Data protection regulation

Type of data processed

• Master data (e.g. personal master data, names or addresses)
• Contact details (e.g. e-mail addresses, telephone numbers)
• Content data (e.g. text input, photographs, videos)
• Usage data (e.g. websites visited, interest in content, access times)
• Metadata/communication data (e.g. device information, IP addresses)
  
  

Categories of data subjects

Visitors to, and users of, the online offering (data subjects are hereinafter also collectively referred to as “users”).

Purpose of processing

• Making the online offering, its functions and content available
• Responding to contact requests and communicating with users
• Security measures
• Measuring coverage/marketing
  
  

Terms used

The term “personal data” means any information relating to an identified or identifiable natural person (“data subject”); an identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier (e.g. a cookie) or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person.

“Processing” means any operation carried out with or without the aid of automated procedures or any such series of operations in connection with personal data. The term has a broadly defined meaning and covers virtually all types of data handling.

“Pseudonymisation” means the processing of personal data in such a manner that the personal data can no longer be attributed to a specific data subject without the use of additional information, provided that such additional information is kept separately and is subject to technical and organisational measures to ensure that the personal data are not attributed to an identified or identifiable natural person.

“Profiling” means any form of automated processing of personal data consisting of the use of personal data to evaluate certain personal aspects relating to a natural person, in particular to analyse or predict aspects concerning that natural person’s performance at work, economic situation, health, personal preferences, interests, reliability, behaviour, location or movements.

The “controller” is the natural or legal person, public authority, agency or other body which, alone or jointly with others, determines the purposes and means of the processing of personal data.

The “processor” means a natural or legal person, public authority, agency or other body which processes personal data on behalf of the controller.

Relevant legal basis

We provide you with information on the legal basis for our data processing in accordance with Article 13 of the GDPR. For those users that fall under the scope of the GDPR, i.e. in the European Union (EU) and the European Economic Area (EEA), the following applies where the legal basis is not indicated in the data privacy statement:

The legal basis for obtaining consent is Article 6(1)(a) and Article 7 of the GDPR.

The legal basis for processing in order to perform our services and contractual measures, and to respond to enquiries, is Article 6(1)(b) of the GDPR.

The legal basis for the processing to fulfil our legal obligations is Article 6(1)(c) of the GDPR.

In the event that the vital interests of the data subject or another natural person require the processing of personal data, Article 6(1)(d) of the GDPR serves as the legal basis.

The legal basis for processing that is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller is Article 6(1)(e) of the GDPR.

The legal basis for processing to protect our legitimate interests is Article 6(1)(f) of the GDPR.

The processing of data for purposes other than those for which the data was collected is governed by the requirements set out in Article 6(4) of the GDPR.

The processing of special categories of data (in accordance with Article 9(1) of the GDPR) is governed by the requirements set out in Article 9(2) of the GDPR.

Security measures

In accordance with the statutory requirements, taking into account the state of the art, the costs of implementation and the nature, scope, context and purposes of processing, as well as the risk of varying likelihood and severity for the rights and freedoms of natural persons, we implement appropriate technical and organisational measures to ensure a level of security appropriate to the risk.

These measures include, in particular, ensuring the confidentiality, integrity and availability of the data by controlling physical access to the data, and access to it in the relevant systems, data entry, dissemination, ensuring availability and data separation. We have also established procedures to ensure that the rights of data subjects can be exercised, that data is erased and that we can respond to any risks to the data. Furthermore, we take the protection of personal data into account during the development/selection of hardware, software and processes in accordance with the principles of privacy by design and privacy by default.

Cooperation with processors, joint controllers and third parties

If, in the context of our processing operations, we disclose data to other individuals and companies (processors, joint controllers or third parties), disseminate the data to them or otherwise grant them access to the data, this will only be done if we are authorised to do so by law (e.g. if the dissemination of the data to third parties, such as payment service providers, is necessary to fulfil a contract), if users have granted their consent or if this is required for compliance with a legal obligation or is based on our legitimate interests (e.g. when using agents or web hosting companies).

If we disclose, transmit or otherwise grant access to data to other companies within our group of companies, this will be done, in particular, for administrative purposes as a legitimate interest and also on a basis that complies with the statutory requirements.

Transmission to third countries

If we process data in a third country (i.e. a country outside the EU, the EEA or the Swiss Confederation) or if this occurs when using services provided by third parties or in connection with the disclosure/transmission of data to other individuals or companies, we will only do so if this is necessary to fulfil our (pre)contractual obligations, on the basis of your consent, on the basis of a legal obligation or on the basis of our legitimate interests. Subject to statutory or contractual authorisations, we only process or leave the data in a third country if the statutory requirements are met. This means that the data is processed, for example, on the basis of specific safeguards, such as a level of data protection that is officially recognised as being equivalent to that in the EU (e.g. for the US, the Privacy Shield) or compliance with officially recognised specific contractual obligations.

