Privacy policy

This privacy policy informs you about the nature, scope and purpose of the processing of personal data (hereinafter “data”) within our online offering and the websites, functions and content connected with it, as well as external online presences such as our social media profiles (hereinafter collectively referred to as the “online offering”). With regard to the terminology used, such as “processing” or “controller”, we refer to the definitions in Art. 4 of the General Data Protection Regulation (GDPR/DSGVO).

Controller

Bolch & Enge Events OG
Donaustrasse 113/5
2344 Maria Enzersdorf
Austria

Email: office [a] photoadventure [.] at

For details, see our legal notice

Types of data processed:

• Master data (e.g. names, addresses)
• Contact data (e.g. email, telephone numbers)
• Content data (e.g. text entries, photographs, videos)
• Usage data (e.g. websites visited, interest in content, access times)
• Meta/communication data (e.g. device information, IP addresses)

Purpose of processing

• Provision of the online offering, its functions and content.
• Responding to contact requests and communicating with users.
• Security measures.
• Reach measurement/marketing

Terminology used

“Personal data” means any information relating to an identified or identifiable natural person (hereinafter “data subject”); an identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier (e.g. a cookie) or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person.

“Processing” means any operation or set of operations which is performed on personal data, whether or not by automated means. The term is broad and covers practically any handling of data.

“Controller” means the natural or legal person, public authority, agency or other body which, alone or jointly with others, determines the purposes and means of the processing of personal data.

Relevant legal bases

In accordance with Art. 13 GDPR, we inform you of the legal bases of our data processing. Where the legal basis is not stated in this privacy policy, the following applies: the legal basis for obtaining consent is Art. 6(1)(a) and Art. 7 GDPR; the legal basis for processing in order to perform our services and carry out contractual measures, and to respond to enquiries, is Art. 6(1)(b) GDPR; the legal basis for processing in order to comply with our legal obligations is Art. 6(1)(c) GDPR; and the legal basis for processing in order to safeguard our legitimate interests is Art. 6(1)(f) GDPR. Where the vital interests of the data subject or of another natural person make the processing of personal data necessary, Art. 6(1)(d) GDPR serves as the legal basis.

Security measures

We ask you to check the content of our privacy policy regularly. We adapt the privacy policy as soon as changes to the data processing we carry out make this necessary. We will inform you as soon as the changes require any action on your part (e.g. consent) or any other individual notification.

Cooperation with processors and third parties

Where, in the course of our processing, we disclose data to other persons and companies (processors or third parties), transmit it to them or otherwise grant them access to the data, we do so only on the basis of a legal permission (e.g. where a transfer of data to third parties, such as payment service providers, is necessary for the performance of a contract pursuant to Art. 6(1)(b) GDPR), where you have given your consent, where a legal obligation provides for this, or on the basis of our legitimate interests (e.g. when using agents, web hosts, etc.).

Where we commission third parties to process data on the basis of a so-called “data processing agreement”, we do so on the basis of Art. 28 GDPR.

Transfers to third countries

Where we process data in a third country (i.e. outside the European Union (EU) or the European Economic Area (EEA)), or where this occurs in the context of using third-party services or disclosing or transferring data to third parties, we do so only where it is necessary to fulfil our (pre-)contractual obligations, on the basis of your consent, on the basis of a legal obligation or on the basis of our legitimate interests. Subject to legal or contractual permissions, we process data in a third country, or have it processed there, only where the special conditions of Art. 44 et seq. GDPR are met. This means that processing takes place, for example, on the basis of special guarantees, such as an officially recognised finding of a level of data protection equivalent to that of the EU (e.g. for the USA through the EU-US Data Privacy Framework), or compliance with officially recognised special contractual obligations (so-called “standard contractual clauses”).

