I. Name and Address of the Controller
The controller within the meaning of the General Data Protection Regulation, other national data protection laws of the Member States and other data protection provisions is:
Compass-Verlag GmbH
Schönbrunner Strasse 231
1120 Vienna
Austria
Phone: +43 / 1 / 981 16-0
Email: office[at]compass.at
Website: www.compass.at
II. Name and Address of the Data Protection Officer
The Controller's Data Protection Officer is:
Dr. Georg Hittmair
Schönbrunner Strasse 231
1120 Vienna
Austria
Email: datenschutzbeauftragte[at]compass.at
III. General information on Data Processing
1. Extent of the Processing of Personal Data
As a matter of principle, we collect and use our users' personal data only to the extent that this is necessary for providing an operable website and our contents and services. As a rule, the personal data of our users is collected and used only upon the user’s prior consent. A derogation applies to cases where prior obtaining of consent is not possible for factual reasons and the processing of the data is permitted by statutory provisions.
2. Legal Basis for the Processing of Personal Data
Insofar as we obtain the data subject’s consent to the processing of their personal data, Article 6(1)(a) of the EU General Data Protection Regulation (GDPR) constitutes the legal basis.
For the processing of personal data that is necessary for performing a contract to which the data subject is a party, Article 6(1)(b) GDPR constitutes the legal basis. This also applies to processing activities which are necessary to implement pre-contractual measures.
Insofar as processing of personal data is necessary to fulfil a legal obligation to which this company is subject, Article 6(1)(c) GDPR constitutes the legal basis.
In the event that processing of personal data is necessary in order to protect vital interests of the data subject or another natural person, Article 6(1)(d) GDPR constitutes the legal basis.
Article 6(1)(f) GDPR constitutes the legal basis for data processing which is necessary to safeguard the legitimate interests of this company or those of a third party and where the interests, fundamental rights or fundamental freedoms of the data subject do not prevail over such interests.
3. Erasure of Data; Storage Period
The data subject's personal data will be erased or access to such data will be blocked as soon as the purpose of storing ceases to exist. Data may continue to be stored if this has been provided for by the EU or the national legislator in EU regulations, legislation or other provisions to which the controller is subject. Access to data will be blocked or data will be erased upon expiry of a storage period prescribed by such legislation, unless continued storage of the data is required for conclusion or performance of a contract.
IV. Collection of Data for Compass Products (Information as defined in Article 14 GDPR)
1. Extent of the Processing of Personal Data
Compass-Verlag GmbH has been working as a directory publishing company for 150 years. In its business databases it publishes data of Austrian business enterprises and, in addition to the (Austrian) Business Register, we also use other registers and editorial research as a source. In the interest of our customers we aim to ensure completeness and accuracy. Link to a presentation of our company: https://compass.at/en/about-compass. When processing data of natural persons our activities are subject to the General Data Protection Regulation and the Austrian Data Protection Act [DSG].
Our core business is
· to collect and structure
· data that is publicly available or has been researched by us
· regarding Austrian business entities
· from different sources
· and to import it into our own databases and
· to pass it on as a convenient information product in different technical formats
for a fee. Our customers may use such information to continuously monitor their own customer relations and to combat fraud.
2. Legal Basis for the Processing of Personal Data
The activities of Compass-Verlag GmbH are primarily governed by Article 6(1)(f) GDPR; processing is required to safeguard the Controller’s or a third party’s legitimate interests. We may refer you to Recital 47, which defines the prevention of fraud as a legitimate interest and states that the processing of personal data for the purpose of direct marketing can be regarded as processing that serves a legitimate interest.
Where data subjects provide us with data we are pleased to receive their consent as defined in Article (6)(1)(a) GDPR.
3. Purpose of Data Processing
Compass-Verlag GmbH possesses several trade licences to provide its services:
· directory publishing company and direct marketing company as defined in Section 151 of the Austrian Trade Code [Gewerbeordnung/GewO]
· credit agency as defined in Section 152 GewO
· book publishing house as defined in Section 103(1)(b) No. 7 GewO 1973
· bookseller as defined in Section 103(1)(b) No. 6 GewO 1973, limited to the sale of the publisher’s own reference books / directories and the purchase and sale of reference books / directories and address books and academic works on economics and business of other publishers
· services in automated data processing and information technology
· advertising agency as defined in Section 103(1)(b) No. 55 GewO 1973, limited to reference books / directories, address books and academic works on economics and business
The purpose of data processing as defined in Article 5(1)(b) GDPR therefore is to support the provision of services expressly permitted by the Trade Code.
