The protection of your privacy and your data is very important to us and is always taken into account in all business transactions.

In principle, you can use our website without providing any personal data. However, other regulations may apply to individual services, which we will point out to you separately below.

The purpose of processing your personal data (hereinafter referred to as "data") is to provide you with information about our wide range of machines and the products and services we offer. In this data protection declaration we inform you, among other things, about

• the name and contact details of the person responsible
• all the purposes for which your data will be processed
• the legal basis on which the processing activities are based, including, if applicable, our legitimate interest
• all recipients of your data
• any transfer of your data to a third country and a description of the legal basis for this
• the storage period for your data or the criteria for determining the period
• the categories of your data that are processed
• the origin of your data
• the rights of the data subjects

ELMAG Entwicklungs- und Handels GmbH, Hannesgrub Nord 19, A-4911 Tumeltsham, Email datenschutz@elmag.at.

No data protection officer has been appointed, as this is not required by law.

You have the following rights with regard to personal data concerning you:

• Right to information
• Right to correction or deletion
• Right to restriction of processing
• Right to object to processing
• Right to data portability
• Right to withdraw your consent

You also have the right to complain to a data protection supervisory authority about our processing of your personal data.

You can contact us at any time for this purpose and for further questions on the subject of personal data.

Right to information

You have the right to obtain from us at any time, free of charge, information about the personal data we have stored about you and a copy of this information, including information about

• the purposes of processing
• the categories of personal data processed
• the recipients or categories of recipients to whom the personal data have been or will be disclosed, in particular in the case of recipients in third countries or international organisations
• if possible, the planned duration for which the personal data will be stored or, if this is not possible, the criteria for determining this duration
• the existence of a right to rectification or erasure of the personal data concerning you or to restriction of processing by us or a right to object to such processing
• the existence of a right of appeal to a supervisory authority
• if the personal data is not collected from the data subject: Any available information about the origin of the data
• the existence of automated decision-making, including profiling, pursuant to Article 22(1) and (4) of the GDPR and - at least in these cases - meaningful information about the logic involved and the scope and intended effects of such processing for the data subject.
• Furthermore, you have the right to be informed whether personal data have been transferred to a third country or to an international organisation. If this is the case, you also have the right to obtain information about the appropriate safeguards in connection with the transfer.

Right to rectification

You have the right to request that inaccurate personal data be corrected without delay.

You also have the right to request that incomplete personal data be completed, including by means of a supplementary declaration, taking into account the purposes of the processing.

Right to erasure

You have the right to request that we erase your personal data concerned without undue delay, provided that one of the following reasons applies and to the extent that the processing is not necessary:

• The personal data was collected or otherwise processed for such purposes for which it is no longer necessary.
• You revoke your consent on which the processing was based pursuant to Art 6 (1) (a) DSGVO or Art 9 (2) (a) DSGVO and there is no other legal basis for the processing.
• You object to the processing pursuant to Art 21(1) DSGVO and there are no overriding legitimate grounds for the processing, or you object to the processing pursuant to Art 21(2) DSGVO.
• The personal data have been processed unlawfully.
• The erasure of the personal data is necessary for compliance with a legal obligation under Union or Member State law to which the controller is subject.
• The personal data has been collected in relation to information society services offered pursuant to Art 8(1) DSGVO.

Right to be forgotten

If the personal data have been made public by us and our company as a controller is obliged to erase the personal data pursuant to Art 17(1) DSGVO, we shall take reasonable measures, including technical measures, having regard to the available technology and the cost of implementation, to inform other controllers who process the published personal data that you have requested from those other controllers the erasure of all links to those personal data or copies or replications of those personal data, unless the processing is necessary.

Right to restrict processing

You have the right to request us to restrict processing if one of the following conditions is met:

• The accuracy of the personal data is contested by you for a period of time which enables us to verify the accuracy of the personal data.
• The processing is unlawful, you object to the erasure of the personal data and instead request the restriction of the use of the personal data.
• We no longer need the personal data for the purposes of processing, but you need it to assert, exercise or defend legal claims.
• You have objected to the processing pursuant to Art 21 (1) DSGVO and it is not yet clear whether our legitimate reasons outweigh yours.