Rights of the data subject

You have the right to obtain confirmation as to whether or not personal data concerning you is being processed, to obtain access to the data and further information, and a copy of the data, in line with the statutory requirements.

In accordance with the statutory requirements, you have the right to request that data concerning you be completed or that inaccurate data be rectified.

You have the right, in line with the statutory requirements, to demand that data concerning you be erased without delay or, alternatively, in line with the statutory requirements, to request the restriction of data processing.

You have the right to request data that you have made available to us in accordance with the statutory requirements and to demand that this data be transferred to other controllers.

Furthermore, in line with the statutory requirements, you have the right to lodge a complaint with the responsible supervisory authority.

Right of withdrawal

You are entitled to withdraw consent given at any time with effect for the future.

Right to object

You are entitled to object to the future processing of data concerning you in line with the statutory requirements at any time. You can object, in particular, to processing for direct marketing purposes.

Cookies and right to object to direct marketing

Cookies are small files that are stored on a user’s computer. Cookies can be used to store different pieces of information. Cookies are used primarily to store information about users (or the device on which the cookie is stored) during or after their visit within an online offering. Temporary cookies, also known as session cookies or transient cookies, are cookies that are deleted after users leave an online offering and close their browser. This sort of cookie is used, for example, to save the contents of a shopping cart in an online shop or a login status. Cookies are described as permanent or persistent if they remain saved even after users close their browsers. This allows a login status to be saved if users visit the site concerned a few days later. Similarly, these cookies can be used to store information on a user’s interests so that this information can be used to measure coverage or for marketing purposes. Third-party cookies are cookies that are offered by providers other than the controller that operates the online offering (otherwise, if the only cookies used are the controller’s, they are referred to as first-party cookies).

We may use both temporary and permanent cookies, and provide information about this in our data privacy statement.

If users do not want cookies to be stored on their computer, they should deactivate the corresponding option in their browser’s system settings. Stored cookies can be deleted in the browser system settings. Disabling cookies can restrict the functions provided by this online offering.

You can make a general objection to the use of those cookies used for online marketing purposes for a large number of services, particularly in cases involving tracking, via the US website www.aboutads.info/choices or the EU site www.youronlinechoices.com. The storage of cookies can also be blocked by deactivating them in the browser settings. Please note that if you choose this option, however, you might not be able to use all of the functions offered by this online offering.

Data erasure

The data processed by us will be erased, or the processing of this data restricted, in accordance with the statutory requirements. Unless explicitly stated in this data privacy statement, the data stored by us will be erased as soon as it is no longer required for its intended purpose and statutory retention obligations do not provide otherwise.

If data is not erased because it is required for other legally permissible purposes, its processing will be restricted. This means that the data will be blocked and will not be processed for other purposes. This applies, for example, to data that has to be retained for commercial or tax law reasons.

Amendments and updates to this data privacy statement

We would ask you to consult the content of our data privacy statement on a regular basis. We will amend it as soon as changes in the data processing operations that we perform require us to do so. We will let you know as soon as the changes require cooperation on your part (e.g. consent) or another form of individual notification.

Contractual services

We process data concerning our contracting partners and interested parties as well as other principals, customers, clients or contracting partners (hereinafter collectively referred to as “contracting partners”) in accordance with Article 6(1)(b) of the GDPR in order to provide our contractual or precontractual services to them. The data processed within this context as well as the nature, scope, and purpose of, and the need for, processing are consistent with the underlying contractual relationship.

The data processed includes master data concerning our contracting partners (e.g. names and addresses), contact details (e.g. e-mail addresses and telephone numbers), contractual data (e.g. services used, contractual content, contractual communication, names of contact persons) and payment details (e.g. bank account details, payment history).

In general, we do not process special categories of personal data, unless they form part of a commissioned or contractual processing operation.

We process data that is required to establish and perform contractual services and indicate where such data has to be provided if this is not evident to the contracting partners. Data is only disclosed to external individuals or companies if this is required as part of a contract. When processing the data provided to us in the context of an order, we act in accordance with the instructions issued by the principal and the statutory requirements.

When our online services are used, we may store the user’s IP address and the time at which the user took the action concerned. The storage of this data is based on our legitimate interests, and the interests of users in protection against misuse and other unauthorised use. This data is generally not disseminated to third parties unless we need to do so to pursue our claims in accordance with Article 6(1)(f) of the GDPR or have a statutory obligation to do so in accordance with Article 6(1)(c) of the GDPR.

