be deleted quite so easily. This is the case when data is automatically collected directly when a page is accessed and transmitted to a third-party provider (such as Google). Then please contact the support of the corresponding provider. In Google’s case, you can reach support at https://support.google.com/?hl=de.
Legal basis
If you have consented to web design tools being used, the legal basis of the corresponding data processing is this consent. This consent constitutes, according to Art. 6 para. 1 lit. a DSGVO (consent) constitutes the legal basis for the processing of personal data as it may occur during the collection by web design tools. From our side, there is also a legitimate interest to improve the web design on our website. After all, only then we can provide you with a beautiful and professional web offer. The corresponding legal basis for this is Art. 6 para. 1 lit. f DSGVO (Legitimate Interests). Nevertheless, we only use web design tools if you have given your consent. In any case, we want to emphasize that again here.
Information on specific web design tools – if available – is provided in the following sections.
Google Fonts Privacy Policy
| Google Fonts Privacy Policy Summary
👥 Data subjects: Visitors to the website |
What are Google Fonts?
On our website we use Google Fonts. These are the “Google Fonts” of the company Google Inc. For the European area, the company Google Ireland Limited (Gordon House, Barrow Street Dublin 4, Ireland) is responsible for all Google services.
You do not need to log in or set a password to use Google Fonts. Furthermore, no cookies are stored in your browser. The files (CSS, fonts) are requested via the Google domains fonts.googleapis.com and fonts.gstatic.com. According to Google, CSS and fonts requests are completely separate from all other Google services. If you have a Google account, you do not need to worry that your Google account data, while using Google Fonts, will be transmitted to Google. Google records the use of CSS (Cascading Style Sheets) and the fonts used and stores this data securely. We will take a detailed look at how the data storage looks exactly.
Google Fonts (formerly Google Web Fonts) is a directory of over 800 fonts that Google makes available to your users for free.
Many of these fonts are released under the SIL Open Font License, while others are released under the Apache license. Both are free software licenses.
Why do we use Google Fonts on our website?
With Google Fonts, we can use fonts on our own website, and not have to upload them to our own server. Google Fonts is an important component to keep the quality of our website high. All Google fonts are automatically optimized for the web and this saves data volume and is a great advantage especially for use on mobile devices. When you visit our site, the low file size ensures fast loading time. Furthermore, Google Fonts are secure web fonts. Different image synthesis systems (rendering) in different browsers, operating systems and mobile devices can lead to errors. Such errors can sometimes visually distort texts or entire web pages. Thanks to the fast Content Delivery Network (CDN), there are no cross-platform issues with Google Fonts. Google Fonts supports all major browsers (Google Chrome, Mozilla Firefox, Apple Safari, Opera) and works reliably on most modern mobile operating systems, including Android 2.2+ and iOS 4.2+ (iPhone, iPad, iPod). So we use the Google Fonts so that we can present our entire online service as beautifully and consistently as possible.
What data is stored by Google?
When you visit our website, the fonts are reloaded via a Google server. This external call transmits data to the Google servers. In this way, Google also recognizes that you or your IP address visited our website. The Google Fonts API is designed to reduce the use, storage, and collection of end-user data to what is necessary for proper font delivery. By the way, API stands for “Application Programming Interface” and serves, among other things, as a data transmitter in the software field.
Google Fonts stores CSS and font requests securely at Google and is therefore protected. By collecting usage figures, Google can determine how well each font is received. Google publishes the results on internal analytics pages, such as Google Analytics. In addition, Google also uses data from its own web crawler to determine which web pages use Google fonts. This data is published in Google Fonts’ BigQuery database. Entrepreneurs and developers use Google’s BigQuery web service to explore and move large amounts of data.
It should be noted, however, that each Google Font request also automatically transmits information such as language settings, IP address, browser version, browser screen resolution, and browser name to the Google servers. Whether this data is also stored cannot be clearly determined or is not clearly communicated by Google.
How long and where is the data stored?
Google stores requests for CSS assets for one day on its servers, which are mainly located outside the EU. This allows us to use fonts with the help of a Google stylesheet. A stylesheet is a format template that can be used to quickly and easily change the design or font of a web page, for example.
The font files are stored by Google for one year. Google thus pursues the goal of fundamentally improving the loading time of websites. When millions of web pages reference the same fonts, they are cached after the first visit and immediately reappear on all other web pages visited later. Sometimes Google updates font files to reduce file size, increase language coverage, and improve design.
How can I delete my data or prevent data storage?
The data that Google stores for a day or a year cannot simply be deleted. The data is automatically transmitted to Google when the page is called up. To delete this data prematurely, you must contact Google support at https://support.google.com/?hl=de&tid=122328430. Data storage you prevent in this case only if you do not visit our site.
