Data protection

Information on cookies and data protection

Privacy policy
In data protection, what counts for us is keeping our word on every legal requirement of the EU General Data Protection Regulation (GDPR) and of all relevant Austrian legislation.

We are the operator of this website; the full information about us and how to contact us can be found above in the legal notice. Please feel free to approach us at any time with your questions.

We use your personal data exclusively in the way described in this privacy policy. You will also find the legal bases here.

What rights do data subjects have?
For questions and for asserting data subject rights relating to data protection, you can use the options for contacting us by telephone, in writing or in person that are listed in the legal notice.

You can assert the data subject rights listed below where the respective conditions are met. Please note that you may first have to provide suitable proof of identity.

Right of access: you can request confirmation – as a rule free of charge – as to whether personal data concerning you is being processed, and request access to that data and to the information pursuant to Art. 15 GDPR.

Right to rectification if we process inaccurate or incomplete data about you (Art. 16 GDPR).
Right to erasure of personal data concerning you where the conditions of Art. 17 GDPR are met.

Right to restriction of the processing of your data pursuant to Art. 18 GDPR.

Right to data portability and to receive the personal data you have provided by automated means in a structured, commonly used and machine-readable format (Art. 20 GDPR).

Where processing is based on a (non-overriding) legitimate interest, you have the right to object at any time pursuant to Art. 21 GDPR. Where processing is carried out for the purpose of direct marketing and any profiling connected with it, this right applies without restriction.

You can withdraw consent given to the processing of personal data at any time; the lawfulness of the processing carried out up to the point of withdrawal is not affected.

You have the right to lodge a complaint with a supervisory authority competent for you (data protection authority), in particular in the EU member state of your residence, your place of work or the place of the alleged infringement, if you consider that the processing of personal data concerning you infringes the General Data Protection Regulation or that your data subject rights have been violated. We would welcome it if you contacted us beforehand and gave us the opportunity to comment.

You will find a list of the supervisory authorities here: http://ec.europa.eu/newsroom/article29/item-detail.cfm?item_id=612080.

For what purposes do we process personal data?
1. Operation of the website and of our IT systems (maintenance and security)
2. Processing in connection with the provision of deliveries and services
3. Processing for marketing (customer enquiries, customer care and advertising)
4. Public relations and company archive
5. Data processing in application procedures
6. Communication

Operation of the website and of our IT systems (maintenance and security)
For the operation and maintenance of IT systems and company websites, as well as for maintaining data security and preventing abusive or fraudulent conduct, we process our users’ personal data in principle only in so far as this is necessary to provide the services and our content and offerings.

We process your data for pre-contractual measures or contractual obligations (e.g. performance of terms and conditions, terms of use, Art. 6(1)(b) GDPR), where legally required (Art. 6(1)(c) GDPR, e.g. consent to the use of cookies, maintaining appropriate data security) and on the basis of Art. 6(1)(f) GDPR for the following (overriding) legitimate interests:
• ensuring a functional and attractive web presence,
• maintaining data security,
• efficient internal administration within the group of companies

Transfers are not envisaged; data published by users of our services themselves (e.g. comments) is however public and potentially accessible worldwide. Where there is cause, the data may be transferred to law enforcement authorities, courts and the like in order to assert legal claims of the controller or of third parties.

We transfer your data to third parties where we are legally obliged to do so. Beyond that, in individual cases we make use of processors in the course of processing your data within the contractual relationship or for analysis, information and optimisation purposes. These include, for example, service providers in the field of marketing and market research, transport and delivery companies, tax advisers or IT service providers. However, we transfer your data to such processors only on the basis of an agreement meeting the statutory requirements and only for the purposes of the processing commissioned.

The controller is part of a group of companies. For economical internal administration we therefore also make use of the affiliated companies for the processing activity. The group of companies has an overriding legitimate interest in this (recital 48 GDPR)

Each time our website is accessed, our system automatically records data and information from the computer system of the accessing device.

The following data is collected in this process:
• information about the browser type and the version used
• the user’s operating system
• the user’s internet service provider
• the user’s IP address, session ID of the browser
• date and time of access
• data about the end device (device ID, screen resolution, language and country settings …)
• websites from which the user’s system reaches our website
• websites accessed by the user’s system via our website.

