Datenschutzerklärung

The data controller is:

PERRO GmbH
Salzachweg 1
5061 Salzburg
Austria
Email: kundenservice@perro.at
Telephone: 43 (0)662 64 50 20

We are delighted that you are interested in our online shop. Protecting your privacy is very important to us. Below, we provide detailed information on how we handle your data. Your data is processed in accordance with the GDPR and Section 96(3) of the Telecommunications Act (TKG).

1. Access data and hosting

You can visit our websites without providing any personal details. Each time you access a webpage, the web server automatically stores only a so-called server log file, which contains, for example, the name of the requested file, your IP address, the date and time of the request, the amount of data transferred and the requesting provider (access data), and which documents the request. This access data is analysed solely for the purpose of ensuring the smooth operation of the website and improving our service. This serves to safeguard our legitimate interests, which prevail following a balancing of interests, in the correct presentation of our service in accordance with Article 6(1), first sentence, point f of the GDPR. All access data is deleted no later than seven days after the end of your visit to the website.

Hosting

The services for hosting and displaying the website are partly provided by our service providers as part of processing carried out on our behalf. Unless otherwise stated in this privacy policy, all access data and all data collected via the forms provided for this purpose on this website are processed on their servers. If you have any questions regarding our service providers and the basis of our cooperation with them, please use the contact details provided in this privacy policy.

2. Data processing for contract fulfilment and to establish contact

2.1 Data processing for contract fulfilment

For the purposes of contract fulfilment (including enquiries regarding and the handling of any existing warranty claims and claims for breach of contract, as well as any statutory obligations to provide updates) in accordance with Article 6(1), first sentence, point (b) of the GDPR, we collect personal data if you voluntarily provide it to us as part of your order. Mandatory fields are marked as such, as in these cases we absolutely require the data for contract fulfilment and cannot dispatch the order without it. The data collected is shown in the relevant input forms. Further information on the processing of your data, in particular regarding its disclosure to our service providers for the purposes of order, payment and dispatch processing, can be found in the following sections of this privacy policy. Once the contract has been fully processed, your data will be restricted for further processing and deleted upon expiry of the retention periods under tax and commercial law in accordance with Article 6(1), first sentence, point (c) of the GDPR, unless you have expressly consented to the further use of your data in accordance with Article 6(1), first sentence, point (a) of the GDPR, or unless we reserve the right to use your data beyond this, which is permitted by law and about which we inform you in this policy.

2.2 Customer account

We collect personal data when you voluntarily provide it to us when opening a customer account. Mandatory fields are marked as such, as in these cases we require the data to open the customer account and you cannot complete the account opening process without providing it. The data collected is can be seen from the relevant input forms. We use the data you provide to fulfil the contract and process your enquiries in accordance with Article 6(1)(b) of the GDPR. You may delete your customer account at any time; this can be done either by sending a message to the contact details, or via a function provided for this purpose within your customer account. Once your customer account has been deleted, your data will be deleted, unless you have expressly consented to the further use of your data in accordance with Article 6( 1(1)(a) of the GDPR, or unless we reserve the right to use your data for other purposes that are permitted by law and about which we inform you in this policy.

2.3 Contacting us

As part of our customer communications, we collect personal data to process your enquiries in accordance with Article 6(1), first sentence, point (b) of the GDPR, if you provide this to us when contacting us (e.g. via the contact form or by email) . Mandatory fields are marked as such, as in these cases we require the data to process your enquiry. The data collected is indicated in the respective input forms. Once your enquiry has been fully processed, your data will be deleted, unless you have expressly consented to further use of your data in accordance with Article 6(1), first sentence, point (a) of the GDPR, or unless we reserve the right to use your data for other purposes that are permitted by law and about which we inform you in this statement.

