The protection of your personal data is very important to UH Technologies GmbH, Friedrich-Engels-Platz 20/35, A-1200 Wien (hereinafter “we”, “us”). We comply with the applicable legal provisions concerning the protection, lawful handling and confidentiality of personal data and on data security, in particular the European General Data Protection Regulation (“GDPR”) and the applicable national data protection regulations.
This privacy policy informs you about the nature, scope and purpose of the collection and use of your personal data by us in connection with your visit to and your use of our website www.uhtech.at (“website”).
1. Who controls the data processing and who can you contact?
Controller:
UH Technologies GmbH
Friedrich-Engels-Platz 20/35
A-1200 Wien
Email address of the Data Protection Officer/Data Protection Manager: [email protected]
2. What is personal data?
Personal data (“data”) means any information relating to an identified or identifiable natural person (“data subject”). This includes, for example, their name, email address or IP address.
3. Processing of data in the context of the use of our website
3.1 Use of cookies and Google Analytics
Please refer to the cookie banner for the privacy policy concerning the use of cookies and Google Analytics.
3.2 Note on the transfer of data to the USA and other third countries
In the course of the data processing, your data may be transferred to recipients in countries outside the European Union (known as third countries). If these tools are active, your personal data may be transferred to these (third) countries and processed there. We would like to point out that in some countries it is not possible to guarantee a level of data protection that is fully comparable to that in the EU, but that all possible data protection measures are taken nevertheless.
For example, Art. 45 GDPR stipulates that a data transfer to a third country is permitted if the EU has issued an adequacy decision. Such a decision is only issued if an adequate level of data protection is guaranteed in the country. An adequacy decision is currently (July 2023) available for the following third countries: Andorra, Argentina, Faroe Islands, United Kingdom (initially until June 28, 2025), Guernsey, Israel, Isle of Man, Japan, Jersey, Canada (commercial organizations only), New Zealand, Switzerland, South Korea, Uruguay. Since July 10, 2023, such an adequacy decision has also been in place between the EU and the US as long as the recipients are certified in accordance with the EU-U.S. Data Privacy Framework. In principle, US companies can be obligated to hand over personal data to security authorities in cases relating to national security. We have no influence on such processing activities. The new adequacy decision now provides legal remedies for EU citizens, however. The EU Commission also considers US companies that are certified and included in the Data Privacy Framework list to be secure data recipients. US companies that have self-certified to the Ministry and undertaken to comply with the principles of the EU-U.S. Data Privacy Framework can be found at: https://www.dataprivacyframework.gov/s/participant-search.
If there is no adequacy decision for a third country, a data transfer may still be permitted in accordance with Art. 46 (1) GDPR, provided that suitable guarantees for the protection of the data are offered by the recipient. These can be binding corporate rules or the standard contractual clauses adopted by the EU Commission. In addition to the guarantees, enforceable and effective legal remedies must also be available.
If neither an adequacy decision nor suitable guarantees are available, a data transfer to such a third country may also be permitted in accordance with Art. 49 GDPR if it is considered necessary for important reasons of public interest.
3.3 Provision and protection of the website
You can visit our website without providing us with information about your identity. When you use our website, your device sends data to our web servers. Each time you visit our website, our system automatically collects data and information from the device accessing it (such as a computer, cell phone, tablet, etc.) This data is processed by our web servers and automatically stored in what are known as “log files”.
Purpose: The temporary (automated) storage of the data is necessary for the duration of a website visit to enable the website to be provided. The storage and processing of personal data also takes place to maintain the compatibility of our website for as many visitors as possible and to combat misuse and troubleshooting. For this purpose, it is necessary to log the technical data of the accessing computer to be able to respond as quickly as possible in the case of display errors, attacks on our IT systems and/or errors in the functionality of our website. In addition, the data serves the purpose of optimizing our website and generally ensuring the security of our IT systems.
Data categories: IT protocol and identification data (IP address, HTTP header fields, browser type, previously visited website (referrer), date and time of access, other traffic data, such as device information, amount of data sent, etc.)
Legal basis: The provision of a secure, functional and user-friendly website is our legitimate business interest. The processing therefore takes place in accordance with point (f) of Article 6 (1) GDPR.
