Privacy policy

This privacy policy uses the terms employed by the European legislator in the General Data Protection Regulation (GDPR). It should be easy to read and understand for the public and for our customers and business partners. To that end we explain the terms used. In this privacy policy we use, among others, the following terms:

Personal data means any information relating to an identified or identifiable natural person (“data subject”). A natural person is identifiable if they can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person.

A data subject is any identified or identifiable natural person whose personal data are processed by the controller.

Processing means any operation or set of operations performed on personal data, whether or not by automated means, such as collection, recording, organisation, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure or destruction.

Restriction of processing means the marking of stored personal data with the aim of limiting their processing in the future.

Profiling means any form of automated processing of personal data consisting of the use of personal data to evaluate certain personal aspects relating to a natural person, in particular to analyse or predict aspects concerning that natural person’s performance at work, economic situation, health, personal preferences, interests, reliability, behaviour, location or movements.

Pseudonymisation means the processing of personal data in such a manner that the personal data can no longer be attributed to a specific data subject without the use of additional information, provided that such additional information is kept separately and is subject to technical and organisational measures to ensure that the personal data are not attributed to an identified or identifiable natural person.

Controller means the natural or legal person, public authority, agency or other body which, alone or jointly with others, determines the purposes and means of the processing of personal data. Where the purposes and means of such processing are determined by Union or Member State law, the controller or the specific criteria for its nomination may be provided for by Union or Member State law.

Processor means a natural or legal person, public authority, agency or other body which processes personal data on behalf of the controller.

Recipient means a natural or legal person, public authority, agency or another body, to which the personal data are disclosed, whether a third party or not. Public authorities which may receive personal data in the framework of a particular inquiry in accordance with Union or Member State law shall not be regarded as recipients.

Third party means a natural or legal person, public authority, agency or body other than the data subject, controller, processor and persons who, under the direct authority of the controller or processor, are authorised to process personal data.

Consent of the data subject means any freely given, specific, informed and unambiguous indication of the data subject’s wishes by which they, by a statement or by a clear affirmative action, signify agreement to the processing of personal data relating to them.

The controller within the meaning of the General Data Protection Regulation, other data-protection laws applicable in the Member States of the European Union, and other provisions relating to data protection is:

Wolfgang und Karl Hanzl OG

Karl Hanzl

Schulerstraße 19

1010 Vienna

Austria

+43 1 5128143

Email: office@porterhouse.at

10332102

Many websites and servers use cookies. Many cookies contain a cookie ID. A cookie ID is a unique identifier of the cookie. It consists of a string of characters by which websites and servers can be assigned to the specific browser in which the cookie was stored. This allows visited websites and servers to distinguish the individual browser of the data subject from other browsers that contain other cookies. A particular browser can be recognised and identified via the unique cookie ID.

Cookies allow us to provide users of this website with more user-friendly services that would not be possible without the cookie.

A cookie can be used to optimise the information and offers on our website for the user. Cookies allow us, as already mentioned, to recognise users of our website. The purpose of this recognition is to make our website easier to use. The user of a website that uses cookies does not, for example, have to enter access data again on every visit, because the website and the cookie stored on the user’s computer system do this. Another example is the cookie of a shopping basket in an online shop. The shop remembers the items a customer has placed in the virtual basket by means of a cookie.

The website uses cookies, local storage and session storage in part. This makes our offer more user-friendly, effective and secure. Local storage and session storage are technologies with which your browser stores data on your computer or mobile device. Cookies are text files that are stored on a computer system via a browser. You can prevent the use of cookies, local storage and session storage by a corresponding setting in your browser. The data subject can prevent cookies from being set by our website at any time by means of a setting in the browser used, and thus permanently object to cookies. Cookies that have already been set can also be deleted at any time via a browser or other software. This is possible in all common browsers. If the data subject deactivates cookies in the browser used, not all functions of our website may be fully usable.

