Privacy policy

Declaration on the obligation to provide information in accordance with data protection law.

Rocksol-IT GmbH (Kög 13, 6600 Reutte, Austria) as the data controller for the processing of your personal data is pleased about your visit on the websites of Rocksol-IT GmbH and thanks you for your interest in the company, its products and services. The protection of your privacy and your personal data is an important concern for us. In order to guarantee you the highest possible degree of transparency and security, this data protection declaration informs you, among other things, about the type, scope and purpose of the processing of personal data by Rocksol-IT GmbH.

Types of data processed

  • Inventory data (e.g., personnel master data, names, addresses)
  • Contact data (e.g., e-mail addresses, telephone numbers)
  • Content data (e.g., text entries, photographs, videos)
  • Usage data (e.g., websites visited, interest in content, access times)
  • Meta/communication data (e.g., device information, IP addresses)

Categories of data subjects

Visitors and users of the online offer (hereinafter collectively also referred to as “users”).

Purpose of processing

  • Provision of the online offer, its functions and contents
  • Processing of service or product enquiries and orders
  • Responding to requests for information and communicating with users
  • To detect, prevent and investigate attacks on our website and to ensure a secure and stable Internet presence.
  • Reach Measurement/Marketing

Terms used

‘personal data’ means any information relating to an identified or identifiable natural person (‘data subject’); an identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person.

‘processing’ means any operation or set of operations which is performed on personal data or on sets of personal data, whether or not by automated means. The term reaches far and covers practically every handling of data.

‘profiling’ means any form of automated processing of personal data consisting of the use of personal data to evaluate certain personal aspects relating to a natural person, in particular to analyse or predict aspects concerning that natural person’s performance at work, economic situation, health, personal preferences, interests, reliability, behaviour, location or movements.

‘pseudonymisation’ means the processing of personal data in such a manner that the personal data can no longer be attributed to a specific data subject without the use of additional information, provided that such additional information is kept separately and is subject to technical and organisational measures to ensure that the personal data are not attributed to an identified or identifiable natural person.

‘controller’ means the natural or legal person, public authority, agency or other body which, alone or jointly with others, determines the purposes and means of the processing of personal data.

‘processor’ means a natural or legal person, public authority, agency or other body which processes personal data on behalf of the controller.

Applicable legal bases

For users from the scope of the general data protection regulation (GDPR), i.e. the EU and the EEC, the following legal basis for our data processing applies, if the legal basis is not mentioned in the data protection policy, in accordance with art. 13 GDPR:

The legal basis for obtaining consent is Art. 6 para. 1 lit. a and Art. 7 GDPR;

The legal basis for the processing for the fulfilment of our services and the implementation of contractual measures as well as the answering of inquiries is Art. 6 para. 1 lit. b GDPR;

The legal basis for the processing for the fulfilment of our legal obligations is Art. 6 para. 1 lit. c GDPR;
In the event that vital interests of the data subject or another natural person necessitate the processing of personal data, Art. 6 para. 1 lit. d GDPR serves as the legal basis.

The legal basis for the processing necessary for the performance of a task carried out in the public interest or in the exercise of official authority entrusted to the controller is Art. 6 para. 1 lit. e GDPR.

The legal basis for the processing to safeguard our legitimate interests is Art. 6 para. 1 lit. f GDPR.

The processing of data for purposes other than those for which they were collected is governed by the provisions of Art. 6 para. 4 GDPR.

The processing of special categories of data (pursuant to Art. 9 para. 1 GDPR) is governed by the provisions of Art. 9 para. 2 GDPR.

Data protection measures

We take appropriate technical and organisational measures in accordance with the legal requirements, taking into account the state of the art, the implementation costs and the type, scope, circumstances and purposes of the processing as well as the different probability of occurrence and severity of the risk to the rights and freedoms of natural persons, in order to ensure a level of protection appropriate to the risk.

Measures shall include, in particular, ensuring the confidentiality, integrity and availability of data by controlling physical access to, as well as the concerning access to, inputting, disclosure, securing and separation of data. In addition, we have established procedures to ensure the exercise of data subjects’ rights, deletion of data and reaction to data threats.

