TERMS AND CONDITIONS

Editor
BrandSashka e.U.
Tel: +43 699 171 989 77
Penningbergstrasse 81, A-6361 Hopfgarten im Brixental
[email protected]

Management
Sashka Hanna-Rappl

Disclaimer

In using this website you are deemed to have read and agreed to the following terms and conditions:

The following terminology applies to these Terms and Conditions, Privacy Statement and any disclaimer Notice and any or all Agreements: “Client”, “You” and “Your” refers to you, the person accessing this website and accepting the Company’s terms and conditions. “The Company”, “Ourselves”, “We” and “Us”, refers to our Company. “Party”, “Parties”, or “Us”, refers to both the Client and ourselves, or either the Client or ourselves. All terms refer to the offer, acceptance and consideration of payment necessary to undertake the process of our assistance to the Client in the most appropriate manner, whether by formal meetings of a fixed duration, or any other means, for the express purpose of meeting the Client’s needs in respect of provision of the Company’s stated services/products, in accordance with and subject to, prevailing Austrian Law. Any use of the above terminology or other words in the singular, plural, capitalisation and/or he/she or they, are taken as interchangeable and therefore as referring to same.

1. Content
The author reserves the right not to be responsible for the topicality, correctness, completeness or quality of the information provided. Liability claims regarding damage caused by the use of any information provided, including any kind of information which is incomplete or incorrect, will, therefore, be rejected. All offers are not-binding and without obligation. Parts of the pages or the complete publication including all offers and information might be extended, changed or partly or completely deleted by the author without separate announcement.

2. Referrals and links
The author is not responsible for any contents linked or referred to from his pages – unless he has full knowledge of illegal contents and would be able to prevent the visitors of his site from viewing those pages. If any damage occurs by the use of information presented there, only the author of the respective pages might be liable, not the one who has linked to these pages. Furthermore, the author is not liable for any postings or messages published by users of discussion boards, guestbooks or mailing lists provided on his page.

Links to this website
You may not create a link to any page of this website without our prior written consent. If you do create a link to a page of this website you do so at your own risk and the exclusions and limitations set out above will apply to your use of this website by linking to it.

Links from this website
We do not monitor or review the content of other party’s websites which are linked to from this website. Opinions expressed or material appearing on such websites are not necessarily shared or endorsed by us and should not be regarded as the publisher of such opinions or material. Please be aware that we are not responsible for the privacy practices, or content, of these sites. We encourage our users to be aware when they leave our site & to read the privacy statements of these sites. You should evaluate the security and trustworthiness of any other site connected to this site or accessed through this site yourself, before disclosing any personal information to them. This Company will not accept any responsibility for any loss or damage in whatever manner, howsoever caused, resulting from your disclosure to third parties of personal information.

3. Copyright
The author intended not to use any copyrighted material for the publication or, if not possible, to indicate the copyright of the respective object. The copyright for any material created by the author is reserved. Any duplication or use of objects such as images, diagrams, sounds or texts in other electronic or printed publications is not permitted without the author’s agreement.

Copyright and Trademark
Copyright and other relevant intellectual property rights exist on all text relating to the Company’s services and the full content of this website. This Company’s logo is a registered trademark of this Company in Austria. The brand names and specific services of this Company featured on this website are trademarked – Brand Your Soul® and Soul Brand Marketing®.

4. Privacy policy
If the opportunity for the input of personal or business data (email addresses, name, addresses) is given, the input of these data takes place voluntarily. The use and payment of all offered services are permitted – if and so far technically possible and reasonable – without specification of any personal data or under specification of anonymized data or an alias. The use of published postal addresses, telephone or fax numbers and email addresses for marketing purposes is prohibited, offenders sending unwanted spam messages will be punished.

Privacy Statement
We are committed to protecting your privacy. Authorised employees within the company on a need to know basis only use any information collected from individual Clients. We constantly review our systems and data to ensure the best possible service to our Clients. There are specific offences for unauthorised actions against computer systems and data. We will investigate any such actions with a view to prosecuting and/or taking civil proceedings to recover damages against those responsible.

5. Legal validity of this disclaimer
This disclaimer is to be regarded as part of the internet publication which you were referred from. If sections or individual terms of this statement are not legal or correct, the content or validity of the other parts remains uninfluenced by this fact.