Right to data portability

You have the right to receive your personal data concerned, which has been provided by us, in a structured, common and machine-readable format.

You also have the right to transfer this data to another controller without hindrance from us, provided that the processing is based on consent pursuant to Art 6(1)(a) DSGVO or Art 9(2)(a) DSGVO or on a contract pursuant to Art 6(1)(b) DSGVO and the processing is carried out with the aid of automated procedures, unless the processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in us.

Furthermore, when exercising your right to data portability, you have the right to obtain that the personal data be transferred directly from us to another controller, insofar as this is technically feasible and insofar as this does not adversely affect the rights and freedoms of other persons.

Right to object

You have the right to object at any time, on grounds relating to your particular situation, to the processing of your personal data concerned which is carried out on the basis of Art 6(1)(e) or (f) DSGVO. This also applies to profiling based on these provisions.

We will no longer process the personal data in the event of an objection, unless we can demonstrate compelling legitimate grounds for the processing which override the interests, rights and freedoms of you, or the processing serves to assert, exercise or defend legal claims.

If we process personal data for the purpose of direct marketing, you have the right to object at any time to the processing of your personal data for the purpose of such marketing. This also applies to profiling, insofar as it is connected with such direct advertising.

If you object to us processing your personal data for direct marketing purposes, we will no longer process it for these purposes.

In addition, you have the right to object on grounds relating to your particular situation to the processing of personal data which is carried out by us for scientific or historical research purposes or for statistical purposes pursuant to Article 89(1) DSGVO, unless such processing is necessary for the performance of a task carried out in the public interest.

Automated decisions in individual cases including profiling

You have the right not to be subject to a decision based solely on automated processing - including profiling - which produces legal effects concerning you or similarly significantly affects you, unless the decision (1) is necessary for the conclusion or performance of a contract between you and us, or (2) is permitted by Union or Member State law to which we are subject and that law contains adequate measures to safeguard your rights and freedoms and your legitimate interests, or (3) is based on your explicit consent.

Right to withdraw consent under data protection law

You have the right to withdraw consent to the processing of personal data at any time. However, your revocation does not affect the lawfulness of the data processing that took place until the revocation.

Our website and services are not intended for use by minors and we do not wish to collect data from minors. If a parent or guardian of a minor believes that their child may have provided personal data to us, please write to us at the contact details below and we will delete that personal data subject to applicable law and this Policy.

We use appropriate technical and organisational measures and safeguards (TOMs) designed to prevent unauthorised access, unlawful processing and unauthorised or accidental loss of your data.

This includes, for example, the encryption of your communication with us via this website based on the Secure Socket Layer (SSL) encryption protocol.

You can check the quality of our encryption here: https://www.ssllAbs.com/ssltest

It is important to us to point out that data transmission on the Internet can have security gaps, as complete protection against access by unauthorised third parties is not possible.

The server on which this website is hosted is located in Germany and is operated by Mittwald CM Service GmbH & Co KG, with whom we have concluded an order processing agreement.

Please see https://www.mittwald.de/datenschutz for more details.

Our website collects a series of general data and information with each of your calls by an automated system.

This general data and information is stored in the log files of our server by Mittwald CM Service GmbH & Co KG in Germany.

The following can be recorded

• the browser types and versions used
• the operating system used by the accessing system
• the website from which an accessing system arrives at our website (so-called referrer)
• the sub-websites which are accessed via an accessing system on our website
• the date and time of an access to the website
• an internet protocol address (IP address)
• the Internet service provider of the accessing system
• other similar data and information which serve to avert danger in the event of attacks on our
• information technology systems.

When using this general data and information, we do not draw any conclusions about you.

This information is required in order to

• deliver the contents of our website correctly
• optimise the contents of our website and the advertising for it
• ensure the long-term functionality of our information technology systems and the technology of our website
• Website
• To provide law enforcement authorities with the information necessary for prosecution in the event of a cyber attack.

