Privacy Policy

Types of data processed

Inventory data (e.g., personnel master data, names, addresses)
Contact data (e.g., e-mail addresses, telephone numbers)
Content data (e.g., text entries, photographs, videos)
Usage data (e.g., websites visited, interest in content, access times)
Meta/communication data (e.g., device information, IP addresses)

Categories of data subjects

Visitors and users of the online offer (hereinafter collectively also referred to as “users”).

Purpose of processing

Provision of the online offer, its functions and contents
Processing of service or product enquiries and orders
Responding to requests for information and communicating with users
To detect, prevent and investigate attacks on our website and to ensure a secure and stable Internet presence.
Reach Measurement/Marketing

Terms used

‘personal data’ means any information relating to an identified or identifiable natural person (‘data subject’); an identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person.

‘processing’ means any operation or set of operations which is performed on personal data or on sets of personal data, whether or not by automated means. The term reaches far and covers practically every handling of data.

‘profiling’ means any form of automated processing of personal data consisting of the use of personal data to evaluate certain personal aspects relating to a natural person, in particular to analyse or predict aspects concerning that natural person’s performance at work, economic situation, health, personal preferences, interests, reliability, behaviour, location or movements.

‘pseudonymisation’ means the processing of personal data in such a manner that the personal data can no longer be attributed to a specific data subject without the use of additional information, provided that such additional information is kept separately and is subject to technical and organisational measures to ensure that the personal data are not attributed to an identified or identifiable natural person.

‘controller’ means the natural or legal person, public authority, agency or other body which, alone or jointly with others, determines the purposes and means of the processing of personal data.

‘processor’ means a natural or legal person, public authority, agency or other body which processes personal data on behalf of the controller.

Applicable legal bases

For users from the scope of the general data protection regulation (GDPR), i.e. the EU and the EEC, the following legal basis for our data processing applies, if the legal basis is not mentioned in the data protection policy, in accordance with art. 13 GDPR:

The legal basis for obtaining consent is Art. 6 para. 1 lit. a and Art. 7 GDPR;

The legal basis for the processing for the fulfilment of our services and the implementation of contractual measures as well as the answering of inquiries is Art. 6 para. 1 lit. b GDPR;

The legal basis for the processing for the fulfilment of our legal obligations is Art. 6 para. 1 lit. c GDPR;
In the event that vital interests of the data subject or another natural person necessitate the processing of personal data, Art. 6 para. 1 lit. d GDPR serves as the legal basis.

The legal basis for the processing necessary for the performance of a task carried out in the public interest or in the exercise of official authority entrusted to the controller is Art. 6 para. 1 lit. e GDPR.

The legal basis for the processing to safeguard our legitimate interests is Art. 6 para. 1 lit. f GDPR.

The processing of data for purposes other than those for which they were collected is governed by the provisions of Art. 6 para. 4 GDPR.

The processing of special categories of data (pursuant to Art. 9 para. 1 GDPR) is governed by the provisions of Art. 9 para. 2 GDPR.

Data protection measures

We take appropriate technical and organisational measures in accordance with the legal requirements, taking into account the state of the art, the implementation costs and the type, scope, circumstances and purposes of the processing as well as the different probability of occurrence and severity of the risk to the rights and freedoms of natural persons, in order to ensure a level of protection appropriate to the risk.

Measures shall include, in particular, ensuring the confidentiality, integrity and availability of data by controlling physical access to, as well as the concerning access to, inputting, disclosure, securing and separation of data. In addition, we have established procedures to ensure the exercise of data subjects’ rights, deletion of data and reaction to data threats.

Furthermore, we take the protection of personal data into account already during the development or selection of hardware, software and processes, in accordance with the principle of data protection through technology design and privacy by default.

Data recipients

Personal data is processed by CHEMstone GmbH according to the principle of data minimization and is only accessible to persons in the relevant departments who have to process the data in order to fulfil their tasks. Insofar as we disclose data to other persons and companies (processors, jointly responsible persons or third parties) within the scope of our processing, transfer them to them or otherwise grant them access to the data, this shall only take place on the basis of legal permission (e.g. if a transfer of the data to third parties, such as payment service providers, is necessary for the fulfilment of the contract), users have consented, a legal obligation requires this or on the basis of our legitimate interests (e.g. when using agents, web hosts, etc.).

Insofar as we disclose, transmit or otherwise grant access to data to other companies of our group of companies, this is done in particular for administrative purposes as a legitimate interest and beyond that on a basis corresponding to the legal requirements.