Exclusions and Limitations
The information on this website is provided on an “as is” basis. To the fullest extent permitted by law, this Company:

  • excludes all representations and warranties relating to this website and its contents or which is or may be provided by any affiliates or any other third party, including in relation to any inaccuracies or omissions in this website and/or the Company’s literature; and
  • excludes all liability for damages arising out of or in connection with your use of this website. This includes, without limitation, direct loss, loss of business or profits (whether or not the loss of such profits was foreseeable, arose in the normal course of things or you have advised this Company of the possibility of such potential loss), damage caused to your computer, computer software, systems and programs and the data thereon or any other direct or indirect, consequential and incidental damages.

This Company does not, however, exclude liability for death or personal injury caused by its negligence. The above exclusions and limitations apply only to the extent permitted by law. None of your statutory rights as a consumer are affected.

6. Cookies

This website contains “cookies”, which are used to optimise the efficiency of the Site for the user. A cookie is a small text file that contains information and is stored on a user’s computer when the user visits a website. There are two types of cookies. One of these, known as a “persistent cookie”, is permanent and is stored on the user’s computer even after he or she has left the website in question and closed the web browser. The other is temporary, a so-called ”session cookie”, and is stored on the user’s computer during the Internet session. When the web browser is closed, the session cookie disappears from the user’s computer.

The Site uses both persistent and session cookies. These are used to:
- Count the number of visitors and analyse traffic
- Access and log into functions for news subscriptions and job applications
- Enable the Site to remember and display the language chosen by the user

If you as a user do not accept the use of cookies, you can change the settings in your web browser (e.g. Internet Explorer, Firefox, Safari or Google Chrome) to disable storage of cookies and remove undesired cookies.

7. Miscellaneous

BrandSashka may provide you with notices, including those regarding changes to these Terms, by email, regular mail or postings on the BrandSashka Service. Notice will be deemed given unless BrandSashka is notified that the email address is invalid.

8. Communication
We have several different e-mail addresses for different queries. These, & other contact information, can be found on our Contact Us link on our website or via Company literature or via the Company’s stated telephone or mobile telephone numbers.

This company is registered in Austria, FN320024z, Penningbergstrasse 81, 6361, Hopfgarten Austria.

9. Availability
You are solely responsible for evaluating the fitness for a particular purpose of any downloads, programs and text available through this site. Redistribution or republication of any part of this site or its content is prohibited, including such by framing or other similar or any other means, without the express written consent of the Company. The Company does not warrant that the service from this site will be uninterrupted, timely or error free, although it is provided to the best ability. By using this service you thereby indemnify this Company, its employees, agents and affiliates against any loss or damage, in whatever manner, howsoever caused.

10. Log Files
We use IP addresses to analyse trends, administer the site, track user’s movement, and gather broad demographic information for aggregate use. IP addresses are not linked to personally identifiable information. Additionally, for systems administration, detecting usage patterns and troubleshooting purposes, our web servers automatically log standard access information including browser type, access times/open mail, URL requested, and referral URL. This information is not shared with third parties and is used only within this Company on a need-to-know basis. Any individually identifiable information related to this data will never be used in any way different to that stated above without your explicit permission.

11. Force Majeure

Neither party shall be liable to the other for any failure to perform any obligation under any Agreement which is due to an event beyond the control of such party including but not limited to any Act of God, terrorism, war, Political insurgence, insurrection, riot, civil unrest, act of civil or military authority, uprising, earthquake, flood or any other natural or man-made eventuality outside of our control, which causes the termination of an agreement or contract entered into, nor which could have been reasonably foreseen. Any Party affected by such event shall forthwith inform the other Party of the same and shall use all reasonable endeavours to comply with the terms and conditions of any Agreement contained herein.

12. Waiver

Failure of either Party to insist upon strict performance of any provision of this or any Agreement or the failure of either Party to exercise any right or remedy to which it, he or they are entitled hereunder shall not constitute a waiver thereof and shall not cause a diminution of the obligations under this or any Agreement. No waiver of any of the provisions of this or any Agreement shall be effective unless it is expressly stated to be such and signed by both Parties.