Smartsupp live chat tool

If you use the Smartsupp live chat tool to contact us, the data you voluntarily enter there (name, email address, message) will be processed by us in accordance with Article 6(1), first sentence, 1(b) of the GDPR for the purpose of responding to your enquiry as part of the performance of a contract. Furthermore, the use of this tool serves to safeguard our overriding legitimate interests, as determined following a balancing of interests, in effective and improved customer communication in accordance with Article 6( 1(1)(f) of the GDPR. The data will subsequently be deleted. The live chat tool is provided by Smartsupp.com, s.r.o. (Milady Horakove 13, 602 00 Brno, Czech Republic) (“Smartsupp”), which acts on our behalf.

3. Data processing for the purpose of order fulfilment

To fulfil the contract in accordance with Article 6(1)(b) of the GDPR, we pass on your data to the delivery service provider commissioned to carry out the delivery, insofar as this is necessary for the delivery of the goods ordered.

Data disclosure to delivery service providers for the purpose of dispatch notifications

Provided you have given us your explicit consent to this during or after placing your order, we will, on the basis of this consent in accordance with Article 6(1), sentence 1(a) of the GDPR, we will pass on your email address and telephone number to the selected delivery service provider so that they may contact you prior to delivery for the purpose of notifying you of delivery or co-ordination prior to delivery. You may withdraw your consent at any time by sending a message via the contact details provided in this privacy policy or directly to the delivery service provider at the contact address listed below. Following withdrawal of consent, we will delete the data you provided for this purpose, unless you have expressly consented to further use of your data, or unless we reserve the right to use your data for other purposes that are permitted by law and about which we inform you in this policy.

Österreichische Post Aktiengesellschaft
Head Office
Rochusplatz 1
1030 Vienna

United Parcel Service (UPS) Speditionsgesellschaft m.b.H.
PO Box 124
1300 Vienna Airport
Austria

DPD Direct Parcel Distribution Austria GmbH
Arbeitergasse 46
2333 Leopoldsdorf

4. Data processing for payment processing

When processing payments in our onlineshop, we work with the following partners: technical service providers, credit institutions and payment service providers.

4.1 Data processing for transaction processing

Depending on the selected payment method, we pass on the data necessary for processing the payment transaction to our technical service providers, who act on our behalf as data processors, or to the designated credit institutions or the selected payment service provider, insofar as this is necessary for the processing of the payment. This serves the purpose of fulfilling the contract in accordance with Article 6(1), first sentence, point (b) of the GDPR. In some cases, the payment service providers collect the data required for processing the payment themselves, e.g. on their own website or via a technical integration within the ordering process. In this respect, the privacy policy of the respective payment service provider applies. If you have any questions regarding our payment processing partners and the basis of our cooperation with them, please use the contact details provided in this privacy policy.

4.2 Data processing for the purposes of fraud prevention and the optimisation of our payment processes

Where necessary, we may provide our service providers with additional data, which they, as our data processors, will use together with the data required for payment processing for the purposes of fraud prevention and optimisingour payment processes (e.g. invoicing, handling disputed payments, supporting accounts management). This serves, in accordance with Article 6(1), first sentence, point f of the GDPR, to safeguard our legitimate interests – which, following a balancing of interests, are deemed to prevail – in protecting ourselves against fraud and in ensuring efficient payment management.

4.3 Credit checks

Where we make an advance payment (for purchases on account), we obtain identity and creditworthiness information from specialist service providers (credit reference agencies). To this end, we transfer your personal data required for a credit check to:

CRIF GmbH
Kaiserstraße 217
76133 Karlsruhe
Germany

This serves to safeguard our legitimate interests, which prevail following a balancing of interests in accordance with Article 6(1)( 1(f) of the GDPR to assess the creditworthiness and willingness to pay of our potential customers prior to the conclusion of a contract, thereby avoiding losses on the purchase price, and is necessary for the conclusion of the contract in accordance with Article 22(2)(a) of the GDPR. Appropriate measures to safeguard your rights, freedoms and legitimate interests are taken into account in this regard. You have the option of setting out your position and challenging the decision by contacting us via the contact details provided in this privacy policy. Once the contract has been fully executed, your data processed for this purpose will be erased, unless you have expressly consented to the further use of your data or we reserve the right to use your data for other purposes that are permitted by law and about which we inform you in this policy.

