Categories
Privacy Policy
Introduction and Overview
We have prepared this privacy policy (version 02.11.2026-113243628) to explain to you, in accordance with the requirements of the General Data Protection Regulation (EU) 2016/679 and applicable national laws, which personal data (hereinafter referred to as "data") we, as data controllers – and the data processors we have engaged (e.g., providers) – process, will process in the future, and what legal options you have. The terms used are to be understood as gender-neutral.
In short: We provide you with comprehensive information about the data we process about you.
Privacy policies usually sound very technical and use legal terminology. This privacy policy, however, aims to describe the most important aspects to you as simply and transparently as possible. Where it promotes transparency, technical terms are explained in a reader-friendly manner, links to further information are provided, and graphics are used. We are informing you in clear and simple language that we only process personal data in the course of our business activities when there is a corresponding legal basis for doing so. This is certainly not possible if one provides the briefest, unclear, and overly technical legal explanations that are so often standard practice on the internet when it comes to data protection. I hope you find the following explanations interesting and informative, and perhaps you will find some information here that you were not previously aware of.
If you still have questions, please contact the responsible party named below or in the legal notice, follow the provided links, and consult further information on third-party websites. Our contact details can, of course, also be found in the legal notice.
Scope of Application
This privacy policy applies to all personal data processed by us within our company and to all personal data processed by companies we have commissioned (data processors). Personal data, as defined in Article 4 No. 1 of the GDPR, refers to information such as a person's name, email address, and postal address. The processing of personal data enables us to offer and bill for our services and products, whether online or offline. This privacy policy applies to:
In short: This privacy policy applies to all areas where personal data is processed in a structured manner within our company via the aforementioned channels. Should we enter into a legal relationship with you outside of these channels, we will inform you separately.
In short: This privacy policy applies to all areas in which personal data is processed in a structured manner within our company via the aforementioned channels. Should we enter into a legal relationship with you outside of these channels, we will inform you separately, if necessary.
In short: This privacy policy applies for all areas in which personal data is processed in a structured manner within our company via the aforementioned channels. Legal Basis
In the following privacy policy, we provide you with transparent information on the legal principles and regulations, i.e., the legal bases of the General Data Protection Regulation (GDPR), that allow us to process personal data.
With regard to EU law, we refer to REGULATION (EU) 2016/679 OF THE EUROPEAN PARLIAMENT AND OF THE COUNCIL of 27 April 2016. You can, of course, read this EU General Data Protection Regulation online at EUR-Lex, the access point to EU law, at 3A32016R0679.
We only process your data if at least one of the following conditions applies:
Other conditions, such as the recording of images in the public interest, the exercise of official authority, and the protection of vital interests, do not generally apply to us. If such a legal basis should apply, it will be indicated accordingly.
In addition to the EU Regulation, national laws also apply:
If other regional or national laws apply, we will inform you about them in the following section
Contact Details of the Data Controller
Should you have any questions regarding data protection or the processing of personal data, you will find the contact details of the data controller below, in accordance with Article 4, Paragraph 7 of the EU General Data Protection Regulation (GDPR):
KW open promotion consulting & trading gmbh
Die Spinnerei 18
6845 Hohenems
Authorized Representative: Manfred Janek
Email: mj@kwopen.com
Telephone: +43 5576 72544
Data Retention Period
Our general principle is that we only store personal data for as long as is absolutely necessary for the provision of our services and products. This means that we delete personal data as soon as the reason for processing the data no longer exists. In some cases, we are legally obligated to store certain data even after the original purpose has ceased to exist, for example, for accounting purposes.
Should you wish to have your data deleted or withdraw your consent to data processing, the data will be deleted as quickly as possible, provided there is no legal obligation to retain it.
If you wish to have your data deleted or withdraw your consent to data processing, the data will be deleted as quickly as possible, unless there is a legal obligation to retain it. We will inform you about the specific duration of each data processing activity below, provided we have further information.
Rights under the General Data Protection Regulation (GDPR)
In accordance with Articles 13 and 14 of the GDPR, we inform you about the following rights to which you are entitled to ensure fair and transparent data processing:
o the purpose for which we carry out the processing;
o the categories, i.e., the types of data, that are processed;
o who receives this data and, if the data is transferred to third countries, how security is guaranteed;
o how long the data will be stored;
o the existence of the right to rectification, erasure, or restriction of processing and the right to object to processing;
o that you can lodge a complaint with a supervisory authority (links to these authorities can be found below);
Whether profiling is carried out, i.e., whether data is automatically analyzed to create a personal profile of you.
If the processing of your data is based on Article 6(1)(e) (public interest, exercise of official authority) or Article 6(1)(f) (legitimate interest), you can object to the processing. We will then review your objection as quickly as possible to determine whether we can legally comply with it.
If data is used for direct marketing purposes, you can object to this type of data processing at any time. We will then no longer be permitted to use your data for direct marketing.
