Privacy Policy

Privacy policy and rights information

Thank you for visiting our website https://www.tech2people.at/. tech2people GmbH (hereinafter referred to as "we" or "tech2people") takes data protection very seriously. On this page you will find more detailed information about the processing of your data

in the context of treatments (point II.A.),
in the context of other contractual and business relationships (point II.B.),
when you visit our website (points II.C. and II.D.),
in the context of our social media presence (point II.E.),
in the context of customer management and advertising measures (point II.F.),
in the case of subscribing to tech2people News (point II.G.),
in the context of customer support and contact (point II.H.)

I. Name and address of the controller

The controller responsible for data processing within the meaning of the EU General Data Protection Regulation 2016/679 (hereinafter: "GDPR") is

tech2people Ltd.

Janis-Joplin-Promenade 24/501

1220 Vienna

E-mail: walkagain@tech2people.at

For inquiries about data protection and to exercise your rights, please contact our data protection officer atdpo@tech2people.ator by post to the address given above with the addition "Attn. For the attention of the data protection officer".

II Data processing activities

A. Data processing in the context of treatments

1. description and scope of data processing

Data processing is carried out in order to carry out your treatment and fulfill the associated obligations. In this context, we process your data in the following contexts

Checking your suitability for treatment
Coordinating appointments between you and the therapists
Evaluation of the data in the course of your treatment
Statistical evaluations to improve our services. We evaluate which patients come to us so that the right therapists can be recruited and the right equipment purchased
Billing of treatment services

In detail:

Before you can take part in Personal Bionic Training, the individually adapted standing and walking training in EksoTM GT (hereinafter: "PBT"), we must check whether you are suitable for the training. To do this, you must first register on our website and complete a questionnaire ("Registration", link:https://www.tech2people.at/therapie/ersttermin/). In addition to your contact details, the questionnaire also asks for health-related data (such as illnesses, anatomical measurements, etc.). We also require medical clearance from your doctor ("Medical clearance"). If the examination shows that you are suitable for PBT, you will be activated for training and can book training sessions online via us with the therapist of your choice. In this respect, we also coordinate the appointments between you and the therapists. Invoicing is also handled by us.

As part of PBT, your training data is collected and evaluated and other health-related data is collected from you (such as the success of your treatment). This data is required to carry out the treatment and to measure the success of the treatment. Doctors, physiotherapists or other therapists with whom you are being treated may also provide us with data for these purposes. Conversely, we also make your data (in particular health data) available to doctors, physiotherapists or other therapists with whom you are undergoing treatment if this is necessary for your treatment and there is a corresponding legal basis (such as your consent).

In addition, we process the data collected during your treatment in anonymized form as part of statistics and analyses for clinical studies. This serves the purpose of improving the therapy and proving the efficiency of the therapy. If we intend to use your data in personalized form for research purposes, we will inform you separately and ask for your consent.

The collection and processing of health data is a prerequisite for your treatment. If the necessary information is not provided, careful and safe treatment cannot take place.

We also process your data in order to bill you for treatment services.

2 Purpose of data processing

We process this data for the purpose of carrying out the treatment and complying with legal provisions and industry standards. For details, see point II.A.1 above.

3. legal basis for data processing

Processing activities that are necessary to carry out and process the treatment are based on the legal basis of Art. 6 para. 1 lit. b GDPR.

If your health data is also processed in this context, your consent constitutes the legal basis for this processing (Art. 9 para. 2 lit. a GDPR). You can withdraw your consent at any time. You can find more information about your rights under point IV. The collection and processing of health data is a prerequisite for your treatment. If you do not consent to the processing of your data, you will not be able to participate in our treatment. The same applies if you withdraw your consent at a later date. Please note, however, that we must continue to store the data collected in the course of your treatment even after you have withdrawn your consent in accordance with statutory provisions. In addition, we will continue to process your data in anonymized form to improve the therapy and to prove its effectiveness.

Therapists who belong to a health profession and are subject to professional secrecy process your health data as independent controllers (independently of tech2people) on the basis of Art. 9 para. 2 lit. h GDPR (such as doctors pursuant to Sections 51 and 54 ÄrzteG and physiotherapists pursuant to Sections 1c and 11c MTD-Gesetz).

Processing activities that are required due to legal provisions are based on the legal basis of Art. 6 para. 1 lit. c GDPR or Art. 9 para. 2 lit. g GDPR.