4.4 Engagement of debt collection agencies

We will pass on your data to a commissioned debt collection agency (CRIF GmbH, Kaiserstraße 217, 76133 Karlsruhe, Germany), provided that our payment claim has not been settled despite a prior reminder. In this case, the claim will be collected directly by the debt collection agency. This serves the purpose of fulfilling the contract in accordance with Article 6(1)( 1(b) of the GDPR, as well as to safeguard our legitimate interests – which prevail following a balancing of interests – in the effective assertion and enforcement of our payment claim in accordance with Article 6(1), first sentence, point (f) of the GDPR.

5. Advertising by email

If you subscribe to our newsletter, we will use the data required for this purpose or data provided separately by you to send you our email newsletter on a regular basis, based on your consent in accordance with Article 6(1), first sentence, point (a) of the GDPR.

You may unsubscribe from the newsletter at any time, either by sending a message to the contact details provided below or via a link provided for this purpose in the newsletter.

Once you have unsubscribed, we will remove your email address from the mailing list, unless you have expressly consented to the further use of your data in accordance with Article 6(1), sentence 1(a) of the GDPR, or unless we reserve the right to use your data for other purposes that are permitted by law and about which we inform you in this statement.

Newsletter distribution

The newsletter is sent by our service provider Sendinblue (Sendinblue GmbH, Köpenicker Straße 126, 10179 Berlin) as part of processing carried out on our behalf. This service provider is based in the EU. The server is located in Germany. Proof of this can be found at TÜV Rheinland test report.

If you have any questions regarding our service providers and the basis of our cooperation with them, please use the contact details provided in this privacy policy.

6. Cookies and other technologies

6.1 General information

To make your visit to our website more engaging and to enable the use of certain features, we use various technologies on different pages, including so-called cookies. Cookies are small text files that are automatically stored on your device. Some of the cookies we use are deleted at the end of the browser session, i.e. when you close your browser (so-called session cookies). Other cookies remain on your device and enable us to recognise your browser the next time you visit (persistent cookies). Privacy protection on end devices When you use our online service, we employ technologies that are strictly necessary to provide the explicitly requested telemedia service. The storage of information on your end device or access to information already stored on your end device does not, in this respect, require your consent.

For functions that are not strictly necessary, the storage of information on your device or access to information which is already stored on your device, requires your consent. Please note that if you do not give your consent, parts of the website may not be fully accessible. Any consent you have given remains valid until you adjust or reset the relevant settings on your device.

Any subsequent data processing via cookies and other technologies
We use technologies that are strictly necessary for the use of certain functions on our website (e.g. the shopping basket function). These technologies collect and process your IP address, the time of your visit, device and browser information, as well as information regarding your use of our website (e.g. information about the contents of your shopping basket). This is based on a balancing of interests, where our overriding legitimate interests in optimising the presentation of our services prevail, in accordance with Article 6(1)(f) of the GDPR.

We also use technologies to fulfil the legal obligations to which we are subject (e.g. to be able to provide evidence of consent to the processing of your personal data) as well as for web analytics and online marketing. Further information on this, including the respective legal basis for data processing, can be found in the following sections of this privacy policy.

Where applicable, we may also use technologies that are not listed individually in this Privacy Policy. Further information on these technologies, including the respective legal basis for data processing, can be found on the Usercentrics platform.

You can access these by clicking on the fingerprint button in the bottom right-hand or bottom left-hand corner of the page.

You can find the cookie settings for your browser via the following links: Microsoft Edge™ / Safari™ / Chrome™ / Firefox™ / Opera™

Functional - Cookies
These cookies are used for certain functionalities on our website, e.g. to improve the navigation flow on our website and to display personalised and relevant information to you (e.g. ‘interest-based adverts’)

Essential cookies
These cookies are necessary to enable our website to function. They include, for example, cookies that allow you to log in to the customer area or add items to your basket.

Where you have consented to the use of these technologies in accordance with Article 6(1)(a) of the GDPR, you may withdraw your consent at any time by contacting us via the details provided in the privacy policy.

