Privacy policy

We have written this privacy policy to explain to you, in accordance with the General Data Protection Regulation (EU) 2016/679 and applicable national laws, which personal data (data for short) we as the controller – and the processors commissioned by us (e.g. providers) – process, will process in the future and what lawful options you have.

In short: we inform you comprehensively about the data we process about you. If you still have questions, please contact the responsible office named below.

This privacy policy applies to all personal data processed by us in the company and to all personal data processed by companies commissioned by us (processors). By personal data we mean information within the meaning of Art. 4 No. 1 GDPR, such as a person's name, e-mail address and postal address. The scope covers:

• all online presences (websites) that we operate
• social media presences and e-mail communication

In short: the privacy policy applies to all areas in which personal data is processed in a structured way via the channels mentioned. Should we enter into legal relationships with you outside these channels, we will inform you separately if necessary.

We refer to Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 (General Data Protection Regulation, GDPR), available at eur-lex.europa.eu/legal-content/EN/ALL/?uri=celex%3A32016R0679. We only process your data if at least one of the following conditions applies:

• Consent (Art. 6 (1) (a) GDPR): you have given us your consent to process data for a specific purpose – for example, storing the data you enter in a contact or complaint form.
• Contract (Art. 6 (1) (b) GDPR): we process your data in order to fulfil a contract or pre-contractual obligations with you – for example an enquiry, order, return or complaint.
• Legal obligation (Art. 6 (1) (c) GDPR): if we are subject to a legal obligation, we process your data. For example, we are legally obliged to keep invoices for accounting purposes.
• Legitimate interests (Art. 6 (1) (f) GDPR): in the case of legitimate interests that do not restrict your fundamental rights, we reserve the right to process personal data – for example to operate our website securely and efficiently.

In addition to the EU regulation, the Austrian Data Protection Act (DSG) applies.

If you have any questions about data protection or the processing of personal data, you will find the contact details of the responsible office below:

EFE Autoteile GmbH

Ramazan Kayhan

Kaplanstraße 21, 3430 Tulln an der Donau, Austria

E-mail: office@efe-autoteile.at

Phone: +43 2272 82239

As a general criterion, we only store personal data for as long as is absolutely necessary to provide our services and products. This means that we delete personal data as soon as the reason for processing no longer exists. In some cases we are legally obliged to store certain data even after the original purpose has ceased to apply, for example for accounting purposes (7 years under § 132 Austrian Federal Fiscal Code).

If you wish your data to be deleted or revoke your consent to data processing, the data will be deleted as quickly as possible, provided there is no obligation to store it.

In accordance with Articles 13 and 14 GDPR, we inform you of the following rights to which you are entitled so that data is processed fairly and transparently:

• Right of access (Art. 15 GDPR): you have the right to know whether we process data about you, to receive a copy of the data and to learn the purpose, the categories, the recipients, the storage period and the origin of the data.
• Right to rectification (Art. 16 GDPR): we must correct data if you find errors.
• Right to erasure (Art. 17 GDPR, "right to be forgotten"): you may request the deletion of your data.
• Right to restriction of processing (Art. 18 GDPR): we may then only store the data but not use it further.
• Right to data portability (Art. 20 GDPR): on request we will provide your data in a common format.
• Right to object (Art. 21 GDPR): if processing is based on legitimate interest you can object; you can object to direct marketing and profiling at any time.
• Right not to be subject to a decision based solely on automated processing (Art. 22 GDPR).
• Right to lodge a complaint (Art. 77 GDPR): you can complain to the data protection authority at any time if you believe that the processing of data violates the GDPR.

In short: you have rights – do not hesitate to contact the responsible office listed above!

If you believe that the processing of your data violates data protection law or that your data protection rights have been infringed in any other way, you can lodge a complaint with the supervisory authority. The Austrian Data Protection Authority is responsible for our company:

Datenschutzbehörde, Barichgasse 40-42, 1030 Vienna, Austria

Phone: +43 1 52 152-0

E-mail: dsb@dsb.gv.at

Website: www.dsb.gv.at/

To protect personal data, we have implemented both technical and organisational measures. Wherever possible, we encrypt or pseudonymise personal data, making it as difficult as possible for third parties to infer personal information from our data.

TLS encryption with HTTPS: we use HTTPS to transmit data securely on the internet. The entire transmission of all data from your browser to our web server is secured – nobody can "listen in". This fulfils data protection by design (Art. 25 (1) GDPR). You can recognise the secured connection by the padlock symbol in your browser's address bar and the https scheme as part of our web address.

Data subjects: everyone who communicates with us by phone, e-mail, WhatsApp or online form. Data processed: e.g. phone number, name, e-mail address, entered form data. Purpose: handling communication with customers, business partners etc. Storage period: duration of the business case and statutory requirements. Legal bases: Art. 6 (1) (a) (consent), (b) (contract) and (f) (legitimate interests) GDPR.

Phone: when you call us, call data is stored pseudonymously on the respective device and at the telecommunications provider used. In addition, data such as name and phone number may subsequently be sent by e-mail and stored to answer the enquiry. The data is deleted as soon as the business case has ended and legal requirements permit.

E-mail: when you communicate with us by e-mail, data may be stored on the respective device and on the e-mail server. The data is deleted as soon as the business case has ended and legal requirements permit.

Online forms (contact, complaint, return): when you communicate with us via an online form, the data entered – including any files you upload with complaint and return forms – is transmitted to our server in encrypted form, compiled into a PDF document there and forwarded by e-mail to the branch or warehouse you selected, with a copy to your e-mail address. Form data is not stored permanently on the web server. The data is deleted as soon as the business case has ended and legal requirements permit.