Furthermore, we take the protection of personal data into account already during the development or selection of hardware, software and processes, in accordance with the principle of data protection through technology design and privacy by default.

Data recipients

Personal data is processed by Rocksol-IT GmbH according to the principle of data minimization and is only accessible to persons in the relevant departments who have to process the data in order to fulfil their tasks. Insofar as we disclose data to other persons and companies (processors, jointly responsible persons or third parties) within the scope of our processing, transfer them to them or otherwise grant them access to the data, this shall only take place on the basis of legal permission (e.g. if a transfer of the data to third parties, such as payment service providers, is necessary for the fulfilment of the contract), users have consented, a legal obligation requires this or on the basis of our legitimate interests (e.g. when using agents, web hosts, etc.).

Insofar as we disclose, transmit or otherwise grant access to data to other companies of our group of companies, this is done in particular for administrative purposes as a legitimate interest and beyond that on a basis corresponding to the legal requirements.

Transfers of personal data to third countries

If we transmit data to recipients in countries outside the European Union or the European Economic Area, this will only take place if it is done to fulfil our (pre)contractual obligations, on the basis of your consent, a legal obligation or on the basis of our legitimate interests. Subject to express consent or contractually required transfer, we process or allow the data to be processed only in third countries with a recognised level of data protection, which includes US processors certified under the “Privacy Shield” or on the basis of special guarantees, such as a contractual obligation through so-called standard protection clauses of the EU Commission, the existence of certifications or binding internal data protection regulations (Art. 44 to 49 GDPR, information page of the EU Commission).

Rights of the data subject

Under applicable data protection law, under certain conditions you have a right to (i) be informed about your stored data, (ii) rectification, (iii) restrict processing, (iv) erasure/be forgotten, (v) data portability, (vi) revocation of your consent and (vii) objection.

To exercise these rights, please contact us using the contact details below.

You also have the right to lodge a complaint with the competent supervisory authority in accordance with legal requirements.

Of course, you are also welcome to contact us directly at any time if you have any questions, comments or complaints in connection with this privacy statement.

Right of revocation

You have the right to withdraw your consent at any time with effect for the future.

Cookies

A cookie is a small text file that is stored on your computer or mobile device if your web browser allows it. You can set your web browser to refuse cookies or to notify you before they are stored.

The use of cookies serves on the one hand to make the use of our offer more pleasant for you. For example, we use so-called session cookies to recognize that you have already visited individual pages on our website. These are automatically deleted after leaving our site.

In addition, we also use temporary cookies to optimize user-friendliness, which are stored on your terminal device for a specified period of time. If you visit our site again in order to use our services, it is automatically recognized that you have already been with us and which inputs and settings you have made so that you do not have to enter them again.

On the other hand, we use cookies in order to statistically record the use of our website and to evaluate it for the purpose of optimizing our offer for you. These cookies enable us to automatically recognize that you have already visited our site when you visit it again. These cookies are automatically deleted after a defined period of time.

The data processed by cookies are necessary for the mentioned purposes to safeguard our legitimate interests and those of third parties in accordance with Art. 6 para. 1 lit. f GDPR. You can configure your browser settings according to your wishes and, for example, refuse the acceptance of third-party cookies or all cookies. Stored cookies can be deleted in the system settings of the browser. We would like to inform you that the exclusion of cookies may lead to functional limitations of this online service.

The legal basis for the use of cookies is Art. 6 para. 1 lit. f GDPR.

Retention periods

The data processed by us will be kept by us for as long as is necessary to provide the requested service to you. If Rocksol-IT GmbH no longer needs the personal data to comply with contractual or legal obligations, they will be deleted from our systems or anonymised accordingly so that identification is not possible, unless Rocksol-IT GmbH has to store the information, including your personal data, in order to comply with legal or official obligations to which it is subject.

If personal data are not deleted because they are required for other and legally permissible purposes, their processing will be restricted. This means that the data will be blocked and not processed for other purposes. This applies, for example, to data that must be stored for commercial or tax reasons.