Alternatively, you can click on the fingerprint button in the bottom right-hand or bottom left-hand corner of the page. If you do not accept cookies, the functionality of our website may be restricted.

6.2 Use of the Usercentrics Consent Management Platform to manage consent

On our website, we use the Usercentrics Consent Management Platform (“Usercentrics”) on our website to inform you about the cookies and other technologies we use on our website, as well as to obtain, manage and document your consent – where legally required – to the processing of your personal data by these technologies. This is necessary, in accordance with Article 6(1), first sentence, point (c) of the GDPR, to fulfil our legal obligation under Article 7(1) of the DSG, to be able to demonstrate your consent to the processing of your personal data, to which we are subject. Usercentrics is a service provided by Usercentrics GmbH, Sendlinger Straße 7, 80331 Munich, Germany, which processes your data on our behalf. When you visit our website, the Usercentrics web server stores a so-called server log file, which also contains your anonymised IP address, the date and time of your visit, device and browser information, as well as information regarding your consent behaviour. Your data will be deleted after three years, unless you have expressly consented to the further use of your data in accordance with Article 6(1) sentence 1(a) of the GDPR, or unless we reserve the right to use your data beyond this period in a manner that is permitted by law and about which we inform you in this policy.

7. Use of cookies and other technologies for web analytics and advertising purposes

Provided that you have given your consent to this in accordance with Article 6(1), sentence 1(a) of the GDPR, we use the following third-party cookies and other technologies on our website. Once the purpose has ceased to apply and we have stopped using the relevant technology, the data collected in this context will be deleted. You may withdraw your consent at any time with future effect. Further information on your options for withdrawal can be found in the section ‘Cookies and other technologies’. Further information, including the legal basis for our cooperation with the individual providers, can be found under the individual technologies. If you have any questions regarding the providers and the legal basis for our cooperation with them, please use the contact details provided in this privacy policy.

7.1 Use of Google services

We use the following technologies provided by Google Ireland Ltd., Gordon House, Barrow Street, Dublin 4, Ireland (‘Google’). The information automatically collected by Google’s technologies regarding your use of our website is generally transmitted to a server operated by Google LLC, 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA, and stored there. No adequacy decision has been issued by the European Commission for the USA. Our cooperation with them is based on the European Commission’s Standard Data Protection Clauses. If your IP address is collected via Google’s technologies, it is truncated before being stored on Google’s servers by activating IP anonymisation. Only in exceptional cases is the full IP address transmitted to a Google server and truncated there. Unless otherwise specified for the individual technologies, data processing takes place on the basis of an agreement concluded between joint controllers for the respective technology in accordance with Article 26 of the GDPR. Further information on data processing by Google can be found in the Google’s privacy policy.

Google Analytics

For the purpose of website analysis, Google Analytics automatically collects and stores data (IP address, time of visit, device and browser information, and information regarding your use of our website) automatically collected and stored, from which usage profiles are created using pseudonyms. Cookies may be used for this purpose. Your IP address is not, as a rule, combined with other data held by Google. Data processing is carried out on the basis of a data processing agreement with Google.

Google Ads

For advertising purposes in Google search results and on third-party websites, the so-called Google Remarketing cookie is set when you visit our website; this is created automatically through the collection and processing of data (IP address, time of visit, device and browser information, and information about your use of our website) and, by means of a pseudonymous cookie ID and based on the pages you have visited, enables interest-based advertising. Any further data processing only takes place if you have enabled the ‘personalised advertising’ setting in your Google Account. In this case, if you are logged into Google whilst visiting our website, Google will use your data in conjunction with Google Analytics data to create and define audience lists for cross-device remarketing.

7.2 Use of Facebook services

Use of Facebook Pixel

We use the Facebook Pixel as part of the technologies described below from Meta Platforms Ireland Ltd., 4 Grand Canal Square, Dublin 2, Ireland (“Facebook (by Meta)” or “Meta Platforms Ireland”). The Facebook Pixel automatically collects and stores data (IP address, time of visit, device and browser information, as well as information on your use of our website based on events specified by us, such as visiting a webpage or subscribing to a newsletter), from which usage profiles are created using pseudonyms.