Data required for the functioning of the web presence is processed and stored only for the duration of your visit to our pages. Log data and IP addresses are additionally stored as a rule for 7 days in order to fend off attacks on our systems, and, where there is cause, until final resolution for the purpose of investigating data security incidents and asserting claims for damages.

There is no legal or contractual obligation to provide the data; it is however necessary for the functioning of the web presence and of our IT systems, which may otherwise be impaired.

Part of the data collected is further processed for marketing measures. We point this out, together with your rights of objection, at the moment of collection. In this regard we ask you to note point 3 of this privacy policy.

The data is processed under joint controllership pursuant to Article 26 GDPR together with Fröschl AG & Co KG, Brockenweg 2, 6060 Hall in Tirol, telephone 05223-571560, office@froeschl.at.

Processing in connection with the provision of deliveries and services, in particular for the sale of our products
We collect personal data in order to deliver our products and provide our services, including in the online shop, as well as to make use of third-party services in business relationships.

The legal bases for processing the data are pre-contractual measures or contractual obligations (Art. 6(1)(b) GDPR), legal and statutory obligations (Art. 6(1)(c) GDPR, in particular tax and duty law) as well as the following (overriding) legitimate interests (Art. 6(1)(f) GDPR):

• asserting or defending our own legal claims, in particular on grounds of warranty and product liability
• reducing default risks (including at third parties)
• answering customer enquiries about deliveries and services; a right to object exists at any time, unless overriding interests (e.g. liability) stand in the way
• efficient internal administration within the group of companies

Where necessary, personal data is transferred to the following categories of recipients:
• banks (for handling payment transactions)
• legal representatives, courts where there is cause
• auditors and tax consultants (for auditing purposes)
• competent administrative authorities, in particular tax authorities
• debt collection agencies for the recovery of debts (abroad therefore only in so far as the debt has to be collected abroad)
• external financiers such as leasing or factoring companies and assignees, in so far as the delivery or service is externally financed in this way
• contractual or business partners who take part or are to take part in the delivery or service (e.g. delivery services)
• insurers on the occasion of concluding an insurance contract concerning the delivery/service or of the occurrence of an insured event
• authorities and institutions for the compilation of statutorily prescribed (official) statistics
• customers (recipients of services)
• credit reference agencies

A transfer to third countries or international organisations takes place in these cases only if either an adequacy decision pursuant to Art. 45 GDPR exists, or the conditions of Art. 49(1)(b), (c) or (e) GDPR are met (necessity for the performance of pre-contractual measures at the request of the data subject or in their interest, establishment, exercise or defence of legal claims), or consent pursuant to Art. 49(1)(a) GDPR has been given.

We transfer your data to third parties where we are legally obliged to do so. Beyond that, in individual cases we make use of processors in the course of processing your data within the contractual relationship or for analysis, information and optimisation purposes. These include, for example, transport and delivery companies, tax advisers or IT service providers. However, we transfer your data to such processors only on the basis of an agreement meeting the statutory requirements and only for the purposes of the processing commissioned.

The controller is part of a group of companies. For economical internal administration we therefore also make use of the affiliated companies for the processing activity. The group of companies has an overriding legitimate interest in this (recital 48 GDPR).

Where there is a corresponding legitimate interest (size of the order value), we check creditworthiness before accepting an order.

In the online shop, cookies are used for the functioning of the shopping basket and the ordering process. Cookies are not evil by nature; they also allow useful conveniences for you and for us. You can prevent the analysis of user behaviour by blocking the setting of cookies by this domain in your browser, for example by setting up an exception in the browser (as, for instance, in the Firefox browser). Please consult the program help if necessary to find out how this can be set up in your browser.

Of course you can also delete the cookies mentioned above in your browser as the occasion arises in individual cases or periodically, in order to delete tracking information.

If you have activated the so-called Do Not Track function (“DNT”) in your browser, your visit to the website is automatically not recorded by the web analytics tool. However, this does not work in every browser. To activate DNT in your browser, please consult your browser’s help function if you do not know how to activate it.