Changes and updates to the privacy policy

Please note that this privacy policy will be subject to periodic revision as changes in our data processing practices make this necessary. We ask you to inform yourself regularly about the content of our privacy policy. We will inform you as soon as the changes require your cooperation (e.g. consent) or other individual notification.

Business-related processing

Additionally, we process

  • contract data (e.g. object of content, term, customer category)
  • payment data (e.g. bank details, payment history)

of our customers, interested parties and business partners for the purpose of providing contractual services, service and customer care, marketing, advertising and market research.

TLS encryption with HTTPS

We use https to transmit data encrypted on the Internet (data protection through technology design Art. 25 para. 1 GDPR). Through the use of TLS (Transport Layer Security), an encryption protocol for secure data transmission on the Internet, we can ensure the protection of confidential data. You can recognize the use of this data transmission security by the small lock symbol in the top left corner of the browser address bar and the use of the https scheme (instead of http) as part of our Internet address.

Order processing in the online shop and customer account

In the course of order processing in our online shop, we process personal data of our customers in order to enable them to select and order the selected products and services, as well as their payment and delivery, or execution. The processing takes place for the purpose of providing contractual services within the scope of operating an online shop, billing, delivery and customer services. The processed data includes inventory data, communication data, contract data, payment data and the persons affected by the processing include our customers, interested parties and other business partners.

During processing, session cookies are used to capture products in the shopping cart and permanent cookies are used to retain the login status.

The processing is carried out to fulfil our services and to carry out contractual measures (e.g. carrying out order transactions) and insofar as it is legally prescribed (e.g. legally required archiving of business transactions for trade and tax purposes). The information marked as necessary is required for the justification and fulfilment of the contract. We only disclose the data to third parties within the scope of delivery, payment or within the scope of the statutory permits and obligations, and also if this is done on the basis of our legitimate interests (e.g. to legal and tax consultants, financial institutions, freight companies and authorities).

In order to be able to place orders via this offer, each customer must set up a password-protected customer account. This includes an overview of orders placed and active ordering processes.

The required information will be provided within the registration process. If users have terminated their customer account, their data will be deleted with regard to the customer account, except for their retention, which is necessary for commercial or tax reasons. The data in the customer account remain until its deletion with subsequent archiving in the case of a legal obligation or our legitimate interests (e.g. in the case of litigation). It is the responsibility of the users to secure their data before the end of the contract in the event of termination.

In the course of the registration and renewed registrations as well as use of our online services, Rocksol-IT GmbH stores the IP address and the time of the respective user action. The storage takes place on the basis of our legitimate interests, as well as to protect the users and our systems from misuse and other unauthorized use. The collected data will not be passed on to third parties, unless this is necessary to pursue our legal claims as a legitimate interest or there is a legal obligation to do so.

The deletion takes place after expiry of statutory warranty and other contractual rights or obligations (e.g., payment claims or performance obligations from contracts with customers), whereby the necessity of the storage of data is reviewed every three years; in the case of storage due to statutory archiving obligations, the deletion takes place insofar after their expiry.

Payment service provider

Via our online services you have the possibility to place orders or conclude contracts. Insofar as this is necessary for the fulfilment of the contract, data will also be transferred to external payment service providers or the credit institution commissioned with the handling of payments.

In the case of payment by credit card or direct debit, payment is processed via Stripe by the payment service provider Stripe Payments Europe Ltd, Block 4, Harcourt Centre, Harcourt Road, Dublin 2, Ireland. For more information on Stripe’s privacy policy, please visit https://stripe.com/de/privacy#translation.

When paying with PayPal, payment is processed by the payment service provider PayPal (Europe) S.à.r.l. & Cie. S.C.A., 22-24 Boulevard Royal, 2449 Luxembourg, Luxembourg. For more information on PayPal’s privacy policy, please visit https://www.paypal.com/de/webapps/mpp/ua/privacy-full.

The basis for the use of external payment service providers to fulfil contracts is Art. 6 para. 1 lit. b. GDPR and our legitimate interests pursuant to Art. 6 para. 1 lit. f. GDPR in order to offer our users effective and secure payment options.