Unlike other web fonts, Google allows us unlimited access to all fonts. So we can access an unlimited sea of fonts and get the most out of our website. You can find out more about Google Fonts and other questions at https://developers.google.com/fonts/faq?tid=122328430. There, Google addresses privacy-related matters, but really detailed information about data storage is not included. It is relatively difficult to get really precise information from Google about stored data.
Legal basis
If you have consented to Google Fonts being used, the legal basis for the corresponding data processing is this consent. This consent represents according to Art. 6 par. 1 lit. a GDPR (Consent) constitutes the legal basis for the processing of personal data as may occur during the collection by Google Fonts.
On our part, there is also a legitimate interest in using Google Font to optimize our online service. The legal basis for this is Art. 6 par. 1 lit. f DSGVO (Legitimate Interests). Nevertheless, we only use Google Font if you have given your consent.
Google also processes data from you in the USA, among other places. Google is an active participant in the EU-US Data Privacy Framework, which regulates the correct and secure transfer of personal data of EU citizens to the US. You can find more information about this at https://commission.europa.eu/document/fa09cbad-dd7d-4684-ae60-be03fcb0fddf_en.
In addition, Google uses so-called standard contractual clauses (= Art. 46. para. 2 and 3 DSGVO). Standard Contractual Clauses (SCC) are templates provided by the EU Commission and are intended to ensure that your data complies with European data protection standards even if it is transferred to and stored in third countries (such as the USA). Through the EU-US Data Privacy Framework and through the standard contractual clauses, Google undertakes to comply with the European level of data protection when processing your relevant data, even if the data is stored, processed and managed in the USA. These clauses are based on an implementing decision of the EU Commission. You can find the decision and the corresponding standard contractual clauses here, among other places: https://eur-lex.europa.eu/eli/dec_impl/2021/914/oj?locale=de
The Google Ads Data Processing Terms, which reference the Standard Contractual Clauses, can be found at https://business.safety.google/intl/de/adsprocessorterms/.
You can also find out what data is generally collected by Google and what it is used for at https://www.google.com/intl/de/policies/privacy/.
Explanation of used terms
We always try to write our privacy policy as clear and understandable as possible. However, this is not always easy, especially when it comes to technical and legal topics. It often makes sense to use legal terms (such as personal data) or certain technical terms (such as cookies, IP address). However, we would not like to use them without explanation. Below you will now find an alphabetical list of important terms used that we may not have adequately addressed in the previous privacy statement. If these terms are taken from the GDPR and are definitions, we will also cite the GDPR texts here and add our own explanations if necessary.
Processor
Definition according to Article 4 of the GDPR
For the purposes of this Regulation, the term:
“Processor” means a natural or legal person, public authority, agency or other body which processes personal data on behalf of the Controller;
Explanation: As a company and website owner, we are responsible for all data that we process from you. In addition to the responsible parties, there may also be so-called processors. This includes any company or person that processes personal data on our behalf. In addition to service providers such as tax advisors, processors can also include hosting or cloud providers, payment or newsletter providers, or large companies such as Google or Microsoft.
Consent
Definition according to Article 4 of the GDPR
For the purposes of this Regulation, the term:
“Consent” of the data subject means any freely given specific, informed and unambiguous indication of his or her wishes in the form of a statement or other unambiguous affirmative act by which the data subject signifies his or her agreement to the processing of personal data relating to him or her;
Explanation: As a rule, websites provide such consent via a cookie consent tool. I’m sure you’re familiar with this. Whenever you visit a website for the first time, you are usually asked via a banner whether you agree or consent to data processing. In most cases, you can also make individual settings and thus decide for yourself which data processing you allow and which you do not. If you do not consent, no personal data of yours may be processed either. In principle, consent can of course also be given in writing, i.e. not via a tool.
Personal data
Definition according to Article 4 of the GDPR
For the purposes of this Regulation, the term:
“personal data”
any information relating to an identified or identifiable natural person (hereinafter referred to as “data subject”); an identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person;
Explanation: Personal data is therefore all data that can identify you as a person. This is usually data such as:
- Name
- Address
- E-mail address
- Postal address
- Phone number
- Date of birth
- Identification numbers such as social security number, tax identification number, identity card number or matriculation number
- Bank data such as account number, credit information, account balances, and more.
According to the European Court of Justice (ECJ), your IP address is also considered personal data. IT experts can use your IP address to at least determine the approximate location of your device and, subsequently, you as the connection owner. Therefore, the storage of an IP address also requires a legal basis within the meaning of the GDPR. There are also so-called “special categories” of personal data, which also require special protection. These include:
- racial and ethnic origin
- political opinions
- religious or ideological convictions
- the union affiliation
- Genetic data, such as data taken from blood or saliva samples
- biometric data (this is information on mental, physical or behavioral characteristics that can identify a person).
