You have the right of access to the data we hold about you (Art. 15 GDPR), the right to rectification (Art. 16), to erasure (Art. 17), to restriction of processing (Art. 18) and to data portability (Art. 20). You may withdraw any consent at any time with effect for the future (Art. 7(3) GDPR). Processing carried out before the withdrawal remains lawful.

You may submit your request in writing, by e-mail or in person at the address above. We reply without undue delay and at the latest within one month. We only ask for proof of identity if there are reasonable doubts about your identity. Any proof submitted is destroyed once the request has been dealt with.

Hosting and e-mail

Our online shop and our e-mail mailboxes are hosted by STW Group OG (allforyou), Schöngrabern 65, 2020 Hollabrunn, Austria. The servers are located in Austria. E-mails you send us and e-mails sent by the shop, such as order confirmations, also pass through this host's mail server. The host processes the data on our behalf. Operational messages from the shop, by contrast, go to a mailbox at semperconnect.cc (see “Monitoring of shop operations”).

Access and error logs

Each time a page is called up, the web server processes your IP address, the date and time, the address requested, the page visited previously (referrer) and information about your browser and operating system, and stores them in log files. If an error occurs, the web server's error logs and the shop's log files record the event, in some cases also with the IP address. The purpose is the secure and error-free operation of the shop, error analysis and defence against attacks. The legal basis is our legitimate interest in this (Art. 6(1)(f) GDPR). The host deletes the web server logs automatically after about ten days; we delete the shop's log files after 30 days. The host also compiles monthly access statistics (AWStats) from the web server access logs. These summarise page views, referring pages, browsers and operating systems and also include lists of the IP addresses used to access the shop. They are password-protected and can only be viewed by us. The purpose is to evaluate how the shop is used and to analyse errors; the legal basis is again our legitimate interest (Art. 6(1)(f) GDPR). These statistics are not deleted automatically; the monthly reports currently go back to October 2020.

Error monitoring with Sentry

So that we can detect and fix technical errors quickly, the shop's server reports program errors (such as warnings and aborts while building a page or running a scheduled task) to the Sentry service of Functional Software, Inc., 45 Fremont Street, 8th Floor, San Francisco, CA 94105, USA. The chat window (section 6) likewise reports errors that occur in the chat window itself to Sentry via our server semperconnect.cc. A report contains the type of error, the error text, the affected place in the program, the address of the page without parameters, the time and the software version. We do not transmit your IP address, cookies, form, customer or order data or chat messages; before sending, we remove e-mail addresses, phone, IBAN and VAT numbers, access keys and names from the error text. Sentry stores the reports in a data centre in Frankfurt am Main (Germany) and deletes them after 90 days. The purpose is the secure and error-free operation of the shop and the chat; the legal basis is our legitimate interest in this (Art. 6(1)(f) GDPR). Sentry processes the data as our processor (section 11).

Monitoring of shop operations

Automatic checks in the shop report malfunctions by e-mail to our mailbox for operational messages at semperconnect.cc, for example if a welcome e-mail or order confirmation was not sent or a scheduled task does not run. These e-mails are received by the e-mail routing service of Cloudflare, Inc. and passed on to our SEMPERconnect system (server of Hetzner Online GmbH in Nuremberg), where our staff evaluate them in one place. If SEMPERconnect cannot be reached, Cloudflare forwards them to a mailbox of our management. Most messages contain no personal data. Some checks, however, name the customer account identifier and the customer number or the order number if an e-mail from the shop to a customer was not sent, but not the e-mail address. The purpose is the secure and error-free operation of the shop; the legal basis is our legitimate interest in this (Art. 6(1)(f) GDPR). In SEMPERconnect, we delete the received e-mails after 90 days and resolved messages two years after they last occurred; until then they serve as evidence for our quality management.

