Data protection
General
Privacy statement
As of March 11, 2026
Preface
Dominik Bolena e.U., Lange Gasse 61,1080 Vienna, (“Dominik Bolena e.U., “we”, “us”) is committed to protecting your personal data. We therefore comply with applicable legislation on the protection, lawful use and confidentiality of personal data as well as data security, in particular the Data Protection Act (“DSG”), the Telecommunications Act (“TKG”) and the General Data Protection Regulation (“GDPR”). We may need to update this privacy statement from time to time. We therefore recommend that you check this page regularly to ensure that you have read the latest version.
1. Name and address of the person responsible
The person responsible for processing your personal data in accordance with data protection regulations is:
Dominik Bolena e.U., Lange Gasse 61,1080 Vienna,
The contact details of the data protection officer are as follows:
email: bolena@bolena.at
2. Data processing as part of your “website” visit
The following information describes which personal data we may process when you visit our Bolenq website (“website”).
2.1. Scope of processing of personal data
As part of your visit to our website and Bolena
Online services will automatically collect the following personal data about you:
- The date and time a page on our website was accessed
- The date and time of your login to Bolena online services
- Data about your device (device ID) IP address name and version of your web browser
- visit/session ID
For the cookies we collect when you visit our website, please refer to our cookie statement, see Cookie Policy.
2.2. Legal basis for processing personal data
As far as the data relating to your visit to our website is concerned, we rely on our legitimate interest in accordance with Article 6 (1) (f) GDPR, which consists in making our website user-friendly and protecting it from attacks.
2.3. Purpose of data processing
We process your data in connection with your visit to our website for the following purposes:
- to provide you with our website and online services, including their features, and to further improve and develop this website;
- to be able to compile usage statistics;
- to be able to detect, prevent and investigate attacks on our website;
- to display personalized product and page suggestions
- to process the waiting list
2.4. Storage period
We will generally store your data when you visit the website for a period of three months. Longer storage only takes place insofar as this is necessary to investigate identified attacks on our website and, furthermore, only until the end of relevant limitation periods, legal retention periods or any legal disputes.
3. Data processing as part of your social media activities with our company profiles
As part of our social media profiles, we act as a responsible person within the meaning of the GDPR. For this reason, we will inform you in the following privacy policy for which purposes and on which legal basis we use various social media applications to get in touch with you. The contact details of the data protection officer can be found above.
3.1 Contact
You can get in touch with Bolena via the following social media profiles:
- Google Local Business & Reviews
https://g.co/kgs/gmhyBKd
- Facebook https://www.facebook.com/bolenaweinbarfanpage/
- Instagram https://www.instagram.com/restaurant_bolena/
For this purpose, we receive your personal data from the respective operator of the social media platform and also transfer your personal data to them. Insofar as this involves a transfer to countries without an adequate resolution in accordance with Article 45 (3) GDPR and without appropriate guarantees in accordance with Article 46 GDPR, such as in particular the USA, we would like to point out that there is a risk that your data transmitted in this way will be accessed by authorities in these third countries for control and monitoring purposes and that no effective legal remedies will be available against it.
3.2 Social media interaction
You can also interact with us on our social media profiles by clicking various buttons (e.g. “Like,” “Share,” “Subscribe,” “Invite Friends,” “Like,” “Dislike,” etc.) or by commenting on content. In this case, we will process your interaction as well as your username, profile photo and IP address as well as any invited or marked personal data from third parties.In accordance with Article 6 (1) (a) and (f) GDPR, we use this information to answer your questions and comments, to comment on your opinion/feedback, to give you the opportunity to comment or to promote Bolena and our range of products on the platform. We store the data you provide until you withdraw your interaction or as long as our content (images, videos, etc.) is online.
3.3 Tracking/Marketing Campaigns
On our social media profiles, using the page insight tools from Google Local Business & Reviews, Facebook, Instagram, YouTube, LinkedIn, in each case together with the platform operator, we automatically process personal data that provides information about the interaction of visitors and users and serves to optimize your experience on the website or to optimize marketing activities (“tracking data”).