If data is used for profiling, you can object to this type of data processing at any time. We will then no longer be permitted to use your data for profiling.
According to Article 22 of the DPR, you may have the right not to be subject to a decision based solely on automated processing (e.g., profiling).
According to Article 77 of the GDPR, you have the right to lodge a complaint. This means you can lodge a complaint with the data protection authority at any time if you believe that the processing of your personal data infringes the GDPR.
In short: You have rights – don't hesitate to contact the responsible party listed above!
If you believe that the processing of your data violates data protection law or that your data protection rights have been infringed in any other way, you can lodge a complaint with the supervisory authority. In Austria, this is the Data Protection Authority, whose website can be found at https://www.dsb.gv.at/. In Germany, there is a data protection officer for each federal state. For more information, you can contact the Federal Commissioner for Data Protection and Freedom of Information (BfDI). The following local data protection authority is responsible for our company:
Explanation of terms used
We always strive to write our privacy policy as clearly and understandably as possible. However, this is not always easy, especially with regard to technical and legal topics. It often makes sense to use legal terms (such as personal data) or certain technical expressions (such as cookies, IP address). However, we do not want to use these without explanation. Below you will find an alphabetical list of important terms used in this privacy policy that we may not have adequately addressed in the preceding sections. If these terms are taken from the GDPR and are definitions, we will also cite the GDPR texts here and, where necessary, add our own explanations.
Data Processor
Definition according to Article 4 of the GDPR
For the purposes of this Regulation, the term:
“Data processor” means a natural or legal person, public authority, agency or other body which processes personal data on behalf of the controller;
Explanation: As a company and website owner, we are responsible for all data we process from you. In addition to controllers, there may also be so-called data processors. This includes any company or person who processes personal data on our behalf. Data processors can therefore include, in addition to service providers such as tax advisors, hosting or cloud providers, payment or newsletter providers, or large companies such as Google or Microsoft.
Consent
Definition according to Article 4 of the GDPR
For the purposes of this Regulation, the term:
“Consent” of the data subject means any freely given, specific, informed and unambiguous indication of the data subject’s wishes by which he or she, by a statement or by a clear affirmative action, signifies agreement to the processing of personal data relating to him or her;
Explanation: Websites typically obtain such consent via a cookie consent tool. You're probably familiar with this. Whenever you visit a website for the first time, you are usually asked via a banner whether you agree to or consent to the processing of your data. In most cases, you can also adjust your settings and thus decide for yourself which data processing you allow and which you do not. If you do not consent, no personal data may be processed. Of course, consent can also be given in writing, i.e., not via a tool.
Personal Data
Definition according to Article 4 of the GDPR
For the purposes of this Regulation, the term:
“Personal data” means any information relating to an identified or identifiable natural person (hereinafter referred to as “data subject”); an identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person;
Explanation: Personal data is therefore all data that can identify you as a person. This typically includes data such as:
According to the European Court of Justice (ECJ), your IP address also counts as personal data. IT experts can use your IP address to determine at least the approximate location of your device and, consequently, you as the internet connection owner. Therefore, storing an IP address also requires a legal basis under the GDPR. There are also so-called "special categories" of personal data.
Profiling
Definition according to Article 4 of the GDPR
For the purposes of this Regulation, the term:
“Profiling” means any form of automated processing of personal data consisting of the use of personal data to evaluate certain personal aspects relating to a natural person, in particular to analyze or predict aspects concerning that natural person’s performance at work, economic situation, health, personal preferences, interests, reliability, behavior, location, or movements;
Explanation: Profiling involves collecting various pieces of information about a person to learn more about that person. In the online sphere, profiling is frequently used for advertising purposes or credit checks. Web analytics programs, for example, collect data about your behavior and interests on a website. This results in a specific user profile, which can then be used to target advertising to a specific audience.
Explanation: Profiling involves collecting various pieces of information about a person to learn more about that person. Controller
Definition according to Article 4 of the GDPR
For the purposes of this Regulation, the term:
“Controller” means the natural or legal person, public authority, agency or other body which, alone or jointly with others, determines the purposes and means of the processing of personal data; where the purposes and means of such processing are determined by Union or Member State law, the controller or the specific criteria for its designation may be provided for by Union or Member State law;
Explanation: In our case, we are responsible for the processing of your personal data and are therefore the “controller”. If we transfer collected data to other service providers for processing, these are “processors”. A “Data Processing Agreement (DPA)” must be signed for this.
Processing
Definition according to Article 4 of the GDPR
For the purposes of this Regulation, the term:
“Processing” means any operation or set of operations which is performed on personal data or on sets of personal data, whether or not by automated means, such as collection, recording, organisation, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure or destruction;
Note: When we refer to processing in our privacy policy, we mean any type of data processing. As mentioned above in the original GDPR statement, this includes not only the collection but also the storage and processing of data.
All texts are protected by copyright.
Source: Privacy policy created with the privacy policy generator for Austria by AdSimple
Hohenems, November 2026