Until the end of the business relationship or until the expiry of the guarantee, warranty, limitation and statutory retention periods applicable to the controller; beyond that, until the conclusion of any legal disputes in which the data is needed as evidence. In particular at least 10 years to demonstrate compliance with tax and duty obligations (Austrian Federal Fiscal Code, BAO), at least 30 years for property transactions. For services in respect of which claims for damages under the Austrian Civil Code (ABGB) or on other grounds (e.g. product liability) may be asserted, for the necessary period.

The collection of the data we require as mandatory is necessary for the conclusion of a contract.

Part of the data collected is further processed for marketing measures. We point this out, together with your rights of objection, at the moment of collection. In this regard we ask you to note point 3 of this privacy policy.

Processing for marketing (customer enquiries, customer care and advertising)
Customer care and marketing (direct advertising) for the purposes of the controller or of joint controllers, including by means of newsletters and answering customer enquiries, sending advertising by post, invitations to events, prize competitions.

Legitimate interests on the basis of Art. 6(1)(f) GDPR:
• advertising for goods and services of the group of companies
• winning and retaining customers (bonus programmes for regular customers)
• improving the attractiveness of the offerings

You have the right to object at any time and without any formal requirement to processing for these purposes and can request the erasure or the restriction of processing. We point out your rights when data is collected directly.

Where necessary, personal data is transferred to the following categories of recipients: delivery services, printers, newsletter service providers, website service providers, IT service providers

The controller is part of a group of companies. For economical internal administration we therefore also make use of the affiliated companies for the processing activity. The group of companies has an overriding legitimate interest in this (recital 48 GDPR). Processing for marketing and customer retention measures takes place exclusively for the purposes of the controller with whom a business relationship exists; processing for such purposes of the group of companies requires the prior consent of the data subject.

When you visit our web pages we use cookies, web beacons and Google Analytics. You can object to the use of each of these by deactivating the function in your browser.

Data on prospective customers and profiles in online shops are stored for 3 years from the last customer contact. Postal addresses and email addresses are stored for the duration of advertising measures or until objection or until a newsletter is unsubscribed; beyond that, storage takes place where restriction of processing is requested or where processing for other purposes requires a longer storage period (in particular pursuant to point 2 of this privacy policy).

There is no obligation to provide data.

In the case of customer enquiries, depending on the nature of the enquiry and how it is handled, further processing may take place in connection with deliveries and services; for more detail see point 2 of this privacy policy.

Public relations and company archive
Provision of information of at least local or regional public interest about the tasks and achievements of the controller, and safeguarding of essential information documenting the history and development of the company and of selected individuals acting in management functions, in so far as there is a public or legitimate private interest in the archiving.

You have the right to object at any time and without any formal requirement to processing for these purposes on grounds relating to your particular situation, and can request the erasure or the restriction of processing. We point out your rights when data is collected directly and in the context of invitations to events.

The legal basis of the processing is freedom of expression pursuant to Art. 13, 17, 17a of the Austrian Basic Law on the General Rights of Nationals and Art. 10 ECHR and, in so far as journalistic purposes are pursued, pursuant to Art. 85 GDPR in conjunction with § 9(2) of the Austrian Data Protection Act (DSG) (for image data also § 12(2)(4) DSG, in so far as there is an overriding interest in the public depiction of events of contemporary history); otherwise, in particular when publishing image data, the consent of the data subjects is obtained in each case (Art. 6(1)(a) GDPR / Art. 9(2)(a) GDPR). Permanent archiving takes place, in so far as significant persons and events of the company’s history are concerned, on the basis of a public or at least a corresponding private interest in documentation (for image data § 12(3)(3) DSG) and for further processing for (contemporary) historical and scientific purposes pursuant to Art. 89 GDPR (§ 7(1)(1) and (2) DSG, in individual cases with the consent of the data subjects pursuant to § 7(2)(2) DSG). Where persons are incidentally depicted during the documentation of public occasions, no identifying processing takes place.

No transfer recipients are envisaged; a publication is however intended for the general public and, in so far as it takes place on the internet, potentially perceptible by everyone worldwide.