3.4 Platforms in detail
3.4.1 Facebook and Instagram
For our Facebook and Instagram profile, we have concluded the following joint responsibility agreement with Facebook Ireland Ltd., 4 Grand Canal Square, Grand Canal Harbour, Dublin 2, Ireland: https://www.facebook.com/legal/controller\_addendum
You can find out which personal data we process together under the heading “How is this information shared? “in the sub-section “Partners who use our analysis services” in Facebook's privacy policy on
Meta Privacy Policy - How Meta Collects and Uses User Data
In accordance with Article 6 (1) (f) GDPR, we therefore use this information both to create aggregate evaluations of the use of our social media presence and to optimize our marketing activities.
This data is stored by Facebook in accordance with the deadlines set out under Meta Privacy Policy - How Meta collects and uses user data (sub-item: “Data storage, deactivation and deletion of accounts”).
3.4.2 LinkedIn
For our LinkedIn profile, we have signed the following joint responsibility agreement with LinkedIn Ireland Unlimited Company, Wilton Place, Dublin 2, Ireland: https://legal.linkedin.com/pages-joint-controller-addendum
You can find out which personal data we process together in LinkedIn's privacy policy at https://de.linkedin.com/legal/privacy-policy. In accordance with Article 6 (1) (f) GDPR, we use this information both to create aggregate evaluations of the use of our social media presence and to optimize our marketing activities.This data is collected by LinkedIn in accordance with https://de.linkedin.com/legal/privacy-policy saved.
3.4.3 Google Local Business
For our Google Local Business profile, we have concluded the following joint responsibility agreement with Google Ireland Limited Gordon House, Barrow Street, Dublin 4, Ireland:
https://business.safety.google/controllerterms/
You can find out which personal data we process together in Google's privacy policy at https://policies.google.com/privacy#europeanrequirements.
In accordance with Article 6 (1) (f) GDPR, we use this information both to create aggregate evaluations of the use of our social media presence and to optimize our marketing activities.
This data is collected by Google in accordance with https://policies.google.com/privacy#europeanrequirements saved.
3.4.4 Webflow
The Bolena.at website is hosted by Webflow Inc., based at 398 11th Street, 2nd Floor, San Francisco, 94103 California, USA (hereinafter: Webflow). When you visit our website, Webflow collects various log files, including your IP address (es).
Webflow is a tool for creating and hosting websites. Webflow stores cookies or uses other recognition technologies that are necessary to display the page, to provide certain website features and to ensure security (necessary cookies). The use of such necessary cookies is based on Art. 6 para. 1 lit. f DSGVO. Bolena has a legitimate interest in ensuring that the website is presented as reliably as possible.
The use of other Webflow functions and the setting of other, unnecessary Webflow cookies (such as analysis or advertising cookies) is only based on your consent, meaning that processing is carried out exclusively on the basis of Art. 6 para. 1 lit. a DSGVO or § 165 para. 2 TKG 2021. The consent can be withdrawn at any time with effect for the future. We would like to point out that such a withdrawal may result in certain functions of the website no longer being available and/or certain services can no longer be provided to you. You can find more information in the Webflow privacy policy.
When your personal data is transferred to Webflow's servers located in the USA, this is based on the standard contractual clauses of the EU Commission, which we have concluded with Webflow. Through these standard contractual clauses, Webflow has committed itself to maintaining a level of data protection comparable to the EU. You can find more information here: EU & Switzerland Privacy Policy
3.4.5 Elfsight (Google Reviews Widget)
We use a widget from the provider Elfsight, LLC, 0015, Yerevan, Armenia ("Elfsight") on our website to display Google reviews directly on our site. In this process, personal data such as your IP address, device information, and usage data may be transmitted to Elfsight's servers. Elfsight processes this data on our behalf to provide the widget. Use is based on Art. 6 (1) (f) GDPR (legitimate interest in the user-friendly display of customer reviews). Further information can be found in Elfsight's privacy policy: https://elfsight.com/privacy-policy.