4. Source of Personal Data
The sources of the personal data used by Compass-Verlag GmbH include but are not limited to: the Austrian Business Register [Firmenbuch], the Austrian Trade Register [Gewerberegister], the Austrian Trademark Register [Markenregister], the Austrian Patent Register [Patentregister], supplementary registers of other data subjects, the Austrian Medical Chamber [Ärztekammer], telephone directories of information agencies, the Austrian Register of Associations [Vereinsregister], the Austrian Chamber of Notaries [Notariatskammer], dentists, veterinarians, the Austrian Federal Ministry of Health [Bundesministerium für Gesundheit], the Chamber of Public Accountants and Tax Advisors [Kammer der Wirtschaftstreuhänder], the Austrian Federal Economic Chamber [Wirtschaftskammer Österreich], the Financial Market Authority [Finanzmarktaufsicht].
5. Categories of Personal Data
All data categories from the underlying public registers will be stored.
The following data may be contained: internal ID, name, title, sex, date of birth, contact details, official ID (e.g. ZVR [Central Register of Associations] number).
6. Categories of Recipients
The recipients of the data are users of Compass services.
7. Storage Period
We store data permanently because also historical data is of great value to us and our customers. For example, Compass books from the interwar period were used as a key source for handling restitution issues. We have digitised all data gathered in 150 years of publishing and offer this historical data in a separate product.
8. Right to Object and Right to Erasure
Article 14 GDPR provides for obligations to provide information where personal data has not been obtained from the data subject; paragraph 5 of that Article, however, provides for exemptions from those information obligations. Two of the exemptions apply to us:
Paragraphs 1 to 4 (= obligation to provide information) do not apply where and insofar as
(b) the provision of such information proves impossible or would involve a disproportionate effort;
(c) obtaining or disclosure is expressly laid down by Union or Member State law to which the Controller is subject and which provides appropriate measures to protect the data subject's legitimate interests.
Almost all data of Compass products originate from freely accessible public databases. Re-use of such data is regulated in Directive 2013/37/EU and by the Austrian Act on Re-use of Public Sector Information. All of the said legislation contains a reference to data protection provisions and therefore falls under letter (c). Moreover, informing millions of data subjects would involve a disproportionate effort. That is why we make such information available to the public, as is also provided for in the last sentence of Article 14(5)(b) GDPR.
V. Provision of the Website and Creation of Log Files
1. Description and Extent of Data Processing
Each time our website is visited, our system will automatically collect data and information from the computer system of the retrieving computer.
When this happens the following data will be collected:
(1) information on the browser type and the version used;
(2) the user’s operating system;
(3) the user's IP address;
(4) date and time of access;
(5) websites from which the user's system is referred to our website;
(6) websites accessed by the user's system via our website;
(7) the user’s request.
Such data will be stored in the log files of our system as well. Such data will not be stored together with other personal data of the user.
2. Legal Basis for Data Processing
The legal basis for temporary storage of data and log files is Article 6(1)(f) GDPR.
3. Purpose of Data Processing
Temporary storage of the IP address by the system is necessary for delivery of the website to the user's computer. For that purpose the user’s IP address must be stored for the duration of the session.
Log files are stored to ensure the website’s functionality. In addition, such data helps us to optimise the website and ensure security of our IT systems. In this connection the data will not be analysed for marketing purposes.
The said purposes also constitute our legitimate interest in data processing as defined in Article 6(1)(f) GDPR.
4. Storage Period
The data will be erased once it is no longer needed for achieving the purpose for which it was collected. Where data is collected for provision of the website, this will be done when the relevant session has ended.
Where data is stored in log files, this will be done after a maximum of three (3) months. Storage beyond that period is possible. In that case the IP addresses of the users will be deleted or masked so that the retrieving client can no longer be identified.
5. Right to Object and Right to Erasure
Collection of data for provision of the website and storage of data in log files is mandatory for operation of the website. Consequently, users have no right to object.