4. recipients

Your data will only be passed on by us if this is necessary to fulfill the treatment, if we are obliged to do so by law or if you have given your consent. In any case, we will only pass on your data to the extent necessary for the respective purpose, required by the respective legal regulation or, in the case of consent, specified by you.

Your data will be passed on to the following recipients in particular:

therapists with whom you book training sessions
if applicable, doctors or physiotherapists with whom you are undergoing treatment
insurance companies
Cost bearers in the healthcare system
IT service providers who provide us with software

5. duration of storage

In principle, we store your data until your treatment has ended. In addition, we are subject to various retention obligations, according to which data storage is also necessary after the end of treatment (e.g. 10 years for physiotherapists in accordance with Section 11a of the MTD Act). Furthermore, we may retain your data for as long as legal claims can be asserted in connection with the treatment. In the event of pending official or court proceedings, your data will be retained until the respective proceedings have been concluded.

B. Other contractual and business relationships

1. description and scope of data processing

In the context of contractual and business relationships (such as cooperation and collaboration with physiotherapists, doctors, equipment manufacturers, landlords and other partners such as universities and sponsors), tech2people processes personal data of contractual partners or their employees and/or their bodies. In particular, the following data is processed:

Title, name, function, contact details
Contract and business data (e.g. for the fulfillment of services for physiotherapists)
Correspondence
Address and billing address
Payment data (account, donation amount, etc.)

2. purpose of the data processing

We process this data for the purpose of concluding, fulfilling and processing contracts, conducting our business and complying with legal regulations and industry standards.

3. legal basis for data processing

Processing activities that are necessary to conclude, fulfill and process the contract, to conduct our business and to comply with legal requirements are based on the legal bases of contract fulfillment (Art. 6 para. 1 lit. b GDPR) and the fulfillment of legal obligations (Art. 6 para. 1 lit. c GDPR).

4. recipients

Your data will only be passed on by us if this is necessary for the fulfillment of the contract or if we are obliged to do so by law. We may also transfer your data on the basis of an overriding legitimate interest. In any case, we will only pass on your data to the extent that it is necessary for the respective purpose, required by the respective legal regulation or covered by the overriding legitimate interest.

If necessary, your data may be passed on to the following recipients in particular:

Tax consultants, auditors and lawyers
Banks and insurance companies
patients

5. duration of storage

In principle, we store your data until the contract has been fulfilled or the business relationship has ended. In addition, we are subject to various retention obligations, according to which data storage is also necessary after termination of the contractual or business relationship. Furthermore, we may retain your data for as long as legal claims can be asserted in connection with the respective contract. In the event of pending official or court proceedings, your data will be stored until the end of the respective proceedings.

C. Visiting our website (provision of the website and creation of log files)

1. description and scope of data processing

Each time our website is accessed, our system automatically collects data and information from the computer system of the accessing computer.

The following data is collected:

Information about the browser type and version used
Language and version of the browser software
The user's operating system and its interface
The user's internet service provider
The IP address of the user
Date and time of access and time zone difference to Greenwich Mean Time (GMT)
Amount of data transferred
Websites from which the user's system accesses our website
Websites that are accessed by the user's system via our website
Access status/HTTP status code

The data is also stored in the log files of our system.

Further information on the processing of your data in connection with your treatment via our website (such as appointment coordination) can be found under point II.A.

2 Purpose of data processing

The temporary storage of the IP address by the system is necessary to enable the website to be delivered to the user's computer. For this purpose, the user's IP address must remain stored for the duration of the session. The data is stored in log files to ensure the functionality of the website. We also use the data to optimize the website and to ensure the security of our information technology systems. The data is not analyzed for marketing purposes in this context.

3 Legal basis for data processing

The legal basis for the temporary storage of data and log files is our overriding legitimate interest pursuant to Art. 6 para. 1 lit. f GDPR. Our overriding legitimate interest lies in the aforementioned purposes of data processing (point II.C.2.).

4. recipients

If necessary, your data may be passed on to the following recipients in particular

Web hosting provider
IT service providers
software providers

In addition, we sometimes use service providers, so-called processors (see also point III.), for data processing (in particular for technical processing). We use the following processors in particular:

Bernhard Baumrock, Hellwagstraße 4-8/4/27, 1200 Vienna as part of the maintenance of the website.
mobimed Software GmbH, Gumpendorfer Straße 21, 1060 Vienna in the context of registration and online appointment booking.