General

The laws of Austria govern these terms and conditions. By accessing this website [and using our services/buying our products] you consent to these terms and conditions and to the exclusive jurisdiction of the Austrian courts in all disputes arising out of such access. If any of these terms are deemed invalid or unenforceable for any reason (including, but not limited to the exclusions and limitations set out above), then the invalid or unenforceable provision will be severed from these terms and the remaining terms will continue to apply. Failure of the Company to enforce any of the provisions set out in these Terms and Conditions and any Agreement, or failure to exercise any option to terminate, shall not be construed as waiver of such provisions and shall not affect the validity of these Terms and Conditions or of any Agreement or any part thereof, or the right thereafter to enforce each and every provision. These Terms and Conditions shall not be amended, modified, varied or supplemented except in writing and signed by duly authorised representatives of the Company.

Notification of Changes

The Company reserves the right to change these conditions from time to time as it sees fit and your continued use of the site will signify your acceptance of any adjustment to these terms. If there are any changes to our privacy policy, we will announce that these changes have been made on our home page and on other key pages on our site. If there are any changes in how we use our site Clients’ Personally Identifiable Information, notification by e-mail or postal mail will be made to those affected by this change. Any changes to our privacy policy will be posted on our website 30 days prior to these changes taking place. You are therefore advised to re-read this statement on a regular basis.

PRIVACY POLICY

PRIVACY POLICY

This privacy notice provides you with details of how we collect and process your personal data through your use of our site www.brandsashka.com.

By providing us with your data, you warrant to us that you are over 13 years of age.

BrandSashka e.U. is the data controller and we are responsible for your personal data (referred to as “we”, “us” or “our” in this privacy notice).

  1. Introduction

This Policy sets out the obligations of BrandSashka e.U. a company registered in Austria under number FN320024z, whose registered office is at Penningbergstrasse 81, 6361, Hopfgarten, Austria (“the Company”) regarding data protection and the rights of clients and business contacts (“data subjects”) in respect of their personal data under EU Regulation 2016/679 General Data Protection Regulation (“GDPR”).

The GDPR defines “personal data” as any information relating to an identified or identifiable natural person (a “data subject”); an identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier, or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural, or social identity of that natural person.

This Policy sets the Company’s obligations regarding the collection, processing, transfer, storage, and disposal of personal data. The procedures and principles set out herein must be followed at all times by the Company, its employees, agents, contractors, or other parties working on behalf of the Company.

The Company is committed not only to the letter of the law, but also to the spirit of the law and places high importance on the correct, lawful, and fair handling of all personal data, respecting the legal rights, privacy, and trust of all individuals with whom it deals.

WHAT ARE WE DOING WITH YOUR DATA? AND YOUR RIGHTS.

  1. The Data Protection Principles

This Policy aims to ensure compliance with the GDPR. The GDPR sets out the following principles with which any party handling personal data must comply. All personal data must be:

2.1          Processed lawfully, fairly, and in a transparent manner in relation to the data subject.

2.2          Collected for specified, explicit, and legitimate purposes and not further processed in a manner that is incompatible with those purposes. Further processing for archiving purposes in the public interest, scientific or historical research purposes or statistical purposes shall not be considered to be incompatible with the initial purposes.

2.3          Adequate, relevant, and limited to what is necessary in relation to the purposes for which it is processed.

2.4          Accurate and, where necessary, kept up to date. Every reasonable step must be taken to ensure that personal data that is inaccurate, having regard to the purposes for which it is processed, is erased, or rectified without delay.

2.5          Kept in a form which permits identification of data subjects for no longer than is necessary for the purposes for which the personal data is processed. Personal data may be stored for longer periods insofar as the personal data will be processed solely for archiving purposes in the public interest, scientific or historical research purposes, or statistical purposes, subject to implementation of the appropriate technical and organisational measures required by the GDPR in order to safeguard the rights and freedoms of the data subject.

2.6          Processed in a manner that ensures appropriate security of the personal data, including protection against unauthorised or unlawful processing and against accidental loss, destruction, or damage, using appropriate technical or organisational measures.