The data is erased when it is no longer required to fulfil contractual or statutory duties of care or to fulfil any warranty or comparable obligations. Within this context, the need to retain the data is reviewed every three years; in all other respects, the statutory retention obligations apply.

Administration, financial accounting, office organisation, contact management

We process data to perform administrative tasks, to organise our operations, in connection with financial accounting and to comply with statutory obligations, such as archiving. This involves processing the same data that we process to perform our contractual services. This processing is based on Article 6(1)(c) of the GDPR and Article 6(1)(f) of the GDPR and affects customers, interested parties, business partners and visitors to the website. The purpose of, and our interest in, processing lies in administration, financial accounting, office organisation and data archiving, i.e. duties that serve to allow us to maintain our business activities, perform our duties and provide our services. When data is erased with regard to contractual services and communication, this is done in accordance with the information provided for these processing operations.

Within this context, we disclose or transmit data to the tax authorities, consultants, such as tax advisors or auditors, and other fee collection authorities and payment service providers.

We also store information on suppliers, event organisers and other business partners on the basis of our commercial interests so that we can contact them at a later date, for example. We store this data, most of which relates to the company, on a permanent basis as a general rule.

Getting in touch

Whenever users get in touch with us (e.g. By using our contact form, by e-mail or telephone or via social media), the information they provide is processed for the purpose of handling and processing the contact request in accordance with Article 6(1)(b) of the GDPR (in the context of contractual/precontractual relations) and Article 6(1)(f) of the GDPR (other requests). The information supplied by users may be stored in a customer relationship management system (CRM system) or in a comparable request organisation system.

We delete any requests that are no longer needed. We review whether requests need to be stored every two years and the statutory archiving obligations also apply.

Hosting and e-mail dispatch

The hosting services we use serve to make the following services available: infrastructure and platform services, computing capacity, storage space and database services, e-mail dispatch, security services and technical maintenance services that we use to operate this online offering.

Within this context, we or our hosting provider process master data, contact details, content-related data, contractual data, usage data, metadata and communication data concerning customers, interested parties and visitors to this online offering on the basis of our legitimate interests in making this online offering available in an efficient and secure manner in accordance with Article 6(1)(f) of the GDPR in conjunction with Article 28 of the GDPR (conclusion of a contract data processing agreement).

Collection of access data and log files

We or our hosting provider collect data about every access to the server on which this service is located (known as server log files) on the basis of our legitimate interests within the meaning of Article 6(1)(f) of the GDPR. The access data includes the name of the website accessed, file, date and time of access, volume of data transmitted, report on successful access, browser type and version, the user’s operating system, referrer URL (the website visited previously), IP address and the requesting provider.

For security reasons (e.g. to clarify cases of misuse or fraud), log file information is stored for a maximum of seven days and is then erased. Data whose further storage is required for evidentiary purposes is excluded from erasure until the incident in question has been clarified with definitive effect.

Newsletter and mass communication measures

We only send out newsletters, e-mails and other electronic notifications (hereinafter referred to as “newsletters”) with the consent of the recipients or on the basis of a statutory authorisation. If the content of the newsletter is described specifically when users subscribe, this content is decisive with regard to users’ consent. Our newsletters also contain information about our services and about us as a company.

In order to subscribe to our newsletters, it is generally sufficient for you to provide your e-mail address. We may, however, ask you to provide a name so that we can address you personally in the newsletter, or ask you to provide other information if this is necessary for the purposes of the newsletter.

The dispatch of our newsletters is based on the consent granted by the recipients or, if consent is not required, on our legitimate interests in direct marketing, if and to the extent permitted by law, for example in cases involving advertising to existing customers. If we commission a service provider to send out e-mails, this is done on the basis of our legitimate interests. The registration process is recorded on the basis of our legitimate interests so that we can prove that the legal requirements were met.

Google Universal Analytics

We use Google Analytics including the Universal Analytics function. Universal Analytics is a version of Google Analytics in which user analysis is based on a pseudonymous user ID, creating a pseudonymous user profile featuring information collected from the use of various devices (a process known as cross-device tracking).

Google Analytics

We use Google Analytics, a web analysis service provided by Google LLC (hereinafter referred to as “Google”), on the basis of our legitimate interests (i.e. interest in the analysis, optimisation and commercial operation of our online offering within the meaning of Article 6(1)(f) of the GDPR). Google uses cookies. The information generated by the cookie about the use of the online offering by the user is usually transmitted to a Google server located in the US, where it is stored.

Google is certified under the Privacy Shield Framework, meaning that it guarantees that the European data protection legislation will be adhered to.

Google will use this information on our behalf to evaluate the use of our online offering by users, to compile reports on activities within this online offering, and to provide us with further services relating to the use of this online offering and the use of the Internet. This may involve the creation of pseudonymous user profiles based on the data processed.