5. duration of storage

The data will be deleted or anonymized after 30 days.

D. Use of cookies

1. definition of cookies

Cookies are small text files that are stored in your browser. These are downloaded by your browser the first time you visit our website. When this website is called up again with the same end device or browser, the cookie and the information stored in it is either sent back to the respective website that generated it (first party cookie) or sent to another website to which it belongs (third party cookie).

2. listing and consent

Many cookies are technically necessary, as certain website functions would not work without them (e.g. the shopping cart function or the display of videos). Other technologies are used to evaluate user behavior or display advertising.

This website uses the Cookie Script Consent Management Platform (CMP) to enable the privacy-compliant use of certain cookies, scripts or embedded content. Further information on Cookie Script and data processing for the purpose of consent management can be found at https://cookie-script.com/de/legal/privacy-policy.

You can find a list and information about the cookies used on our consent management platform. To do this, click on "Show details" the first time you access the page. You can call up the information again at any time by clicking on "Cookie settings" in the footer of our websites.

Technically necessary cookies are used on the basis of the website operator's overriding legitimate interest in the use of these technologies for the technically error-free and optimized provision of its services (Art. 6 para. 1 lit. f GDPR). Consent is obtained for cookies that are not technically necessary (Art. 6 para. 1 lit. a GDPR). If consent to the storage of cookies has been requested, the cookies in question will be stored exclusively on the basis of this consent.

You can revoke the consent given via the consent management platform at any time with effect for the future. Please note, however, that this may mean that certain functions can no longer be offered. To withdraw your consent, click on "Cookie settings" in the footer of our websites and then make the desired settings.

If the processing is based on a legitimate interest, you can object via the consent management platform by adjusting the settings accordingly (see above). If the corresponding setting options are not available, your right to object is restricted, as there are compelling legitimate grounds for the necessity of processing, see Art. 21 para. 1 sentence 2 GDPR. This is particularly the case for security-relevant services.

3. your cookie settings on this website

If you wish to block or restrict cookies completely, you can make the changes in the settings of your Internet browser. However, cookies that have already been saved can be deleted at any time. If cookies are deactivated for our website, it may no longer be possible to use all the functions of the website to their full extent.

The procedures for managing and deleting cookies can be found in the help function integrated in the respective browser. Further information on this process can be found under the following links:

Internet Explorer: http://windows.microsoft.com/de-DE/windows-vista/Block-or-allow-cookies

Firefox: https://support.mozilla.org/de/kb/cookies-erlauben-und-ablehnen

Chrome: http://support.google.com/chrome/bin/answer.py?hl=de&hlrm=en&answer=95647

Safari: https://support.apple.com/de-at/guide/safari/sfri11471/mac

Opera: https://help.opera.com/de/latest/web-preferences/

4. analysis of website use and statistics

This website uses Google Analytics, a web analytics service provided by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland ("Google"). The purpose of our use of this tool is to enable us to analyze your user interactions on websites and in apps and to use the statistics and reports obtained to improve our offering and make it more interesting for you as a user.

Google Analytics uses cookies that enable your use of the website to be analyzed. The information generated by the cookie about your use of this website is transmitted to a Google server in the USA and stored there. You can find information about the cookies set by Google Analytics in your browser on the following page: https://developers.google.com/analytics/devguides/collection/analyticsjs/cookie-usage

The website uses Google Analytics exclusively with the extension "_anonymizeIp()", which ensures anonymization of the IP address by shortening it and excludes direct personal reference. Data is only transmitted to Google in the USA in this non-personalized form. (Only in exceptional cases is the full IP address transmitted to a Google server in the USA and truncated there).Google is certified for the US-European data protection agreement "Privacy Shield", which guarantees compliance with the level of data protection applicable in the EU. We have also agreed so-called standard contractual clauses with Google, the purpose of which is to ensure compliance with an appropriate level of data protection in the third country.