3.4.6 Zenchef (reservation widget)
We use the reservation widget provided by Zenchef SAS, 23 rue d'Anjou, 75008 Paris, France ("Zenchef"), on our website to facilitate online table reservations. When using this widget, personal data such as your IP address, device information, and the booking details you provide (name, email address, phone number, number of guests, date, and time) may be transmitted to and processed on Zenchef's servers.
Processing is carried out on the basis of Art. 6 (1) (b) GDPR (initiation or execution of a reservation) and Art. 6 (1) (f) GDPR (legitimate interest in providing a user-friendly reservation system).
If the widget transmits Google Tag Manager or Google Analytics 4 events, we also refer to the privacy information for Google (see section 3.4.3).
Further information on data processing by Zenchef can be found at: https://www.zenchef.com/privacy-policy
3.4.7 OpenAI Ads (advertising in ChatGPT) and OpenAI Pixel
We run advertisements on the ChatGPT service. The provider and controller for users in the EEA is OpenAI Ireland Limited, 1st Floor, The Liffey Trust Centre, 117–126 Sheriff Street Upper, Dublin 1, D01 YC43, Ireland ("OpenAI"). The selection of advertisements within ChatGPT is carried out by OpenAI under its own responsibility. We do not receive any chat content or personal data from ChatGPT users.
To measure the success of our advertisements, we use the OpenAI pixel (conversion tracking) on our website, which is integrated via Google Tag Manager. If you reach our website via an advertisement in ChatGPT, a pseudonymous click ID ("oppref") is read from the URL and stored in a cookie ("__oppref") on your device. If you subsequently perform a specific action, such as submitting an inquiry for our event location, this event is transmitted to OpenAI along with the ID, the time, the page visited, and technical data (e.g., IP address, browser and device information). We receive only aggregated statistics from OpenAI (e.g., number of clicks and inquiries) that do not allow for any conclusions to be drawn about individual persons.
The OpenAI pixel is only loaded if you have consented to the "Marketing" category in the cookie banner. The legal basis is your consent in accordance with Art. 6 (1) (a) GDPR or § 165 (3) TKG 2021. You can revoke your consent at any time with effect for the future via the cookie settings. For information on the storage duration of cookies, please refer to our cookie policy.
It cannot be ruled out that data may be transmitted to servers of the OpenAI corporate group in the USA. This is done on the basis of the EU-U.S. Data Privacy Framework or the standard contractual clauses of the EU Commission. Further information can be found in OpenAI's privacy policy for the EEA: https://openai.com/policies/eu-privacy-policy/
4. Rights of the data subject
4.1. Right to information
You have the right to obtain information from us about all personal data processed by Bolena. You have the right to request information as to whether the personal data concerning you is being transferred to a third country or to an international organization. In this context, you can request to be informed of the appropriate guarantees in accordance with Art 46 GDPR in connection with the transfer.
4.2. Right to rectification and right to restrict processing
You can request that incorrect or incomplete data be corrected or completed. In certain circumstances, for example if the accuracy of data is disputed until the accuracy has been verified, you may request that the processing of data be restricted to the effect that it may only be processed with your consent or to assert, exercise or defend legal claims or to protect the rights of another natural or legal person, or for reasons of important public interest.
4.3. Right to data portability
You can request that Bolena send you — or, as far as this is technically feasible, to a third party specified by you — a copy of your data in a structured, commonly used and machine-readable format. You also have the right to transfer this data to another person responsible without hindrance from the person responsible to whom the personal data was provided, provided
(1) processing is based on consent in accordance with Article 6 (1) (a) GDPR or Article 9 (2) (a) GDPR or on a contract in accordance with Article 6 (1) (b) GDPR, and
(2) processing is carried out using automated procedures. In exercising this right, you also have the right to have the personal data concerning you transmitted directly by us to another person responsible, insofar as this is technically feasible. The freedoms and rights of other persons must not be affected as a result.