To this end, when you visit our website, the Facebook Pixel automatically sets a cookie which, by means of a pseudonymous cookie ID, enables your browser to be recognised automatically when you visit other websites. Facebook (by Meta) will combine this information with other data from your Facebook account and use it to compile reports on website activity and to provide other services related to website usage, in particular personalised and group-based advertising. The information automatically collected by Facebook (by Meta) technologies regarding your use of our website is generally transferred to a server operated by Meta Platforms, Inc., 1 Hacker Way, Menlo Park, California 94025, USA, and stored there. There is no adequacy decision by the European Commission in respect of the USA. Where the transfer of data to the USA falls within our responsibility, our cooperation is based on the European Commission’s Standard Data Protection Clauses. Further information on data processing by Facebook can be found in the privacy policy at Facebook (by Meta).

7.3 Use of Microsoft services

We use the technologies of Microsoft Ireland Operations Ltd., One Microsoft Place, South County Business Park, Leopardstown, Dublin 18, D18 P521, Ireland (‘Microsoft’). Data processing is carried out on the basis of an agreement between joint controllers pursuant to Article 26 of the GDPR. The information automatically collected by Microsoft technologies regarding your use of our website is generally transferred to a server belonging to Microsoft Corporation, One Microsoft Way, Redmond, WA 98052-6399, USA, and stored there . Further information on data processing by Microsoft can be found in Microsoft’s privacy policy. Our service providers are based in and/or use servers in countries outside the EU and the EEA, for which the European Commission has, by decision, determined an adequate level of data protection. Our service providers are based in and/or use servers in countries outside the EU and the EEA. There is no adequacy decision by the European Commission. Our cooperation with them is based on the European Commission’s Standard Data Protection Clauses.

For website analytics and event tracking, we use Microsoft Advertising Universal Event Tracking (UET) to measure your subsequent usage behaviour, if you have arrived at our website via a Microsoft Advertising advert . Cookies may be used for this purpose, and data (IP address, time of visit, device and browser information, as well as information about your use of our website can be derived using pseudonyms, based on events specified by us, such as a visit to a website or subscribing to a newsletter), from which usage profiles are created using pseudonyms. Where your internet-enabled devices are linked to your Microsoft account and you have not disabled the ‘Interest-based advertising” setting in your Microsoft account, Microsoft may generate reports on usage behaviour (in particular, cross-device user figures), even if you change your device – known as ‘cross-device tracking’. We do not carry out any processing of personal data does not take place on our part in this respect; we merely receive statistics generated on the basis of Microsoft UET.

7.4 Other providers of web analytics and online marketing services

Use of Hotjar for web analytics

For the purpose of website analysis, technologies from Hotjar Ltd., Level 2, St Julians Business Centre, 3, Elia Zammit Street, St Julians STJ 3155, Malta (“Hotjar”) to automatically collect and store data (IP address, time of visit, device and browser information, and information about your use of our website), from which usage profiles are created using pseudonyms. Cookies may be used for this purpose. The pseudonymised usage profiles are not merged with personal data relating to the bearer of the pseudonym without separate, explicit consent. Hotjar acts on our behalf.

8. Integration of the Trusted Shops Trustbadge

The Trusted Shops Trustbadge is integrated into this website to display our Trusted Shops quality seal and any reviews collected, as well as to offer Trusted Shops products to buyers following an order.

This serves to safeguard our legitimate interests, which prevail following a balancing of interests, in optimal marketing by enabling secure shopping in accordance with Article 6(1), first sentence, point (f) of the GDPR. The Trustbadge and the promoted services are provided by Trusted Shops GmbH, Subbelrather Str. 15C, 50823 Cologne (Trusted Shops), with whom we are joint controllers under Article 26 of the GDPR. In this privacy notice, we set out below the key terms of the agreement in accordance with Article 26(2) of the GDPR. In the context of the joint controllership between us and Trusted Shops GmbH, please contact Trusted Shops GmbH in the first instance regarding data protection queries and to exercise your rights; their contact details can be found here. Further information on data protection can be found via the following link here. Regardless of this, you can always contact us using the contact details provided in this privacy policy. Your enquiry will then, if necessary, be forwarded to the other data controller for a response.