Each time a data subject or an automated system calls up the website, the website collects a series of general data and information. These general data and information are stored in the server log files. The following may be collected: (1) browser types and versions used, (2) the operating system used by the accessing system, (3) the website from which an accessing system reaches our website (referrer), (4) the sub-pages accessed on our website, (5) the date and time of access, (6) an internet protocol address (IP address), (7) the internet service provider of the accessing system and (8) other similar data and information used to avert danger in the event of attacks on our information-technology systems. When using these general data and information, we do not draw conclusions about the data subject. The information is needed to (1) deliver the content of our website correctly, (2) optimise the content of our website and advertising for it, (3) ensure the lasting functioning of our information-technology systems and the technology of our website, and (4) provide law-enforcement authorities with the information necessary for prosecution in the event of a cyberattack. We therefore evaluate these anonymously collected data and information statistically and with the aim of increasing data protection and data security in our business, so as to ensure an optimal level of protection for the personal data we process. The anonymous data of the server log files are stored separately from all personal data provided by a data subject.

Registration on the controller’s website also stores the IP address assigned by the data subject’s internet service provider (ISP), and the date and time of registration. These data are stored so that misuse of our services can be prevented and, if necessary, so that offences can be investigated. Storage of these data is therefore necessary to protect the controller. These data are not passed on to third parties unless there is a legal obligation to do so or the disclosure serves criminal prosecution.

Registration of the data subject with voluntary provision of personal data enables the controller to offer the data subject content or services which, by their nature, can only be offered to registered users. Registered persons are free to change the personal data given at registration at any time, or to have them deleted completely from the controller’s data stock.

The data subject may register on the controller’s website by providing personal data. Which personal data are transmitted to the controller follows from the input mask used for registration. The personal data entered by the data subject are collected and stored solely for internal use by the controller and for the controller’s own purposes. The controller may arrange for disclosure to one or more processors, for example a parcel service, which likewise uses the personal data exclusively for internal use attributable to the controller. The controller provides any data subject, on request at any time, with information about which personal data concerning the data subject are stored. The controller also corrects or deletes personal data at the request or indication of the data subject, insofar as no statutory retention duties prevent this. All employees of the controller are available to the data subject as contacts in this connection.

Because of statutory provisions, the website contains information that enables rapid electronic contact with our business and direct communication with us, including a general address for electronic mail (email address). If a data subject contacts the controller by email or via a contact form, the personal data transmitted by the data subject are stored automatically. Personal data transmitted voluntarily to the controller are stored for the purpose of processing the enquiry or contacting the data subject. These personal data are not passed on to third parties.

On a blog on the controller’s website we offer users the opportunity to leave individual comments on blog posts. A blog is a portal on a website, usually publicly viewable, on which one or more people, called bloggers, can post articles or write down thoughts in blog posts. Blog posts can usually be commented on by third parties. If a data subject leaves a comment in the blog published on this website, the comments, the time of the comment and the user name (pseudonym) chosen by the data subject are stored and published. The IP address assigned by the data subject’s internet service provider (ISP) is also logged. The IP address is stored for security reasons and in case the data subject infringes the rights of third parties or posts unlawful content. These personal data are therefore stored in the controller’s own interest, so that the controller could exculpate itself in the event of an infringement. The personal data collected are not passed on to third parties unless such disclosure is required by law or serves the controller’s legal defence.

Comments use the Gravatar service of Automattic. Gravatar matches your email address and, if you are registered there, displays your avatar next to the comment. If you are not registered, no image is shown. All registered WordPress users are automatically registered with Gravatar as well. Details of Gravatar: https://en.gravatar.com

The controller processes and stores personal data of the data subject only for the period necessary to achieve the purpose of storage, or insofar as this is provided for by the European legislator or another legislator in laws or regulations to which the controller is subject. If the purpose of storage ceases to apply, or a storage period prescribed by the European legislator or another competent legislator expires, the personal data are routinely blocked or erased in accordance with the statutory provisions.

