We attach great importance to data protection. The collection and processing if your personal data occurs in compliance with the relevant statutory data protection regulations, in particular the General Data Protection Regulation (GDPR).
Responsible party (controller)
The responsible party (controller) for the collection and use of your ppersonal data as stipulated in art. 4 no. 7 of the GDPR is
Zellstoff Vertriebs GesmbH, International Branch, Ottogasse 1, A-2333 Leopoldsdorf
If you want to object to the collection, processing or use of your data on our part as stipulated in these data protection regulations in total or for specific measures, your direct your objection to the responsible party (controller).
We collect information about you when you use this website. We automatically collect information concerning your use behaviour and your interaction with us and record data about your computer or mobile device. We collect, store and use data concerning every access to our website (so-called server log files). Access data includes:
- Name and URL of the accessed file
- Date and time of the access
- Quantity of data transmitted
- Message concerning successful access (HTTP response code)
- Browser type and browser version
- Operating system
- Referrer URL (the website previously visited)
- Websites that are accessed by the user's system via our website
- The user's Internet service provider
- IP address and requesting provider
We use this log data without identification of your person or other profiling for statistical analyses for the purpose of operation, security and optimisation of our website, but also for anonymous detection of the number of visitors (traffic) on our website, and to measure the scope and type of use of our website and services, likewise for billing purposes to measure the number of clicks received by the cooperation partners. Based on this information we can make personalised and location-based content available, analyse the data traffic, perform troubleshooting and error rectification, and improve our services.
This also constitutes our legitimate interest pursuant to art 6 para. 1 page 1 f) of the GDPR.
We reserve the right to retroactively analyse the log data, if due to concrete indications there is justified suspicion of unlawful use. We store IP addresses for a limited period of time in the log files, if this is necessary for security purposes or needed for the provision of services, or for the billing of a performance, e.g. if you use one of our offerings. After termination of the ordering procedure or after receipt of payment we delete your IP address, if it is no longer required for security purposes. We also store IP addresses if we have concrete suspicion of a criminal act in conjunction with the use of our website. In addition, as part of your account, we save the date of your last visit (e.g. registration, login, clicking of links, etc.).
We use so-called session cookies to optimize our website. A cookie is a small text file that is sent by the respective server when a website is visited and which is buffered (stored temporarily) on your hard disk. This file, as such contains a so-called session ID with which various queries of your browser can be allocated to the shared session. Thus your computer can be recognized again when you return to our website. These cookies will be deleted after you close your browser. They are used, for example, so that you can use the shopping cart function over multiple pages.
To a minor extent we also use persistent cookies (likewise small text files that are placed on your end device), that remain on your end device and enable us to recognise your browser at your next visit. These cookies are stored on your hard disk and delete themselves after the prescribed time. Their life time is 1 month to 10 years. Thus we can present our offering in a manner that is more user-friendly, more effective and more secure, and for example display information on the website that is especially matched to your interests.
For example the following data and information is stored in the cookies:
- Login information
- Language settings
- Search terms entered
- Information concerning the number of accesses of our website, as well as use of individual functions of our Internet presence.
At activation of the cookie an identification number is assigned to the cookie and an allocation of your personal data to this identification number is not undertaken. Your name, your IP address or similar data that would enable an allocation of the cookie to you, is not placed in the cookie. We only obtain pseudonymised information on the basis of the cookie, for example, pseudonymised information on what pages of our shop were visited, which products were viewed, etc.
You can set your browser so that you will be informed of cookies beforehand and you can decide on a case-by-case basis whether you accept cookies or exclude acceptance of cookies in specific cases, or completely prevent them. This can restrict the functionality of the website.
Data for fulfilment of our contractual obligations
We process personal data that we need for fulfilment of our contractual obligations, such as name, address, email address, ordered products, invoice and payment data. Collection of this data is necessary to enter into a contract.
This data will be deleted after warranty periods and statutory retention periods expire. Data that is linked to a user account (see below), in every case remains intact for the time this account is held.
The legal basis for the processing of this data is art. 6 para. 1 sentence 1 b) of the General Data Protection Regulation (GDPR), so that we can fulfil our contractual obligations to you.
