SCHÖN&GUT privacy policy

We take the protection of your personal data very seriously. We treat your personal information confidentially and in accordance with legal regulations (GDPR, Data Protection Act, Telecommunications Act).

Name and Contact Details of the Data Controller

Job-TransFair gemeinnützige GmbH
Linke Wienzeile 10/21
1060 Vienna
CEO: Mag. Thomas Rihl

Contact for the Administration Department of the Webshop

SCHÖN&GUT - The Social-Concept-Store by Job-TransFair
Preßgasse 28, 1040 Vienna, Austria
office@fairkauf.at

Data Protection Officer

You can reach our Data Protection Officer either by email: datenschutz@jobtransfair.at or by mail:
Job-TransFair non-profit GmbH, Linke Wienzeile 10/21, 1060 Vienna.

Which Data is Processed and from Which Sources

We collect personal data, for example, in the context of the following activities: inquiries via the contact form, inquiries via email, newsletter subscription, orders from the webshop, personally provided information (e.g., contact form, partnership inquiry).

Purpose of data processing and legal basis

We use personal data, for example, for the following purposes: Personal data you provide us during registration (our legal basis: GDPR Art. 6(1)(a)). Performance of pre-contractual services when you gather information about offered goods by visiting our webshop (our legal basis: GDPR Art. 6(1)(b)). Performance of contractual services to deliver ordered goods (our legal basis: GDPR Art. 6(1)(b)). Sending newsletters (our legal basis: GDPR Art. 6(1)(a)). Analysis of visitor behavior to optimize our offering (our legal basis: GDPR Art. 6(1)(a), GDPR Art. 6(1)(f)).

Your personal data will neither be sold to third parties nor otherwise marketed by us.

Server-Log-Files

The provider of the pages automatically collects and stores information in server log files that your browser automatically transmits to us. These are:

• Browser type and version
• Hostname of the accessing computer
• Time of the server request
• Your Internet Protocol (IP) address

We do not merge this data with other data sources. We reserve the right to check this data retrospectively if we become aware of specific indications of unlawful use. In this case, the server log file data may also be assigned to a natural person. We base the processing of server log files on GDPR Article 6(1)(f). This data provides important information that is required to analyse network traffic and access. This serves the purpose of preventive danger defence in order to prevent misuse of the web server or website.

The storage period for data from the server logs is set at 52 days. If we have to process this data further to clarify and prosecute criminal offences or if Job-TransFair has to assert claims for damages against you or if separate legal orders require this, longer storage periods may be necessary.

Contact Form

If you send us inquiries via the contact form or email, your provided data, including the contact details you provided there, will be stored by us for the purpose of processing the inquiry and for follow-up questions for six months. We will not pass on this data without your consent. By using the contact form, we process your data based on consent you have given us (GDPR Art. 6(1)(a)).

Newsletter

If you want to subscribe to the newsletter offered on the website, we need an email address, first name and last name from you, as well as a statement that you agree to receive the newsletter. We use this data exclusively to send the requested information and do not share it with third parties.

The sending of the newsletter is based on GDPR Art. 6(1)(a).

Once you have subscribed to the newsletter, we will send you a confirmation email with a link to confirm your registration. You can revoke the consent given for the storage of data at any time, for example, via the "Unsubscribe" link in the newsletter or by sending an informal email to datenschutz@jobtransfair.at. We will immediately delete your data related to the newsletter dispatch thereafter.

Your data for newsletter dispatch will be processed by us until you revoke your consent.

Registration Function

We offer you the possibility to perform a registration in our shop. The registration is voluntary. The data entered during this registration, visible from the input fields of the registration form (first name, last name, address, telephone number), will be collected and stored solely for the purpose of using our services. By registering on our site, we will also store your IP address, as well as the date and time of your registration. This serves as a safeguard in case a third party misuses your data and registers on our site without your knowledge. There will be no disclosure to third parties.

You will receive a registration email at the email address you provided, containing a link through which you can confirm the registration and complete the registration process.

After successful registration, you can open your user account in our online shop by entering your email address and password and make purchases. The legal basis for processing the data is GDPR Art. 6(1)(a). You have the option to revoke your consent to the processing of personal data at any time by deactivating your user account. The data will then be deleted by us unless we are obligated to retain them for a longer period due to contractual and/or legal obligations.

Technologies for Web Analysis and Advertising Purposes

Google Analytics

This website uses Google Analytics, a web analytics service provided by Google Inc. ("Google"). Google Analytics uses "cookies," which are text files stored on your computer that enable an analysis of your use of the website. The information generated by the cookie about your use of this website will generally be transmitted to and stored on a server of Google in the United States. Because IP anonymization is activated on this website, your IP address will be truncated by Google within member states of the European Union or in other contracting states of the Agreement on the European Economic Area before being transmitted. On behalf of the operator of this website, Google will use this information to evaluate your use of the website, compile reports on website activity, and provide other services related to website activity and internet usage to the website operator. The IP address transmitted by your browser as part of Google Analytics will not be merged with other Google data.