  1. The Rights of Data Subjects

The GDPR sets out the following rights applicable to data subjects (please refer to the parts of this policy indicated for further details):

3.1          The right to be informed (Part 12).

3.2          The right of access (Part 13);

3.3          The right to rectification (Part 14);

3.4          The right to erasure (also known as the ‘right to be forgotten’) (Part 15);

3.5          The right to restrict processing (Part 16);

3.6          The right to data portability (Part 17);

3.7          The right to object (Part 18); and

3.8          Rights with respect to automated decision-making (Part 19).

  1. Lawful, Fair, and Transparent Data Processing

4.1          The GDPR seeks to ensure that personal data is processed lawfully, fairly, and transparently, without adversely affecting the rights of the data subject. The GDPR states that processing of personal data shall be lawful if at least one of the following applies:

4.1.1            The data subject has given consent to the processing of their personal data for one or more specific purposes;

4.1.2            The processing is necessary for the performance of a contract to which the data subject is a party, or in order to take steps at the request of the data subject prior to entering into a contract with them;

4.1.3            The processing is necessary for compliance with a legal obligation to which the data controller is subject;

4.1.4            The processing is necessary to protect the vital interests of the data subject or of another natural person;

4.1.5            The processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the data controller; or

4.1.6            The processing is necessary for the purposes of the legitimate interests pursued by the data controller or by a third party, except where such interests are overridden by the fundamental rights and freedoms of the data subject which require protection of personal data, in particular where the data subject is a child.

  1. Specified, Explicit, and Legitimate Purposes

5.1          The Company collects and processes the personal data set out in Part 20 of this Policy. This includes:

5.1.1     Personal data collected directly from data subjects.

5.2          The Company only collects, processes, and holds personal data for the specific purposes set out in Part 20 of this Policy (or for other purposes expressly permitted by the GDPR).

5.3          Data subjects are kept informed at all times of the purpose or purposes for which the Company uses their personal data. Please refer to Part 12 for more information on keeping data subjects informed.

  1. Adequate, Relevant, and Limited Data Processing

The Company will only collect and process personal data for and to the extent necessary for the specific purpose or purposes of which data subjects have been informed (or will be informed) as under Part 5, above, and as set out in Part 20, below.

  1. The accuracy of Data and Keeping Data Up-to-Date

7.1          The Company shall ensure that all personal data collected, processed, and held by it is kept accurate and up-to-date. This includes, but is not limited to, the rectification of personal data at the request of a data subject, as set out in Part 14, below.

7.2          The accuracy of personal data shall be checked when it is collected and at regular intervals thereafter. If any personal data is found to be inaccurate or out-of-date, all reasonable steps will be taken without delay to amend or erase that data, as appropriate.

  1. Data Retention

8.1          The Company shall not keep personal data for any longer than is necessary in light of the purpose or purposes for which that personal data was originally collected, held, and processed.

8.2          When personal data is no longer required, all reasonable steps will be taken to erase or otherwise dispose of it without delay.

8.3          For full details of the Company’s approach to data retention, including retention periods for specific personal data types held by the Company, please refer to our Data Retention Policy.

  1. Secure Processing

The Company shall ensure that all personal data collected, held, and processed is kept secure and protected against unauthorised or unlawful processing and against accidental loss, destruction, or damage. Further details of the technical and organisational measures which shall be taken are provided in Parts 21 to 26 of this Policy.

  1. Accountability and Record-Keeping

10.1       The Company shall keep written internal records of all personal data collection, holding, and processing, which shall incorporate the following information:

10.1.1         The name and details of the Company, and any applicable third-party data processors;

10.1.2         The purposes for which the Company collects, holds, and processes personal data;

10.1.3         Details of the categories of personal data collected, held and processed by the Company, and the categories of data subject to which that personal data relates;

10.1.4         Details of any transfers of personal data to non-EEA countries including all mechanisms and security safeguards;

10.1.5         Details of how long personal data will be retained by the Company (please refer to the Company’s Data Retention Policy); and

10.1.6         Detailed descriptions of all technical and organisational measures taken by the Company to ensure the security of personal data.

  1. Data Protection Impact Assessments

11.1       The Company shall carry out Data Protection Impact Assessments for any and all new projects and/or new uses of personal data.

11.2       Data Protection Impact Assessments shall be overseen by the Data Protection Officer, or appropriate person, and shall address the following:

11.2.1         The type(s) of personal data that will be collected, held, and processed;

11.2.2         The purpose(s) for which personal data is to be used;

11.2.3         The Company’s objectives;

11.2.4         How personal data is to be used;

11.2.5         The parties (internal and/or external) who are to be consulted;

11.2.6         The necessity and proportionality of the data processing with respect to the purpose(s) for which it is being processed;

11.2.7         Risks posed to data subjects;

11.2.8         Risks posed both within and to the Company; and

11.2.9         Proposed measures to minimise and handle identified risks.

  1. Keeping Data Subjects Informed

12.1       The Company shall provide the information set out in Part 12.2 to every data subject:

12.1.1         Where personal data is collected directly from data subjects, those data subjects will be informed of its purpose at the time of collection; and

12.1.2         Where personal data is obtained from a third party, the relevant data subjects will be informed of its purpose:

  1. if the personal data is used to communicate with the data subject, when the first communication is made; or
  2. if the personal data is to be transferred to another party, before that transfer is made; or
  3. as soon as reasonably possible and in any event, not more than one month after the personal data is obtained.