VI. Use of Cookies
1. Description and Extent of Data Processing
Our website uses cookies. Cookies are text files which are stored in the user's computer system in or by the internet browser. When a user accesses a website, a cookie may be stored in the user's operating system. That cookie contains a characteristic string of characters which allows unambiguous identification of the browser when the website is accessed again.
We use cookies to make the website more user-friendly. Some elements of our website require the retrieving browser to be identified even after changing to another website.
The following data will be stored and transmitted in the cookies:
(1) log-in data
(2) whether or not the cookie notification was viewed
(3) billing address, if requested
Our website uses cookies which allow an analysis of the users' browsing behaviour.
The following data may be transmitted in this way:
(1) frequency of site visits
(2) Survey of the Austrian Web Analysis Association [Österreichische Webanalyse/ÖWA]
The user data which is collected in this way is pseudonymised through technical measures. Consequently, the data can no longer be associated with the retrieving user. The data will not be stored together with other personal data of the users.
When accessing our website an information banner will inform users about the use of cookies for analysing purposes and will refer to this Privacy Statement.
2. Legal Basis for Data Processing
The legal basis for processing personal data by using cookies is Article 6(1)(f) GDPR.
3. Purpose of Data Processing
The purpose of using technically necessary cookies is to make the use of websites easier for users. Some features of our website cannot be provided without the use of cookies. For those it is necessary for the browser to be recognised even after changing to another website.
We need cookies for the following applications:
(1) log-in data
(2) memorising the billing address
(3) non-display of the cookie notification
The user data collected by technically necessary cookies will not be used to create user profiles.
Analytical cookies are used for the purpose of enhancing the quality and contents of our website. By means of analytical cookies we learn how the website is used and are thus able to constantly optimise our offer.
Analytical cookies count the number of visitors to the websites and record their behaviour on our websites. This allows us to optimise our websites so that users find the most frequently used functions more quickly.
The said purposes also constitute our legitimate interest in the processing of personal data as defined in Article 6(1)(f) GDPR.
4. Storage Period, Right to Object and Right to Erasure
Cookies are stored on the user's computer and transmitted from there to our website. Therefore, you as the user have full control over the use of cookies. By adjusting the settings in your internet browser you can disable or restrict transmission of cookies. Cookies which have been stored can be deleted at any time. This can also be done automatically. If cookies are disabled for our website, you may no longer be able to use of all of the website's functions in full.
VII. Newsletter
1. Description and Extent of Data Processing
On our website you may subscribe to a free newsletter. When registering for the newsletter the data from the entry mask will be transmitted to us.
The following data will be collected during the registration process:
(1) email address
(2) name
(3) IP address of the calling computer
(4) date and time of registration
In connection with the registration process your consent to data processing will be obtained with reference to this Privacy Statement.
In connection with data processing for the mailing of newsletters no data will be passed on to third parties. Data will exclusively be used for mailing the newsletter.
2. Legal Basis for Data Processing
The legal basis for data processing after the user's registration for the newsletter is Article 6(1)(a) GDPR, provided that the user has given their consent thereto.
In addition, preparing and using interest profiles and consumer behaviour profiles for target group segmentation constitutes legitimate processing of data for direct advertising purposes which is therefore permissible without the consent of the data subject. In cases where no consent was given or where the consent is not correct, we consider Article 6(1)(f) GDPR to be an effective legal basis.
3. Purpose of Data Processing
The collection of the user’s email address serves the purpose of delivering the newsletter.
Collection of other personal data in the course of the registration process serves the purpose of preventing misuse of the services or the email address used.
4. Storage Period
Data will be erased once it is no longer necessary to achieve the purpose for which it was collected. Thus, the user’s email address will be stored for as long as the subscription to the newsletter is active.
5. Right to Object and Right to Erasure
Users may cancel their subscription to the newsletter at any time. A relevant link is contained in every newsletter.
This also allows withdrawal of consent to storing of personal data collected during the registration process.
VIII. Contact Form and Email Contact
1. Description and Extent of Data Processing
Our website provides a contact form, which may be used to contact us electronically. If a user makes use of that option, the data entered into the input mask will be transmitted to us and stored. This data includes:
·