In addition, the EU-U.S. Data Privacy Framework (DPF), which came into force on July 10, 2023, applies to the transfer of personal data to the USA. Based on self-certification (proof of compliance with the new data protection framework), companies from the USA are included in a list. Google LLC is included in the list as "Active". You can view the list at the following link: https://www.dataprivacyframework.gov/s/participant-search

Google will not associate your IP address with any other data held by Google Inc. under any circumstances. You may refuse the use of cookies by selecting the appropriate settings on your browser, however please note that if you do this you may not be able to use the full functionality of this website. By using this website, you consent to the processing of data about you by Google in the manner and for the purposes set out above.

The legal basis for the collection and further processing of the information (which takes place for a maximum of 14 months) is your consent (Art. 6 para. 1 lit. a GDPR). You can withdraw your consent at any time without affecting the lawfulness of processing based on consent before its withdrawal. The easiest way to withdraw your consent is via our consent management platform (see above) or by installing the Google browser add-on, which can be accessed via the following link: https://tools.google.com/dlpage/gaoptout?hl=de/.

Google provides information on data processing when using Google Analytics at the following link: https://support.google.com/analytics/answer/6004245?hl =en/.

5. targeted advertising

We use your data for personalized advertising that is presented to you on our website and on the websites and apps of other providers (onsite and in-app optimization of ads).

We use standard internet technologies, in particular to place advertisements in social networks (e.g. Google Ads) and on advertising spaces that are provided to us via online advertising networks such as DoubleClick from Google. This enables us to advertise in a more targeted manner in order to only present you with advertising and offers that are actually relevant to you. These technologies are only used if you have given your consent via our consent management platform in accordance with Art. 6 para. 1 lit. a GDPR (see above).

In the case of online advertising, your data may be transmitted to providers of social networks and other marketing partners. The main technologies and services we currently use are

i) Google Ads: We use the Google Ads service to draw attention to our offers with the help of advertisements. If you access our website via a Google ad, Google Ads will store a cookie on your device. The legal basis for the processing of your data is Art. 6 para. 1 lit. a GDPR, i.e. the integration only takes place with your consent.

The advertising material is delivered by Google via so-called "ad servers". For this purpose, we and other websites use so-called ad server cookies, through which certain parameters for measuring success, such as the display of ads or clicks by users, can be measured. We can obtain information about the success of our advertising campaigns via the Google Ads cookies stored on our website. These cookies are not intended to identify you personally. The unique cookie ID, the number of ad impressions per placement (frequency), the last impression (relevant for post-view conversions) and opt-out information (marking that a user no longer wishes to be addressed) are usually stored as analysis values for this cookie.

The cookies set by Google enable Google to recognize your internet browser. If a user visits certain pages of an Ads customer's website and the cookie stored on their computer has not yet expired, Google and the customer can recognize that the user clicked on the ad and was redirected to this page. A different cookie is assigned to each Ads customer so that the cookies cannot be tracked via the websites of other Ads customers. By integrating Google Ads, Google receives the information that you have accessed the relevant part of our website or clicked on an ad from us. If you are registered with a Google service, Google can assign the visit to your account. Even if you are not registered with Google or are not logged in, it is possible that the provider will find out your IP address and store it.

Due to the marketing tools used, your browser automatically establishes a direct connection with the Google server. We ourselves do not independently collect personal data in the course of the aforementioned advertising measures, but only provide Google with the opportunity to collect the data. We only receive statistical evaluations from Google, which provide information on which advertisements were clicked on how often and at what prices. We do not receive any further data from the use of the advertising material; in particular, we cannot identify users on the basis of this information.

You can withdraw your consent at any time without this affecting the permissibility of processing up to the time of withdrawal. The easiest way to revoke your consent is via our consent management platform (see above) or via the following functions: a) by setting your browser software accordingly, in particular by suppressing third-party cookies so that you do not receive any ads from third-party providers; b) by setting your browser to block cookies from the domain www.googleadservices.com, c) by making the appropriate setting in My Ad Center under the link www.google.com/settings/ads, whereby this setting will be deleted if you delete your cookies; d) by deactivating the interest-based ads of the providers that are part of the "About Ads" self-regulation campaign via the link www.aboutads.info/choices, whereby this setting will be deleted if you delete your cookies; f) by permanently deactivating cookies in your Firefox, Internet Explorer or Google Chrome browsers under the link www.google.com/settings/ads/plugin. We would like to point out that in this case you may not be able to use all functions of this website to their full extent.

Google also processes your personal data in the USA and has imposed a standard that corresponds to the former EU-US Privacy Shield. We have also agreed so-called standard data protection clauses with Google, the purpose of which is to maintain an appropriate level of data protection in the third country.