Every data subject has the right, granted by the European legislator, to obtain from the controller confirmation as to whether personal data concerning them are being processed. A data subject who wishes to exercise this right of confirmation may contact an employee of the controller at any time.

the purposes of the processing

the categories of personal data concerned

the recipients or categories of recipient to whom the personal data have been or will be disclosed, in particular recipients in third countries or international organisations

where possible, the envisaged period for which the personal data will be stored, or, if not possible, the criteria used to determine that period

the existence of the right to request from the controller rectification or erasure of personal data, or restriction of processing, or to object to such processing

the right to lodge a complaint with a supervisory authority

where the personal data are not collected from the data subject, any available information as to their source

the existence of automated decision-making, including profiling, referred to in Article 22(1) and (4) GDPR and, at least in those cases, meaningful information about the logic involved, as well as the significance and the envisaged consequences of such processing for the data subject

Every data subject has the right, granted by the European legislator, to obtain from the controller at any time, free of charge, information about the personal data stored about them and a copy of that information. The European legislator has also granted the data subject access to the following information. The data subject also has the right to know whether personal data have been transferred to a third country or to an international organisation. Where that is the case, the data subject has the right to be informed of the appropriate safeguards relating to the transfer. A data subject who wishes to exercise this right of access may contact an employee of the controller at any time.

Every data subject has the right, granted by the European legislator, to obtain the rectification of inaccurate personal data concerning them without undue delay. Taking into account the purposes of the processing, the data subject also has the right to have incomplete personal data completed, including by means of a supplementary statement. A data subject who wishes to exercise this right of rectification may contact an employee of the controller at any time.

• The personal data are no longer necessary in relation to the purposes for which they were collected or otherwise processed.
• The data subject withdraws consent on which the processing is based according to Article 6(1)(a) GDPR or Article 9(2)(a) GDPR, and there is no other legal ground for the processing.
• The data subject objects to the processing pursuant to Article 21(1) GDPR and there are no overriding legitimate grounds for the processing, or the data subject objects to the processing pursuant to Article 21(2) GDPR.
• The personal data have been unlawfully processed.
• The personal data have to be erased for compliance with a legal obligation in Union or Member State law to which the controller is subject.
• The personal data have been collected in relation to the offer of information-society services referred to in Article 8(1) GDPR.

Every data subject has the right, granted by the European legislator, to obtain from the controller the erasure of personal data concerning them without undue delay where one of the following grounds applies and insofar as the processing is not necessary. If one of the grounds above applies and a data subject wishes to have personal data stored by us erased, they may contact an employee of the controller at any time. The employee will arrange for the erasure request to be complied with immediately. Where the personal data have been made public and our business, as controller, is obliged pursuant to Article 17(1) GDPR to erase them, we, taking account of available technology and the cost of implementation, take reasonable steps, including technical measures, to inform other controllers which are processing the published personal data that the data subject has requested the erasure by such controllers of any links to, or copies or replications of, those personal data, insofar as processing is not required. The employee will arrange what is necessary in the individual case.

• The accuracy of the personal data is contested by the data subject, for a period enabling the controller to verify the accuracy of the personal data.
• The processing is unlawful and the data subject opposes the erasure of the personal data and requests the restriction of their use instead.
• The controller no longer needs the personal data for the purposes of the processing, but they are required by the data subject for the establishment, exercise or defence of legal claims.
• The data subject has objected to processing pursuant to Article 21(1) GDPR pending verification whether the legitimate grounds of the controller override those of the data subject.

Every data subject has the right, granted by the European legislator, to obtain from the controller restriction of processing where one of the following conditions is met. If one of the conditions above is met and a data subject wishes to request restriction of personal data stored by us, they may contact an employee of the controller at any time. The employee will arrange for the restriction of processing.

In exercising the right to data portability pursuant to Article 20(1) GDPR, the data subject also has the right to have the personal data transmitted directly from one controller to another, where technically feasible and where this does not adversely affect the rights and freedoms of others.