Rights of data subjects

You have the right to obtain confirmation as to whether data concerning you is being processed, and to access this data, as well as to further information and a copy of the data in accordance with Art. 15 GDPR.
In accordance with Art. 16 GDPR, you have the right to request that data concerning you be completed or that inaccurate data concerning you be rectified.

In accordance with Art. 17 GDPR, you have the right to request that data concerning you be erased without undue delay or, alternatively, in accordance with Art. 18 GDPR, to request restriction of the processing of the data.
You have the right to receive the data concerning you that you have provided to us in accordance with Art. 20 GDPR and to request that it be transmitted to other controllers.
Furthermore, pursuant to Art. 77 GDPR, you have the right to lodge a complaint with the competent supervisory authority.

Right of withdrawal

You have the right to withdraw any consent you have given, pursuant to Art. 7(3) GDPR, with effect for the future

Right to object

You may object at any time to the future processing of data concerning you in accordance with Art. 21 GDPR. In particular, you may object to processing for the purposes of direct marketing.

Cookies and the right to object to direct marketing

“Cookies” are small files that are stored on users’ computers. Various pieces of information can be stored within cookies. A cookie is primarily used to store information about a user (or the device on which the cookie is stored) during or after their visit to an online offering. Temporary cookies, also called “session cookies” or “transient cookies”, are cookies that are deleted after a user leaves an online offering and closes their browser. Such a cookie may store, for example, the contents of a shopping basket in an online shop or a login status. “Permanent” or “persistent” cookies are cookies that remain stored even after the browser has been closed. In this way, for example, the login status can be saved if users return after several days. Such a cookie can likewise store users’ interests, which are used for reach measurement or marketing purposes. “Third-party cookies” are cookies offered by providers other than the controller operating the online offering (otherwise, if they are only the controller’s own cookies, they are referred to as “first-party cookies”).

If users do not want cookies to be stored on their computer, they are asked to deactivate the corresponding option in their browser’s system settings. Stored cookies can be deleted in the browser’s system settings. Excluding cookies may lead to functional limitations of this online offering.

For a large number of services, especially in the case of tracking, a general objection to the use of cookies employed for online marketing purposes can be declared via the EU website www.youronlinechoices.com/ at any time. Furthermore, the storage of cookies can be prevented by disabling them in the browser settings. Please note that in this case you may not be able to use all functions of this online offering.

Erasure of data

We erase personal data that we have collected, or that the data subject has provided to us without a contractual relationship, no later than three years after the person has finally become inactive. We erase data collected from contractual relationships no later than thirteen years after the end of the contractual relationship.

Business-related processing

In addition, we process
– contract data (e.g. subject matter of the contract, term, customer category)
– payment data (e.g. payment history)
of our customers, prospective customers and business partners for the purpose of providing contractual services, service and customer care, marketing, advertising and market research.

Web hosting

The hosting services we use serve to provide the following services: infrastructure and platform services, computing capacity, storage space and database services, security services and technical maintenance services, which we use for the purpose of operating this online offering.

In doing so, we or our hosting provider process master data, contact data, content data, contract data, usage data, meta and communication data of customers, prospective customers and visitors to this online offering on the basis of our legitimate interests in the efficient and secure provision of this online offering pursuant to Art. 6(1)(f) GDPR in conjunction with Art. 28 GDPR (conclusion of a data processing agreement).

Collection of access data and log files

On the basis of our legitimate interests within the meaning of Art. 6(1)(f) GDPR, we or our hosting provider collect data about every access to the server on which this service is located (so-called server log files). The access data includes the name of the website accessed, the file, the date and time of access, the amount of data transferred, notification of successful access, browser type and version, the user’s operating system, referrer URL (the previously visited page), IP address and the requesting provider.

For security reasons (e.g. to investigate misuse or fraud), log file information is stored for a maximum of 7 days and then deleted. Data whose further retention is required for evidential purposes is exempt from deletion until the incident in question has been finally resolved.