Further information on data protection at Google Ireland Limited, Gordon House, Barrow Street Dublin 4, Ireland, can be found here: https://policies.google.com/privacy?hl=de&gl=de, https://policies.google.com/technologies/ads?hl=de, and https://business.safety.google/adsservices/.

ii) Google Tag Manager: We use Google Tag Manager ("GTM"), a tag management system for managing JavaScript and HTML tags used to track and analyze websites. Tags are small code elements that are used, among other things, to measure traffic and visitor behavior: to understand the impact of online advertising and social channels; to set up remarketing and targeting; and to test and optimize websites. GTM makes it easier for us to integrate and manage our tags.

The legal basis for the processing of your data in this respect is also Art. 6 para. 1 lit. a GDPR, i.e. the integration only takes place with your consent. You can withdraw your consent at any time without affecting the lawfulness of processing based on consent before its withdrawal. The easiest way to withdraw your consent is via our consent management platform (see above). If you have opted out, GTM will take this into account.

Further information on data protection at Google Ireland Limited, Gordon House, Barrow Street Dublin 4, Ireland, can be found here: https://policies.google.com/privacy?hl=de&gl=de and https://marketingplatform.google.com/about/analytics/tag-manager/use-policy/.

6. integration of information videos on our website

We have integrated YouTube components to optimize our website ("YouTube plugin"). YouTube is an Internet video portal where video clips can be viewed, rated, commented on and uploaded free of charge. The processing of personal data when using YouTube is carried out by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland, as the controller. Further information about YouTube is available athttps://www.youtube.com/yt/about/de/

YouTube sets various cookies in your browser as part of this service.
Domains: The cookies may originate from different domains. They are listed here: https://policies.google.com/technologies/types?hl=de

The information collected is stored on Google servers, including in the USA. In these cases, the provider has, according to its own information, imposed a standard that corresponds to the former EU-US Privacy Shield and has promised to comply with applicable data protection laws when transferring data internationally. We have also agreed so-called standard data protection clauses with Google, the purpose of which is to maintain an appropriate level of data protection in the third country.

Further information on the handling of user data can be found in YouTube's privacy settings athttps://www.youtube.com/intl/ALL_at/howyoutubeworks/user-settings/privacy/, at YouTube Help under the "Basics of data protection in YouTube apps", available athttps://support.google.com/youtube/answer/10364219?hl=de andin Google's privacy policy athttps://policies.google.com/privacy?hl=de&gl=de. Information on a possible opt-out can be found athttps://adssettings.google.com/authenticated.

E. Our social media presence

1. description and scope of data processing

We have various presences on social media platforms ("profile pages"). We operate these sites with the following providers

Facebook (Meta Platforms Ireland Limited, 4 Grand Canal Square, Grand Canal Harbour, Dublin 2, Ireland) - privacy policy: https://www.facebook.com/about/privacy/, agreement concluded with Meta on joint responsibility for Page Insights: https://www.facebook.com/legal/terms/information_about_page_insights_data; opt-out: https://www.facebook.com/settings?tab=adsandhttp://www.youronlinechoices.com.
Instagram (Meta Platforms Ireland Limited, 4 Grand Canal Square, Grand Canal Harbour, Dublin 2, Ireland) - Privacy Policy / Opt-Out: http://instagram.com/about/legal/privacy/.
LinkedIn (LinkedIn Ireland Unlimited Company, Wilton Place, Dublin 2, Ireland) - Privacy Policyhttps://www.linkedin.com/legal/privacy-policy, Opt-Out: https://www.linkedin.com/psettings/guest-controls/retargeting-opt-out.
YouTube (Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland) - Privacy Policyhttps://policies.google.com/privacy?hl=de&gl=de; Opt-Out: https://adssettings.google.com/authenticated.

2 Purpose of the data processing

We use the technical platform and services of the providers for these information services. These appearances serve the external presentation of our company and the offers, organization of competitions for new customer acquisition or existing customer loyalty. We would like to point out that you are responsible for your own use of our presence on social networks and their functions. This applies in particular to the use of interactive functions (e.g. commenting, sharing, rating).

3 Legal basis for data processing

As the provider of the information service, we only process the data from your use of our service that you provide to us and that require interaction. For example, if you ask a question that we can only answer by email. The legal basis for the processing of your data on the social media platform is Art. 6 para. 1 sentence 1 lit. f GDPR.