12.2       The following information shall be provided:

12.2.1         Details of the Company;

12.2.2         The purpose(s) for which the personal data is being collected and will be processed (as detailed in Part 20 of this Policy) and the legal basis justifying that collection and processing;

12.2.3         Where applicable, the legitimate interests upon which the Company is justifying its collection and processing of the personal data;

12.2.4         Where the personal data is not obtained directly from the data subject, the categories of personal data collected and processed;

12.2.5         Where the personal data is to be transferred to a third party that is located outside of the European Economic Area (the “EEA”), details of that transfer, including but not limited to the safeguards in place (see Part 27 of this Policy for further details);

12.2.6         Details of data retention;

12.2.7         Details of the data subject’s rights under the GDPR;

12.2.8         Details of the data subject’s right to withdraw their consent to the Company’s processing of their personal data at any time;

12.2.9         Details of the data subject’s right to complain to the Information Commissioner’s Office (the “supervisory authority” under the GDPR);

12.2.10      Where applicable, details of any legal or contractual requirement or obligation necessitating the collection and processing of the personal data and details of any consequences of failing to provide it; and

12.2.11      Details of any automated decision-making or profiling that will take place using the personal data, including information on how decisions will be made, the significance of those decisions, and any consequences.

  1. Data Subject Access

13.1       Data subjects may make subject access requests (“SARs”) at any time to find out more about the personal data which the Company holds about them, what it is doing with that personal data, and why.

13.2       Data subjects wishing to make a SAR may do so in writing, or other written communication. SARs should be addressed to BrandSashka e.U.

13.3       Responses to SARs shall normally be made within one month of receipt, however, this may be extended by up to two months if the SAR is complex and/or numerous requests are made. If such additional time is required, the data subject shall be informed.

13.4       The Company does not charge a fee for the handling of normal SARs. The Company reserves the right to charge reasonable fees for additional copies of information that has already been supplied to a data subject, and for requests that are manifestly unfounded or excessive, particularly where such requests are repetitive.

  1. Rectification of Personal Data

14.1       Data subjects have the right to require the Company to rectify any of their personal data that is inaccurate or incomplete.

14.2       The Company shall rectify the personal data in question, and inform the data subject of that rectification, within one month of the data subject informing the Company of the issue. The period can be extended by up to two months in the case of complex requests. If such additional time is required, the data subject shall be informed.

  1. Erasure of Personal Data

15.1       Data subjects have the right to request that the Company erases the personal data it holds about them in the following circumstances:

15.1.1         It is no longer necessary for the Company to hold that personal data with respect to the purpose(s) for which it was originally collected or processed;

15.1.2         The data subject wishes to withdraw their consent to the Company holding and processing their personal data;

15.1.3         The data subject objects to the Company holding and processing their personal data (and there is no overriding legitimate interest to allow the Company to continue doing so) (see Part 18 of this Policy for further details concerning the right to object);

15.1.4         The personal data has been processed unlawfully;

15.1.5         The personal data needs to be erased in order for the Company to comply with a particular legal obligation.

15.2       Unless the Company has reasonable grounds to refuse to erase personal data, all requests for erasure shall be complied with, and the data subject informed of the erasure, within one month of receipt of the data subject’s request. The period can be extended by up to two months in the case of complex requests. If such additional time is required, the data subject shall be informed.

  1. Restriction of Personal Data Processing

16.1       Data subjects may request that the Company ceases processing the personal data it holds about them. If a data subject makes such a request, the Company shall retain only the amount of personal data concerning that data subject (if any) that is necessary to ensure that the personal data in question is not processed further.

  1. Data Portability

17.1       The Company processes personal data using automated means. Specifically using mailing software and payment software, so that data subject is able to access purchased programme materials and/or access materials they gave their consent to be subscribed to.