Like most companies, we do not work alone but also use the services of other companies. By involving various service providers, we may pass on personal data for processing. These partners then act as processors with whom we conclude a contract, the so-called data processing agreement pursuant to Art. 28 GDPR. Your personal data is processed exclusively on our instructions.

Processors can be service providers such as hosting or cloud providers, e-mail delivery services or large companies such as Google.

Our website does not use tracking, analytics or advertising cookies and does not set third-party cookies for advertising purposes. For this reason we do not display a cookie banner.

Technically necessary storage: your browser may store purely technical settings (e.g. the selected language German/English via the page address). This processing is based on our legitimate interest in a functioning website (Art. 6 (1) (f) GDPR).

Embedded services (see Google Maps) may set their own cookies when the respective content is loaded; we inform you about this in the respective section.

You can delete, deactivate or partially allow cookies in your browser settings at any time. The procedure varies depending on the browser – search for "delete cookies" together with the name of your browser.

Data subjects: website visitors. Purpose: professional hosting of the website and securing its operation. Data processed: IP address, time of visit, browser used and other data. Storage period: depends on the provider, usually a few days to weeks. Legal basis: Art. 6 (1) (f) GDPR (legitimate interests).

When you visit websites today, certain information – including personal data – is automatically created and stored, as is the case on this website. When your browser connects to our web server, the web server usually automatically stores data such as the address accessed (URL), browser and browser version, the operating system used, the previously visited page (referrer URL), the IP address of the accessing device and the date and time in so-called web server log files. This data is automatically deleted after a short time. We do not pass this data on, but cannot rule out that it may be viewed by authorities in the event of unlawful behaviour.

Vercel: this website is hosted by Vercel Inc., 440 N Barranca Ave #4133, Covina, CA 91723, USA and delivered via its global content delivery network. Vercel processes technical access data (in particular the IP address) to deliver the site and protect against attacks. Vercel is certified under the EU-US Data Privacy Framework; in addition, we use the standard contractual clauses approved by the EU Commission (Art. 46 (2) and (3) GDPR). You can find out more about the data processed through the use of Vercel in the privacy policy at vercel.com/legal/privacy-policy. We have concluded a data processing agreement (Data Processing Addendum) with Vercel.

To send the enquiries submitted via our online forms and the confirmation copies to you, we use the e-mail delivery service Resend, Inc., 2261 Market Street #5039, San Francisco, CA 94114, USA. The form contents, your e-mail address and the generated PDF are transmitted to Resend and processed exclusively for the purpose of delivery. Transfers to the USA are based on the EU Commission's standard contractual clauses; a data processing agreement is in place with Resend. Further information: resend.com/legal/privacy-policy.

Data subjects: website visitors. Purpose: displaying our locations on a map and optimising our service. Data processed: IP address and, where applicable, location data. Storage period: depends on the data stored. Legal bases: Art. 6 (1) (a) GDPR (consent), Art. 6 (1) (f) GDPR (legitimate interests).

We use Google Maps from Google Inc. on our website. For the European area, Google Ireland Limited (Gordon House, Barrow Street, Dublin 4, Ireland) is responsible for all Google services. With Google Maps we show you the location of our branches on the contact and location pages and enable route planning. When the embedded map is loaded, a connection to Google servers is established; your IP address and, where applicable, location data are transmitted to Google and Google may set cookies in your browser. Google also processes data in the USA; Google is certified under the EU-US Data Privacy Framework and uses standard contractual clauses.

If you do not want Google to collect, use or process data about you, you can block embedded content in your browser settings or simply not load the map view. You can read which data Google collects and what it is used for at policies.google.com/privacy.

On our website we offer the option of contacting us directly via a WhatsApp link. The service provider is WhatsApp Ireland Limited, 4 Grand Canal Square, Grand Canal Harbour, Dublin 2, Ireland, a subsidiary of Meta Platforms Inc. (USA).

Simply visiting our website does not transfer any data to WhatsApp. Only when you click on a WhatsApp link does the WhatsApp application or WhatsApp Web open and WhatsApp's privacy policy apply. When communicating via WhatsApp, your phone number and message contents are processed; WhatsApp also processes metadata in third countries on the basis of standard contractual clauses. We use WhatsApp exclusively to answer your enquiries (Art. 6 (1) (b) and (f) GDPR). Further information: www.whatsapp.com/legal/privacy-policy-eea.

On our website we link to our profiles on Facebook and Instagram (Meta Platforms Ireland Limited, 4 Grand Canal Square, Dublin 2, Ireland). These are simple links, not embedded plugins – no data is transferred to Meta when you visit our website. Only when you follow a link does the privacy policy of the respective provider apply: www.facebook.com/privacy/policy.

Our dealer shop (online catalogue and ordering system for trade customers) is operated on a separate platform that can be reached via links from this website. The terms of use and privacy policy stored in the dealer shop apply to data processing there.

• Processor: a natural or legal person, public authority, agency or other body which processes personal data on behalf of the controller (Art. 4 No. 8 GDPR).
• Consent: any freely given, specific, informed and unambiguous indication of the data subject's wishes (Art. 4 No. 11 GDPR).
• Personal data: any information relating to an identified or identifiable natural person (Art. 4 No. 1 GDPR).
• Controller: the body which alone or jointly with others determines the purposes and means of the processing of personal data (Art. 4 No. 7 GDPR).
• Processing: any operation performed on personal data, whether or not by automated means, such as collection, recording, storage, use, transmission or erasure (Art. 4 No. 2 GDPR).

Congratulations, you made it to the end. We endeavour to keep this privacy policy up to date and will adapt it as soon as anything changes on our website or in the legal situation. If you have any questions about data protection, you can reach us at any time at office@efe-autoteile.at.