4.4. Right to delete
You have the right to delete data under certain circumstances, such as when it is not processed in accordance with data protection requirements.
The so-called “right to be forgotten” does not apply to you because Bolena will never make your personal data public.
If you have asserted the right to correct, delete or restrict processing against Bolena, we are obliged to notify all recipients to whom the personal data concerning you has been disclosed of this correction or deletion of the data or restriction of processing, unless this proves impossible or involves disproportionate effort.
4.5. Right to object
For reasons arising from your particular situation, you have the right to object at any time to the processing of personal data concerning you, which is carried out on the basis of Article 6 (1) (e) or f GDPR.
In this case, Bolena will no longer process the personal data concerning you, unless we can demonstrate compelling legitimate grounds for processing that outweigh your interests, rights and freedoms, or the processing serves to assert, exercise or defend legal claims.
4.6. Right to withdraw the declaration of consent under data protection law
You have the right to withdraw your data protection consent at any time. Withdrawal of consent does not affect the lawfulness of the processing carried out on the basis of the consent up to the withdrawal.
4.7. supervisory authority
Notwithstanding any other remedies, you have the right to lodge a complaint with the national supervisory authority in your place of residence if unlawful processing of personal data is assumed. In Austria, the data protection authority is responsible.
5. Transfer to third parties
To the extent necessary, we also transfer your personal data to external vicarious agents or service providers (contract processors):
-to IT service providers and/or providers of data hosting or data processing or similar services
- to other service providers, providers of tools and software solutions who also support us in providing our services and work on our behalf (including providers of marketing tools, marketing agencies, communication service providers and call centers)
All our contract processors process your data only on our behalf and on the basis of our instructions so that we can make our online offer available to you.
If we process your data in a third country outside the European Union (EU) or the European Economic Area (EEA) or if this is done as part of the use of third-party services, this will only be done if it is necessary to fulfill our (pre) contractual obligations, on the basis of your consent, on the basis of a legal obligation or on the basis of our legitimate interests. We have implemented suitable and appropriate guarantees to make the transfer of your data to the respective third country compliant with data protection regulations. At your request, we will provide you with a copy of these appropriate guarantees, provided that we process or have your data processed in third countries.
6. Storage period
To process inquiries (as well as in case of follow-up questions) via our website or social media sites, we store the data you provide for three months. In individual cases (such as complaints), we store personal data for the time during which claims can be made against us (statutory limitation period of 3 or up to 30 years).
7. Data security
We take appropriate technical and organizational security measures to protect your personal data from accidental or unauthorised deletion, alteration or loss, theft and unauthorised access, transfer, reproduction, use, alteration or access. In addition, we and our employees are required to maintain data secrecy and confidentiality. Our vicarious agents and agents, who must have access to your personal data to perform their professional duties, will also have access and will be subject to the same obligations to comply with data secrecy and confidentiality.
8. Your rights
You can request information about the data stored about you at any time. In addition, you can request that your data be corrected or deleted under certain conditions. You may also have the right to restrict the processing of your data and a right to release the data you have provided in a structured, common and machine-readable format. Furthermore, you have the right to withdraw your consent at any time with effect for the future. You also have the right to object to data processing for reasons arising from your particular situation (Art 21 GDPR). You have the option to contact the data protection authority with a complaint. So that we can process your request regarding your rights set out above and to ensure that personal data is not disclosed to unauthorised third parties, please make the request clearly identifying yourself and with a brief description of the scope of the exercise of your data subject rights listed above.
General
Privacy Policy
Last updated: March 11, 2026
Preliminary note
Protecting your personal data is a high priority for Dominik Bolena e.U., Lange Gasse 61, 1080 Vienna ("Dominik Bolena e.U.", "we", "us"). We therefore comply with applicable legal requirements for the protection, lawful handling, and confidentiality of personal data, as well as data security, in particular the Data Protection Act ("DSG"), the Telecommunications Act ("TKG"), and the General Data Protection Regulation ("GDPR"). We may need to update this privacy policy from time to time. We therefore recommend that you check this page at regular intervals to ensure that you have read the current version.