The data processed by the payment service providers includes inventory data, such as name and address, bank data, such as account numbers or credit card numbers, passwords and TANs, as well as contract, total and recipient details. The information is required for the execution of transactions, but the data entered is only processed and stored by the payment service providers. Rocksol-IT GmbH does not have access to account- or credit card-related information, but only to information for confirmation or negative disclosure of the payment transaction. Under certain circumstances, the data may be transmitted by the payment service provider to credit agencies. The purpose of this transmission is to check identity and creditworthiness. Please refer to the general terms and conditions and data protection information of the payment service providers.

Payment transactions are subject to the terms and conditions and data protection notices of the respective payment service providers, which can be accessed within the respective websites or transaction applications. We also refer to these for the purpose of further information and assertion of revocation, information and other rights affected.

Make contact

You have the possibility to request information about our company, our products and activities or events via a contact form on our website, by telephone, e-mail or social media. When you contact us, the data you provide us with (title, first and last name, contact data, content of your enquiry and any other information provided by you) will be processed by us in order to answer your questions and process your request.

You are free to provide us with your data for your enquiry. However, if you do not provide us with this data, we may not be able to treat your request accordingly.

Data processing, as a result of contacting us, will be carried out in accordance with Art. 6 Para. 1 lit. b GDPR in order to process your enquiry. The user data can be stored in a customer relationship management system (“CRM system”) or comparable system.

The data will be kept as long as the contact with the person concerned exists and deleted if they are no longer necessary. We check the necessity every two years; furthermore, the legal archiving obligations apply.

Newsletter

You can subscribe to our newsletter and other mailings to receive information about the latest topics about our company, our services, events and other information material.

Required information is marked in the particular form. In addition to the e-mail address on some forms, the name is also required for sending the newsletter in order to address you personally in the newsletter.

In addition, the following data is collected during registration, IP address of the calling computer and date and time of registration. The collection of this data as part of the registration process serves to prevent misuse of the services or the e-mail address used.

The legal basis for the aforementioned data processing is Art. 6 para. 1 lit a GDPR. The use of the data for this purpose complies with the provisions of communications law, in particular Art. 107 TKG 2003.

We use IT and marketing service providers for the dispatch of the newsletter who only have access to personal data in accordance with our order and instructions in order to be able to provide the commissioned services.

The subscription to the newsletter and other mailings can be cancelled at any time. You have the option of refusing to receive future newsletters and e-mails electronically, free of charge and without any problems, at any time after they have been sent to you.

The data arising in this connection will be stored as long as you have subscribed to the newsletter and therefore until you revoke your consent.

Newsletter – success measurement

The newsletters contain a so-called “web-beacon”, i.e. a file the size of a pixel, which is retrieved from our server when the newsletter is opened or, if we use a dispatch service provider, from its server. Within the scope of this retrieval, technical information such as information about the browser and your system, as well as your IP address and time of retrieval are initially collected.

This information is used to technically improve the services on the basis of technical data or target groups and their reading behaviour on the basis of their retrieval locations (which can be determined with the help of the IP address) or access times. The statistical surveys also include determining whether the newsletters are opened, when they are opened and which links are clicked. For technical reasons, this information can be assigned to the individual newsletter recipients. It is, however, neither our intention nor, if used, that of the dispatch service provider to observe individual users. The evaluations serve us much more to recognise the reading habits of our users and to adapt our content to them or to send different content according to the interests of our users.

A separate revocation of the performance measurement is unfortunately not possible, in which case the entire newsletter subscription must be cancelled.

Hosting and E-Mail dispatch

The hosting services used by us serve the availability of the following services: Infrastructure and platform services, computing capacity, storage space and database services, e-mail dispatch, security services and technical maintenance services which we use for the purpose of operating this online service.

Here we, or our hosting provider, process inventory data, contact data, content data, contract data, usage data, meta data and communication data of customers, interested parties and visitors to this online service on the basis of our legitimate interests in the efficient and secure availability of this online service in accordance with Art. 6 para. 1 lit. f GDPR in conjunction with Art. 28 GDPR (conclusion of an processor contract).