We evaluate this anonymously collected data and information on the one hand statistically and on the other hand with the aim of increasing data protection and data security in our company, in order to ultimately ensure an optimal level of protection for you. In any case, we may process this data on the basis of our legitimate interest pursuant to Art 6 (1) lit f DSGVO.

The logs are stored separately from all personal data provided by you and are also deleted after a maximum of 90 days.

Information on the use of cookies and clarification of your corresponding choices and rights can be found in our cookie banner.

At the current time, you can enter your data on our website, send us an email, contact us by phone, fax and in person. Please note that unencrypted emails sent over the internet are not sufficiently protected against unauthorised access by third parties.

Customer account, orders

If you would like to place an order in our webshop, it is necessary for the conclusion of the contract that you provide your personal data listed below, which we require for the processing of your order. To prevent unauthorised access by third parties to your personal data, in particular financial data, the ordering process is encrypted using SSL technology.

Contact form website

If you would like to send us a message, it is necessary that you provide the personal data listed below, which we need to process your request. To prevent unauthorised access to your personal data by third parties, the ordering process is encrypted using SSL technology.

Newsletter

With your consent, you can subscribe to our newsletter, with which we inform you about our current interesting offers. This means that we will write to you directly by e-mail, direct mail or customised online advertising and inform you if we believe, on the basis of the data you have provided, that information about our products, services and events and those of our partner companies are of particular relevance and interest to you.

You can only receive our company newsletter if (1) you have a valid e-mail address and (2) you have registered to receive the newsletter.

A confirmation e-mail will be sent to the e-mail address you entered for the first time for the newsletter dispatch in the double opt-in procedure, in which we ask you to confirm that you wish to receive the newsletter.

This confirmation e-mail serves to check whether you, as the owner of the e-mail address, have authorised the receipt of the newsletter.

The purpose of this procedure is to be able to prove your registration and, if necessary, to clarify any possible misuse of your personal data.

If you contact us, for example, simply to obtain information from us, we process your data for this purpose. If you contact us to conclude a contract, for example, we process your data for this purpose.

Customer account, order, including customer support

If you provide your order details on our website, by telephone, by fax, by post or via email, the data you provide, including your personal data, will be processed by us and the recipients mentioned below as part of our business relationship with you for the (pre-)processing of the contract, in order to process and manage your order and to look after you as a customer.

If you wish to place an order in our webshop, it is necessary for the conclusion of the contract that you provide your personal data, which we require for the processing of your order. We only process the data you provide for the purpose of processing your order.

This data is required for the fulfilment of the contract or for the implementation of pre-contractual measures. Without this data, we cannot conclude the contract with you.

You can voluntarily create a customer account, through which we can save your data for future orders. When you create an account under "New customers", the data you provide will be stored revocably.

Contact form website

We process the data you provide in order to be able to answer your enquiry in the best possible and personalised way and to be able to determine from which country/location an enquiry originates.

Newsletter

We inform our customers and business partners at regular intervals by means of a newsletter about offers of the company.

The data collected in the course of your registration for the newsletter is used exclusively for sending our newsletter.

Furthermore, subscribers to the newsletter could be informed by e-mail if this is necessary for the operation of the newsletter service or a related registration, as could be the case in the event of changes to the newsletter offer or changes in the technical circumstances.

Marketing (general)

To initiate business and intensify the business relationship with existing and potential customers.

If you contact us, for example, simply to obtain information from us, we may process your data on the basis of your consent in accordance with Art 6 (1) (a) DSGVO or Art 6 (1) (f) DSGVO. If you contact us in order to conclude a contract, for example, we may process your data on the basis of Art 6 (1) (b) DSGVO and, if necessary, store it on the basis of Art 6 (1) (c) DSGVO.