Order processing in the online shop and customer account

We process our customers’ data in the course of the ordering processes in our online shop in order to enable them to select and order the chosen products and services, as well as to pay for them and have them delivered or performed.

The data processed includes master data, communication data, contract data and payment data, and the persons affected by the processing include our customers, prospective customers and other business partners. The processing is carried out for the purpose of providing contractual services in the context of operating an online shop, invoicing, delivery and customer service. For this purpose, we use session cookies to store the contents of the shopping basket and permanent cookies to store the login status.

The processing is carried out on the basis of Art. 6(1)(b) (execution of ordering processes) and (c) (legally required archiving) GDPR. The information marked as required is necessary for the conclusion and performance of the contract. We disclose the data to third parties only in the context of delivery, payment or within the scope of legal permissions and obligations towards legal advisers and authorities. The data is processed in third countries only if this is necessary for the performance of the contract (e.g. at the customer’s request for delivery or payment).

Users may optionally create a user account. During registration, users are informed of the mandatory information required. User accounts are not public and cannot be indexed by search engines. If users have terminated their user account, their data relating to the user account will be erased, unless its retention is necessary for commercial or tax law reasons in accordance with Art. 6(1)(c) GDPR. Information in the customer account remains until the account is deleted, followed by archiving where there is a legal obligation to do so. It is the users’ responsibility to back up their data before the end of the contract if they have given notice of termination.

In the course of registration and subsequent logins, as well as when using our online services, we store the IP address and the time of the respective user action. The storage is based on our legitimate interests and those of the users in protection against misuse and other unauthorised use. As a rule, this data is not passed on to third parties unless it is necessary to pursue our claims or there is a legal obligation to do so pursuant to Art. 6(1)(c) GDPR.

Erasure takes place after the expiry of statutory warranty and comparable obligations; the necessity of retaining the data is reviewed every three years. In the case of statutory archiving obligations, erasure takes place after their expiry after 13 years.

Provision of contractual services

We process master data (e.g. names and addresses as well as contact data of users) and contract data (e.g. services used, names of contact persons, payment information) for the purpose of fulfilling our contractual obligations and services pursuant to Art. 6(1)(b) GDPR. The entries marked as mandatory in online forms are required for the conclusion of the contract.

When you use our online services, we store the IP address and the time of the respective user action. The storage is based on our legitimate interests and those of the users in protection against misuse and other unauthorised use. As a rule, this data is not passed on to third parties unless it is necessary to pursue our claims or there is a legal obligation to do so pursuant to Art. 6(1)(c) GDPR.

We process usage data (e.g. the pages of our online offering visited, interest in our products) and content data (e.g. entries in the contact form or user profile) for advertising purposes in a user profile, in order, for example, to show users product suggestions based on the services they have used so far.

The data is erased after the expiry of statutory warranty and comparable obligations; the necessity of retaining the data is reviewed every three years. In the case of statutory archiving obligations, erasure takes place after their expiry. Information in any customer account remains until the account is deleted.

Administration, financial accounting, office organisation, contact management

We process data in the context of administrative tasks and the organisation of our business, financial accounting and compliance with legal obligations, such as archiving. In doing so, we process the same data that we process in the course of providing our contractual services. The bases for processing are Art. 6(1)(c) GDPR and Art. 6(1)(f) GDPR. Customers, prospective customers, business partners and website visitors are affected by the processing. The purpose of and our interest in the processing lie in administration, financial accounting, office organisation and the archiving of data, i.e. tasks that serve to maintain our business activities, perform our tasks and provide our services. The erasure of data with regard to contractual services and contractual communication corresponds to the information given for these processing activities.

In this context, we disclose or transmit data to the tax authorities, advisers such as tax advisers or auditors, and other payment service providers.

Furthermore, on the basis of our business interests, we store information about suppliers, event organisers and other business partners, e.g. for the purpose of contacting them later. As a rule, we store this predominantly company-related data permanently.