Health data - Data on sexual orientation or sexual life
Profiling
Definition according to Article 4 of the GDPR
For the purposes of this Regulation, the term:
“Profiling” any form of automated processing of personal data consisting of the use of personal data to evaluate certain personal aspects relating to a natural person, in particular to analyze or predict aspects concerning that natural person’s performance at work, economic situation, health, personal preferences, interests, reliability, behavior, location or movements;
Explanation: Profiling involves gathering various pieces of information about a person in order to learn more about that person. In the web sector, profiling is often used for advertising purposes or even for credit checks. For example, web or advertising analytics programs collect data about your behavior and interests on a website. This results in a special user profile that can be used to target advertising to a specific group.
Person responsible
Definition according to Article 4 of the GDPR
For the purposes of this Regulation, the term:
“Responsible person” the natural or legal person, public authority, agency or other body which, alone or jointly with others, determines the purposes and means of the processing of personal data; where the purposes and means of such processing are determined by Union or Member State law, the controller or the specific criteria for its nomination may be provided for by Union or Member State law;
Explanation: In our case, we are responsible for the processing of your personal data and are therefore the “controller”. If we pass on collected data to other service providers for processing, these are “processors”. An “order processing contract (AVV)” must be signed for this.
Processing
Definition according to Article 4 of the GDPR
For the purposes of this Regulation, the term:
“Processing”
any operation or set of operations which is performed on personal data or on sets of personal data, whether or not by automated means, such as collection, recording, organization, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure or destruction;
Note: When we refer to processing in our Privacy Policy, we mean any type of data processing. This includes, as mentioned above in the original GDPR statement, not only the collection but also the storage and processing of data.
When using the test drive butler applications:
Booking process:
Responsible: Organizer
Order data processor: Butler Solutions GmbH
As part of the booking process for test drives, the organizer acts as the data controller under data protection law, while the test drive butler acts as the data processor. In special cases, the test drive butler can also act as the organizer. In this case, the is Butler Solutions GmbH is also responsible for bookings in accordance with EU-DSGVO Art. 4 para. 7 to see. The personal data required for the booking includes address data, driver’s authorization, name and the choice of vehicle. This data is processed by Probefahrten Butler on behalf of the organizer and stored and protected in accordance with the applicable data protection regulations.
Offsetting:
Responsible: Butler Solutions GmbH
The test drive butler is responsible under data protection law for the billing of the test drives. In this role, Probefahrten Butler processes your personal data necessary for processing the payment in compliance with strict data protection standards and laws.
Marketing:
Joint responsible parties: Butler Solutions GmbH, vehicle manufacturers and dealers
In the case of marketing activities, Probefahrten Butler, the vehicle manufacturer and the dealer assume joint responsibility for the processing of your personal data. This data is used for marketing purposes and for direct contact electronically (e-mail, chat, messenger services) or by telephone. We are committed to protecting your rights and privacy and are transparent about how your data is used for marketing purposes.
General provisions:
Data transmission:
Your personal data will not be transferred to countries outside the European Union.
Duration of storage:
Your personal data will be stored until the legal basis according to Art. 6 para. 1 lit. b or until revocation of your consent according to Art. 6 para. 1 lit. a, or as long as it is necessary for the fulfillment of the respective purposes.
Specifically: Booking: until the test drive is carried out plus 1 month after the end of the test drive due to the discovery of damage or accidents in connection with the booking.
Offsetting: 7 years according to § 132 BAO
Marketing: Until revoked in accordance with Art. 6 para. 1 lit. a.
Rights of the data subjects:
You have the right to access, rectification, erasure of your personal data, the right to restriction of processing, the right to data portability and the right to object to processing. You also have the right to withdraw your consent at any time. If you have any complaints, you can contact the competent supervisory authority.
Data source:
Personal data is collected directly from data subjects who wish to take a test drive or make use of other services offered.
Closing words
Congratulations! If you are reading these lines, you have really “fought” your way through our entire privacy policy, or at least scrolled all the way to here. As you can see from the scope of our privacy policy, we take the protection of your personal data, anything but lightly.
It is important to us to inform you to the best of our knowledge and belief about the processing of personal data. However, we do not only want to tell you what data is processed, but also to explain the reasons for using various software programs. As a rule, privacy policies sound very technical and legalistic. However, since most of you are not web developers or lawyers, we also wanted to take a different approach linguistically and explain the facts in simple and clear language. Of course, this is not always possible due to the subject matter. Therefore, the most important terms are explained in more detail at the end of the privacy policy.
If you have any questions about data protection on our website, please do not hesitate to contact us or the responsible office. Have a nice time and we hope to see you on our website again soon.
All texts are protected by copyright.