1. Name and address of the controller
The controller responsible for the processing of your personal data in accordance with data protection regulations is:
Dominik Bolena e.U., Lange Gasse 61, 1080 Vienna,
The contact details for the Data Protection Officer are as follows:
Email: bolena@bolena.at
2. Data processing in the context of your "Website" visit
The following information describes which personal data we may process when you visit the Bolena website ("Website").
2.1. Scope of Personal Data Processing
During your visit to our website and the Bolena online services, we will automatically collect the following personal data about you:
- Date and time of accessing a page on our website
- Date and time of your login to the Bolena online services
- Data regarding your device (Device ID), IP address, name and version of your web browser
- Visit/Session ID
For information on the cookies we collect during your visit to our website, please refer to our Cookie Declaration, see Cookie Policy.
2.2. Legal Basis for the Processing of Personal Data
Regarding the data from your visit to our website, we base the processing on our legitimate interest pursuant to Article 6(1)(f) GDPR, which consists of making our website user-friendly and protecting it from attacks.
2.3. Purpose of Data Processing
We process your data in connection with your visit to our website for the following purposes:
- to provide you with our website and online services, including their features, and to further improve and develop this website;
- to generate usage statistics;
- to detect, prevent, and investigate attacks on our website;
- to display personalized product and page recommendations;
- to process the waiting list.
2.4. Storage Duration
As a general rule, we will store your website visit data for a period of three months. Longer storage will only occur if necessary to investigate identified attacks on our website, and beyond that, only until the expiration of relevant limitation periods, statutory retention periods, or the conclusion of any legal disputes.
3. Data processing in the context of your social media activities with our company profiles
In the context of our social media profiles, we act as the controller within the meaning of the GDPR. For this reason, we inform you in the following privacy policy about the purposes for which and the legal bases on which we use various social media applications to communicate with you. You can find the contact details of our Data Protection Officer above.
3.1 Contacting Us
You can get in touch with Bolena via the following social media profiles:
- Google Local Business & Reviews
https://g.co/kgs/gmhyBKd
- Facebook https://www.facebook.com/bolenaweinbarfanpage/
- Instagram https://www.instagram.com/restaurant_bolena/
For this purpose, we receive your personal data from the respective social media platform operator and also transmit your personal data to them. To the extent that this involves a transfer to countries without an adequacy decision pursuant to Article 45(3) GDPR and without appropriate safeguards pursuant to Article 46 GDPR, such as the USA, we point out that there is a risk that your data transferred in this way may be subject to access by authorities in these third countries for control and monitoring purposes, and that no effective legal remedies may be available.
3.2 Social Media Interaction
You can also interact with us on our social media profiles by using various buttons (e.g., "Like," "Share," "Subscribe," "Invite Friends," etc.) or by commenting on content. In such cases, we will process your interaction, your username, profile photo, and IP address, as well as any personal data of third parties you may have invited or tagged. We use this information in accordance with Article 6(1)(a) and (f) of the GDPR to respond to your questions and comments, to address your feedback, to provide you with a platform for expression, and to promote Bolena and our product offerings. We store the data you provide until you withdraw your interaction or as long as our content (images, videos, etc.) remains online.
3.3 Tracking / Marketing Campaigns
On our social media profiles, we use the page insight tools of Google Local Business & Reviews, Facebook, Instagram, YouTube, and LinkedIn to automatically process personal data jointly with the respective platform operators. This data provides insights into visitor and user interactions and is used to optimize your experience on our website and to improve our marketing activities ("tracking data").