Customer account, order

The processing of your data, including the personal data provided by you, is carried out by us and the recipients listed below on the legal basis of Art 6 Para 1 S 1 lit b in order to be able to identify you as a customer, in order to be able to process the contract in question appropriately, as well as for correspondence with you. The data processing is carried out upon your request and is necessary for the aforementioned purposes for the appropriate processing of your order. Data that is not required for the processing of the contract and is provided voluntarily by you will be processed by us on the legal basis of your consent in accordance with Art 6 Para 1 lit a DSGVO. You have a right of revocation at any time. For more details, see your rights above.

Contact form website

If we receive a message from you, the legal basis is Art 6 para 1 lit a, Art 6 para 1 lit b or Art 6 para 1 lit f DSGVO, depending on the message content.

Newsletter

The legal basis is your consent according to Art 6 para 1 lit a DSGVO. You have a right of revocation at any time. For more details, see your rights above.

Marketing (general)

The legal basis is our legitimate interest according to Art 6 Para 1 S 1 lit f DSGVO. The legitimate interest is our interest in initiating business and intensifying the business relationship with existing and potential customers.

In general, we expressly ask you not to disclose any data to us that is likely to have little or no relevance to your intended purpose; this applies in particular to special categories of personal ("sensitive") data. The provision of information is purely voluntary on your part.

Information

If you contact us simply to obtain information from us, we will process the data you provide.

Customer account, orders

Mandatory information required for the processing of contracts is marked separately, other information is voluntary.

Depending on what you voluntarily provide to us, your data processed by us may include the following:

• Your contact details (name, address, telephone number, email address, etc.)
• Company name
• Content of the order
• the ELMAG dealer selected by you
• special categories of personal data voluntarily provided to us by you without request
• personal data

Contact form website

When we receive a message from you, our web host logs and stores the date/time of registration and the IP address from which the registration was received. This is for evidence purposes only in the event that an email address is used by an unauthorised person. In addition, it is mandatory to enter your name, a valid e-mail address and a personal message. The provision of further information is voluntary.

Newsletter

Which personal data are transmitted to us when ordering the newsletter, can be seen from the input mask used for this purpose.

Only your e-mail address is required for sending the newsletter.

The provision of any further, separately marked data is voluntary and will be used to address you personally.

When you register for the newsletter, we also store the IP address assigned by your internet service provider (ISP), the computer system you are using at the time of registration and the date and time of registration.

The collection of this data is necessary in order to be able to trace the (possible) misuse of your e-mail address at a later date and therefore serves as a legal safeguard for us.

Marketing (general)

Depending on what you have voluntarily provided to us, your data processed by us may include the following:

• Your contact details (name, address, telephone number, email address, etc.)
• The content of previous orders

Your data may be disclosed in whole or in part, but only to the extent and to the extent necessary, to the following responsible parties:

• Banks (payment transactions - Austria)
• Tax advisors (accounting - Austria)
• Collection agencies (debt collection - Austria)
• Legal representatives (law enforcement - Austria)
• Courts (law enforcement - Austria)
• Administrative authorities (Austria)
• Paypal (payment transactions - USA)
• Mastercard (USA)
• Visa (USA)

In addition, your data may be shared with the following recipients as processors; we have entered into a (sub-)processing agreement with all of them and verified the appropriate technical and organisational measures (TOMs):

• Innpuls GmbH (web design - Austria)
• Mittwald CM Service GmbH & Co KG (web hosting, webmail - Germany)
• eworx Network und Internet GmbH (Newsletter - Austria)

Your data will be stored in a form that allows your identification only for as long as necessary for the purpose for which it is processed.

Information

By providing us with your data via the contact form or email, or by contacting us by telephone or in person, you expressly consent to the processing of your data, including the personal data you have provided and any unsolicited and voluntarily provided special categories of personal data, by us and the recipients listed above for the duration of the processing of the information in question.

If you contact us merely to obtain information from us, your data will therefore, depending on the content of the communication, either be deleted immediately or deleted after the expiry of a reasonable period corresponding to the content.

If you revoke your declaration of consent, we will delete (have deleted) all of your data - including accumulated data - from all databases.

