Privacy Policy
This privacy policy informs you about the nature, scope, and purpose of the processing of personal data (hereinafter referred to as 'data') within our online offering and the websites, functions, and content associated with it, as well as external online presences, such as our social media profiles (hereinafter collectively referred to as the 'online offering'). With regard to the terminology used, such as 'processing' or 'controller', we refer to the definitions in Art. 4 of the General Data Protection Regulation (GDPR).
Controller
Cetravac AG
Managing Director: Adolf Cermak
Kesselbachstrasse 40 CH – 9450 Altstätten Switzerland
Legal Notice
Contact:
Tel.: +41 71 520 75 50
Email: contact@cetravac.ch
Types of data processed:
– Master data (e.g. names, addresses).
– Contact data (e.g. email, phone numbers).
– Content data (e.g. text inputs, photographs, videos).
– Usage data (e.g. websites visited, interest in content, access times).
– Meta-/communication data (e.g. device information, IP addresses).
Categories of data subjects Visitors and users of the online offering (hereinafter we also refer to the data subjects collectively as 'users').
Purposes of processing
– Provision of the online offering, its functions and content.
– Responding to contact enquiries and communicating with users.
– Security measures.
– Reach measurement/marketing
Terminology Used
"Personal Data" means any information relating to an identified or identifiable natural person (hereinafter referred to as the "data subject"); an identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier (e.g. cookie), or to one or more specific characteristics expressing the physical, physiological, genetic, psychological, economic, cultural or social identity of that natural person.
"Processing" means any operation or set of operations performed with or without the aid of automated procedures in connection with personal data. The term is broad and covers practically any handling of data.
"Pseudonymization" means the processing of personal data in such a manner that the personal data can no longer be attributed to a specific data subject without the use of additional information, provided that such additional information is kept separately and is subject to technical and organizational measures ensuring that the personal data cannot be attributed to an identified or identifiable natural person.
"Profiling" means any form of automated processing of personal data consisting of the use of personal data to evaluate certain personal aspects relating to a natural person, in particular to analyze or predict aspects concerning that natural person's work performance, economic situation, health, personal preferences, interests, reliability, behavior, location or change of location.
"Controller" means the natural or legal person, public authority, agency or other body which, alone or jointly with others, determines the purposes and means of the processing of personal data.
"Processor" means a natural or legal person, public authority, agency or other body that processes personal data on behalf of the Controller.
Applicable Legal Bases
In accordance with Art. 13 GDPR, we inform you of the legal bases for our data processing activities.
Unless the legal basis is specified in this Privacy Policy, the following applies:
The legal basis for obtaining consent is Art. 6 para. 1 lit. a and Art. 7 GDPR,
the legal basis for processing for the performance of our services, the implementation of contractual measures and the response to inquiries is Art. 6 para. 1 lit. b GDPR,
the legal basis for processing in order to fulfill our legal obligations is Art. 6 para. 1 lit. c GDPR,
and the legal basis for processing for the purposes of our legitimate interests is Art. 6 para. 1 lit. f GDPR.
In the event that the vital interests of the data subject or another natural person require the processing of personal data, Art. 6 para. 1 lit. d GDPR serves as the legal basis.
Security Measures
In accordance with Art. 32 GDPR, taking into account the state of the art, the implementation costs and the nature, scope, circumstances and purposes of the processing as well as the varying likelihood and severity of the risk to the rights and freedoms of natural persons, we implement appropriate technical and organizational measures to ensure a level of protection appropriate to the risk.
These measures include, in particular, safeguarding the confidentiality, integrity and availability of data by controlling physical access to the data, as well as access to, input of, disclosure of, safeguarding the availability of and separation of the data.
Furthermore, we have established procedures that ensure the exercise of data subject rights, the deletion of data and responses to threats affecting data.
Furthermore, we take the protection of personal data into account already during the development and selection of hardware, software and procedures, in accordance with the principles of data protection by design and data protection by default (Art. 25 GDPR).
Cooperation with Processors and Third Parties
If, in the course of our processing activities, we disclose data to other persons or companies (processors or third parties), transfer data to them or otherwise grant them access to the data, this shall only take place on the basis of a legal authorization (e.g. where a transfer of data to third parties, such as payment service providers, is required pursuant to Art. 6 para. 1 lit. b GDPR for the performance of a contract), where you have given your consent, where a legal obligation requires it or on the basis of our legitimate interests (e.g. when using agents, web hosts, etc.).