Business analyses and market research

In order to run our business economically and to identify market trends and customer and user wishes, we analyse the data available to us on business transactions, contracts, enquiries, etc. In doing so, we process master data, communication data, contract data, payment data, usage data and metadata on the basis of Art. 6(1)(f) GDPR, with the data subjects including customers, prospective customers, business partners, visitors and users of the online offering.

The analyses are carried out for the purposes of business evaluations, marketing and market research. In doing so, we may take into account the profiles of registered users with information, for example, on their purchases. The analyses help us to increase user-friendliness, optimise our offering and improve cost-effectiveness. The analyses serve us alone and are not disclosed externally, unless they are anonymous analyses with aggregated values.

Where these analyses or profiles relate to individuals, they are deleted or anonymised when users terminate, otherwise two years after conclusion of the contract. In all other respects, overall business analyses and general trend assessments are prepared anonymously wherever possible.

Registration function

Users may optionally create a user account. During registration, users are informed of the mandatory information required. The data entered during registration is used for the purpose of using the offering. Users may be informed by email about information relevant to the offering or registration, such as changes to the scope of the offering or technical circumstances. If users have terminated their user account, their data relating to the user account will be erased, unless its retention is necessary for commercial or tax law reasons in accordance with Art. 6(1)(c) GDPR. It is the users’ responsibility to back up their data before the end of the contract if they have given notice of termination. We are entitled to irretrievably delete all of the user’s data stored during the term of the contract.

When you use our registration and login functions and your user account, we store the IP address and the time of the respective user action. The storage is based on our legitimate interests and those of the users in protection against misuse and other unauthorised use. As a rule, this data is not passed on to third parties unless it is necessary to pursue our claims or there is a legal obligation to do so pursuant to Art. 6(1)(c) GDPR. IP addresses are anonymised or deleted after 7 days at the latest.

Contacting us

When you contact us (e.g. via contact form, email, telephone or social media), the information you provide is processed for the purpose of handling and processing your enquiry pursuant to Art. 6(1)(b) GDPR. Users’ information may be stored in a customer relationship management system (“CRM system”) or a comparable enquiry management system.

We delete enquiries once they are no longer required. We review the necessity every two years; statutory archiving obligations also apply.

Comments and posts

If users leave comments or other posts, their IP addresses may be stored for 7 days on the basis of our legitimate interests within the meaning of Art. 6(1)(f) GDPR. This is done for our own protection in case someone leaves unlawful content in comments and posts (insults, prohibited political propaganda, etc.). In such a case, we ourselves may be held liable for the comment or post and are therefore interested in the identity of the author.

Furthermore, we reserve the right to process users’ information for the purpose of spam detection on the basis of our legitimate interests pursuant to Art. 6(1)(f) GDPR.

Akismet anti-spam check

Our online offering uses the “Akismet” service provided by Automattic Inc., 60 29th Street #343, San Francisco, CA 94110, USA. It is used on the basis of our legitimate interests within the meaning of Art. 6(1)(f) GDPR. This service helps to distinguish comments by real people from spam comments. For this purpose, all comment data is sent to a server in the USA, where it is analysed and stored for four days for comparison purposes. If a comment has been classified as spam, the data is stored beyond this period. This data includes the name entered, the email address, the IP address, the content of the comment, the referrer, information about the browser and computer system used, and the time of the entry.

Automattic is certified under the EU-US Data Privacy Framework (DPF) and thereby guarantees compliance with a level of data protection that corresponds to European data protection law. In addition, the provider has committed itself as a processor under data protection law in the respective terms of use or contractual bases pursuant to Art. 28 GDPR. Further information on the collection and use of data by Akismet can be found in Automattic’s privacy notice: https://automattic.com/privacy/.

Users are welcome to use pseudonyms or to refrain from entering their name or email address. You can prevent the transfer of data completely by not using our comment system. That would be a pity, but unfortunately we see no other alternatives that work just as effectively.