Storage period: We shall store your data for as long as it is necessary for the processing of your inquiry. After your inquiry has been processed in full, your data will be erased in compliance with the statutory retention periods, unless it is required for the assertion, repulsion or defense of legal claims and their enforcement in official or judicial proceedings. The maximum limit for the storage of cookies is 8 months.
Categories of recipient: Processors (such as IT service providers); may also be contacted in the event of a security incident: Law enforcement authorities, legal representatives, courts and administrative authorities.
3.4 Contacting us
You are welcome to contact us by email, telephone or fax if you have any questions about our company, our products or our services. In this case, we shall process your data for the purpose of processing your inquiry, whereby your data may also be processed in a customer management system operated by us.
Please note that in the case of unencrypted communication by email, complete data security cannot be guaranteed on the transfer path to our IT systems; we therefore expressly recommend encrypted communication or the postal service for information that requires a high level of confidentiality. Among others, transfer by email entails the following risks:
- Personal data may be disclosed to third parties without authorization if the email address is not entered correctly.
- You have no information on the recipient side, such as which or how many employees are able to access the email.
- The transfer of data by email via several distributed intermediaries means that without encryption, unauthorized third parties are able to access the data.
Purpose: The purpose of the data processing is to know your requirements in order to be able to offer you customized products and services. The processing of personal data enables us to analyze your surfing behavior. The evaluation of the data obtained enables us to compile information on the user of individual components of our website. This helps us continuously to improve our website and its user-friendliness. The anonymization of the IP address takes sufficient account of the interests of the user in the protection of their personal data.
Data categories: Personal master data (such as salutation, title, first name and surname); contact data (such as address, telephone number, email address); correspondence data (such as content of the inquiry), IT protocol and identification data (such as date and time of the inquiry), as well as any data that you make available to us by uploading and/or attaching documents.
Legal basis: Inquiries are processed either to implement (pre-) contractual measures (point (b) of Art. 6 GDPR) or on the basis of our legitimate business interests (point (f) of Art. 6 (1) GDPR), specifically, communication with our customers and website users.
Storage period: We shall store your data for as long as it is necessary for the processing of your inquiry. After your inquiry has been processed in full, your data will be erased in compliance with the statutory retention periods, unless it is required for the assertion, repulsion or defense of legal claims and their enforcement in official or judicial proceedings. The maximum limit for the storage of cookies is 8 months.
3.5 CDN, Cloudflare
This website uses what is known as a content delivery network (“CDN”) from the technology service provider Cloudflare Inc, 101 Townsend St. San Francisco, CA 94107, USA (“Cloudflare”). A content delivery network is an online service which is used to deliver large media files (such as graphics, page content or scripts) through a network of regionally distributed servers that are connected via the Internet.
Purpose: The use of the content delivery network from Cloudflare helps with optimizing the loading speed of this website. The temporary storage of data within the CDN is required to make the content of our online offering, particularly files such as graphics or scripts, available more quickly with the use of regionally or internationally distributed servers.
Data categories: Cloudflare may collect certain information concerning the use of our website and process data sent by us or for which Cloudflare has received the appropriate instructions. In most cases, Cloudflare receives data such as contact information, IP addresses, security fingerprints, DNS log data and website performance data which are derived from the browser activities. Log data helps Cloudflare to detect new threats, for example. This enables Cloudflare to guarantee a high level of security protection for our website.
Legal basis: The use of the Content Delivery Network is based on our legitimate interests, i.e. our interests in the secure and efficient provision and optimization of our online offering in accordance with point (f) of Art. 6 (1) GDPR.
Storage period: Cloudflare only stores data records for as long as it is necessary. In most cases your data will be erased within 24 hours, however. The specific storage period for the processed data cannot be influenced by us, but is determined by Cloudflare, Inc. Further information is available in the privacy policy of Cloudflare CDN: www.cloudflare.com/privacypolicy/.
Categories of recipient: The company is the recipient of your personal data and acts as a processor on our behalf. Cloudflare primarily stores your information in the United States and the European Economic Area and may transfer and access the information described above from around the world. Cloudflare, which is based in the USA, is certified for the US-European data protection agreement, the “EU-U.S. Data Privacy Framework”, which guarantees compliance with the level of data protection that applies in the EU.