You can create a user account on our website. If this is what you desire, then we need the personal data requested at login. When you subsequently login, only your email address or user name and the password you have selected are required.
For a new registration we collect master data (e.g. name, address), communication data (e.g. email address) and payment data (bank information) as well as access data (user name & password).
To ensure your proper login and to prevent unauthorised logins by third parties, after registration you will receive an activation link via email to activate your account. We will permanently store the data you have transmitted only after registration has occurred.
You can have us delete a user account that has been created at any time, without incurring any costs other than the transmission costs at the basic rates. A message in text form sent to the contact data cited under number 1 (e.g. email, fax, letter) suffices for this purpose. We will then delete your stored personal data, if we are not obligated to still store it for the transacting of orders or due to statutory retention obligations.
The legal basis for the processing of this data your consent in accordance with art. 6 para. 1 page 1 a) of the GDPR.
To subscribe to the newsletter the data requested in the subscription process is required. The subscription to the newsletter is logged. After subscribing you will receive a message in which you will be asked to confirm the subscription ("double opt-in"). This is necessary so that third persons cannot subscribe with your email address.
You can revoke your consent to receive the newsletter, and thus unsubscribe from the newsletter, at any time.
We store the subscription data as long as it is needed to send the newsletter. We save the logging of the subscription and the sending address as long as an interest exists in verification of the consent originally granted, as a rule this is the statute of limitations for civil claims, therefore a maximum of three years.
The legal basis for sending the newsletter is your consent, in accordance with art. 6 para. 1 page 1 a) in conjunction with Art. 7 of the GDPR in conjunction with § 7 para. 2 no. 3 of the Law Against Unfair Competition (UWG). The legal basis for logging the subscription is our legitimate interest in proving that the sending was undertaken with your consent.
You can revoke the subscription at any time without incurring costs in this regard other than the transmission costs at the basic rates. A message in text form sent to the contact data cited under number 1 (e.g. email, fax, letter) suffices for this purpose. Naturally you will find an unsubscribe link in every newsletter.
Independently of the newsletter we regularly send product recommendations to you via email. In this manner we provide you with information concerning products from our offering that could be of interest to you based on your recent purchases of goods or services from us. In this regard we strictly comply with the statutory regulations. You can object to this product recommendations at any time, without incurring costs in this regard other than the transmission costs at the basic rates. A message in text form sent to the contact data cited under number 1 (e.g. email, fax, letter) suffices for this purpose. Naturally you will find an unsubscribe link in every email.
The legal basis for this is the statutory permission pursuant to art. 6 para. 1 page 1 f) of the GDPR in conjunction with § 7 para./// 3 of the Law Against Unfair Competition (UWG).
When you enter into contact with us (e.g. via contact form or email), we process your information in order to respond to your inquiry and for the case that follow-on questions arise.
If the data processing occurs for execution of contractual measures that are associated with your inquiry, or if you are already our customer, for execution of the contract, the legal basis for this data processing is art. 6 para. 1 page 1 b) of the GDPR.
We process other personal data only if you consent to this processing (art. 6 Abs. 1 page 1 a) of the GDPR) or if we have a legitimate interest in the processing of your data (art. 6 para. 1 page 1 f) of the GDPR). A legitimate interest, for example, in responding to your email.
We use Google Analytics, a web analysis service of Google Inc. ("Google"). Google Analytic uses so-called "cookies", text files which are stored on your computer and that allow an analysis of your use of the website. As a rule, the information generated by the cookie about the website visitor's use of this website will be transferred to a Google server in the USA and stored there.
This also constitutes our legitimate interest pursuant to art 6 para. 1 page 1 f) of the GDPR.
Google has subjected itself to the Privacy Shield agreement entered into by the European Union and the US, and certified itself in this regard. Thus Google has obligated itself to comply with the standards and regulations of the European data protection law. More information is provided at the linked entry below: https://www.privacyshield.gov/participant?id=a2zt000000001L5AAI&status=Active.
We have activated the IP anonymisation (anonymizeIp) on this website. Through this measure, within the Member States of the European Union, or in other States party to the Agreement on the European Economic Area, your IP address will be shortened by Google beforehand. The full IP address will only be transmitted to Google in the USA and shortened there in exceptional cases. On our behalf Google will use this information to evaluate your use of the website, to provide reports on website activities and to provide other services related to the use of the website and of the Internet to us.