Transfers of personal data to third countries

If we transmit data to recipients in countries outside the European Union or the European Economic Area, this will only take place if it is done to fulfil our (pre)contractual obligations, on the basis of your consent, a legal obligation or on the basis of our legitimate interests. Subject to express consent or contractually required transfer, we process or allow the data to be processed only in third countries with a recognised level of data protection, which includes US processors certified under the “Privacy Shield” or on the basis of special guarantees, such as a contractual obligation through so-called standard protection clauses of the EU Commission, the existence of certifications or binding internal data protection regulations (Art. 44 to 49 GDPR, information page of the EU Commission).

Rights of the data subject

Under applicable data protection law, under certain conditions you have a right to (i) be informed about your stored data, (ii) rectification, (iii) restrict processing, (iv) erasure/be forgotten, (v) data portability, (vi) revocation of your consent and (vii) objection.

To exercise these rights, please contact us using the contact details below.

You also have the right to lodge a complaint with the competent supervisory authority in accordance with legal requirements.

Of course, you are also welcome to contact us directly at any time if you have any questions, comments or complaints in connection with this privacy statement.

Right of revocation

You have the right to withdraw your consent at any time with effect for the future.

Cookies

A cookie is a small text file that is stored on your computer or mobile device if your web browser allows it. You can set your web browser to refuse cookies or to notify you before they are stored.

The use of cookies serves on the one hand to make the use of our offer more pleasant for you. For example, we use so-called session cookies to recognize that you have already visited individual pages on our website. These are automatically deleted after leaving our site.

In addition, we also use temporary cookies to optimize user-friendliness, which are stored on your terminal device for a specified period of time. If you visit our site again in order to use our services, it is automatically recognized that you have already been with us and which inputs and settings you have made so that you do not have to enter them again.

On the other hand, we use cookies in order to statistically record the use of our website and to evaluate it for the purpose of optimizing our offer for you. These cookies enable us to automatically recognize that you have already visited our site when you visit it again. These cookies are automatically deleted after a defined period of time.

The data processed by cookies are necessary for the mentioned purposes to safeguard our legitimate interests and those of third parties in accordance with Art. 6 para. 1 lit. f GDPR. You can configure your browser settings according to your wishes and, for example, refuse the acceptance of third-party cookies or all cookies. Stored cookies can be deleted in the system settings of the browser. We would like to inform you that the exclusion of cookies may lead to functional limitations of this online service.

The legal basis for the use of cookies is Art. 6 para. 1 lit. f GDPR.

Retention periods

The data processed by us will be kept by us for as long as is necessary to provide the requested service to you. If CHEMstone GmbH no longer needs the personal data to comply with contractual or legal obligations, they will be deleted from our systems or anonymised accordingly so that identification is not possible, unless CHEMstone GmbH has to store the information, including your personal data, in order to comply with legal or official obligations to which it is subject.

If personal data are not deleted because they are required for other and legally permissible purposes, their processing will be restricted. This means that the data will be blocked and not processed for other purposes. This applies, for example, to data that must be stored for commercial or tax reasons.

Changes and updates to the privacy policy

Please note that this privacy policy will be subject to periodic revision as changes in our data processing practices make this necessary. We ask you to inform yourself regularly about the content of our privacy policy. We will inform you as soon as the changes require your cooperation (e.g. consent) or other individual notification.

Business-related processing

Additionally, we process:

contract data (e.g. object of content, term, customer category)
payment data (e.g. bank details, payment history)

of our customers, interested parties and business partners for the purpose of providing contractual services, service and customer care, marketing, advertising and market research.

TLS encryption with HTTPS

We use https to transmit data encrypted on the Internet (data protection through technology design Art. 25 para. 1 GDPR). Through the use of TLS (Transport Layer Security), an encryption protocol for secure data transmission on the Internet, we can ensure the protection of confidential data. You can recognize the use of this data transmission security by the small lock symbol in the top left corner of the browser address bar and the use of the https scheme (instead of http) as part of our Internet address.

Make contact

You have the possibility to request information about our company, our products and activities or events via a contact form on our website, by telephone, e-mail or social media. When you contact us, the data you provide us with (title, first and last name, contact data, content of your enquiry and any other information provided by you) will be processed by us in order to answer your questions and process your request.

You are free to provide us with your data for your enquiry. However, if you do not provide us with this data, we may not be able to treat your request accordingly.