3.6 Google Analytics
We use the functions of the web analysis service Google Analytics on our website in order to analyze user behavior and optimize our Internet presence. The provider of this service is Google Ireland Limited, Barrow Street, Dublin 4, Ireland.
Purpose: In using Google Analytics, we are able to analyze information about website visitors in a simplified way. This enables us to further optimize our website.
Data categories: During your visit to the website, among others, the following data are collected: The pages you access, your “click path”, the achievement of the “website goals” (conversions, such as newsletter registrations, downloads, purchases), your user behavior (such as clicks, length of stay, bounce rates), your approximate location (region), your IP address (in shortened form), technical information about your browser and the devices you use (such as language settings, screen resolution), your Internet provider, the referrer URL (from which website/advertising medium you came to our website), app updates, JavaScript support, widget interactions as well as the date and time of your visit.
Legal basis: The processing of your data with the use of Google Analytics is based on your express consent in terms of point (a) of Art. 6 (1) GDPR. You can withdraw your consent at any time, with effect for the future.
Storage period: The data on your use of our website will be erased immediately after the end of the storage period set by us. Google Analytics issues us with the following options for the retention period: 14 months, 26 months, 38 months, 50 months, do not erase automatically. You can ask us about the current storage period we have set at any time.
Categories of recipient: On our behalf, Google will use information to evaluate the use of our website, to compile reports on the activities on our website and in order to provide us with further services connected to the use of our website. The information generated is transferred by Google to a server in the USA for analysis and stored there. The parent company of Google Ireland, Google LLC, is based in California, USA. A transfer of data to the USA and access by public authorities in the US to the data stored by Google cannot be ruled out. Google LLC, which is based in the USA, however, is certified for the US-European data protection agreement, the “EU-U.S. Data Privacy Framework”, which guarantees compliance with the level of data protection that applies in the EU. Google only transfers such data to third parties on the basis of statutory provisions or within the scope of contracted data processing. We have no influence on the scope or further use of the data collected by Google through the use of this tool.
3.7 Google Fonts
For the uniform representation of fonts, our website uses what are known as “web fonts” that are provided by Google. Google Fonts is a service provided by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland.
Purpose: With Google Fonts, we are able to use fonts on our own website and do not have to upload them to our server. Google Fonts is an important component for maintaining the quality of our website. All Google fonts are automatically optimized for the web, which saves data volume and is a considerable advantage, especially when using mobile devices. When you visit us, the small file size ensures a rapid loading time. Google Fonts are also secure web fonts and support all standard browsers.
Data categories: For the processing itself, the service, and/or we, shall collect the following data:
Data concerning fonts, the IP address of the website visitor, statistics concerning the use of fonts and other data from Google services which relate to our website.
In addition, each Google Font inquiry automatically transfers information such as language settings, screen resolution, version and browser name to Google servers. Google can use the collected usage data to determine the popularity of fonts.
Legal basis: The processing of your data only takes place with your express consent in accordance with point (a) of Art. 6 (1) GDPR.
Storage period: Google stores requests for CSS assets on its servers for one day. This allows us to use the fonts with the help of a Google stylesheet. The font files are stored by Google for one year. To erase data prematurely, you are required to contact Google support (https://support.google.com).
Categories of recipient: If the service is activated on our website, the information which is generated is transferred by Google to a server in the USA for evaluation and stored there. The parent company of Google Ireland, Google LLC, is based in California, USA. A transfer of data to the USA and access by public authorities in the US to the data stored by Google cannot be ruled out. Google LLC, which is based in the USA, however, is certified for the US-European data protection agreement, the “EU-U.S. Data Privacy Framework”, which guarantees compliance with the level of data protection that applies in the EU. Google only transfers such data to third parties on the basis of statutory provisions or within the scope of contracted data processing. We have no influence on the scope or further use of the data collected by Google through the use of this tool.
3.8 Google Maps
We use the Google Maps service of the company Google Ireland Limited, Gordon House, Barrow Street, 4 Dublin, Ireland on our website. The use of Google Maps is subject to special terms of use, which you can find here: https://policies.google.com/terms?hl=de&gl=en and https://www.google.com/intl/de_de/help/terms_maps.html
Purpose: The integration of map material from Google Maps is used for the professional presentation of the contents of our website. We use this service to offer the localization of objects.
