Information obligation: Storage of customer data according to Article 13 GDPR

HYPOXI Produktions- und Vertriebs GmbH
AT-4881 Straß im Attergau, Wildenhag 88
Managing Director: Mag. Bernd Eckerstorfer, Mag. (FH) Uwe Hintringer

stores in order to fulfil your request according to Article 6 paragraph 1 b GDPR following data:

– name/company name and address
– contact data (e-mail, phone, telefax, homepage)
– name and contact data of requestor

Data receiver
Employees of HYPOXI Produktions- und Vertriebs GmbH,
AT-4881 Straß im Attergau, and their data processors.

The client has the right to:
– information about stored data (Article 15 GDPR)
– data correction (Article 16 GDPR)
– deletion within statutory deletion periods (Article 17 GDPR)
– restriction of processing (Article 18 GDPR)
– right to data portability (Article 20 GDPR)
– right of withdrawal (Article 21 GDPR)

The storage takes place in context of the legal storage obligations, as long as the customer relationship exists, or the customer withdraws. According to Article 7, paragraph 3 GDPR, the customer has the right to object to the storage of his data at any time without stating reasons. The objection can be made under datenschutz@hypoxi.com. Until the date of withdrawal, the processing remains legal.

The customer’s failure to provide data would mean that the purpose of the contract cannot be met.

The customer has the right according to Article 77 GDPR to complain to the supervisory authority if he considers that the processing is incorrect.

Basis of information according to GDPR

(Article 6 paragraph 1b)
The processing is necessary for the contract fulfilment of which the affected person is a party, or to carry out pre-contractual measurements at the request of the data subject.

(Article 13 paragraphs 1, 2, 3)
1. When personal data is collected from the data subject, the person in charge communicates to the data subject at time of collecting such data as follows:

a) Name and contact data of person in charge and possibly of any representative.
b) Possibly the contact data of the data protection officer.
c) The purpose for which the personal data is to be processed and the legal basis for processing.
d) If the processing is based on Article 6 (1) (f), the legitimate interests pursued by the person in charge or a third party.
e) Where appropriate, the recipients or categories of recipients of the personal data and
f) where applicable, the intention of the person in charge to transfer the personal data to a third country or to an international organization, as well as the presence or absence of adequacy decision by the Commission, or in case of transmissions according to article 46 or article 47 or article 49 paragraph 1 subparagraph 2, a reference to the appropriate or reasonable warranties and the possibility on how to obtain a data copy or where such is available.

2. In addition to the information referred to in paragraph 1, the responsible person shall, at the time of data collecting, provide the following further information which are necessary to ensure a fair and transparent processing:

a) The duration for which the personal data is stored or, if this is impossible, the criteria for determining that duration.
b) The existence of a right to information on the part of the person in charge of the concerning personal data, as well as amendment or deletion or limitation of the data processing or of a right of objection to data processing and the right to data portability.
c) If the processing is based on article 6 (1) (a) or article 9 (2) (a), the right to revoke the consent at any time without affecting the lawfulness based on the consent until the objection.
d) The existence of a right of appeal to a supervisory authority.
e) Whether the supply of personal data is required by law or contract, or is required for a contract to be concluded, whether the data subject is required to provide the personal data and the potential consequences of non–provision of data; and
f) the existence of automated decision-making including profiling as referred to in article 22 (1) and (4) and, at least in these cases, meaningful information about the logic involved, and the consequence and intended impact of such processing for the data subject.

3. If the responsible person intends to process the personal data for a
purpose other than that for which the personal data was collected, he shall provide the data subject prior the further data processing with information on that other purpose and any other relevant information referred to in paragraph 2.

4. Paragraphs 1, 2 and 3 shall not apply if and so far as the data subject already has the information.