3.4 Platforms in detail
3.4.1 Facebook and Instagram
For our Facebook and Instagram profiles, we have entered into the following joint controller agreement with Facebook Ireland Ltd., 4 Grand Canal Square, Grand Canal Harbour, Dublin 2, Ireland: https://www.facebook.com/legal/controller_addendum
You can find details on which personal data we process jointly under the section "How is this information shared?" in the subsection "Partners who use our analytics services" in Facebook's privacy policy at
Meta Privacy Policy - How Meta collects and uses user data
We therefore use this information in accordance with Art. 6(1)(f) GDPR both to create aggregated reports on the use of our social media presence and to optimize our marketing activities.
This data is stored by Facebook in accordance with the timeframes outlined under Meta Privacy Policy - How Meta collects and uses user data (subsection: "Data retention, account deactivation and deletion").
3.4.2 LinkedIn
For our LinkedIn profile, we have entered into the following joint controller agreement with LinkedIn Ireland Unlimited Company, Wilton Place, Dublin 2, Ireland: https://legal.linkedin.com/pages-joint-controller-addendum
You can find details on which personal data we process jointly in LinkedIn's privacy policy at https://de.linkedin.com/legal/privacy-policy. We use this information in accordance with Art. 6(1)(f) GDPR both to create aggregated reports on the use of our social media presence and to optimize our marketing activities. This data is stored by LinkedIn in accordance with https://de.linkedin.com/legal/privacy-policy.
3.4.3 Google Local Business
For our Google Local Business profile, we have entered into the following joint controller agreement with Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland:
https://business.safety.google/controllerterms/
You can find details on which personal data we process jointly in Google's privacy policy at https://policies.google.com/privacy#europeanrequirements.
We use this information in accordance with Art. 6(1)(f) GDPR both to create aggregated reports on the use of our social media presence and to optimize our marketing activities.
This data is stored by Google in accordance with https://policies.google.com/privacy#europeanrequirements.
3.4.4 Webflow
The website Bolena.at is hosted by Webflow Inc., located at 398 11th Street, 2nd Floor, San Francisco, 94103 California, USA (hereinafter: Webflow). When you visit our website, Webflow collects various log files, including your IP address(es).
Webflow is a tool for creating and hosting websites. Webflow stores cookies or uses other recognition technologies necessary for displaying the site, providing specific website functions, and ensuring security (necessary cookies). The use of such necessary cookies is based on Art. 6(1)(f) GDPR. Bolena has a legitimate interest in ensuring the website is displayed as reliably as possible.
The use of other Webflow features and the setting of other, non-essential Webflow cookies (such as analytics or advertising cookies) occurs only based on your consent, meaning the processing is based exclusively on Art. 6(1)(a) GDPR or § 165(2) TKG 2021. Consent can be withdrawn at any time with effect for the future. Please note that such a withdrawal may result in certain website functions no longer being available and/or certain services no longer being provided to you. You can find more information in the Webflow Privacy Policy.
If your personal data is transferred to Webflow's servers in the USA, this is done on the basis of the EU Commission's Standard Contractual Clauses, which we have concluded with Webflow. Through these Standard Contractual Clauses, Webflow has committed to maintaining a level of data protection comparable to that of the EU. Further information can be found here: Data Protection Provisions EU & Switzerland
4. Data subject rights
4.1. Right of access
You have the right to obtain information from us regarding all your personal data processed by Bolena. You have the right to request information as to whether your personal data is being transferred to a third country or an international organization. In this context, you may request to be informed about the appropriate safeguards pursuant to Art. 46 GDPR regarding the transfer.
4.2. Right to rectification and right to restriction of processing
You may request the rectification or completion of inaccurate or incomplete data. Under certain circumstances—for example, if the accuracy of data is contested, pending verification—you may request a restriction of processing so that the data may only be processed with your consent, for the establishment, exercise, or defense of legal claims, for the protection of the rights of another natural or legal person, or for reasons of important public interest.