Data categories: For the processing itself, the service, and/or we, shall collect the following data:
Data required for the visualization and display of location data in the form of a map, in particular IP address, information from Google background services such as Google Apis, search terms, IP address, coordinates, the start location and destination when using the route planner, location data, Google advertising ID, Android advertising ID.
Legal basis: The collection, storage and evaluation take place in accordance with point (f) of Art. 6 (1) GDPR on the basis of the legitimate interest of Google in the display of personalized advertising, market research and/or the needs-based design of Google websites. You have the right to object to the creation of these user profiles; you must contact Google to exercise this right. If you do not agree to the future transfer of your data to Google when using Google Maps, you also have the option to completely deactivate the Google Maps web service by switching off the JavaScript application in your browser. In this case, Google Maps and therefore the map display cannot be used on this website.
Storage period: Google anonymizes data in server logs by erasing part of the IP address and cookie information after 9 and/or 18 months respectively. Depending on your decision, your location and activity data will be stored for either 3 or 18 months and then erased. You can also erase the history manually at any time in your Google account. If you want to completely prevent your location from being recorded, you must deactivate the “Web and App Activity” section in your Google account. Further information is available in the data protection information of Google, which you can access here: https://www.google.com/policies/privacy/
You can find out exactly where the Google data centers are located here: https://www.google.com/about/datacenters/inside/locations/. The data processing conditions for Google products and the standard contractual clauses for the data transfer to third countries are available at https://business.safety.google/adsprocessorterms/.
Categories of recipient: The information generated is transferred by Google to a server in the USA for analysis and stored there. The parent company of Google Ireland, Google LLC, is based in California, USA. A transfer of data to the USA and access by public authorities in the US to the data stored by Google cannot be ruled out. Google LLC, which is based in the USA, however, is certified for the US-European data protection agreement, the “EU-U.S. Data Privacy Framework”, which guarantees compliance with the level of data protection that applies in the EU. Google only transfers such data to third parties on the basis of statutory provisions or within the scope of contracted data processing. We have no influence on the scope or further use of the data collected by Google through the use of this tool.
Data recipients:
Google Ireland Limited
Google LLC (United States of America)
Alphabet Inc (United States of America)
3.9 Google Tag Manager
Our website uses the Google Tag Manager service from Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland.
Purpose: Tag Manager is a service with which we can manage website tags through an interface. This allows us to integrate code snippets such as tracking codes or conversion pixels on websites without interfering with the source code.
Data categories: Google Tag Manager itself does not create any user profiles, does not store any cookies and does not carry out any independent analyzes. It is only used to manage and display the tools that integrated through its use. Google Tag Manager records your IP address, however, which may also be transferred to the parent company of Google in the United States.
Legal basis: The use of Google Tag Manager takes place on the basis of point (f) of Article 6 (1) GDPR. We have a legitimate interest in the fast and uncomplicated integration and management of various tools on its website.
Storage period: Apart from your IP address, no data is collected. To ascertain how long the individual tracking tools store your data, please refer to the respective data protection texts for the individual tools.
Categories of recipient: As no data is collected by Google Tag Manager, the various web analysis tools are considered as primary categories of recipient.
A transfer of data to the USA and access by public authorities in the US to the data stored by Google cannot be ruled out, however. Google LLC, which is based in the USA, however, is certified for the US-European data protection agreement, the “EU-U.S. Data Privacy Framework”, which guarantees compliance with the level of data protection that applies in the EU. Google only transfers such data to third parties on the basis of statutory provisions or within the scope of contracted data processing. We have no influence on the scope or further use of the data collected by Google through the use of this tool.
3.10 Gstatic
A web service of the company Google Ireland Limited, Gordon House, Barrow Street, 4 Dublin, Ireland (hereinafter: Gstatic) has been uploaded to our website.
Gstatic is a background service which is used by Google to retrieve static content in order to reduce bandwidth usage and preload required catalog files. In particular, the service loads background data for Google Fonts and Google Maps.
Purpose: The temporary storage of data within the scope of Gstatic is necessary to ensure the full functionality of our website.
Data categories: Your browser may transfer personal data to Gstatic. The collected data includes: Unique identifiers, browser type and settings, device type and settings, phone number, IP, Internet provider, purchasing activities, videos viewed. You can prevent the collection and processing of your data by Gstatic by deactivating the running of script code in your browser or by installing a script blocker in your browser (you can find these, for example, at www.noscript.net or www.ghostery.com).