Retrieval of profile pictures from Gravatar

Within our online offering, and in particular in the blog, we use the Gravatar service of Automattic Inc., 60 29th Street #343, San Francisco, CA 94110, USA.

Gravatar is a service where users can register and store profile pictures and their email addresses. When users leave posts or comments on other online presences (especially blogs) using the respective email address, their profile pictures can be displayed next to the posts or comments. For this purpose, the email address provided by users is transmitted to Gravatar in encrypted form in order to check whether a profile is stored for it. This is the sole purpose of transmitting the email address; it is not used for any other purpose and is deleted afterwards.

Gravatar is used on the basis of our legitimate interests within the meaning of Art. 6(1)(f) GDPR, as Gravatar allows us to offer authors of posts and comments the option of personalising their posts with a profile picture.

Automattic is certified under the Privacy Shield agreement and thereby guarantees compliance with European data protection law. In addition, the provider has committed itself as a processor under data protection law in the respective terms of use or contractual bases pursuant to Art. 28 GDPR.

By displaying the images, Gravatar learns the IP address of users, as this is necessary for communication between a browser and an online service. Further information on the collection and use of data by Gravatar can be found in Automattic’s privacy notice: https://automattic.com/privacy/.

If you do not want a user picture linked to your email address at Gravatar to appear in the comments, you should use an email address for commenting that is not registered with Gravatar. We would also point out that it is possible to use an anonymous email address or no email address at all if users do not wish their own email address to be sent to Gravatar. You can prevent the transfer of data completely by not using our comment system.

Newsletter

With the following information, we inform you about the content of our newsletter, the subscription, dispatch and statistical evaluation procedures, and your rights to object. By subscribing to our newsletter or registering for it in writing, you agree to receive it and to the procedures described.

Content of the newsletter: We send newsletters, emails and other electronic notifications containing promotional information (hereinafter “newsletter”) only with the consent of the recipients or a legal permission. Where the content of the newsletter is specifically described when subscribing, this description is decisive for the users’ consent. Otherwise, our newsletters contain information about our services and offers.

Double opt-in and logging: Subscription to our newsletter takes place via a so-called double opt-in procedure. This means that after subscribing, you will receive an email asking you to confirm your subscription. This confirmation is necessary so that no one can subscribe using someone else’s email address. Newsletter subscriptions are logged in order to be able to prove the subscription process in accordance with legal requirements. This includes storing the time of subscription and confirmation, as well as the IP address. Changes to your data stored with the dispatch service provider are also logged.

Subscription data: To subscribe to the newsletter, it is sufficient to provide your email address. Optionally, we ask you to provide a name so that we can address you personally in the newsletter.

The newsletter is sent, and its success measured, on the basis of the recipients’ consent pursuant to Art. 6(1)(a) and Art. 7 GDPR in conjunction with § 107(2) of the Austrian Telecommunications Act (TKG), or on the basis of the legal permission pursuant to § 107(2) and (3) TKG. The subscription procedure is logged on the basis of our legitimate interests pursuant to Art. 6(1)(f) GDPR. Our interest lies in using a user-friendly and secure newsletter system that serves our business interests, meets users’ expectations and also allows us to prove consent.

Cancellation/withdrawal: You can cancel your subscription to our newsletter at any time, i.e. withdraw your consent. You will find a link to unsubscribe at the end of every newsletter. We may store unsubscribed email addresses for up to three years on the basis of our legitimate interests before deleting them, in order to be able to prove consent previously given. The processing of this data is limited to the purpose of a possible defence against claims. An individual request for erasure is possible at any time, provided that the former existence of consent is confirmed at the same time.

Newsletter – success measurement

The newsletters contain a so-called “web beacon”, i.e. a pixel-sized file that is retrieved from our server when the newsletter is opened or, if we use a dispatch service provider, from its server. During this retrieval, technical information such as information about the browser and your system, as well as your IP address and the time of retrieval, is initially collected.