Where we commission third parties to process data on the basis of a so-called "Data Processing Agreement", this is done on the basis of Art. 28 GDPR.
Transfers to Third Countries
Where we process data in a third country (i.e. outside the European Union (EU) or the European Economic Area (EEA)), or where this occurs in the course of using third-party services or the disclosure or transfer of data to third parties, this shall only take place where it is necessary for the fulfillment of our (pre-)contractual obligations, on the basis of your consent, due to a legal obligation or on the basis of our legitimate interests.
Subject to legal or contractual authorizations, we only process or have data processed in a third country where the special requirements of Art. 44 et seq. GDPR are fulfilled.
This means that processing takes place, for example, on the basis of specific safeguards, such as an officially recognized determination of a level of data protection equivalent to that of the EU (e.g. for the USA through the "Privacy Shield") or compliance with officially recognized specific contractual obligations (so-called "Standard Contractual Clauses").
Rights of Data Subjects
You have the right to request confirmation as to whether the data concerned is being processed and to obtain information about such data, as well as further information and a copy of the data in accordance with Art. 15 GDPR.
In accordance with Art. 16 GDPR, you have the right to request the completion of the data concerning you or the correction of inaccurate data concerning you.
In accordance with Art. 17 GDPR, you have the right to request that the data concerned be deleted without undue delay or, alternatively, in accordance with Art. 18 GDPR, to request the restriction of the processing of the data.
You have the right to receive the data concerning you that you have provided to us in accordance with Art. 20 GDPR and to request its transmission to other Controllers.
Furthermore, pursuant to Art. 77 GDPR, you have the right to lodge a complaint with the competent supervisory authority.
Right of Withdrawal
You have the right to withdraw any consent you have given in accordance with Art. 7 para. 3 GDPR with effect for the future.
Right to Object
You may object at any time to the future processing of the data concerning you in accordance with Art. 21 GDPR.
The objection may, in particular, be directed against processing for the purposes of direct marketing.
Cookies and Right to Object to Direct Advertising
"Cookies" are small files that are stored on users' computers.
Various types of information can be stored within cookies.
A cookie primarily serves to store information about a user (or the device on which the cookie is stored) during or after their visit to an online service.
Temporary cookies, also referred to as "session cookies" or "transient cookies", are cookies that are deleted after a user leaves an online service and closes their browser.
Such a cookie may, for example, store the contents of a shopping cart in an online shop or a login status.
Cookies that remain stored even after the browser has been closed are referred to as "permanent" or "persistent".
For example, the login status may remain stored when users revisit the website after several days.
Likewise, such a cookie may store users' interests, which are used for audience measurement or marketing purposes.
"Third-party cookies" are cookies offered by providers other than the Controller operating the online service (otherwise, if they are only the Controller's own cookies, they are referred to as "first-party cookies").
We may use temporary and permanent cookies and provide information about them within this Privacy Policy.
If users do not wish cookies to be stored on their computers, they are asked to deactivate the corresponding option in their browser's system settings.
Stored cookies can be deleted in the browser's system settings.
Disabling cookies may result in functional limitations of this online service.
A general objection to the use of cookies employed for online marketing purposes can be declared for many services, particularly in the case of tracking, via the US website http://www.aboutads.info/choices/ or the EU website http://www.youronlinechoices.com/.
Furthermore, the storage of cookies can be prevented by disabling them in the browser settings.
Please note that, in this case, not all functions of this online service may be available.
Deletion of Data
The data processed by us will be deleted or its processing restricted in accordance with Art. 17 and 18 GDPR.
Unless expressly stated otherwise in this Privacy Policy, the data stored by us will be deleted as soon as it is no longer required for its intended purpose and no statutory retention obligations prevent its deletion.
Where the data is not deleted because it is required for other legally permissible purposes, its processing will be restricted.
This means that the data will be blocked and not processed for any other purposes.
This applies, for example, to data that must be retained for commercial or tax law reasons.