The controller is part of a group of companies. For economical internal administration we therefore also make use of the affiliated companies for the processing activity. The group of companies has an overriding legitimate interest in this (recital 48 GDPR). Processing for marketing and customer retention measures takes place exclusively for the purposes of the controller with whom a business relationship exists; processing for such purposes of the group of companies requires the prior consent of the data subject.

In so far as necessary for the purposes described, data on individuals in public life is collected from publicly available sources (name, public function, attendance with time, place and occasion of the documented event); in the case of private individuals, additional data from personnel administration may be used (name, age, years of service in the case of anniversaries).

The storage period is limited to the period for which the data is suitable and usable for journalistic purposes; where there is a corresponding interest in documentation, permanent archiving takes place for later (re-)use for the purposes described in this processing activity.

There is no obligation to provide data.

Use takes place solely for the intended purposes and, where applicable, in accordance with Art. 5(1)(b) GDPR for archiving purposes in the public interest, for scientific or historical research purposes or for statistical purposes.

Data processing in application procedures
Keeping personal data of applicants on file for a limited period in the case of speculative applications and in application procedures with job advertisements, as well as use for the purpose of selecting applicants and concluding an employment contract.

We process applicant data on the basis of Art. 6(1)(b) GDPR (pre-contractual measures) and of Art. 6(1)(f) GDPR, in order to be able to contact you for the intended storage period for the purpose of selecting applicants and, in individual cases, to be able to verify your statements where this is in our interest for a position because of particularly high requirements as to your trustworthiness, or is necessary in the interest of third parties.

Your data is disclosed to our employees only where necessary. Where references are given, contact may be made in individual cases. Likewise, in justified cases and where there is a corresponding overriding interest, your statements may be verified with third parties (e.g. qualifications and university degrees submitted). A transfer to third countries or international organisations takes place in these cases only if either an adequacy decision pursuant to Art. 45 GDPR exists, or the conditions of Art. 49(1)(b) GDPR are met (necessity for the performance of pre-contractual measures at the request of the data subject), or consent pursuant to Art. 49(1)(a) GDPR has been given.

The controller is part of a group of companies. For economical internal administration we therefore also make use of the affiliated companies for the processing activity. The group of companies has an overriding legitimate interest in this (recital 48 GDPR).

When contact is made with references you have given, data and information about your previous employment or activity as well as subjective assessments of your work performance may be collected from those third parties. (Storage of this data and information is not envisaged.)

If you have applied for an advertised position, we will store your personal data for a maximum of 3 years from the end of the application procedure and will then erase it, whereby from eight months after the end of the procedure you can object at any time without any formal requirement.

If you have submitted a speculative application, we will store your documents for a maximum of 3 years in order to be able to contact you about suitable open positions, whereby you can object to the processing at any time without any formal requirement.

In order to carry out the application procedure it is in any case necessary that you provide evidence of having the qualifications required for the position to be filled and that you leave contact details. In individual cases it may also be necessary, depending on the requirements for filling a position, for us to request further data from you (e.g. a criminal record extract). If you do not provide the mandatory data, your application cannot be considered for the position in question.

If an employment relationship is entered into, your application documents will continue to be used for personnel administration purposes, with the exception of particularly sensitive data (e.g. criminal record extract). All further information will be provided to you before the contract is concluded.

Communication
If you contact us via a form on the website, by email or by telephone, the data technically necessary for the communication (depending on the means of communication chosen) is collected and processed, such as telephone number, email address, time (and where applicable duration) of the communication and so on. Incoming emails are also processed by means of spam filters, firewalls, virus scanners and the like for the purposes set out in point 1 of this policy.

The data you provide is processed for the purpose of handling your enquiry on the basis of the corresponding legitimate interest pursuant to Art. 6(1)(f) GDPR. The further purposes of the processing depend on the content of the communication and are stated at points 1-6 of this privacy policy.