Customer account, orders

After the shopping process has been cancelled, the data stored by us will be deleted.
You can always delete all other data, including your user account, in the customer area.
If you register on our website, we will store your data in any case for as long as your account exists.

We are obliged by company and tax law to store your address, payment and order data for a period of 7 years. If you contact us to conclude a contract, the data will be deleted at the end of the 7th year after the last receipt has been posted (§ 132 BAO). In the event of a contract being concluded, all data from the contractual relationship will therefore be stored until the end of this period.

However, we restrict processing after 2 years, i.e. your data is only used to comply with legal obligations.

Statutory/legal retention obligations or contractual obligations, e.g. towards customers from warranty or compensation or towards contractual partners, are a further basis for continuing to store your data. (Art 6 para 1 lit c DSGVO; Art 17 para 3 lit e DSGVO).

Newsletter

Your data provided for the newsletter will only be stored by us for as long as you wish to receive the newsletter and beyond that only for as long as we require data to enforce or defend legal claims.

You can revoke your consent to receive the newsletter at any time with future effect by clicking on the link provided in every newsletter e-mail, in writing by e-mail or letter to our contact address. The revocation of consent does not affect the lawfulness of the processing of your data carried out on the basis of your consent until the revocation. After revocation of the consent, the collected and stored personal data of the participant will be deleted immediately.

Marketing (general)

Marketing data will be kept for 3 years after the last contact.

We only set a link to Facebook and do not use any plugins or cookies in compliance with DSGVO

Address of the respective page including URL to their data protection information:

Facebook, Inc, 1601 Willow Road, 94024 Menlo Park, USA,
https://www.facebook.com/policy.php
https://www.facebook.com/policies/cookies
https://www.facebook.com/legal/terms/page_controller_addendum#.

We use a Facebook page at

https://www.facebook.com/ELMAG.at/

The relevant terms supplementing this Privacy Policy can be found here:

https://www.facebook.com/policy.php
https://www.facebook.com/policies/cookies
https://www.facebook.com/business/news/updates-for-page-admins-in-the-eu-and-the-eea
https://www.facebook.com/legal/terms/page_controller_addendum#

We use an Instagram profile at

https://www.instagram.com/elmag.at

The relevant terms and conditions supplementing this privacy policy can be found here:

https://help.instagram.com/519522125107875
https://help.instagram.com/1896641480634370

We operate a YouTube channel at

https://www.youtube.com/@ELMAG_Machines

The relevant provisions supplementing this data protection declaration can be found here:

https://policies.google.com/privacy?hl=de&gl=de

We use the Google Maps service on this website.

As a legal basis for the use of Google Maps, we use our legitimate interest according to Art. 6 para. 1 p. 1 lit. f DSGVO, to offer you the possibility of an interactive search for ELMAG dealers by way of the ordering process, as well as in the improvement of our information and service offer and our website. This is necessary so that you can select ELMAG dealers. This enables us to show you interactive maps directly on the website and allows you to use the map function conveniently. You have the right to object to this at any time.

By visiting the website, Google receives the information that you have accessed the corresponding sub-page of our website.

This occurs regardless of whether Google provides a user account via which you are logged in or whether no user account exists.

If you are logged in to Google, your data will be directly assigned to your account. If you do not want your data to be associated with your Google profile, you must log out before activating the button.

Google stores your data as usage profiles and uses them for the purposes of advertising, market research and/or the needs-based design of its website.

Such an evaluation is carried out in particular (even for users who are not logged in) to provide needs-based advertising and to inform other users of the social network about your activities on our website.

You have the right to object to the creation of these user profiles, and you must contact Google to exercise this right.

For more information on the purpose and scope of data collection and its processing by the plug-in provider, please refer to the provider's privacy policy. There you will also find further information on your rights in this regard and setting options for protecting your privacy: https://policies.google.com/privacy?hl=de&gl=de. Google also processes your personal data in the USA and has submitted to the EU-U.S. Data Privacy Framework, https://www.dataprivacyframework.gov/s/.