Collection of access data and log files

When using our website, our system automatically collects data and information from the computer system of the calling computer. The following data is collected automatically via log files:

  • Websites that are called up by the user’s system via our website
  • Websites from which the user’s system accesses our website
  • Amount of data sent in bytes
  • Notification of successful retrieval
  • Browser type and version used
  • Operating system of the user
  • IP address
  • Date and time of access
  • Referrer URL (the previously visited page)
  • The requesting provider

Rocksol-IT does not draw any conclusions about the data subject from these transmitted data. This data is used for technical reasons, in particular to ensure a secure and stable Internet presence, for example to detect, prevent and investigate attacks on our website. The storage of the IP address by the system is necessary to enable delivery of the website to the user’s computer. For this purpose, the IP address of the user must remain stored for the duration of the session. In addition, data is stored in log files to ensure the functionality of the website and to optimise the website.

Logfile information is stored for security reasons (e.g. to clarify misuse or fraud) for a maximum period of 7 days and then deleted. Data, the further storage of which is necessary for evidence purposes, are excluded from deletion until the respective incident has been finally clarified. This storage takes place on the legal basis of Art. 6 para. 1 lit. f) GDPR. The collection of data for the provision of the website and the storage of data in log files is mandatory for the operation of the website. The user is therefore not entitled to object according to Art 21 GDPR. This data will not be passed on to other third parties for their own purposes without your consent.

For the operation and administration of the website, we use IT service providers who, in accordance with our instructions, may also have access to personal data in order to be able to provide the commissioned services.

Matomo (formerly PIWIK)

Our website uses a web analytics services provided by Matomo (www.matomo.org; formerly PIWIK). We use the Matomo cookie to collect information on the use of our website from our users including the website from which your accessing system comes to our website, the subsites, which are accessed via an accessing system on our website, the frequency and duration of your visit to our website, and your IP address. We will shorten your IP address to ensure that we cannot identify you personally. We will not use the collected information to compile user profiles or combine information on specific users. The purpose of processing is marketing and optimization of our websites. These purposes constitute our legitimate interests for processing of Personal Data using Matomo on the legal basis of Art. 6 para 1 lit.f) GDPR. Your Personal Data is deleted once the reasons we collected it for cease to apply. That is the case after 180 days.

You can object to the use of your information with effect for the future if you do not wish for your information to be collected and used with a simple mouse click.

If you click into the field below, a so-called opt-out-cookie will be set on your device which allows us to recognize that we may not collect information on your usage. Please note that if you delete cookies from your browser this may affect the opt-out-cookie.

Youtube privacy policy

We use the video service YouTube from YouTube, LLC, 901 Cherry Ave, San Bruno, CA 94066, USA on this page.

When you visit pages on our website that have YouTube videos integrated, data is transferred to YouTube, stored and evaluated. If you have a YouTube account and are logged in, this data is associated with your personal account and the data stored in it.

To find out what information Google collects and how we use it, please visit https://policies.google.com/privacy?hl=en.

LinkedIn privacy policy

On our website we use functions of the social media network LinkedIn of the company LinkedIn Corporation, 2029 Stierlin Court, Mountain View, CA 94043, USA.

By accessing pages that use such functions, data (IP address, browser data, date and time, cookies) are transmitted to LinkedIn, stored and evaluated. If you have a LinkedIn account and are logged in, this information will be associated with your personal account and the information stored in it. The privacy policy of what information LinkedIn collects and how they use it can be found at https://www.linkedin.com/legal/privacy-policy. LinkedIn is certified under the Privacy Shield Agreement and thereby provides a guarantee of compliance with European data protection legislation (https://www.privacyshield.gov/participant?id=a2zt0000000L0UZAA0&status=Active).

Xing privacy policy

On our website we use functions of the social media network XING of the company XING SE, Dammtorstraße 30, 20354 Hamburg, Germany.

By accessing pages that use such functions, data (IP address, browser data, date and time, cookies) are transmitted to XING, stored and evaluated. If you have an XING account and are logged in, this data will be assigned to your personal account and the data stored in it. You can find the privacy policy regarding what information XING collects and how they use it at https://www.xing.com/privacy.

You can reach us under the following contact details:

Rocksol-IT GmbH
Kög 13
6600 Reutte
Austria

E-Mail: office@rocksol-it.com