We are delighted by your interest in our company. Data protection is ofparamount importance to the management of STI Solution GmbH. Use of the STISolution GmbH website is generally possible without providing any personaldata. However, if a data subject wishes to use special services offered by ourcompany via our website, processing of personal data may become necessary. Ifthe processing of personal data is necessary and there is no legal basis forsuch processing, we generally obtain the data subject's consent
The processing of personal data, such as the name, address, emailaddress, or telephone number of a data subject, is always carried out inaccordance with the General Data Protection Regulation (GDPR) and in compliancewith the country-specific data protection regulations applicable to STISolution GmbH. This privacy policy aims to inform the public about the nature,scope, and purpose of the personal data we collect, use, and process.Furthermore, this privacy policy informs data subjects about their rights
STI Solution GmbH, as the data controller, hasimplemented numerous technical and organizational measures to ensure the mostcomplete possible protection of personal data processed via this website.However, internet-based data transmissions can fundamentally have securityvulnerabilities, meaning absolute protection cannot be guaranteed. For thisreason, every data subject is free to transmit personal data to us viaalternative means, such as by telephone.
Definitions
The privacy policy of STI Solution GmbH isbased on the terms used by the European legislator when enacting the GeneralData Protection Regulation (GDPR). Our privacy policy is intended to be easilyreadable and understandable for both the general public and our customers andbusiness partners. To ensure this, we would like to explain the terminologyused beforehand.
In this privacy policy, we use, among otherthings, the following terms:
Personal data is any information relating to anidentified or identifiable natural person (hereinafter referred to as"data subject"). An identifiable natural person is one who can beidentified, directly or indirectly, in particular by reference to an identifiersuch as a name, an identification number, location data, an online identifieror to one or more factors specific to the physical, physiological, genetic,mental, economic, cultural or social identity of that natural person.
A data subject is any identified oridentifiable natural person whose personal data is processed by the controller.
Processing means any operation or set of operations which is performedon personal data or on sets of personal data, whether or not by automatedmeans, such as collection, recording, organisation, structuring, storage,adaptation or alteration, retrieval, consultation, use, disclosure bytransmission, dissemination or otherwise making available, alignment orcombination, restriction, erasure or destruction
Restriction of processing is the marking ofstored personal data with the aim of limiting its future processing.
Profiling is any form of automated processing of personal dataconsisting of the use of personal data to evaluate certain personal aspectsrelating to a natural person, in particular to analyze or predict aspectsconcerning that natural person's performance at work, economic situation,health, personal preferences, interests, reliability, behavior, location ormovements.
Pseudonymization is the processing of personal data in such a mannerthat the personal data can no longer be attributed to a specific data subjectwithout the use of additional information, provided that such additionalinformation is kept separately and is subject to technical and organizationalmeasures to ensure that the personal data is not attributed to an identified oridentifiable natural person
The controller is the natural or legal person,public authority, agency or other body which, alone or jointly with others,determines the purposes and means of the processing of personal data. Where thepurposes and means of such processing are determined by Union or Member Statelaw, the controller or the specific criteria for its designation may beprovided for by Union or Member State law.
A data processor is a natural or legal person,public authority, agency or other body which processes personal data on behalfof the controller.
A recipient is a natural or legal person, public authority, agency orother body to whom personal data are disclosed, whether a third party or not.However, public authorities that may receive personal data in the framework ofa particular inquiry in accordance with Union or Member State law are notconsidered recipients
A third party is a natural or legal person,public authority, agency or body other than the data subject, the controller,the processor and persons who, under the direct authority of the controller orprocessor, are authorized to process personal data.
Consent means any freely given, specific,informed and unambiguous indication of the data subject's wishes by which he orshe, by a statement or by a clear affirmative action, signifies agreement tothe processing of personal data relating to him or her.
Name and address of the data controller
The controller within the meaning of theGeneral Data Protection Regulation, other data protection laws applicable inthe Member States of the European Union and other provisions of a dataprotection nature is:
STI Solution
Industriestraße 18
A-4800 Attnang-Puchheim
Email: office@sti-solution.de
Website: www.sti-solution.de
The STI Solution GmbH website collects a rangeof general data and information each time a data subject or an automated systemaccesses the website. This general data and information is stored in theserver's log files. The following may be collected: (1) the browser types andversions used, (2) the operating system used by the accessing system, (3) thewebsite from which an accessing system reached our website (known as thereferrer ), (4) the sub-pages accessed on our website by an accessing system, (5)the date and time of access to the website, (6) an internet protocol address(IP address), (7) the internet service provider of the accessing system, and(8) other similar data and information that serves to prevent attacks on our ITsystems.