Protection of customer accounts

To protect customer accounts, the shop stores login attempts with IP address and time and deletes them after 90 days. To prevent misuse of the VAT ID check (section 7), the shop limits the number of checks per IP address; for this purpose, it stores your IP address and the time of the check for one day. During your visit, the shop also keeps a list of currently active visitors with IP address, the page last visited and, if you are logged in, your name. The shop removes these entries a few minutes after your last page view. The legal basis is Art. 6(1)(f) GDPR (protection against misuse, operation of the shop).

We only use cookies and comparable entries in your browser's storage (such as localStorage or sessionStorage) if they are strictly necessary for the service you have requested or if you have given your consent (Section 165(3) of the Austrian Telecommunications Act 2021, TKG 2021).

Without consent, because strictly necessary

The legal basis for the related processing is Art. 6(1)(b) and (f) GDPR (provision of the shop).

Only with your consent

We only load the following services once you have agreed in the consent banner (Section 165(3) TKG 2021, Art. 6(1)(a) GDPR):

Google and Vimeo are themselves responsible for the further processing of the data they receive in this way. Details can be found in their privacy notices (policies.google.com/privacy, vimeo.com/privacy). Apart from the access statistics compiled by the host (AWStats, see section 4), we do not use any services for audience measurement such as Google Analytics or for advertising such as Google Ads.

“Don’t show again” in the notice for guests (sd_gp_aus): If you choose “Don’t show again” in the window “Prices and ordering need a customer account”, your browser stores this choice with your consent (Section 165(3) TKG 2021, Art. 6(1)(a) GDPR) in localStorage (entry sd_gp_aus with the time of your choice) so that the window does not appear on later visits. After 12 months the choice no longer applies; the page deletes the entry as soon as it reads it after that. You can withdraw it in the cookie settings with “Show notice again”.

Changing or withdrawing consent

You can change or withdraw your choice at any time via the “Cookie settings” link at the bottom of the page. You can also delete or block cookies and website data in your browser. Without the session cookie, however, login and ordering are not possible. If you have hidden side banners, you can bring them back in the cookie settings with “Show side banners again”. If you chose “Don’t show again” in the notice for guests or on the chat greeting, you can withdraw this choice there with “Show notice again” or “Show greeting again”.

Loading the chat window

Your browser loads the chat window and individual page content such as notice banners and side banners from our own system SEMPERconnect at semperconnect.cc. The chat window regularly checks there whether a staff member is available. In doing so, we process your IP address and technical information about your browser, even if you do not open the chat. The SEMPERconnect server is operated by Hetzner Online GmbH in Nuremberg (Germany). It sits behind the network and security service of Cloudflare, Inc. (USA); all requests to semperconnect.cc, including your chat messages, pass through it. The legal basis is Art. 6(1)(f) GDPR (legitimate interest in an available and secure chat and in up-to-date page content). The server logs containing IP addresses are deleted after 14 days. If program errors occur in the chat window itself, it reports them to our error monitoring service (Sentry, section 4) without your IP address and without your chat messages.

What we process in the chat

When you use the chat, we process your messages, the language and type of organisation you select, the address and title of the page on which you are chatting, the product currently displayed, a random visitor ID and, if you are logged in, your customer number and customer status. In a chat with a staff member, your name is added if you provide it. We do not store your IP address with the conversation. If a staff member takes over the conversation, they see the previous messages. If you start a new chat in the same browser within two hours of your last chat, we carry over the contact details you gave in the previous chat so that you do not have to enter them again.

If you provide contact details and a request in the chat, we pass these on, together with the conversation, as an enquiry to our customer service and send them by e-mail to the responsible team. We keep this e-mail in the same way as an enquiry sent by e-mail (section 13).

The legal basis is Art. 6(1)(b) GDPR where your enquiry concerns or prepares a contract, otherwise Art. 6(1)(f) GDPR (legitimate interest in fast advice, including outside our office hours).