During your visit to the website, your user behaviour is recorded in the form of ‘events’. Events can be:

• Page views
• First visit to the website
• Start of the session
• Your ‘click path’, interaction with the website
• Scrolls (whenever a user scrolls to the bottom of the page (90%))
• Clicks on external links
• Internal search queries
• Interaction with videos
• File downloads
• Ads viewed / clicked on
• Language setting

Also recorded:

• Your approximate location (region)
• Your IP address (in abbreviated form)
• Technical information about your browser and the end devices you use (e.g. language setting, screen resolution)
• Your internet provider
• The referrer URL (via which website/advertising medium you came to this website)

Recipients of the data are/may be:

• Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland (as processor pursuant to Art. 28 GDPR)
• Google LLC, 1600 Amphitheatre Parkway Mountain View, CA 94043, USA
• Alphabet Inc, 1600 Amphitheatre Parkway Mountain View, CA 94043, USA

It cannot be ruled out that US authorities may access the data stored by Google. The parent company of Google Ireland, Google LLC, is based in California, USA. A transfer of data to the USA and access by US authorities to the data stored by Google cannot be ruled out. The USA is currently considered a third country from a data protection perspective. You do not have the same rights there as within the EU/EEA. You may not be entitled to any legal remedies against access by authorities.

Data will only be collected and analysed if you have expressly consented to this via our cookie banner (Art. 6 para. 1 lit. a GDPR). You can revoke or adjust your consent at any time by clicking on the ‘Cookie settings’ button at the bottom left of the website and calling up the banner again.

The use of Google Analytics serves to continuously improve the functions and services. JobTransFair only uses non-personal data for analysis and reporting purposes. JobTransFair bases this data processing on Art. 6 para. 1 lit. a GDPR. Please note Google's privacy policy: https://policies.google.com/privacy?hl=en#intro

Facebook-Plugins (Like-Button)

Our pages integrate plugins from the social network Facebook, provided by Facebook Inc., 1 Hacker Way, Menlo Park, California 94025, USA. You can recognize the Facebook plugins by the Facebook logo or the "Like Button" on our page. An overview of Facebook plugins can be found here: https://developers.facebook.com/docs/plugins/. When you visit our pages, a direct connection is established between your browser and the Facebook server via the plugin. This allows Facebook to receive information that you have visited our site with your IP address. If you click the Facebook "Like Button" while logged into your Facebook account, you can link the content of our pages to your Facebook profile. This enables Facebook to associate the visit to our pages with your user account. We would like to point out that as the provider of the pages, we have no knowledge of the content of the transmitted data or its use by Facebook. For more information, please refer to Facebook's privacy policy.

If you do not want Facebook to associate your visit to our pages with your Facebook user account, please log out of your Facebook user account.

Use of Instagram

Our website integrates features of the Instagram service. These features are provided by Instagram Inc., 1601 Willow Road, Menlo Park, CA, 94025, USA. If you are logged into your Instagram account, you can link the content of our pages to your Instagram profile by clicking the Instagram button. This allows Instagram to associate the visit to our pages with your user account. We would like to point out that as the provider of the pages, we have no knowledge of the content of the transmitted data or its use by Instagram.

 

Data Processing for Payment Processing

For payment processing, fairkauf.at uses the service provider Payone, a service for online payment procedures. The contact address of Payone is: PAYONE GmbH, Lyoner Straße 9, 60528 Frankfurt am Main, Local Court Frankfurt am Main HRB 116860, info@payone.com. For privacy inquiries, please use: privacy@payone.com

Please note that you will be redirected to Payone's servers for payment processing. Therefore, Payone is considered the data controller under GDPR Article 4(7) from a data protection perspective.

You can find Payone's privacy policy at the following link: https://www.payone.com/DE-en/data-protection-regulations

External Hosting

We use the infrastructure of Hetzner Online GmbH, Industriestr. 25, 91710 Gunzenhausen, Germany to operate this webshop.
Hetzner provides us exclusively with the technical server infrastructure (virtual machine). The processing of personal data (e.g. through visits to the website) is carried out exclusively by us or by the company toscom GmbH.
The use of Hetzner is based on our legitimate interest in the secure, stable and efficient provision of our online services (Art. 6(1)(f) GDPR).

Data Processing on behalf of the Controller

We rely on contractually affiliated external companies and external service providers ("data processors") to provide the services. In such cases, personal data is transferred to these data processors to enable them to further process the data. Data processors are only allowed to use the data for the purposes defined by us and are also contractually obligated by us to process your data exclusively in accordance with GDPR and DSG (Austrian Data Protection Act).

 

ETRON Softwareentwicklungs- und Vertriebs GmbH

We use solutions provided by ETRON Softwareentwicklungs- und Vertriebs GmbH for our POS and inventory management system. To ensure day-to-day operations, as well as to provide technical support, troubleshooting and system maintenance, ETRON carries out maintenance and support services under a data processing agreement in accordance with Article 28 of the GDPR.
In the course of these activities, ETRON may gain access to personal data processed in the POS and inventory management system. Access is granted only to the extent necessary to properly carry out support or maintenance tasks.