17.2       Where data subjects have given their consent to the Company to process their personal data in such a manner, or the processing is otherwise required for the performance of a contract between the Company and the data subject, data subjects have the right, under the GDPR, to receive a copy of their personal data and to use it for other purposes (namely transmitting it to other data controllers).

17.3       To facilitate the right of data portability, the Company shall make available all applicable personal data to data subjects.

17.4       Where technically feasible, if requested by a data subject, personal data shall be sent directly to the required data controller.

17.5       All requests for copies of personal data shall be complied with within one month of the data subject’s request. The period can be extended by up to two months in the case of complex or numerous requests. If such additional time is required, the data subject shall be informed.

  1. Objections to Personal Data Processing

18.1       Data subjects have the right to object to the Company processing their personal data based on legitimate interests, direct marketing (including profiling).

18.2       Where a data subject objects to the Company processing their personal data based on its legitimate interests, the Company shall cease such processing immediately, unless it can be demonstrated that the Company’s legitimate grounds for such processing override the data subject’s interests, rights, and freedoms, or that the processing is necessary for the conduct of legal claims.

18.3       Where a data subject objects to the Company processing their personal data for direct marketing purposes, the Company shall cease such processing immediately.

  1. Automated Decision-Making

19.1          The Company uses personal data in automated decision-making processes.

19.2          Where such decisions have a legal (or similarly significant effect) on data subjects, those data subjects have the right to challenge to such decisions under the GDPR, requesting human intervention, expressing their own point of view, and obtaining an explanation of the decision from the Company.

19.3          The right described in Part 19.2 does not apply in the following circumstances:

19.3.1     The decision is necessary for the entry into, or performance of, a contract between the Company and the data subject;

19.3.2     The decision is authorised by law; or The data subject has given their explicit consent.

  1. Personal Data Collected, Held, and Processed

The following personal data is collected, held, and processed by the Company:

 

Purpose/Activity

 

Type of data

 

Lawful basis for processing

 

To register you as a new customer

 

(a) Identity

(b) Contact

 

Performance of a contract with you

 

To process and deliver your order including:

(a) Manage payments, fees and charges

(b) Collect and recover money owed to us

 

(a) Identity

(b) Contact

(c) Financial

(d) Transaction

(e) Marketing and Communications

 

(a) Performance of a contract with you

(b) Necessary for our legitimate interests to recover debts owed to us

 

To manage our relationship with you which will include:

(a) Notifying you about changes to our terms or privacy policy

(b) Asking you to leave a review or take a survey

 

(a) Identity

(b) Contact

(c) Profile

(d) Marketing and Communications

 

(a) Performance of a contract with you

(b) Necessary to comply with a legal obligation

(c) Necessary for our legitimate interests to keep our records updated and to study how customers use our products/services

 

To enable you to partake in a prize draw, competition or complete a survey

 

(a) Identity

(b) Contact

(c) Profile

(d) Usage

(e) Marketing and Communications

 

(a) Performance of a contract with you

(b) Necessary for our legitimate interests to study how customers use our products/services, to develop them and grow our business

 

To administer and protect our business and our site (including troubleshooting, data analysis, testing, system maintenance, support, reporting and hosting of data)

 

(a) Identity

(b) Contact

(c) Technical

 

(a) Necessary for our legitimate interests for running our business, provision of administration and IT services, network security, to prevent fraud and in the context of a business reorganisation or group restructuring exercise

(b) Necessary to comply with a legal obligation

 

To deliver relevant content and advertisements to you and measure and understand the effectiveness of our advertising

 

(a) Identity

(b) Contact

(c) Profile

(d) Usage

(e) Marketing and Communications

(f) Technical

 

Necessary for our legitimate interests to study how customers use our products/services, to develop them, to grow our business and to inform our marketing strategy

 

To use data analytics to improve our website, products/services, marketing, customer relationships and experiences

 

(a) Technical

(b) Usage

 

Necessary for our legitimate interests to define types of customers for our products and services, to keep our site updated and relevant, to develop our business and to inform our marketing strategy

 

To make suggestions and recommendations to you about goods or services that may be of interest to you

 

(a) Identity

(b) Contact

(c) Technical

(d) Usage

(e) Profile

 

Necessary for our legitimate interests to develop our products/services and grow our business

 

  1. Data Security – Transferring Personal Data and Communications

The Company shall ensure that the following measures are taken with respect to all communications and other transfers involving personal data:

21.1       All emails containing personal data must be encrypted;

21.2       All emails containing personal data must be marked “confidential”;

21.3       Personal data may be transmitted over secure networks only; transmission over unsecured networks is not permitted in any circumstances;

21.4       Personal data may not be transmitted over a wireless network if there is a wired alternative that is reasonably practicable;

21.5       Personal data contained in the body of an email, whether sent or received, should be copied from the body of that email and stored securely. The email itself should be deleted. All temporary files associated therewith should also be deleted;

21.6       Where personal data is to be transferred in hardcopy form it should be passed directly to the recipient; and

21.7       All personal data to be transferred physically, whether in hardcopy form or on removable electronic media shall be transferred in a suitable container marked “confidential”.

  1. Data Security – Storage

The Company shall ensure that the following measures are taken with respect to the storage of personal data:

22.1       All electronic copies of personal data should be stored securely using passwords and data encryption;

22.2       All hard copies of personal data, along with any electronic copies stored on physical, removable media should be stored securely in a locked box, drawer, cabinet, or similar;

22.3       All personal data stored electronically should be backed up monthly with backups stored onsite AND/OR offsite. All backups should be encrypted;

22.4       No personal data should be stored on any mobile device (including, but not limited to, laptops, tablets, and smartphones), whether such device belongs to the Company or otherwise; and

22.5       No personal data should be transferred to any device personally belonging to a team member and personal data may only be transferred to devices belonging to agents, contractors, or other parties working on behalf of the Company where the party in question has agreed to comply fully with the letter and spirit of this Policy and of the GDPR (which may include demonstrating to the Company that all suitable technical and organisational measures have been taken).

  1. Data Security – Disposal

When any personal data is to be erased or otherwise disposed of for any reason (including where copies have been made and are no longer needed), it should be securely deleted and disposed of. For further information on the deletion and disposal of personal data, please refer to the Company’s Data Retention Policy.

  1. Data Security – Use of Personal Data

The Company shall ensure that the following measures are taken with respect to the use of personal data:

24.1       No personal data may be shared informally and if an employee, agent, sub-contractor, or other party working on behalf of the Company requires access to any personal data that they do not already have access to, such access should be formally requested from BrandSashka e.U.;

24.2       No personal data may be transferred to any employees, agents, contractors, or other parties, whether such parties are working on behalf of the Company or not, without the authorisation of BrandSashka e.U.;

24.3       Personal data must be handled with care at all times and should not be left unattended or on view to unauthorised employees, agents, sub-contractors, or other parties at any time;

24.4       If personal data is being viewed on a computer screen and the computer in question is to be left unattended for any period of time, the user must lock the computer and screen before leaving it; and

24.5       Where personal data held by the Company is used for marketing purposes, it shall be the responsibility of BrandSashka e.U. to ensure that the appropriate consent is obtained and that no data subjects have opted out, whether directly or via a third-party service such as the TPS.

  1. Data Security – IT Security

The Company shall ensure that the following measures are taken with respect to IT and information security:

25.1       All passwords used to protect personal data should be changed regularly and should not use words or phrases that can be easily guessed or otherwise compromised. All passwords must contain a combination of uppercase and lowercase letters, numbers, and symbols;

25.2       Under no circumstances should any passwords be written down or shared between any employees, agents, contractors, or other parties working on behalf of the Company, irrespective of seniority or department. If a password is forgotten, it must be reset using the applicable method;

25.3       All software (including, but not limited to, applications and operating systems) shall be kept up-to-date. The Company’s IT staff shall be responsible for installing any and all security-related updates as soon as reasonably and practically possible; and

  1. Organisational Measures

The Company shall ensure that the following measures are taken with respect to the collection, holding, and processing of personal data:

26.1       All employees, agents, contractors, or other parties working on behalf of the Company shall be made fully aware of both their individual responsibilities and the Company’s responsibilities under the GDPR and under this Policy and shall be provided with a copy of this Policy;

26.2       Only employees, agents, sub-contractors, or other parties working on behalf of the Company that need access to, and use of, personal data in order to carry out their assigned duties correctly shall have access to personal data held by the Company;

26.3       All employees, agents, contractors, or other parties working on behalf of the Company handling personal data will be appropriately trained to do so;

26.4       All employees, agents, contractors, or other parties working on behalf of the Company handling personal data will be appropriately supervised;