4.3. Right to data portability
You may request that Bolena send you—or, where technically feasible, a third party designated by you—a copy of your data in a structured, commonly used, and machine-readable format. Furthermore, you have the right to transmit this data to another controller without hindrance from the controller to whom the personal data was provided, provided that
(1) the processing is based on consent pursuant to Art. 6(1)(a) or Art. 9(2)(a) GDPR or on a contract pursuant to Art. 6(1)(b) GDPR, and
(2) the processing is carried out by automated means. In exercising this right, you also have the right to have your personal data transmitted directly from us to another controller, where technically feasible. This must not adversely affect the rights and freedoms of others.
4.4. Right to erasure
You have the right to have your data erased under certain circumstances, such as when it is not being processed in accordance with data protection requirements.
The so-called "right to be forgotten" does not apply to you because Bolena does not make your personal data public under any circumstances.
If you have exercised your right to rectification, erasure, or restriction of processing against Bolena, we are obligated to inform all recipients to whom your personal data has been disclosed of this rectification, erasure, or restriction, unless this proves impossible or involves disproportionate effort.
4.5. Right to object
You have the right to object at any time, for reasons arising from your particular situation, to the processing of your personal data based on Article 6(1)(e) or (f) of the GDPR.
In such cases, Bolena will no longer process your personal data unless we can demonstrate compelling legitimate grounds for the processing that override your interests, rights, and freedoms, or if the processing is for the establishment, exercise, or defense of legal claims.
4.6. Right to Withdraw Data Protection Consent
You have the right to withdraw your data protection consent at any time. The withdrawal of consent does not affect the lawfulness of processing based on consent before its withdrawal.
4.7. Supervisory Authority
Without prejudice to any other legal remedies, you have the right to lodge a complaint with the national supervisory authority of your place of residence if you believe that personal data is being processed unlawfully. In Austria, the Data Protection Authority is responsible.
5. Transfer to Third Parties
We also transfer your personal data to the extent necessary to external agents or service providers (data processors):
- to IT service providers and/or providers of data hosting or data processing or similar services
- to other service providers and providers of tools and software solutions that support us in providing our services and act on our behalf (including providers of marketing tools, marketing agencies, communication service providers, and call centers)
All our data processors process your data only on our behalf and based on our instructions so that we can provide you with our online services.
If we process your data in a third country outside the European Union (EU) or the European Economic Area (EEA), or if this occurs in the context of using third-party services, this only happens if it is necessary for the fulfillment of our (pre)contractual obligations, based on your consent, due to a legal obligation, or based on our legitimate interests. We have implemented appropriate and suitable safeguards to ensure that the transfer of your data to the respective third country complies with data protection regulations. Upon your request, we will provide you with a copy of these appropriate safeguards if we process or have your data processed in third countries.
6. Storage Period
We store the data you provide for three months to process inquiries (as well as any follow-up questions) via our website or social media pages. In individual cases (such as complaints), we retain personal data for the period during which claims can be asserted against us (statutory limitation period of 3 or up to 30 years).
7. Data Security
We implement appropriate technical and organizational security measures to protect your personal data against accidental or unauthorized deletion, alteration, loss, theft, and unauthorized viewing, disclosure, reproduction, use, modification, or access. Furthermore, we and our employees are committed to maintaining data confidentiality and secrecy. Likewise, our agents and contractors who require access to your personal data to perform their professional duties will be granted access and are subject to the same obligations of data confidentiality and secrecy.
8. Your Rights
You may request information about the personal data we hold about you at any time. Furthermore, under certain conditions, you may request the correction or deletion of your data. You may also have the right to restrict the processing of your data and the right to receive the data you have provided in a structured, commonly used, and machine-readable format. You also have the right to withdraw any consent given at any time with effect for the future. Additionally, you have the right to object to data processing for reasons arising from your particular situation (Art. 21 GDPR). You have the option to lodge a complaint with the data protection authority. To enable us to process your request regarding the aforementioned rights and to ensure that personal data is not disclosed to unauthorized third parties, please submit your request with clear identification of your person and a brief description of the scope of the data subject rights you wish to exercise.