AI replies by Anthropic

When no staff member is available, an AI system replies, not a human. AI replies may contain errors; our staff will give you binding information. For each AI reply, our server transmits the conversation so far (up to 30 messages), the type of organisation selected, the address and title of the page, the product displayed and a rough customer status to our processor Anthropic Ireland, Limited, 6th Floor, South Bank House, Barrow Street, Dublin 4, D04 TR29, Ireland. We do not transmit your IP address or your customer number. Whatever you write in your messages yourself, such as your name, e-mail address or telephone number, is transmitted unchanged. Please do not enter sensitive data in the chat.

Our staff can also have reply suggestions or a summary generated for a chat, including a conversation held only with a staff member; the content of the conversation is then also sent to Anthropic. Anthropic does not use the data to train its AI models and deletes it within 30 days. Anthropic only keeps it longer where this is necessary to enforce its usage policies or required by law. For transfers to the USA, see section 12.

Drafts for frequently asked questions

From short questions to the AI and its answers, SEMPERconnect creates drafts for frequently asked questions. A draft contains a few keywords from the question and the AI's answer, but no visitor ID and no link to your chat. A staff member checks every draft before the chat uses it; drafts that we do not adopt are deleted after 180 days. The legal basis is our legitimate interest in improving the chat's answers (Art. 6(1)(f) GDPR).

Storage

We automatically delete chat histories and the information recorded in the chat in SEMPERconnect as soon as they are older than 180 days, as well as the enquiries resulting from them; deletion runs once a week. At your request, we will delete a chat earlier.

When you open the chat, your browser stores the current conversation in localStorage (entry sd_chat_v3) so that it continues when you change pages, together with a random visitor ID (sd_visitor_id) that our server uses to assign your messages to your chat. If you have not chatted for two hours, the chat window deletes both entries on the next page view. If you confirm the privacy notice in the chat, the browser stores this confirmation (sd_privacy_ok) until you delete the website data, so that we do not show the notice again for every chat. During a conversation, the browser records in sessionStorage whether we have already asked whether you need further help (sd_inactivity_asked); it deletes this entry when you close the tab or window. These entries are necessary for the chat you have requested (Section 165(3) TKG 2021). At the start of a visit, the chat window greets you with a short note after a moment. If you choose “Don’t show again” there, your browser stores this choice with your consent in localStorage (entry sd_gruss_aus with the time of your choice) so that the greeting does not appear on later visits. After 12 months the choice no longer applies; the chat window deletes the entry as soon as it reads it after that. The legal basis is your consent (Section 165(3) TKG 2021, Art. 6(1)(a) GDPR). You can withdraw it in the cookie settings at the bottom of the page with “Show greeting again” or by deleting the website data.

Only registered business customers can place orders. For the customer account, we process the company name, salutation, first and last name of the contact person, address, e-mail address, telephone and fax number, VAT ID, customer number and customer group, as well as your password, which we only store as a hash value. The purpose is to manage your customer account and to process your orders (Art. 6(1)(b) GDPR).

If several people from one company share a company account, we also process which customer accounts belong to it, each person's role (such as main buyer or requester), any order limit, approval requests with cost centre, order number and delivery details, and a log of who initiated what in the company account. Approval requests are seen by the people in your company who are authorised to approve orders. Which accounts belong to the company account and which role and order limit a person has are set by our staff on the basis of information from your company; in that case, this data does not come from you yourself.

VAT ID check and proof of business

As we sell exclusively to businesses, we check during registration whether you are a business. For this purpose, we process your VAT ID and the proof of business registration that you upload (such as a trade licence or an extract from the commercial register). We check the VAT ID via the European Commission's VAT Information Exchange System (VIES) and store the result together with the request ID, the date and the name and address recorded there. The legal bases are Art. 6(1)(b) GDPR, our obligations under tax law (point (c)) and our legitimate interest in an offer made exclusively to businesses (point (f)).