Data processing, as a result of contacting us, will be carried out in accordance with Art. 6 Para. 1 lit. b GDPR in order to process your enquiry. The user data can be stored in a customer relationship management system (“CRM system”) or comparable system.

The data will be kept as long as the contact with the person concerned exists and deleted if they are no longer necessary. We check the necessity every two years; furthermore, the legal archiving obligations apply.

You can subscribe to our newsletter and other mailings to receive information about the latest topics about our company, our services, events and other information material.

Required information is marked in the particular form. In addition to the e-mail address on some forms, the name is also required for sending the newsletter in order to address you personally in the newsletter.

In addition, the following data is collected during registration, IP address of the calling computer and date and time of registration. The collection of this data as part of the registration process serves to prevent misuse of the services or the e-mail address used.

The legal basis for the aforementioned data processing is Art. 6 para. 1 lit a GDPR. The use of the data for this purpose complies with the provisions of communications law, in particular Art. 107 TKG 2003.

We use IT and marketing service providers for the dispatch of the newsletter who only have access to personal data in accordance with our order and instructions in order to be able to provide the commissioned services.

The subscription to the newsletter and other mailings can be cancelled at any time. You have the option of refusing to receive future newsletters and e-mails electronically, free of charge and without any problems, at any time after they have been sent to you.

The data arising in this connection will be stored as long as you have subscribed to the newsletter and therefore until you revoke your consent.

Newsletter – success measurement

The newsletters contain a so-called “web-beacon”, i.e. a file the size of a pixel, which is retrieved from our server when the newsletter is opened or, if we use a dispatch service provider, from its server. Within the scope of this retrieval, technical information such as information about the browser and your system, as well as your IP address and time of retrieval are initially collected.

This information is used to technically improve the services on the basis of technical data or target groups and their reading behaviour on the basis of their retrieval locations (which can be determined with the help of the IP address) or access times. The statistical surveys also include determining whether the newsletters are opened, when they are opened and which links are clicked. For technical reasons, this information can be assigned to the individual newsletter recipients. It is, however, neither our intention nor, if used, that of the dispatch service provider to observe individual users. The evaluations serve us much more to recognise the reading habits of our users and to adapt our content to them or to send different content according to the interests of our users.

A separate revocation of the performance measurement is unfortunately not possible, in which case the entire newsletter subscription must be cancelled.

Hosting and E-Mail dispatch

The hosting services used by us serve the availability of the following services: Infrastructure and platform services, computing capacity, storage space and database services, e-mail dispatch, security services and technical maintenance services which we use for the purpose of operating this online service.

Here we, or our hosting provider, process inventory data, contact data, content data, contract data, usage data, meta data and communication data of customers, interested parties and visitors to this online service on the basis of our legitimate interests in the efficient and secure availability of this online service in accordance with Art. 6 para. 1 lit. f GDPR in conjunction with Art. 28 GDPR (conclusion of an processor contract).

Collection of access data and log files

When using our website, our system automatically collects data and information from the computer system of the calling computer. The following data is collected automatically via log files:

Websites that are called up by the user’s system via our website
Websites from which the user’s system accesses our website
Amount of data sent in bytes
Notification of successful retrieval
Browser type and version used
Operating system of the user
IP address
Date and time of access
Referrer URL (the previously visited page)
The requesting provider

CHEMstone does not draw any conclusions about the data subject from these transmitted data. This data is used for technical reasons, in particular to ensure a secure and stable Internet presence, for example to detect, prevent and investigate attacks on our website. The storage of the IP address by the system is necessary to enable delivery of the website to the user’s computer. For this purpose, the IP address of the user must remain stored for the duration of the session. In addition, data is stored in log files to ensure the functionality of the website and to optimise the website.

Logfile information is stored for security reasons (e.g. to clarify misuse or fraud) for a maximum period of 7 days and then deleted. Data, the further storage of which is necessary for evidence purposes, are excluded from deletion until the respective incident has been finally clarified. This storage takes place on the legal basis of Art. 6 para. 1 lit. f) GDPR. The collection of data for the provision of the website and the storage of data in log files is mandatory for the operation of the website. The user is therefore not entitled to object according to Art 21 GDPR. This data will not be passed on to other third parties for their own purposes without your consent.

For the operation and administration of the website, we use IT service providers who, in accordance with our instructions, may also have access to personal data in order to be able to provide the commissioned services.