Categories of data processed by ETRON
In particular, ETRON processes the following categories of personal data:
•    Personal master data (e.g. name, address)
•    Communication data (e.g. email, telephone number)
•    Contract master data
•    Customer history
•    Customer contract billing and payment data

Processing takes place exclusively for the specific purpose of the maintenance and support contract.

Security and data protection measures
ETRON is contractually obliged:
•    to process personal data exclusively in accordance with our instructions,
•    to treat data confidentially,
•    to implement appropriate technical and organisational security measures in accordance with Article 32 of the GDPR,
•    not to process data for its own purposes,
•    not to disclose data to unauthorised third parties.

 

Service provider (data processor):
ETRON Softwareentwicklungs- und Vertriebs GmbH
Pottendorfer Straße 23-25/2/3B
1120 Wien
Österreich
https://www.etron.at/

 

No data will be transferred to third countries unless this is stated separately.

 

 

Friendly Captcha

On our website, we use the “Friendly Captcha” service provided by Friendly Captcha GmbH, Am Anger 3–5, 82237 Wörthsee, Germany, to prevent abusive and automated requests (e.g. from bots). Friendly Captcha serves to protect our online services against unauthorised access and to ensure the stability and security of our systems.

Unlike other Captcha services, Friendly Captcha does not set tracking cookies and does not store any personal data from end users that could be used for profiling or marketing purposes.

 

Data processed
During use, a computational task (‘Proof of Work’) is solved by the visitor’s device. The following information may be processed in the process:
•    Request header data (e.g. user agent, referring page)
•    Anonymised IP address (hashed by Friendly Captcha and untraceable)
•    Timestamps and technical metadata for verification
•    Solution to the computational puzzle

 

Friendly Captcha does not store full IP addresses and does not track user behaviour.

 

Purpose of processing
•    To protect the website from automated attacks and spam
•    To ensure the stability and functionality of the website
•    To fulfil our obligation to ensure IT security

 

Legal basis
Data processing is carried out in accordance with
•    Art. 6(1)(f) GDPR (legitimate interest) – our interest lies in protecting our website,
•    alternatively or additionally: Art. 6(1)(c) GDPR, provided there is an obligation to ensure technical security.

 

As Friendly Captcha does not use cookies for analysis  or advertising purposes, no consent is required under Section 165(3) of the Telecommunications Act 2021.
No data is transferred to third countries outside the EU/EEA.

 

Retention period
Friendly Captcha stores the anonymised hash values for a maximum of 30 days in order to analyse system-related security incidents and prevent misuse. It is not possible to link these to a natural person.

 

Further information
Please also note the “Privacy Policy for End Users” provided by Friendly-Captcha via this link: https://friendlycaptcha.com/en/legal/privacy-end-users/

 

 

SRG IT & Marketing GmbH

Technical implementation and maintenance (SRG IT & Marketing GmbH)

SRG is responsible for the administration of the CMS used for the operation, maintenance and technical development of our website.

 

Sub-contractor (sub-processor):
SRG IT & Marketing GmbH
Waldingerstraße 12,
4201 Gramastetten
Austria

 

No data will be transferred to third countries unless this is stated separately.

 

 

Visticle GmbH

Interfaces and integration services (Visticle)

 

We use the service provider Visticle to technically connect our website to the actual online shop. Visticle provides the technical interface as well as the relevant integration and communication processes required to correctly transfer functions, data flows and content between the front-end and the shop system.
In the course of these activities, Visticle may, as a data processor in accordance with Article 28 of the GDPR, gain access to personal data required for the use of the online shop (e.g. order, product or user interaction data). Processing takes place exclusively within the scope of the technical implementation and only to the extent necessary to ensure the functionality of the interface.

 

Visticle is contractually obliged:
•    to process personal data strictly in accordance with the controller’s instructions,
•    not to use any data for its own purposes,
•    to comply with appropriate technical and organisational security measures in accordance with Article 32 of the GDPR,
•    not to disclose data to unauthorised third parties.

Service provider (data processor):
Visticle GmbH
Arnoldstraße 16
22765 Hamburg
Germany

 

Personal data will not be transferred to third countries in connection with this service, unless this is expressly stated.

 

Automated Decision Making, Including Profiling (Art. 22 GDPR)

The personal data processed by you will not be used for automated decision making that has legal effects on you or similarly significantly affects you.

No Obligation to Provide Your Data

There is no obligation to provide us with your personal data. However, it is possible that we may need your data to perform a contract, for example, if you want to purchase products on our website. If you do not provide us with the personal data required for this purpose and requested by us, we may not be able to enter into a contract with you or, if a contract has already been concluded, we may not be able to fulfill it.

SSL Encryption

For security reasons and to protect the transmission of confidential content, such as inquiries you send to us as the site operator, this site uses SSL encryption. You can recognize an encrypted connection by the fact that the address line of the browser changes from "http://" to "https://" and by the lock symbol in your browser line.