4. recipients

As a rule, social networks can comprehensively analyze your user behavior. This applies in particular if you use the relevant networks to visit our social media sites. The data collected about you in this context is processed by the social networks and may be transferred to countries outside the European Union, in particular the USA. According to their own statements, all of the aforementioned providers maintain an appropriate level of data protection that corresponds to that of the former EU-US Privacy Shield and we have concluded the standard data protection clauses with the companies.

In addition, the EU-U.S. Data Privacy Framework (DPF), which came into force on July 10, 2023, applies to the transfer of personal data to the USA. Companies from the USA are included in a list based on self-certification (proof of compliance with the new data protection framework). You can view the list at the following link: https://www.dataprivacyframework.gov/s/participant-search

5. duration of storage

What information the social network in question receives, how it is used and in particular how long it is stored is described by the providers in their privacy policies (see the list above). There you will also find information about contact options, your rights and the settings options for advertisements. Further information on social networks and how you can protect your data can also be found at https://www.youngdata.de/.

F. Customer management and advertising measures

1. description and scope of data processing

As part of customer management, we process personal data of patients, their legal representatives and other accompanying persons, other customers, other partners and interested parties or their employees and/or their bodies. In particular, the following data is processed:

Title, first name, surname, company, position/occupation
contact details
Data on the treatments carried out (point II.A.)
Contractual and business data (point II.B.)
Correspondence
Address and billing address
Payment data (account, donation amount, etc.)
Data that you provide to us directly via customer surveys, such as age, gender, lifestyle and other behavior (e.g. sleep patterns, sport).

2 Purpose of data processing

We process this data for the purposes of supporting and managing contacts and business opportunities, customer communication, preparing and obtaining offers, maintaining a customer database, contract management, fraud prevention, assertion, exercise or defense of legal claims, reporting on customer contacts and related task management and reporting on business development.

In addition, we process personal data for the preparation and implementation of marketing and advertising activities, in particular to advertise services offered, to maintain existing business contacts and to prepare and initiate future contracts.

3. legal basis for data processing

Processing activities that are necessary to fulfill a contract or to carry out pre-contractual measures are based on the legal basis of contract fulfillment (Art. 6 para. 1 lit. b GDPR). Due to our overriding legitimate interests, we process personal data when using (extended) functionalities of the customer database and other CRM software, for fraud prevention, to exercise our rights and for legal defense (Art. 6 para. 1 lit. f GDPR).

Marketing and advertising activities are carried out on the basis of our overriding legitimate interest in acquiring new customers and maintaining existing customer relationships in order to market and sell the services and products we offer (Art. 6 para. 1 lit. f GDPR).

If you voluntarily provide us with health data in surveys, the data processing is based on your consent in accordance with Art. 6 para. 1 lit. a in conjunction with Art. 9 para. 2 lit. f GDPR. Art. 9 para. 2 lit. a GDPR. You can withdraw your consent at any time. You can find more information about your rights under point IV.

4. recipients

If necessary, your data may be passed on to the following recipients in particular:

Affiliated companies, in particular therapy2people GmbH
marketing partners
IT service providers
payment service providers
public authorities

We use HubSpot for our online marketing activities. This is an integrated software solution that we use to cover various aspects of our online marketing. These include, among others:

Content management (website and blog)
Email marketing (automated mailings, e.g. to provide downloads)
Social media publishing & reporting
Reporting (e.g. traffic sources, hits, etc. ...)
Contact management (e.g. user segmentation & CRM)
Landing pages and contact forms

Our sign-up service allows visitors to our website to learn more about our company, download content and provide their contact information and other demographic information. This information is stored on the servers of our software partner HubSpot. It can be used by us to contact visitors to our website and to determine which services or offers are of interest to them.

HubSpot is a software company from the USA with several branches in the EU. The contractual partner is HubSpot Germany GmbH(https://legal.hubspot.com/jurisdiction-specific-terms).

Contact: HubSpot Ireland Limited, HubSpot House, One Sir John Rogerson's Quay, Dublin 2, Ireland, Attention: Legal, (with copy to HubSpot, Inc.)(https://legal.hubspot.com/jurisdiction-specific-terms).