8.1 Data processing when integrating the Trustbadge/other widgets

The Trustbadge is provided by a US-based CDN provider (Content Delivery Network) . An adequate level of data protection is ensured through standard data protection clauses and further contractual measures. Further information on data protection at Trusted Shops GmbH can be found here. When the Trustbadge is accessed, the web server automatically stores a so-called server log file, which also contains your IP address, the date and time of access, the volume of data transferred and the requesting provider (access data) and documents the request. The IP address is anonymised immediately after collection, so that the stored data cannot be linked to you personally. The anonymised data is used in particular for statistical purposes and for error analysis.

8.2 Data processing after order completion

Once the order has been completed, your email address – hashed using a cryptographic one-way function – is transmitted to Trusted Shops GmbH. The legal basis for this is Article 6(1), first sentence, point (f) of the GDPR. This serves to verify whether you are already registered for services with Trusted Shops GmbH and is therefore necessary for the fulfilment of our and Trusted Shops’ overriding legitimate interests in providing the buyer protection and transactional review services linked to the specific order in question, in accordance with Article 6(1), sentence 1(f) of the GDPR. If this is the case, further processing takes place in accordance with the contractual agreement between you and Trusted Shops. If you are not yet registered for the services, you will subsequently be given the opportunity to do so for the first time. Further processing following successful registration is also governed by the contractual agreement with Trusted Shops GmbH. If you do not register, all data transmitted will be automatically deleted by Trusted Shops GmbH and it will no longer be possible to link the data to an individual. Trusted Shops uses service providers for hosting, monitoring and logging. The legal basis is Article 6(1)(f) of the GDPR for the purpose of ensuring trouble-free operation. Processing may take place in third countries (the USA and Israel). An adequate level of data protection is ensured in the case of the USA through standard data protection clauses and further contractual measures, and in the case of Israel through an adequacy decision.

9. Social media

9.1 Social plugins from Facebook (by Meta), Twitter, Instagram (by Meta), Pinterest

Our website uses social buttons from social networks. These are simply embedded in the page as HTML links, so that no connection is established with the respective provider’s servers when you visit our website. If you click on one of the buttons, the website of the respective social network will open in a new browser window. There, you can, for example, click the ‘Like’ or ‘Share’ button.

9.2 Our online presence on Facebook (by Meta), Twitter, Instagram (by Meta), Pinterest

Insofar as you have given your consent in accordance with Article 6(1), first sentence, point a of the GDPR to the respective social media operator, when you visit our online presence on the social media platforms mentioned above, your data will be automatically collected and stored for market research and advertising purposes, from which usage profiles are created using pseudonyms. These may be used, for example, to display adverts within and outside the platforms that are presumed to correspond to your interests. Cookies are generally used for this purpose. For detailed information on the processing and use of your data by the relevant social media operator, as well as contact details, your rights in this regard and settings to protect your privacy, please refer to the providers’ privacy policies linked below. Should you nevertheless require assistance in this regard, please do not hesitate to contact us.

Facebook (by Meta) is a service provided by Meta Platforms Ireland Ltd., 4 Grand Canal Square, Dublin 2, Ireland (‘Meta Platforms Ireland’). The information automatically collected by Meta Platforms Ireland regarding your use of our online presence on Facebook (by Meta) is generally transferred to and stored on a server belonging to Meta Platforms, Inc., 1 Hacker Way, Menlo Park, California 94025, USA, and stored there. There is no adequacy decision from the European Commission in respect of the USA. Our cooperation with them is based on the European Commission’s Standard Data Protection Clauses. Data processing in connection with visits to a Facebook (by Meta) fan page is carried out on the basis of an agreement between joint controllers in accordance with Article 26 of the GDPR. Further information (information on Insights data) can be found here.