Moreover, you can prevent the transmission of the data generated through the cookie that concerns your use of the website (incl. your IP address), as well as the processing of this data to Google, by downloading and installing the browser plugin at the following link: http://tools.google.com/dlpage/gaoptout?hl=de.
Alternatively to the browser plugin, or within browsers on mobile devices, you can click the following link to set an opt-out cookie, which will prevent future collection by Google Analytics within this website (this opt-out cookie only functions in this browser and only for this domain. If you delete the cookies in your browser, you must click this link again): [Deactivate Google Analytics]
Duration of storage
Unless specifically indicated we save personal data only as long as necessary for fulfilment of the purposes pursued.
In some cases legislation provides for the retention of personal data, for example, under tax law or commercial law. In these cases we will only continue to store the data for these legal purposes, but we will not otherwise process it, and we will delete in after statutory retention period expires.
Your rights as the person affected by the data processing (data subject)
In addition to the applicable laws you have various rights relative to your personal data. If you desire to assert these rights, then please direct your inquiry via email or post, clearly identifying your person, to the address cited in number 1.
An overview of your rights is provided below.
Right to confirmation and information
You have the right to receive clear and understandable information concerning your personal data.
You have the right, at any time, to receive from us a confirmation as to whether personal data relating to you is processed. If this is the case you have the right to demand from us free-of-charge information concerning the personal data relating to you, in addition to a copy of this data. Moreover a right to the following information exists:
- the purposes for processing;
- the categories of personal data that are processed;
- the recipients or the categories of recipients to whom the personal data has been disclosed or will yet be disclosed, in particular in the case of recipients in third countries or in the case of international organisations;
- if possible, the planned duration for which the personal data will be saved, or if this is not possible, the criteria for determination of this duration;
- the existence of a right to correct or delete the personal data relating to you, or a right of restriction of the processing through the responsible party (controller) or a right to object to this processing;
- the existence of a right to appeal to a supervisory authority;
- if the personal data is not collected from you, all available information concerning the origin of the data;
- the existence of automated decision-making, including profiling pursuant to art. 22 para. 1 and 4 of the GDPR and – at least in these cases – meaningful information concerning the logic involved, as well as the scope and the intended effects of this type of processing for you.
If personal data is transmitted to a third country or to an international organisation, then you have the right to be informed of suitable guarantees in accordance with art. 46 of the GDPR in conjunction with the transmission.
Right of correction
You have the right to demand of us the correction, and if necessary also completion of the personal data relating to you.
You have the right to demand of us the correction of the correct personal data relating to you, without delay. With due consideration of the purposes of the processing you have the right to demand the completion of incomplete personal data – also via a supplemental declaration.
Right to deletion ("right to be forgotten")
In a number of cases we are obligated to delete personal data relating to you.
In accordance with art. 17 para. 1 of the GDPR, you the right to demand from us that the personal data relating to you be deleted without delay, and the we are obligated to delete this personal data without delay, if one of the following reasons applies:
- The personal data is no longer necessary for the purposes for which it was collected, or for which it was processed in some other manner.
- You revoke your consent to the processing on which in accordance with art. 6 Abs. 1 page 1 a) of the GDPR or art. 9 Abs. 2 a) of the GDPR the processing was based and absence of another legal basis for the processing.
- In accordance with art. 21 para. 1 of the GRDP you object to the processing and there are no overriding legitimate reasons for the processing, or you object to the processing pursuant to art. 21 Abs. 2 of the DSGVO.
- The personal data has been unlawfully processed.
- The deletion of the personal data is required for fulfilment of a legal obligation pursuant to Union law or the law of the Member States, to which we are subject.
- The personal data was collected in reference to offered information society services pursuant to art. 8 para. 1 of the GDPR.
If we have made the personal data public and we are obligated to delete it in accordance with Art. 17 para. 1 of the GDPR, then we take appropriate measures with due consideration of the available technology and implementation costs, also of a technical nature, to inform the relevant responsible parties (controllers) that process the personal data, that you have demanded from them the deletion of all links to this personal data or to copies or replications of this personal data.