When using this general data and information,STI Solution GmbH does not draw any conclusions about the data subject. Rather,this information is needed to (1) deliver the content of our website correctly,(2) optimize the content of our website and its advertising, (3) ensure thelong-term functionality of our IT systems and the technology of our website,and 4) provide law enforcement authorities with the information necessary forprosecution in the event of a cyberattack. STI Solution GmbH therefore usesthis anonymously collected data and information for statistical analysis andalso with the aim of increasing data protection and data security within ourcompany, ultimately to ensure the highest level of protection for the personaldata we process. The anonymous data in the server log files is storedseparately from all personal data provided by a data subject.
Due to legal requirements, the STI SolutionGmbH website contains information that enables quick electronic contact withour company and direct communication with us, including a general emailaddress. If a data subject contacts the data controller via email or a contactform, the personal data transmitted by the data subject will be storedautomatically. Such personal data transmitted voluntarily by a data subject tothe data controller will be stored for the purpose of processing the inquiry orcontacting the data subject. This personal data will not be disclosed to thirdparties.
The controller shall process and store personal data of the data subjectonly for the period necessary to achieve the purpose of storage or as far asthis is provided for by the European legislator or another legislator in lawsor regulations to which the controller is subject
If the purpose for which the data was storedceases to exist, or if a storage period prescribed by the European legislatoror another competent legislator expires , the personal data will be routinelyblocked or deleted in accordance with legal requirements.
Every data subject has the right, granted bythe European legislator, to obtain from the controller confirmation as towhether or not personal data concerning him or her are being processed. If adata subject wishes to exercise this right of confirmation, he or she may, atany time, contact our data protection officer or another employee of thecontroller.
Every data subject has the right, granted bythe European legislator, to obtain from the controller, free of charge,information about the personal data stored concerning him or her and a copy ofthis information. Furthermore, the European legislator has granted the datasubject access to the following information:
the processing purposes
the categories of personal data that areprocessed
the recipients or categories of recipients towhom the personal data have been or will be disclosed, in particular recipientsin third countries or international organisations
If possible, the planned duration for which thepersonal data will be stored, or, if this is not possible, the criteria used todetermine that duration.
the existence of a right to rectification orerasure of personal data concerning them or to restriction of processing by thecontroller or a right to object to such processing
the existence of a right to lodge a complaintwith a supervisory authority
If the personal data are not collected from thedata subject: All available information about the source of the data.
the existence of automated decision-making,including profiling, pursuant to Article 22(1) and (4) GDPR and – at least inthose cases – meaningful information about the logic involved, as well as thesignificance and the envisaged consequences of such processing for the datasubject.
Furthermore, the data subject has the right toobtain information as to whether personal data has been transferred to a thirdcountry or to an international organization. If this is the case, the datasubject also has the right to be informed of the appropriate safeguardsrelating to the transfer.
If a data subject wishes to exercise this rightof access, they can contact our data protection officer or another employee ofthe controller at any time.
Every data subject whose personal data is beingprocessed has the right, granted by the European legislator, to request theimmediate rectification of inaccurate personal data concerning him or her.Furthermore, the data subject has the right, taking into account the purposesof the processing, to request the completion of incomplete personal data,including by means of a supplementary statement.
If a data subject wishes to exercise this rightto rectification, they can contact our data protection officer or anotheremployee of the controller at any time.
Every data subject has the right, granted bythe European legislator, to request from the controller the erasure of personaldata concerning him or her without undue delay where one of the followinggrounds applies and where the processing is not necessary:
The personal data were collected or otherwiseprocessed for purposes for which they are no longer necessary.
The data subject withdraws their consent onwhich the processing was based pursuant to Article 6(1)(a) GDPR or Article9(2)(a) GDPR, and there is no other legal basis for the processing.