According to statutory requirements in Germany, retention periods are, in particular, 10 years pursuant to Sections 147 para. 1 AO, 257 para. 1 no. 1 and 4, para. 4 HGB (books, records, management reports, accounting documents, commercial books, documents relevant for taxation, etc.) and 6 years pursuant to Section 257 para. 1 no. 2 and 3, para. 4 HGB (commercial correspondence).
According to statutory requirements in Austria, retention periods are, in particular, 7 years pursuant to Section 132 para. 1 BAO (accounting records, receipts/invoices, accounts, vouchers, business documents, statements of income and expenses, etc.), 22 years in connection with real estate and 10 years for documents relating to electronically supplied services, telecommunications, radio and television services provided to non-taxable persons in EU Member States for which the Mini One Stop Shop (MOSS) is used.
Privacy Information in the Application Process
We process applicants' data solely for the purpose of and within the scope of the application process in accordance with the applicable legal provisions.
The processing of applicants' data takes place for the fulfillment of our (pre-)contractual obligations within the application process pursuant to Art. 6 para. 1 lit. b GDPR, and Art. 6 para. 1 lit. f GDPR where data processing becomes necessary for us, for example, in the context of legal proceedings (in Germany, Section 26 BDSG also applies).
The application process requires applicants to provide us with their applicant data.
Where we provide an online application form, the required applicant data is marked accordingly. Otherwise, it results from the job descriptions and generally includes personal information, postal and contact addresses, and the application documents such as the cover letter, CV and certificates.
In addition, applicants may voluntarily provide us with further information.
By submitting their application to us, applicants consent to the processing of their data for the purposes of the application process in accordance with the type and scope described in this Privacy Policy.
Where special categories of personal data within the meaning of Art. 9 para. 1 GDPR are voluntarily provided during the application process, they will additionally be processed in accordance with Art. 9 para. 2 lit. b GDPR (e.g. health data, such as severe disability status or ethnic origin).
Where special categories of personal data within the meaning of Art. 9 para. 1 GDPR are requested from applicants during the application process, they will additionally be processed in accordance with Art. 9 para. 2 lit. a GDPR (e.g. health data where this is required for the exercise of the profession).
Where available, applicants may submit their applications to us by means of an online form on our website.
The data is transmitted to us in encrypted form in accordance with the current state of the art.
Applicants may also submit their applications to us via email.
However, we ask applicants to note that emails are generally not transmitted in encrypted form and that applicants themselves are responsible for ensuring encryption.
We can therefore assume no responsibility for the transmission path of the application between the sender and receipt on our server and therefore recommend using an online form or postal mail instead.
As an alternative to applying via the online form or email, applicants may also submit their application to us by post.
In the event of a successful application, the data provided by the applicants may be further processed by us for the purposes of the employment relationship.
Otherwise, if the application for a job posting is unsuccessful, the applicants' data will be deleted.
Applicants' data will also be deleted if an application is withdrawn, which applicants are entitled to do at any time.
Subject to a justified withdrawal by the applicants, the data will be deleted after a period of six months so that we can answer any follow-up questions regarding the application and comply with our obligations to provide evidence under equal treatment legislation.
Invoices relating to any reimbursement of travel expenses will be archived in accordance with tax law requirements.
Contact
When contacting us (e.g. via contact form, email, telephone or social media), the information provided by the user is processed for the purpose of handling the contact request and its processing in accordance with Art. 6 para. 1 lit. b GDPR.
The information provided by users may be stored in a Customer Relationship Management System ("CRM System") or a comparable inquiry management system.
We delete inquiries once they are no longer required.
We review the necessity every two years; furthermore, the statutory archiving obligations apply.
Google Analytics
On the basis of our legitimate interests (i.e. an interest in the analysis, optimization and economic operation of our online services within the meaning of Art. 6 para. 1 lit. f GDPR), we use Google Analytics, a web analytics service provided by Google LLC ("Google").
Google uses cookies.
The information generated by the cookie regarding users' use of the online service is generally transmitted to and stored on a Google server in the USA.
Google is certified under the Privacy Shield Agreement and thereby provides a guarantee of compliance with European data protection law (https://www.privacyshield.gov/participant?id=a2zt000000001L5AAI&status=Active).
Google will use this information on our behalf to evaluate users' use of our online service, to compile reports on activities within this online service and to provide us with further services related to the use of this online service and internet usage.
Pseudonymous user profiles may be created from the processed data.