We store the uploaded proof on our web server with no access from the internet; the responsible staff only receive an e-mail notification that it is ready for verification. We delete it 30 days after the verification has been completed. If no verification takes place, we delete it no later than 90 days after upload. If you delete your customer account before then, we delete the proof together with the account. The result of the verification (approved or rejected, date and reason) remains stored in your customer account.

Customer accounts set up by our staff

Our staff can also set up your customer account for you, for example after a conversation with our sales team. They enter the information your company has given us: company name, salutation, first and last name of the contact person, address, e-mail address, telephone number, VAT ID, customer group and the language for our e-mails. In that case, this data does not come from you yourself. We record who set up the account and when. We check the VAT ID in the same way as at registration. The shop never sends a password by e-mail. Instead, you receive an e-mail with a link through which you set your password yourself; the link is valid for seven days and can only be used once. Alternatively, our staff member gives you a start password separately from this e-mail. So that nobody can guess the link by trial and error, the shop limits the number of attempts on the page for setting the password; for this purpose, it stores for no more than 20 minutes a checksum of your IP address formed with a secret key, not the IP address itself. The legal basis is Art. 6(1)(b) GDPR and, for limiting the attempts, Art. 6(1)(f) GDPR (protection against misuse).

Our sales team can also submit the application for a customer account in our SEMPERconnect system (server of Hetzner Online GmbH in Nuremberg, reached via Cloudflare, see section 6). SEMPERconnect stores the information in the application in encrypted form and deletes it as soon as the shop has decided on the application or the application is withdrawn. The shop retrieves the application itself and checks it, for example for an existing account with the same e-mail address; our staff decide whether the account is set up. The shop keeps the information in the application until 30 days after this decision. After that, only the application identifier, who submitted it and when, and the decision remain.

Help if your registration cannot be completed

If the shop cannot complete your registration, for example because a detail is missing or cannot be verified, it offers to have your details checked manually. For this purpose, it keeps the details from the form in your session, without your password and without your proof of business registration. If you choose the manual check and send the details, we store in the shop your salutation, first and last name, company name, VAT ID, e-mail address, telephone number, address, country and language, together with your optional message, the names of the fields that were rejected and the time. We do not pass on your password or your proof of business registration. Our SEMPERconnect system (server of Hetzner Online GmbH in Nuremberg, reached via Cloudflare, see section 6) retrieves the details from the shop. There our sales team processes them: it contacts you by e-mail and, at your request, sets up the customer account for you (see above). An operational message informs us of a new request; it names the request identifier but none of your details. The shop deletes the details 30 days after SEMPERconnect has retrieved them, and no later than 90 days after your request; how long SEMPERconnect keeps them is set out in section 13. To prevent misuse, the shop limits the number of such requests; for this purpose, it uses the same checksum of your IP address, formed with a secret key, as on the page for setting the password, not the IP address itself. The legal basis is Art. 6(1)(b) GDPR (your request before a contract is concluded) and, for limiting the requests, Art. 6(1)(f) GDPR (protection against misuse).

Record of your confirmations

If you confirm during registration, when placing an order or in a form that you accept our terms and conditions or have taken note of legal texts such as this policy, we store your name, e-mail address, the wording of the confirmation and the time, without your IP address. This allows us to prove which version you confirmed (Art. 6(1)(f) GDPR).

For quotes, orders and deliveries, we process the company name, contact person, billing and delivery address, contact details, goods ordered, prices, payment method and tracking numbers (Art. 6(1)(b) GDPR). We keep invoices and accounting records for seven years in accordance with Section 132 of the Austrian Federal Fiscal Code (BAO) and Section 212 of the Austrian Commercial Code (UGB) (Art. 6(1)(c) GDPR).