Right to restriction of the processing
In a number of cases you are authorised to demand from us a restriction of the processing of your personal data.
You have the right to demand from us the restriction of the processing if one of the following prerequisites is present:
- if you dispute the correctness of the personal data for a duration that enables us to verify the correctness of the personal data;
- if the processing is unlawful and you refused deletion of the personal data and instead have demanded restriction of the use of the personal data;
- if the we no longer require the personal data for the purposes of processing, and you however require this data for establishment, exercise or defence of legal claims, or
- If you have lodged an objection to the processing pursuant to Art. 21 para. 1 of the GDPR and it has not yet been determined whether the legitimate reasons of our company override your reasons.
Right to data portability
You have the right to receive, to transmit or to have us transmit the personal data relating to you in a form that is machine-readable.
You have the right to receive the personal data that you have provided to us in a structured, commonly used and machine-readable format, and you have the right have this data transmitted to a different responsible party (controller) without hindrance on our part, if
- the processing is based on a consent pursuant to art. 6 Abs. 1 S. 1 a) of the GDPR or art. 9 Abs. 2 a) of the GDPR or on a contract in accordance with art. 6 para. 1 S. 1 b) of the GDPR and
- the processing occurs by automated means.
In exercising your right to data portability in accordance with paragraph 1 you have the right to have the personal data transmitted directly by us to another responsible party (controller), where technically feasible.
Right to object
You have the right to object to lawful processing of your data by us, if this is substantiated in your particular situation and our interests in the processing do not override your interests.
You have the right, at any time, to object to the processing of personal data relating to you, for reasons arising from your particular situation, which is based on art. 6 Abs. 1 page 1 e) or f) of the GDPR, including profiling based on these provisions. We no longer process the personal data, unless we can provide compelling legitimate reasons for the processing that override your interests, rights and freedoms, or if the processing is used for establishment, exercise or defence of legal claims.
If the personal data is used by us for direct marketing, you have the right to object to the processing of personal data relating to you for the purpose of this type of marketing; this also applies for profiling, to the extent that profiling is related to such direct marketing.
You have the right, for reasons arising from your particular situation, to object to the processing of the personal data relating to you that occurs for scientific or historical research purpose or for statistical purposes pursuant to art. 89 Abs. 1 of the GDPR, unless the processing is required for fulfilment of a task in the public interest.
Automated decisions including profiling
You have the right to not be subjected to a decision based exclusively on automated processing – including profiling – that develops its legal effect relative to yourself or that considerably affects you in a similar manner.
Automated decision making on the basis of the collected personal data does not take place.
Right to revoke declaration of consent under data protection law
You have the right to revoke declaration of consent under data protection law at any time.
Right to appeal to a supervisory authority
You have the right to appeal to a supervisory authority, in particular a supervisory authority in the Member State in which you reside, in which your place of work is located, or in which the presumed infringement occurs, if you are of the opinion that the processing of the personal data relating to you is unlawful.
We endeavour to the utmost to protect the security of your data within the framework of the applicable data protection laws and technical possibilities.
In our facilities your personal data is transmitted with encryption. This applies for your orders and also for the customer login. We use the SSL (Secure Socket Layer) coding system, however we expressly state that data transmission on the Internet (e.g. communication via email) can have security gaps. Seamless protection of data against third-party access is not possible.
For the security of your data we maintain technical and organisational security measures in accordance with art. 32 of the GDPR that we consistently adapt to the state of the technology.
Moreover we do not warrant that our offering is available at specific times; the possibility of faults, interruptions or failures cannot be excluded. The servers that we use are carefully backed up on a regular basis.
Forwarding to third parties, no data transmission to non-EU countries
We always use your personal data only within our company.
If and to the extent to which we involve third parties for fulfilment of contracts (logistics service providers, for example), these third parties receive this personal data only in the scope in which the transmission is required for the corresponding performance.
In the event that we outsource certain parts of the data processing ("job processing"), we obligate the job processors to only use the personal data in compliance with the requirements of the data protection laws, and to ensure protection of the rights of the person concerned (data subject).
Data transmission to institutions or persons outside of the EU, except for the cases cited in number 4 does not take place and is not planned.