The data subject objects to the processingpursuant to Article 21(1) GDPR, and there are no overriding legitimate groundsfor the processing, or the data subject objects to the processing pursuant toArticle 21(2) GDPR.
The personal data was processed unlawfully.
The erasure of personal data is necessary for compliance with a legalobligation under Union or Member State law to which the controller is subject
The personal data were collected in relation toinformation society services offered, in accordance with Article 8(1) of theGDPR.
If one of the aforementioned grounds appliesand a data subject wishes to have their personal data stored by STI SolutionGmbH erased, they may contact our data protection officer or another employeeof the controller at any time. The data protection officer of STI Solution GmbHor another employee will ensure that the erasure request is complied withimmediately.
If personal data has been made public by STISolution GmbH and our company, as the controller pursuant to Article 17(1)GDPR, is obligated to erase the personal data, STI Solution GmbH, taking intoaccount available technology and the cost of implementation, shall take reasonablesteps, including technical measures, to inform other controllers processing thepublished personal data that the data subject has requested the erasure bythose other controllers of any links to, or copies or replications of, that personaldata, insofar as processing is not necessary. The data protection officer ofSTI Solution GmbH or another employee will take the necessary steps in eachindividual case.
Every data subject whose personal data is beingprocessed has the right, granted by the European legislator, to request fromthe controller the restriction of processing where one of the followingapplies:
The accuracy of the personal data is contestedby the data subject, for a period enabling the controller to verify theaccuracy of the personal data.
The processing is unlawful, the data subjectrefuses to have their personal data erased and requests instead the restrictionof its use.
The controller no longer needs the personaldata for the purposes of processing, but the data subject needs it for theestablishment, exercise or defense of legal claims.
The data subject has objected to the processingpursuant to Article 21(1) GDPR and it is not yet clear whether the legitimategrounds of the controller override those of the data subject.
If one of the aforementioned conditions is metand a data subject wishes to restrict the processing of their personal datastored by STI Solution GmbH, they may contact our data protection officer oranother employee of the controller at any time. The data protection officer ofSTI Solution GmbH or another employee will then arrange for the restriction ofprocessing.
Every data subject has the right, granted bythe European legislator, to receive the personal data concerning him or her,which he or she has provided to a controller, in a structured, commonly usedand machine-readable format. He or she also has the right to transmit thosedata to another controller without hindrance from the controller to whom thepersonal data have been provided, where the processing is based on consentpursuant to point (a) of Article 6(1) or point (a) of Article 9(2) of the GDPRor on a contract pursuant to point (b) of Article 6(1) of the GDPR, and theprocessing is carried out by automated means, provided that the processing isnot necessary for the performance of a task carried out in the public interestor in the exercise of official authority vested in the controller.
Furthermore, when exercising their right todata portability pursuant to Article 20(1) GDPR, the data subject has the rightto have their personal data transmitted directly from one controller toanother, where technically feasible and provided that this does not adverselyaffect the rights and freedoms of others.
To assert the right to data portability, thedata subject may at any time contact the data protection officer appointed bySTI Solution GmbH or another employee.
Every data subject has the right, granted bythe European legislator, to object, on grounds relating to his or herparticular situation, at any time to processing of personal data concerning himor her which is based on point (e) or (f) of Article 6(1) of the GDPR. Thisalso applies to profiling based on those provisions .
STI Solution GmbH will no longer processpersonal data in the event of an objection, unless we can demonstratecompelling legitimate grounds for the processing which override the interests,rights and freedoms of the data subject, or the processing serves the purposeof establishing, exercising or defending legal claims.
If STI Solution GmbH processes personal datafor direct marketing purposes, the data subject has the right to object at anytime to the processing of their personal data for such marketing. This alsoapplies to profiling insofar as it is related to such direct marketing. If thedata subject objects to processing for direct marketing purposes, STI SolutionGmbH will no longer process the personal data for these purposes.
Furthermore, the data subject has the right to object, on groundsrelating to his or her particular situation, to the processing of personal dataconcerning him or her which is carried out by STI Solution GmbH for scientificor historical research purposes or for statistical purposes pursuant to Article89(1) GDPR, unless such processing is necessary for the performance of a taskcarried out in the public interest
To exercise their right to object, the datasubject may contact the data protection officer of STI Solution GmbH or anotheremployee directly. Furthermore, the data subject is free, in connection withthe use of information society services and notwithstanding Directive2002/58/EC, to exercise their right to object by automated means usingtechnical specifications.