If personal data is transferred to the USA, further protective mechanisms are required to ensure the data protection level of the GDPR. To ensure this, we have agreed standard data protection clauses with the provider in accordance with Art. 46 para. 2 lit. c GDPR. These oblige the recipient of the data in the USA to process the data in accordance with the level of protection in Europe.

Further information on data protection can be found in the HubSpot Data Processing Agreement(https://legal.hubspot.com/de/dpa), HubSpot Privacy Policy(https://legal.hubspot.com/de/privacy-policy) and HubSpot Cookies Policy(https://legal.hubspot.com/de/cookie-policy).

5 Duration of storage

In principle, we store your data until the contract is fulfilled or the business relationship is terminated or until your justified objection. You can find more information on the assertion of rights under point IV. In addition, we are subject to various retention obligations, according to which data storage is necessary even after termination of the contractual or business relationship. Furthermore, we may retain your data for as long as legal claims can be asserted in connection with the respective contract. In the event of pending official or court proceedings, your data will be stored until the end of the respective proceedings.

G. tech2people News

1. description and scope of data processing

You can subscribe to news free of charge on our website tech2people. When you register, the data from the input screen is transmitted to us. In order to inform you regularly about news from the company that is tailored to your personal interests, we require the following personal data in addition to your consent:

Title, first name, surname, company, position/occupation
Date of birth (optional)
Contact details (e.g. e-mail address)
Billing and delivery addresses
Health data such as diagnosis and data on therapy devices used
Payment information
IP address
Date and time of access to the online offer
messages
Usage behavior (e.g. opening and click rates of messages, click rates of links in a message, reactions to campaigns, use of our website)

We use a so-called double opt-in procedure for registration, i.e. we will only send you news if you first confirm your registration via a confirmation e-mail sent to you for this purpose using a link contained therein.

If you have given us your consent, we will send you information tailored to your interests at regular intervals by e-mail about news from the company, including new devices, new blog articles, upcoming events, special offers and services. We may also contact you as part of customer surveys and customer care (e.g. reminders).

We optimize and personalize our information about news from the company as well as customer surveys and other messages in the context of customer care. For the purpose of personalization, we use automated data processing methods to analyze your usage behavior in order to gain new insights. This process is profiling in accordance with Art. 4 No. 4 GDPR. By creating a personal user profile, we want to tailor our information and advertising to your interests and optimize our offers for you. This means that, in addition to general messages, you will also receive information tailored specifically to you.

2 Purpose of data processing

The personal data is processed in order to inform you regularly about news from the company. For details, see point II.F.1 above.

The IP addresses you use and the time of registration and confirmation of the confirmation link are processed by us for the purpose of proving your registration and, if necessary, clarifying any possible misuse of your personal data.

3 Legal basis for data processing

We store and process your personal data on the basis of your consent in accordance with Art. 6 para. 1 lit. a GDPR. You can withdraw your consent at any time. You can find more information about your rights under point IV.

You provide us with your data voluntarily, without any legal or contractual obligation. However, the processing of your data is necessary in order to be able to send news about the company. If you do not provide the above-mentioned data, we will not be able to send you this information.

The processing of your IP addresses and times of registration and confirmation of the confirmation link is based on our overriding legitimate interest (Art. 6 para. 1 lit. f GDPR). Our legitimate interest lies in being able to prove your registration and, if necessary, to clarify any possible misuse of your personal data.

4th recipient

Your data may be passed on to IT service providers.

We use the service provider Brevo (formerly sendinblue), 106 boulevard Haussmann, 75008 Paris, France(https://www.brevo.com/legal-notice/) to send news from the company.

As part of processing via Brevo, data may be transferred to third countries. The security of the transfer is regularly ensured by so-called standard contractual clauses, which guarantee that the processing of personal data is subject to a level of security that complies with the GDPR.

You can find more information on the collection and use of personal data in Brevo's privacy policy athttps://www.brevo.com/legal/privacypolicy/#privacypolicy, as well as in the Agreement on the processing of personal data (General conditions of use of Brevo (formerly Sendinblue) services, Annex 1) athttps://www.sendinblue.com/legal/termsofuse/#annex.

We also use HubSpot for our online marketing activities. You can find more information about your rights under point II.F.4.