26.5       All employees, agents, contractors, or other parties working on behalf of the Company handling personal data shall be required and encouraged to exercise care, caution, and discretion when discussing work-related matters that relate to personal data, whether in the workplace or otherwise;

26.6       Methods of collecting, holding, and processing personal data shall be regularly evaluated and reviewed;

26.7       All personal data held by the Company shall be reviewed periodically, as set out in the Company’s Data Retention Policy;

26.8       The performance of those employees, agents, contractors, or other parties working on behalf of the Company handling personal data shall be regularly evaluated and reviewed;

26.9       All employees, agents, contractors, or other parties working on behalf of the Company handling personal data will be bound to do so in accordance with the principles of the GDPR and this Policy by contract;

26.10    All agents, contractors, or other parties working on behalf of the Company handling personal data must ensure that any and all of their employees who are involved in the processing of personal data are held to the same conditions as those relevant employees of the Company arising out of this Policy and the GDPR; and

26.11    Where any agent, contractor or other party working on behalf of the Company handling personal data fails in their obligations under this Policy that party shall indemnify and hold harmless the Company against any costs, liability, damages, loss, claims or proceedings which may arise out of that failure.

  1. Transferring Personal Data to a Country Outside the EEA

27.1       The Company may from time to time transfer (‘transfer’ includes making available remotely) personal data to countries outside of the EEA.

27.2       The transfer of personal data to a country outside of the EEA shall take place only if one or more of the following applies:

27.2.1         The transfer is to a country, territory, or one or more specific sectors in that country (or an international organisation), that the European Commission has determined ensures an adequate level of protection for personal data;

27.2.2         The transfer is to a country (or international organisation) which provides appropriate safeguards in the form of a legally binding agreement between public authorities or bodies; binding corporate rules; standard data protection clauses adopted by the European Commission; compliance with an approved code of conduct approved by a supervisory authority (e.g. the Information Commissioner’s Office); certification under an approved certification mechanism (as provided for in the GDPR); contractual clauses agreed and authorised by the competent supervisory authority; or provisions inserted into administrative arrangements between public authorities or bodies authorised by the competent supervisory authority;

27.2.3         The transfer is made with the informed consent of the relevant data subject(s);

27.2.4         The transfer is necessary for the performance of a contract between the data subject and the Company (or for pre-contractual steps taken at the request of the data subject);

27.2.5         The transfer is necessary for important public interest reasons;

27.2.6         The transfer is necessary for the conduct of legal claims;

27.2.7         The transfer is necessary to protect the vital interests of the data subject or other individuals where the data subject is physically or legally unable to give their consent; or

26.2.8         The transfer is made from a register that, under Austrian or EU law, is intended to provide information to the public and which is open for access by the public in general or otherwise to those who are able to show a legitimate interest in accessing the register.

  1. Data Breach Notification

28.1       If a personal data breach occurs and that breach is likely to result in a risk to the rights and freedoms of data subjects (e.g. financial loss, breach of confidentiality, discrimination, reputational damage, or other significant social or economic damage), BrandSashka e.U. must ensure that the Information Commissioner’s Office is informed of the breach without delay, and in any event, within 72 hours after having become aware of it.

28.2       In the event that a personal data breach is likely to result in a high risk to the rights and freedoms of data subjects, BrandSashka e.U. must ensure that all affected data subjects are informed of the breach directly and without undue delay.

28.3       Data breach notifications shall include the following information:

28.3.1         The categories and approximate number of data subjects concerned;

28.3.2         The categories and approximate number of personal data records concerned;

28.3.3         The name and contact details of the Company’s data protection officer (or other contact point where more information can be obtained);

28.3.4         The likely consequences of the breach;

28.3.5         Details of the measures taken, or proposed to be taken, by the Company to address the breach including, where appropriate, measures to mitigate its possible adverse effects.

  1. Implementation and Review of Policy

This Policy shall be deemed effective as of 11th May 2018. No part of this Policy shall have retroactive effect and shall thus apply only to matters occurring on or after this date. We may update this privacy notice from time to time as necessary. The terms that apply to you are those posted here on our website on the day you use our website. We advise you to print a copy for your records.

If you have any question regarding our privacy policy, please contact us at [email protected]

By continuing to use the site, you agree to the use of cookies. more information

The cookie settings on this website are set to "allow cookies" to give you the best browsing experience possible. If you continue to use this website without changing your cookie settings or you click "Accept" below then you are consenting to this.

Close