We only use Google Analytics with IP anonymity activated. This means that Google will truncate user IP addresses within member states of the EU or other signatory states to the EEA treaty. The full IP address is only sent to, and truncated by, Google servers in the US in exceptional cases.

The IP address sent by the user’s browser will not be combined with other data from Google. Users can configure their browser software to prevent cookies from being saved. In addition, users can prevent the collection of the data generated by the cookie and relating to their use of the online offering by Google, and also prevent the processing of this data by Google, by downloading and installing the browser plug-in that is available at the following link:
tools.google.com/dlpage/gaoptout?hl=en-GB.

You can find further information on the use of data by Google, on the various options for configuring settings and objecting, in Google Privacy Policy and in the settings for advertisements shown by Google.

Personal data concerning users is erased or rendered anonymous after a period of 14 months.

Facebook pixel

The Facebook pixel allows Facebook, first of all, to be able to identify visitors to our online offering as a target group to display advertisements (known as Facebook ads). As a result, we use the Facebook pixel to ensure that the Facebook ads we show are only available to those Facebook users, and within the services provided by partners cooperating with Facebook (known as an «audience network»), who have also shown an interest in our online offering or who have certain characteristics (e.g. interest in particular topics or products that is evident based on the websites they have visited) that we transmit to Facebook (known as custom audiences). We also use the Facebook pixel to ensure that our Facebook ads match users’ potential interests and are not perceived as annoying. The Facebook pixel also allows us to track the effectiveness of Facebook ads for statistical and market research purposes because it allows us to see whether users have been redirected to our website after clicking on a Facebook ad (known as conversion measurement).

Service provider: Facebook Ireland Ltd., 4 Grand Canal Square, Grand Canal Harbour, Dublin 2, Ireland
Parent company: Facebook, 1 Hacker Way, Menlo Park, CA 94025, USA
Data Policy, Privacy Shield (Ensuring a certain level of data protection when data is processed in the US) and Opt-out.

Integration of third-party services and content

Within our online offering, we use content or services offered by third-party providers on the basis of our legitimate interests (i.e. interest in the analysis, optimisation and commercial operation of our online offering within the meaning of Article 6(1)(f) of the GDPR) in order to integrate their content and services, such as videos or fonts (hereinafter collectively referred to as “content”).

This always requires the third-party providers of this content to receive users’ IP addresses because, without the IP address, they cannot transmit the content to users’ browsers. As a result, the IP address is required to display this content. We strive only to use content whose providers use the IP address exclusively to display the content in question. Third-party providers can also use pixel tags (invisible graphics also known as web beacons) for statistical or marketing purposes. The pixel tags can be used to evaluate information such as visitor traffic on the pages of this website. The pseudonymous information can also be saved in cookies on the user’s device and may include, among other things, technical information on the browser and operating system, referring websites, the time the website was visited and other details on the use of our online offering. It can also be linked to such information from other sources.

Google Maps

We include maps belonging to the Google Maps service of the provider Google LLC, 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA, in our website. The data processed may include, in particular, user IP addresses and location data, although this cannot be collected without their consent (usually granted in the settings of their mobile devices). The data may be processed in the US. Google Privacy Policy, Turn off personalised Google ads.

Youtube

We include videos from the YouTube platform provided by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland, in our website. Google Privacy Policy: www.google.com/policies/privacy, Turn off personalised Google ads: adssettings.google.com/authenticated.

Vimeo

We may include videos from the Vimeo platform provided by Vimeo Inc., Attention: Legal Department, 555 West 18th Street New York, New York 10011, USA, in our website. Privacy Policy: vimeo.com/privacy. We would like to point out that Vimeo may use Google Analytics and refer to the Privacy Policy (policies.google.com/privacy) and the opt-out options for Google Analytics (tools.google.com/dlpage/gaoptout?hl=en-GB) or the Google settings for the use of data for marketing purposes (adssettings.google.com).

Webfonts

We use fonts offered by MyFonts Inc and Typejockeys OG.

User data is used exclusively to display the fonts in the user’s browser. The use of these fonts is based on our legitimate interests in a technically secure, maintenance-free and efficient use of fonts and in displaying them in a uniform manner, and also takes any possible licensing law restrictions on their use into account.

Service provider MyFonts
MyFonts Inc, 600 Unicorn Park Drive, Woburn, Massachusetts 01801, USA
Parent company: Monotype Imaging Holdings Inc., 600 Unicorn Park Drive, Woburn, Massachusetts 01801, USA
Website and Privacy Policy of MyFonts Inc.

Service provider Typejockeys
Typejockeys OG, Henriettenplatz 8/6, 1150 Vienna, Austria
Website and Privacy Policy of Typejockeys OG.