5 Duration of storage

In principle, we store your data for as long as you are registered for tech2people News. In addition, we may retain your data for as long as legal claims can be asserted in connection with the sending of news. In the event of pending official or legal proceedings, your data will be stored until the end of the respective proceedings.

H. Customer support and making contact

1. description and scope of data processing

If you contact us using the contact form (https://www.tech2people.at/kontakt/), by e-mail, by post or by telephone, we collect and process the personal data that you voluntarily provide to us in this context, as well as data about the contact (e.g. contact channel, categorization of processes) in order to contact you and process your request.

In particular, the following data will be processed:

Title, first name, surname, company, position/occupation
contact details
request
Additional information (optional)

to enable correspondence with you.

2 Purpose of data processing

This personal data is processed for the purpose of responding to your inquiries. Depending on the context in which you contact us, this may serve to maintain customer relations, customer advice, customer communication and assistance, customer loyalty measures and acquisition, complaint management, complaint and revocation management, provision of information to data subjects and fulfillment of other rights of data subjects.

3 Legal basis for data processing

Depending on the context in which you contact us, the data processing is carried out for the implementation of (pre-)contractual measures (Art. 6 para. 1 lit. b GDPR), due to a legal obligation (Art. 6 para. 1 lit. c GDPR) or on the basis of our overriding legitimate interest in clarifying your questions and concerns and documenting the result of the processing in the event of queries (Art. 6 para. 1 lit. f GDPR).

4. recipient

Your data will not be passed on.

5. duration of storage

Your data will generally be stored until the customer inquiry has been processed or until your justified objection. You can find more information about the assertion under point IV. In addition, data will be stored if statutory retention obligations prevent deletion or if we need the data in individual cases to defend or enforce legal claims.

III Processors

In some cases, we use external service providers (so-called processors) to process personal data, for example as part of an IT support contract.

These processors are given limited access to your personal data in order to carry out these tasks on our behalf. Processors are carefully selected by us and are contractually obliged to comply with data protection regulations.

Processors used by us are listed under the recipients in the respective processing activities under point II.

IV. Your rights in connection with data processing

The GDPR grants you certain rights as a data subject, to which we draw your attention below. Please note that these complement each other, so that you can only request either the correction or completion of your data or its deletion.

1. revocation of consent

Insofar as tech2people collects and processes your personal data on the basis of your consent, you are entitled to withdraw your consent at any time. However, this does not affect the lawfulness of the processing carried out up to the time of withdrawal. If you wish to withdraw your consent, please let us know at the following e-mail address:dpo@tech2people.at. Please note that in some cases, withdrawing your consent may mean that you will not be able to continue your treatment (see also point II.A.).

2. right to information

You can request information about the origin, categories, storage duration, recipients, purpose of the data processed about you by tech2people and the type of processing.

3. right to rectification and erasure

If tech2people processes personal data concerning you that is incorrect or incomplete, you may request that it be rectified or completed. You may also request the erasure of unlawfully processed data.

4. right to restriction of processing

If it is unclear whether the data processed about you is incorrect or incomplete or is being processed unlawfully, you can request that the processing of your data be restricted until this question has been finally clarified.

5. right to object

Even if your personal data is correct and complete and is processed by tech2people, you can object to the processing of this data. However, this only applies if tech2people processes your data on the basis of an overriding legitimate interest in accordance with Art. 6 para. 1 lit. f GDPR and only in special situations to be justified by you. If you would like to exercise your right to object, simply send an email to dpo@tech2people.at. You can also exercise your right to object by sending a letter to the address given in point I. with the addition "Attn. For the attention of the data protection officer".

6. right to data portability

You may receive the personal data processed by tech2people, which tech2people itself has received from you, in a machine-readable format specified by tech2people or instruct tech2people to transmit this data directly to a third party of your choice, provided that this recipient is technically capable of doing so.nger tech2people makes this possible from a technical point of view and the data transfer does not conflict with any unreasonable expense or legal or other confidentiality obligations or confidentiality considerations on the part of tech2people or third parties.

7. right to lodge a complaint

Finally, you have the right to lodge a complaint with the Austrian data protection authority(https://www.dsb.gv.at/) if you believe that the processing of your personal data violates data protection regulations.

8 Who can you contact to assert your rights?

If you have any questions, you can contact us at any time.

To assert the aforementioned rights, please contact us in writing (by letter or email) using the contact details provided under point I or directly at the following email address:dpo@tech2people.at