This information is used for the technical improvement of the services based on the technical data, or for the target groups and their reading behaviour based on their retrieval locations (which can be determined using the IP address) or access times. The statistical surveys also include determining whether the newsletters are opened, when they are opened and which links are clicked. For technical reasons, this information can be assigned to individual newsletter recipients. However, it is neither our aim nor, where used, that of the dispatch service provider to monitor individual users. Rather, the evaluations help us to identify the reading habits of our users and to adapt our content to them, or to send different content according to our users’ interests.

WhatsApp newsletter

You can receive our newsletter via WhatsApp. To do so, send a message with the word “Start” to our WhatsApp number +43 670 185 0607. By sending this message, you consent to us sending you information about Photo+Adventure (programme, workshops, tickets and news) via WhatsApp. The legal basis is your consent pursuant to Art. 6(1)(a) GDPR.

In doing so, we process your telephone number, your WhatsApp profile name, the time of your subscription and unsubscription, and the content of the messages you send us. We store the subscriber list on our own server in Austria. For sending, we use the WhatsApp Business Platform of WhatsApp Ireland Limited, Merrion Road, Dublin 4, Ireland. In this context, data may be transferred to Meta Platforms Inc. in the USA. Meta is certified under the EU-US Data Privacy Framework.

You can unsubscribe at any time by sending “Stop” to the same number. You can withdraw your consent at any time with effect for the future. After you unsubscribe, we store your telephone number and the time of subscription and unsubscription solely as proof of consent and withdrawal.

Online presences on social media

We maintain online presences within social networks and platforms in order to communicate with the customers, prospective customers and users active there and to inform them about our services. When accessing the respective networks and platforms, the terms and conditions and data processing policies of their respective operators apply.

Unless otherwise stated in our privacy policy, we process users’ data if they communicate with us within the social networks and platforms, e.g. by writing posts on our online presences or sending us messages.

Integration of third-party services and content

Within our online offering, on the basis of our legitimate interests (i.e. interest in the analysis, optimisation and economic operation of our online offering within the meaning of Art. 6(1)(f) GDPR), we use content or service offerings from third-party providers in order to integrate their content and services, such as videos or fonts (hereinafter uniformly referred to as “content”).

This always requires that the third-party providers of this content perceive the users’ IP address, as without the IP address they would not be able to send the content to their browser. The IP address is therefore required for displaying this content. We endeavour to use only content whose respective providers use the IP address solely for delivering the content. Third-party providers may also use so-called pixel tags (invisible graphics, also referred to as “web beacons”) for statistical or marketing purposes. The “pixel tags” can be used to evaluate information such as visitor traffic on the pages of this website. The pseudonymous information may also be stored in cookies on the users’ device and may contain, among other things, technical information about the browser and operating system, referring websites, time of visit and other information about the use of our online offering, and may also be linked with such information from other sources.

Vimeo

We may embed videos from the “Vimeo” platform of the provider Vimeo Inc., Attention: Legal Department, 555 West 18th Street New York, New York 10011, USA. Privacy policy: https://vimeo.com/privacy. Please note that Vimeo may use Google Analytics; in this regard, we refer to Google’s privacy policy (https://www.google.com/policies/privacy) as well as the opt-out options for Google Analytics (http://tools.google.com/dlpage/gaoptout?hl=de) or Google’s settings for the use of data for marketing purposes (https://adssettings.google.com/.).

Google Maps

We embed the maps of the “Google Maps” service of the provider Google LLC, 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA. The data processed may include, in particular, users’ IP addresses and location data, which, however, are not collected without their consent (usually given via the settings of their mobile devices). The data may be processed in the USA. Privacy policy: https://www.google.com/policies/privacy/, opt-out: https://adssettings.google.com/authenticated.

Created with Datenschutz-Generator.de by Dr Thomas Schwenke, attorney at law