Legal basis: The legal basis for the data processing is point (f) of Art. 6 (1) GDPR (legitimate interest). The legitimate interest lies in the error-free functioning of the website.
Storage period: The erasure of the data will take place as soon as the purpose for its collection has been fulfilled.
Categories of recipient: As part of the order processing, the information generated may be transferred by Google to a server in the USA for analysis and stored there. The parent company of Google Ireland, Google LLC, is based in California, USA. A transfer of data to the USA and access by public authorities in the US to the data stored by Google cannot be ruled out. Google LLC, which is based in the USA, however, is certified for the US-European data protection agreement, the “EU-U.S. Data Privacy Framework”, which guarantees compliance with the level of data protection that applies in the EU. Google only transfers such data to third parties on the basis of statutory provisions or within the scope of contracted data processing. We have no influence on the scope or further use of the data collected by Google through the use of this tool.
3.11 YouTube
We use the YouTube service of the company Google Ireland Limited, Gordon House, Barrow Street, 4 Dublin, Ireland on our website.
Purpose: Videos from the YouTube platform are integrated on our website via the YouTube service. The integration allows us to show you videos directly on our website. In this way, you can view videos about our services without having to visit the YouTube platform.
Data categories: For the processing itself, the service, and/or we, shall collect the following data:
Data for displaying the stream, referrer URL, data on visited videos, created play lists, reviews and comments, information on the end device used as well as the date and time of the visit, the IP address and browser of the user and other data from Google services for providing the video in accordance with the Google Privacy Policy.
Legal basis: YouTube is used to ensure a uniform and appealing presentation of our website. This constitutes a legitimate interest in terms of point (f) of Art. 6 (1) GDPR. Consent that has been granted can be withdrawn at any time. The only consequence of not granting or withdrawing consent is that the YouTube content will not be made available.
Storage period: If you are logged in to your YouTube account, YouTube allows you to assign your browsing behavior directly to your personal profile. You can prevent this by logging out of your YouTube account. We have no influence on the data collection and its further use. There is no information on the extent to which, where and for how long the data is stored, to which extent the networks comply with the existing erasure obligations, which evaluations and links are made with the data, and to whom the data is forwarded. Your data will remain stored for as long as this is necessary for the purpose of the service, however.
Categories of recipient: If YouTube is activated on our website and a video is played, our website establishes a connection to the company’s servers in the USA and transfers the data required to display the stream or the video. The parent company of Google Ireland, Google LLC, is based in California, USA. A transfer of data to the USA and access by public authorities in the US to the data stored by Google cannot be ruled out. Google LLC, which is based in the USA, however, is certified for the US-European data protection agreement, the “EU-U.S. Data Privacy Framework”, which guarantees compliance with the level of data protection that applies in the EU. Google only transfers such data to third parties on the basis of statutory provisions or within the scope of contracted data processing. We have no influence on the scope or further use of the data collected by Google through the use of this tool.
Data recipients:
Google Ireland Limited
Google LLC (United States of America)
Alphabet Inc (United States of America)
4. Rights of data subjects and the right to lodge a complaint
- In accordance with Art. 15 GDPR, you have the right to request confirmation as to whether data is being processed by the controller and the right of access regarding this data.
- In accordance with Art. 16 GDPR, you have the right to request the rectification of inaccurate data concerning you and/or the completion of incomplete data without undue delay.
- In accordance with Art. 17 GDPR, you have the right to erasure of your data.
- In accordance with Art. 18 GDPR, you have the right to the restriction of processing.
- In accordance with Art. 20 GDPR, you have a right to data portability.
- In accordance with Art. 21 GDPR, you have the right to object to the data processing.
Finally, you have the option to lodge a complaint with the supervisory authority responsible for you.
If the processing of your data takes place on the basis of your consent, you have the right to withdraw your consent at any time, without this affecting the lawfulness of the processing based on the consent before its withdrawal.
5. Contact data
If you have any questions about data protection and the assertion of your above-mentioned rights, you can contact our data protection organization at [email protected] or by post at UH Technologies GmbH, Compliance, Friedrich-Engels-Platz 20/35, 1200 Vienna.
This privacy policy will be updated from time to time.