In the case of processing for purposes pursuant to Art. 6(1)(e) and (f) GDPR in this privacy policy, in so far as stated there, you have the right to object at any time and without any formal requirement to processing for these purposes on grounds relating to your particular situation, and can request the erasure or the restriction of processing. We point out your rights when data is collected directly (e.g. in online forms). This right does not exist in so far as we have to process your enquiry or a communication for other reasons (e.g. contractual obligations, legal obligations, product liability) and have to store it for the period stated in each case in this privacy policy.

Depending on the purposes of a communication, a corresponding transfer pursuant to points 1 to 6 of this privacy policy may be necessary.

Each time contact is made, our systems automatically record data and information from the data subject’s means of communication or technical systems.

The following data is collected in this process: contact details of the data subject (e.g. telephone number, email address and so on), time of the communication (date, time), consent to recording, where applicable the duration of the call, where applicable a voice message (answering machine), where applicable the content of the communication (text message).

The storage period is governed by the period necessary to carry out the communication through to its conclusion; beyond that, depending on the purpose of the communication, longer storage may be necessary, which is stated in each case at points 1-6 of this privacy policy.

There is no obligation to provide the data.

Depending on the content of your enquiry or of the communication, further processing takes place for all the purposes listed at the preceding points of this privacy policy.

Privacy policy for our Facebook page (social network)
With this statement on data protection and data security we wish to set out how we collect, protect and process your valuable personal data and other information on our Facebook presence. The purpose of the Facebook page is customer care and direct advertising for the purposes of the controller, as well as the presentation of the company’s products and services on social media.

Direct marketing

If you book with us, make a purchase, send us an enquiry or request information or brochures, we process your personal data pursuant to Art. 6(1) sentence 1(b).

On our website you can subscribe to our newsletter. The double opt-in procedure is used for registration. In the newsletters we inform you about developments concerning our product/our service and about news and items of interest, as far as possible and known to us tailored to your interests and holiday wishes. You will also receive our newsletters if you gave us your email address when booking. For the dispatch of the newsletter we collect and store the data you enter in the input mask or provided with an enquiry of any kind (e.g. surname, first name, email address, postal address) and enrich it with interests known to us from your holiday wishes. We use your data for direct marketing when you subscribe to the newsletter pursuant to Art. 6(1) sentence 1(a), (f) GDPR in order to send you tailored information about our service. You can object to this use now or at any time with effect for the future. To do so, send an email to office@central.co.at or use the unsubscribe function in the newsletter sent to you.

Product recommendations by email

As our customer you regularly receive product recommendations from us by email. You receive these product recommendations from us regardless of whether you have subscribed to a newsletter or have consented to marketing communication by email. In this way we want to provide you with information about products from our range that could be of interest to you on the basis of your most recent purchases with us. In doing so we adhere strictly to the statutory requirements.

The product recommendations by email are based on the legal basis of Art. 6(1)(f) GDPR and are also permissible by email to our customers within the scope of § 107(3) of the Austrian Telecommunications Act (TKG). Each time we use your contact details for advertising purposes we expressly point out your right to object, which you can exercise at any time simply and without red tape. If you no longer wish to receive product recommendations from us by email, you can object at any time. Naturally you will find an unsubscribe link in every email. If you wish to exercise this right of objection, please contact: office@central.co.at

For the creation of the newsletter and the product recommendations we use the services of NumBirds CRM GmbH, 6020 Innsbruck, Brixnerstraße 3/3. To safeguard the confidentiality of your personal data we have concluded a data processing agreement with that company.

Data is not passed on to third parties.

Controller and contact details
Please feel free to contact us if you have questions about data protection. You can also receive all information orally.
Owner of this information:
Hotel Cafe Central GmbH
Gilmstraße 5
A-6020 Innsbruck
+43 (0) 512 5920
office@central.co.at

In case C-210/16 of 5 June 2018 the Court of Justice of the European Union (CJEU) ruled that the operation of a Facebook page involves joint controllership with Facebook:
Facebook Ireland Ltd., 4 Grand Canal Square, Grand Canal Harbour, Dublin 2, Ireland
We are joint controllers only in so far as we can influence the processing of your data by Facebook. You can also reach us at any time directly via our website.
For those processing operations for which Facebook alone is responsible, we refer you to the company’s privacy policy:
https://www.facebook.com/about/privacy/
Objection to processing operations for which Facebook is responsible: https://www.facebook.com/settings?tab=ads http://www.youronlinechoices.com