Payment via Gambio Hub

The shop's payment methods, including payment in advance and purchase on account, are processed via the Gambio Hub payment interface of Gambio GmbH, Parallelweg 30, 28219 Bremen, Germany. For this purpose, the shop transmits to Gambio the company name, name, salutation, billing and delivery address, e-mail address, telephone and fax number, customer number, shopping cart, language and currency, as well as your IP address and your browser identifier. If you choose an online payment method such as instant bank transfer (Sofortüberweisung), Gambio Hub forwards the data required for payment to the respective payment service provider, which processes it under its own responsibility. The legal basis is Art. 6(1)(b) GDPR and, for IP address and browser identifier, Art. 6(1)(f) GDPR (secure processing of the payment).

Purchase on account and leasing

Our staff decide on purchase on account, payment limits and leasing requests. If you submit a leasing request, we pass your company, contact and order data on to the leasing partner who draws up the leasing contract (Art. 6(1)(b) GDPR).

Delivery

For delivery, we pass the company name, name of the contact person and delivery address on to the parcel service or freight carrier we have commissioned (Art. 6(1)(b) GDPR).

Late payment

If a payment that is due is not made, we may hand over the claim together with the data required for this to a debt collection agency or a law firm (Art. 6(1)(f) GDPR: enforcement of our claims).

We process enquiries sent by e-mail, by telephone or via the contact form in order to deal with your request (Art. 6(1)(b) GDPR for enquiries about quotes and contracts, otherwise point (f)). The contact form sends your details by e-mail to our mailbox.

The shop transmits repair requests submitted in the “My repairs” area to our SEMPERconnect system (server of Hetzner Online GmbH in Nuremberg, reached via Cloudflare, see section 6): company name, name, telephone number and contact details, device, serial number, fault description and accessories (Art. 6(1)(b) GDPR).

Newsletter

We only send the SEMPERDEAL newsletter with your consent (Art. 6(1)(a) GDPR, Section 174(3) TKG 2021). After subscribing, you will receive an e-mail with a confirmation link; the subscription only becomes effective once you have confirmed it (double opt-in). If you do not confirm the subscription, we delete your details after 30 days. We store your e-mail address, name, status and the date of subscription. We do not store your IP address in this process. You can unsubscribe at any time via the unsubscribe link in the newsletter or by e-mail to support@semperdeal.com. We keep your data for the newsletter until you unsubscribe.

Advertising

We only advertise by e-mail, SMS or telephone with your consent. We may inform customers by post about our own products and services; the legal basis is our legitimate interest in direct marketing (Art. 6(1)(f) GDPR). You may object to this at any time (see section 2).

Within CfT Group GmbH, only those staff members who need your data for their tasks receive it. We also use the following processors, which process data only on our instructions:

The following recipients process data under their own responsibility:

We process most data in Austria and Germany. Data is only transferred to countries outside the EU and the EEA in the following cases:

For the customer account and for orders, the details marked as mandatory and proof that you are a business are required; we also need the VAT ID for tax-exempt intra-Community supplies. Without these details, we cannot set up a customer account or conclude a contract. Use of the chat, the newsletter and the contact form is voluntary.

No decision based solely on automated processing, including profiling, which produces legal effects concerning you or similarly significantly affects you (Art. 22 GDPR) takes place. Our staff decide on approval as a business customer, on purchase on account and on leasing requests.

For persons in Switzerland, the Swiss Federal Act on Data Protection (FADP) also applies. We process your data in Austria and Germany. According to Annex 1 of the Swiss Data Protection Ordinance (DPO), both countries ensure adequate data protection, as does Ireland. Data may be disclosed to the USA to Cloudflare, Inc., Google LLC and Vimeo.com, Inc., which are certified under the Swiss-U.S. Data Privacy Framework; for companies certified in this way, Annex 1 of the DPO lists the USA as a country with adequate protection. For Anthropic and its sub-processors, the standard contractual clauses with the Swiss addendum apply.

You may contact the Federal Data Protection and Information Commissioner (FDPIC), Feldeggweg 1, 3003 Bern, Switzerland.