Every data subject has the right granted by theEuropean legislator not to be subject to a decision based solely on automatedprocessing, including profiling , which produces legal effects concerning himor her or similarly significantly affects him or her, unless the decision (1)is necessary for entering into, or performing, a contract between the datasubject and a data controller, or (2) is authorized by Union or Member Statelaw to which the controller is subject and which also lays down suitable measuresto safeguard the data subject’s rights and freedoms and legitimate interests,or (3) is based on the data subject’s explicit consent.
Where the decision (1) is necessary forentering into, or performing, a contract between the data subject and thecontroller, or (2) is made with the data subject’s explicit consent, STISolution GmbH shall implement suitable measures to safeguard the data subject’srights and freedoms and legitimate interests, at least the right to obtainhuman intervention on the part of the controller, to express his or her pointof view and to contest the decision.
If the data subject wishes to assert rightsrelating to automated decision-making, they can contact our data protectionofficer or another employee of the controller at any time.
Every person whose personal data is beingprocessed has the right, granted by the European legislator, to withdraw theirconsent to the processing of their personal data at any time.
If the data subject wishes to exercise theirright to withdraw consent, they can contact our data protection officer oranother employee of the controller at any time.
Article 6(1 ) (a) GDPR serves as the legalbasis for our company's processing operations where we obtain consent for aspecific processing purpose. If the processing of personal data is necessaryfor the performance of a contract to which the data subject is a party, as isthe case, for example, with processing operations necessary for the delivery ofgoods or the provision of other services or consideration, the processing isbased on Article 6(1 ) (b) GDPR. The same applies to processing operations thatare necessary for carrying out pre-contractual measures, such as in cases ofinquiries about our products or services. If our company is subject to a legalobligation that requires the processing of personal data, such as for thefulfillment of tax obligations, the processing is based on Article 6(1 ) (c)GDPR. In rare cases, the processing of personal data may be necessary toprotect the vital interests of the data subject or another natural person. Thiswould be the case, for example, if a visitor were injured on our premises andtheir name, age, health insurance details, or other vital information had to beshared with a doctor, hospital, or other third party. In that case, theprocessing would be based on Article 6(1 ) (d) GDPR. Finally, processing operationscould be based on Article 6(1 ) (f) GDPR. This legal basis applies toprocessing operations not covered by any of the aforementioned legal bases, ifthe processing is necessary for the purposes of the legitimate interestspursued by our company or a third party, except where such interests areoverridden by the interests or fundamental rights and freedoms of the datasubject. We are permitted to carry out such processing operations in particularbecause they have been specifically mentioned by the European legislator. Thelegislator took the view that a legitimate interest could be assumed where thedata subject is a client of the controller (Recital 47, second sentence, GDPR).
Legitimate interests pursued by the controlleror a third party in the processing
If the processing of personal data is based onArticle 6 I lit . f GDPR, our legitimate interest is the conduct of ourbusiness activities for the benefit of all our employees and our shareholders.
Duration for which the personal data will bestored
The criterion for the duration of storage ofpersonal data is the respective statutory retention period. After this periodexpires, the corresponding data is routinely deleted, unless it is stillrequired for the performance of a contract or for initiating a contract.
Legal or contractual requirements for providingpersonal data; necessity for entering into a contract; obligation of the datasubject to provide the personal data; possible consequences of not providingthe data
We would like to inform you that the provision of personal data issometimes required by law (e.g., tax regulations) or may also arise fromcontractual provisions (e.g., information about the contracting party). In somecases, it may be necessary for a data subject to provide us with personal datathat we subsequently need to process in order to conclude a contract. Forexample, the data subject is obligated to provide us with personal data if ourcompany enters into a contract with them. Failure to provide personal datawould mean that the contract with the data subject could not be concluded.Before providing personal data, the data subject must contact our dataprotection officer. Our data protection officer will inform the data subject ona case-by-case basis whether the provision of personal data is required by lawor contract, or necessary for the conclusion of the contract, whether there isan obligation to provide the personal data, and what the consequences of notproviding the personal data would be
As a responsible company, we refrain fromautomated decision-making or profiling .
