Our data policy is based on the terminology used by the European directive and regulatory body for the enactment of the General Data Protection Regulation (GDPR). Our data policy is meant to be easily readable and understandable for the general public, as well as for our customers and business partners. In order to assure that this is the case, we would like to explain the utilized terminology in advance. Amongst others, we use the following terms in this data policy:

a) Personal Data

Personal data includes all information which makes reference to an identified or an identifiable natural person (hereinafter referred to as “data subject”). A natural person is deemed identifiable if he or she can be identified, either directly or indirectly, in particular by means of assignment to an identifier such as a name, an ID number, location data, an online username or one or more special characteristics which represent the expression of the physical, physiological, genetic, psychic, economic, cultural or social identity of such natural person.

b) Data Subject

A data subject is any identified or identifiable natural person whose personal data is processed by the controller responsible for processing.

c) Processing

Processing is any operation or sequence of operations conducted with or without the help of automated procedures involving personal data such as collection, entry, organization, sorting, storage, adaptation or editing, read-out, retrieval, usage, disclosure by means of transmission, distribution or any other form of making available, reconciliation or linking, restriction, deletion or destruction.

d) Restriction of Processing

Restriction of processing is the identification of stored personal data for the purpose of restricting its future processing.

e) Profiling

Profiling is any type of automated processing of personal data which involves the use of such data in order to evaluate certain personal aspects of a natural person, in particular in order to analyze or predict aspects with regard to work performance, financial status, health, personal preferences, interests, reliability, behavior, whereabouts or changes in the whereabouts of such natural person.

f) Pseudonymization

Pseudonymization is the processing of personal data in such a way that the personal data can no longer be traced back to a specific data subject without the help of additional information, insofar as this additional information is stored separately and subject to technical and organizational measures which ensure that the personal data cannot be traced back to an identified or identifiable natural person.

g) Controller or Controller Responsible for Processing

The controller or the controller responsible for processing is the natural person or legal entity, public authority, institution or other body which, either alone or together with others, makes decisions regarding the purposes and means of processing personal data. If the purposes and means of this processing are specified by EU law or the laws of the member countries, the controller or the specific criteria for his appointment may be subject to EU law or the laws of the member countries.

h) Processor

A processor is a natural person or legal entity, public authority, institution or other body which processes personal data on behalf of the controller.

i) Receiver

A receiver is a natural person or legal entity, public authority, institution or other body to whom data is disclosed, regardless of whether or not a third party is involved. However, public authorities which receive conceivably personal data within the framework of a specific investigation mandate in accordance with EU law or the laws of the member countries are not deemed receivers.

j) 3rd Party

A 3rd party is a natural person, legal entity, public authority, institution or other body to the exclusion of the data subject, the controller, the processor and persons who, under the direct responsibility of the controller or the processor, are authorized to process personal data.

k) Consent

Consent is any unmistakable declaration of intent provided voluntarily by the data subject in an informed manner for the specific case in the form of a statement or other unequivocally confirmed act with which the data subject indicates that he or she agrees to processing of his or her own personal data.