Google Fonts

We use Google Fonts of the company Google Inc. (1600 Amphitheatre Parkway Mountain View, CA 94043, USA) on our website. According to Google, user data is used solely for the purpose of displaying fonts in the user’s browser. The integration takes place on the basis of our legitimate interests in a technically secure, maintenance-free and efficient use of fonts, their uniform presentation and consideration of possible licensing restrictions for their integration.

You can read about which data is collected by Google and what this data is used for at https://www.google.com/intl/de/policies/privacy/.

Google Analytics

This website uses Google Analytics, a web analytics service provided by Google Inc. (“Google”). Google Analytics uses “cookies”, which are text files placed on your computer, to help the website analyse how users use the site. The information generated by the cookie about your use of the website will generally be transmitted to and stored by Google on servers in the United States. However, if IP anonymisation is activated on this website, your IP address will be shortened beforehand by Google within member states of the European Union or in other signatory states to the Agreement on the European Economic Area. Only in exceptional cases will the full IP address be transmitted to a Google server in the USA where it will be shortened. On behalf of the operator of this website, Google will use this information to evaluate your use of the website, to compile reports on website activity and to provide other services relating to website activity and internet usage for the website operator. The IP address transmitted by your browser as part of Google Analytics is not combined with other data from Google. You may refuse the use of cookies by selecting the appropriate settings on your browser, however please note that if you do this you may not be able to use the full functionality of this website. In addition, you can prevent Google from collecting the data generated by the cookie and related to your use of the website (including your IP address) and from processing this data by downloading and installing the browser plug-in available at the following link (http://tools.google.com/dlpage/gaoptout?hl=en).

You can find more detailed information on the terms of use and data protection at https://www.google.com/analytics/terms/gb.html or at https://policies.google.com/?hl=en-GB&gl=gb.

We would like to inform you that on this website Google Analytics has been extended by the code “anonymizeIp” in order to guarantee anonymous recording of IP addresses (so-called IP masking).

If we ask the users for their consent (e.g. in the context of a cookie agreement), the legal basis for this processing is Art. 6 para. 1 lit. a. GDPR. Otherwise, the personal data of the user will be processed on the basis of our legitimate interests (i.e. interest in the analysis, optimisation and economic operation of our online service within the meaning of Art. 6 para. 1 lit. f. GDPR).

As far as data is processed in the USA, we inform you that Google is certified under the Privacy-Shield-Agreement and thereby guarantees to comply with the European data protection law (https://www.privacyshield.gov/participant?id=a2zt000000001L5AAI&status=Active).

Further information on the use of data by Google, setting and objection options can be found in Google’s data protection declaration (https://policies.google.com/privacy) and in the settings for the display of advertising by Google (https://adssettings.google.com/authenticated).

The personal data of the users will be deleted or anonymised after 14 months.

Google Analytics deactivation link

If you click the following opt-out link, you can prevent Google from tracking further visits to this webpage. Note: Deleting cookies, using your browser’s incognito/private mode, or using another browser will result in data being collected again.

Disable Google Analytics

Sales Suckers Marketing Optimization

We use products of Sales-Suckers OG (www.sales-suckers.com) for marketing and optimization purposes. These products collect and process your personal data and use it to create usage profiles under a pseudonym. These usage profiles are fully anonymized where possible and appropriate. We and Sales-Suckers employ cookies and/or Web beacons (also known as tracking pixels) on this website. We transfer the data we collect about you, which may also include personal data to Sales-Suckers, or Sales-Suckers gathers this data directly. Sales-Suckers is entitled to use information that you leave behind by visiting our Web sites to create anonymized usage profiles. The data collected shall not be used to personally identify visitors to this website without the express permission of the party affected and shall not be merged with personal data about the bearer of the pseudonym. Any IP addresses recorded are anonymized immediately by deleting the last number block. Permission to collect and store data in the future may be revoked at any time.
Disable sales suckers

Youtube privacy policy

We use the video service YouTube from YouTube, LLC, 901 Cherry Ave, San Bruno, CA 94066, USA on this page.

When you visit pages on our website that have YouTube videos integrated, data is transferred to YouTube, stored and evaluated. If you have a YouTube account and are logged in, this data is associated with your personal account and the data stored in it.

To find out what information Google collects and how we use it, please visit https://policies.google.com/privacy?hl=en.

You can reach us under the following contact details:

CHEMstone GmbH

Filzenweg 26
A-6392 St.Jakob in Haus
E-Mail: office@chemstone.at