Twitter is a service provided by Twitter International Company, One Cumberland Place, Fenian Street, Dublin 2, D02 AX07, Ireland (“Twitter”). The information automatically collected by Twitter regarding your use of our online presence on Twitter is generally transferred to a server operated by Twitter, Inc., 1355 Market Street, Suite 900, San Francisco, CA 94103, USA, and stored there. There is no adequacy decision by the European Commission for the USA. Our cooperation with them is based on the European Commission’s Standard Data Protection Clauses.

Instagram (by Meta) is a service provided by Meta Platforms Ireland Ltd., 4 Grand Canal Square, Dublin 2, Ireland (‘Meta Platforms Ireland’). The information automatically collected by Meta Platforms Ireland regarding your use of our online presence on Instagram is generally transferred to and stored on a server belonging to Meta Platforms, Inc., 1 Hacker Way, Menlo Park, California 94025, USA, and stored there. There is no adequacy decision by the European Commission in place for the USA. Our cooperation with them is based on the European Commission’s Standard Data Protection Clauses. Data processing in connection with visits to an Instagram (by Meta) fan page is carried out on the basis of an agreement between joint controllers in accordance with Article 26 of the GDPR. Further information (information on Insights data) can be found here.

Pinterest is a service provided by Pinterest Europe Ltd., Palmerston House, 2nd Floor, Fenian Street, Dublin 2, Ireland (‘Pinterest’). The information automatically collected by Pinterest regarding your use of our online presence on Pinterest is generally transferred to a server operated by Pinterest, Inc., 505 Brannan St., San Francisco, CA 94107, USA and stored there. There is no adequacy decision by the European Commission in respect of the USA. Our cooperation with them is based on the European Commission’s Standard Data Protection Clauses.

10. Contact details and your rights

10.1 Your rights

As a data subject, you have the following rights:

in accordance with Article 15 of the GDPR, the right to request information, to the extent specified therein, about your personal data processed by us;
in accordance with Article 16 of the GDPR, the right to request, without undue delay, the rectification of inaccurate personal data or the completion of your personal data stored by us;
in accordance with Article 17 of the GDPR, the right to request the erasure of your personal data stored by us, unless further processing
- for the exercise of the right to freedom of expression and information;
- for compliance with a legal obligation;
- for reasons of public interest or
- is necessary for the establishment, exercise or defence of legal claims;
- in accordance with Article 18 of the GDPR, the right to request the restriction of the processing of your personal data, insofar as
  - you contest the accuracy of the data;
  - the processing is unlawful, but you object to its erasure;
  - we no longer require the data, but you require it for the establishment, exercise or defence of legal claims, or
  - you have objected to the processing in accordance with Article 21 of the GDPR;
  - in accordance with Article 20 of the GDPR, the right to receive the personal data you have provided to us in a structured, commonly used and machine-readable format, or to request that it be transferred to another controller;
  - in accordance with Article 77 of the GDPR, the right to lodge a complaint with a supervisory authority. As a general rule, you may contact the supervisory authority for your usual place of residence or workplace, or for the location of our registered office.

Right to object
Insofar as we process personal data as explained above to safeguard our legitimate interests, which prevail following a balancing of interests, you may object to this processing with effect for the future. If the processing is carried out for direct marketing purposes, you may exercise this right at any time as described above. Insofar as the processing is carried out for other purposes, you are only entitled to a right to object if there are grounds arising from your particular situation.

Once you have exercised your right to object, we will no longer process your personal data for these purposes, unless we can demonstrate compelling legitimate grounds for the processing which override your interests, rights and freedoms, or where the processing serves to establish, exercise or defend legal claims.

This does not apply if the processing is carried out for direct marketing purposes. In that case, we will no longer process your personal data for this purpose.

10.2 Contact details

If you have any questions regarding the collection, processing or use of your personal data, or if you require information, correction, restriction or erasure of data, as well as to withdraw any consent you may have given or to object to a specific use of your data, please contact our company data protection officer.

Data Protection Officer:
PERRO GmbH
Salzachweg 1
5061 Salzburg
Austria
Telephone: +43 (0)662 64 50 20
Email: service@perro.at