Legal bases and legitimate interests
Legitimate interests on the basis of Art. 6(1)(f) GDPR:
•advertising for goods and services of the group of companies
•winning and retaining customers
•improving the attractiveness and increasing the reach of our online presence
•customer communication and answering your questions
•invitations to events via Facebook
You can object at any time to the processing operations within our area of responsibility by deleting comments, likes or a connection to our Facebook page that you have set up yourself, or by contacting us (see the point “Data subject rights”). For rights of objection and withdrawal in respect of processing by Facebook, please contact the company directly.
We have no influence on the collection, processing and storage period of data by Facebook for the “Insights” tool. We evaluate this data statistically on a non-personal basis according to the following criteria:
•categories of data subjects: fans, subscribers, broken down by gender, urban or rural regions, language
•statistics on user activity: total number of page views, “like” clicks, use of posts and content on our pages, reach, video views, comments, shared content, replies, users’ visit times, data on end devices.
•data on the Facebook groups linked to our Facebook page.
We process your data exclusively within the European Union. Content published or shared by users on our fan page, likes and so on can be accessed worldwide.
Facebook also processes data outside the European Union on the basis of the “Privacy Shield” and the corresponding adequacy decision pursuant to Art. 45 GDPR. Facebook thereby undertakes to comply with European data protection rules. Further information on Facebook’s Privacy Shield status is available here: https://www.privacyshield.gov/participant?id=a2zt0000000GnywAAC&status=Active
If you subscribe to our fan page or register as a fan, viewing your Facebook profile is possible in accordance with the terms of use and your privacy settings on Facebook. We do not normally collect and process this data, but in exceptional cases access it for the purposes stated in this privacy policy, in particular for targeted customer communication.
Facebook collects your data among other things for the preparation of statistics for “Insights” in accordance with its privacy policy. We have no influence on this and can merely make a selection for evaluations of non-personal statistics on the basis of predefined criteria.
We do not store any content or personal data from the reports of the Insights module that is within our control.

Provision of data
There is no obligation to provide data. You can contact us at any time by other means – as described on the contact page.
As a rule, no further processing of your data for other purposes takes place. Depending on the purposes of a communication, however, further processing in accordance with our general privacy policy on our website may be necessary.

Data subject rights, objection and withdrawal
You can assert the data subject rights listed below where the respective conditions are met. Please note that you may first have to provide suitable proof of identity.
We can only fulfil these rights in so far as they concern our responsibility in connection with the operation of the Facebook page. To assert your rights beyond that, please approach Facebook.
-Right of access: you can request confirmation – as a rule free of charge – as to whether personal data concerning you is being processed, and request access to that data and to the information pursuant to Art. 15 GDPR.
-Right to rectification if we process inaccurate or incomplete data about you (Art. 16 GDPR).
-Right to erasure of personal data concerning you where the conditions of Art. 17 GDPR are met.
-Right to restriction of the processing of your data pursuant to Art. 18 GDPR.
-Right to data portability and to receive the personal data you have provided by automated means in a structured, commonly used and machine-readable format (Art. 20 GDPR).
-Where processing is based on a (non-overriding) legitimate interest, you have the right to object at any time pursuant to Art. 21 GDPR. Where processing is carried out for the purpose of direct marketing and the profiling connected with it, this right applies without restriction.
-You can withdraw consent given to the processing of personal data at any time; the lawfulness of the processing carried out up to the point of withdrawal is not affected.

Right to lodge a complaint
You have the right to lodge a complaint with a supervisory authority competent for you (data protection authority), in particular in the EU member state of your residence, your place of work or the place of the alleged infringement, if you consider that the processing of personal data concerning you infringes the General Data Protection Regulation or that your data subject rights have been violated.
We would welcome it if you contacted us beforehand and gave us the opportunity to comment.
You will find a list of the supervisory authorities here: http://ec.europa.eu/newsroom/article29/item-detail.cfm?item_id=612080

Version of this privacy policy: 25 May 2018