We only use Google Analytics with IP anonymization activated.
This means that users' IP addresses are shortened by Google within Member States of the European Union or in other contracting states to the Agreement on the European Economic Area.
Only in exceptional cases is the full IP address transmitted to a Google server in the USA and shortened there.
The IP address transmitted by the user's browser is not combined with other Google data.
Users can prevent the storage of cookies by configuring their browser software accordingly.
Users can also prevent Google from collecting the data generated by the cookie relating to their use of the online service, as well as the processing of this data by Google, by downloading and installing the browser plug-in available at the following link:
http://tools.google.com/dlpage/gaoptout?hl=de
Further information regarding Google's use of data, settings and options for objection can be found in Google's Privacy Policy:
https://policies.google.com/technologies/ads
and in Google's ad settings:
https://adssettings.google.com/authenticated
Users' personal data is deleted or anonymized after 14 months.
Google AdWords and Conversion Tracking
On the basis of our legitimate interests (i.e. an interest in the analysis, optimization and economic operation of our online services within the meaning of Art. 6 para. 1 lit. f GDPR), we use the services of Google LLC, 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA ("Google").
Google is certified under the Privacy Shield Agreement and thereby provides a guarantee of compliance with European data protection law (https://www.privacyshield.gov/participant?id=a2zt000000001L5AAI&status=Active).
We use Google's online marketing service "AdWords" to place advertisements within the Google advertising network (e.g. in search results, videos, on websites, etc.) so that they are shown to users who are presumed to have an interest in the advertisements.
This allows us to display advertisements for and within our online services in a more targeted manner so that users are presented only with advertisements that potentially match their interests.
If, for example, a user is shown advertisements for products in which they have expressed an interest on other online services, this is referred to as "Remarketing."
For these purposes, when our website or other websites on which the Google advertising network is active are accessed, Google immediately executes Google code and integrates so-called (re)marketing tags (invisible graphics or code, also referred to as "Web Beacons") into the website.
With their help, an individual cookie, i.e. a small file, is stored on the user's device (comparable technologies may also be used instead of cookies).
This file records which websites the user has visited, which content the user is interested in and which offers the user has clicked on, as well as technical information about the browser and operating system, referring websites, the time of the visit and further information regarding the use of the online service.
Furthermore, we receive an individual "conversion cookie."
The information collected by means of the cookie enables Google to generate conversion statistics for us.
However, we only receive the anonymous total number of users who clicked on our advertisement and were redirected to a page equipped with a conversion tracking tag.
We do not receive any information that would allow users to be personally identified.
User data is processed pseudonymously within the Google advertising network.
This means that Google does not store or process users' names or email addresses, for example, but instead processes the relevant cookie-related data within pseudonymous user profiles.
This means that, from Google's perspective, advertisements are not managed and displayed for a specifically identified person but for the cookie holder, regardless of who that cookie holder is.
This does not apply if a user has expressly permitted Google to process the data without this pseudonymization.
The information collected about users is transmitted to Google and stored on Google's servers in the USA.
Further information regarding Google's use of data, settings and options for objection can be found in Google's Privacy Policy:
https://policies.google.com/technologies/ads
and in Google's ad settings:
https://adssettings.google.com/authenticated
Integration of Third-Party Services and Content
Within our online services, we use content or service offerings from third-party providers on the basis of our legitimate interests (i.e. an interest in the analysis, optimization and economic operation of our online services within the meaning of Art. 6 para. 1 lit. f GDPR) in order to integrate their content and services, such as videos or fonts (hereinafter collectively referred to as "Content").
This always requires that the third-party providers of such Content are able to process the users' IP address, since they would not be able to transmit the Content to the users' browsers without the IP address.
The IP address is therefore required for the display of this Content.
We endeavor to use only such Content whose respective providers use the IP address solely for the delivery of the Content.
Third-party providers may also use so-called pixel tags (invisible graphics, also referred to as "Web Beacons") for statistical or marketing purposes.
The "Pixel Tags" allow information such as visitor traffic on the pages of this website to be analyzed.
The pseudonymous information may also be stored in cookies on the users' devices and may include, among other things, technical information about the browser and operating system, referring websites, the time of the visit and further information regarding the use of our online services, and may also be combined with such information from other sources.