Every data subject has the right, granted by the European legislator, to receive the personal data concerning them, which they have provided to a controller, in a structured, commonly used and machine-readable format. They also have the right to transmit those data to another controller without hindrance from the controller to which the personal data have been provided, where the processing is based on consent pursuant to Article 6(1)(a) GDPR or Article 9(2)(a) GDPR or on a contract pursuant to Article 6(1)(b) GDPR and the processing is carried out by automated means, unless the processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller. To assert the right to data portability, the data subject may contact us at any time.

If the data subject objects, we no longer process the personal data unless we can demonstrate compelling legitimate grounds for the processing which override the interests, rights and freedoms of the data subject, or the processing serves the establishment, exercise or defence of legal claims.

Where we process personal data for direct marketing, the data subject has the right to object at any time to processing of personal data for such marketing. This also applies to profiling to the extent that it is related to such direct marketing. If the data subject objects to processing for direct marketing, we will no longer process the personal data for those purposes.

The data subject also has the right, on grounds relating to their particular situation, to object to processing of personal data concerning them for scientific or historical research purposes or statistical purposes pursuant to Article 89(1) GDPR, unless the processing is necessary for the performance of a task carried out for reasons of public interest.

Every data subject has the right, granted by the European legislator, to object, on grounds relating to their particular situation, at any time to processing of personal data concerning them which is based on Article 6(1)(e) or (f) GDPR. This also applies to profiling based on those provisions. To exercise the right to object, the data subject may contact any employee directly. The data subject is also free, in the context of the use of information-society services, and notwithstanding Directive 2002/58/EC, to exercise their right to object by automated means using technical specifications.

If the decision (1) is necessary for entering into, or performance of, a contract between the data subject and the controller, or (2) is based on the data subject’s explicit consent, we implement suitable measures to safeguard the data subject’s rights and freedoms and legitimate interests, at least the right to obtain human intervention on the part of the controller, to express their point of view and to contest the decision.

Every data subject has the right, granted by the European legislator, not to be subject to a decision based solely on automated processing, including profiling, which produces legal effects concerning them or similarly significantly affects them, unless the decision (1) is necessary for entering into, or performance of, a contract between the data subject and the controller, or (2) is authorised by Union or Member State law to which the controller is subject and which lays down suitable measures to safeguard the data subject’s rights and freedoms and legitimate interests, or (3) is based on the data subject’s explicit consent. A data subject who wishes to exercise rights relating to automated decisions may contact an employee of the controller at any time.

Every data subject has the right, granted by the European legislator, to withdraw consent to the processing of personal data at any time. A data subject who wishes to exercise the right to withdraw consent may contact an employee of the controller at any time.

Article 6(1)(a) GDPR serves our business as the legal basis for processing operations for which we obtain consent for a specific purpose. If processing of personal data is necessary for the performance of a contract to which the data subject is party, as is the case for processing necessary for the delivery of goods or the provision of another service or consideration, the processing is based on Article 6(1)(b) GDPR. The same applies to processing necessary in order to take steps prior to entering into a contract, for example in the case of enquiries about our products or services. If our business is subject to a legal obligation by which processing of personal data is required, for example to fulfil tax duties, the processing is based on Article 6(1)(c) GDPR. In rare cases the processing of personal data may be necessary to protect the vital interests of the data subject or of another natural person. This would be the case, for example, if a visitor were injured in our establishment and their name, age, health-insurance data or other vital information had to be passed on to a doctor, a hospital or other third parties. The processing would then be based on Article 6(1)(d) GDPR. Processing operations may also be based on Article 6(1)(f) GDPR. This legal basis covers processing operations that are not covered by any of the legal bases above, where processing is necessary for the purposes of the legitimate interests pursued by our business or by a third party, except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject. Such processing is permitted in particular because it was specifically mentioned by the European legislator. In that regard the legislator took the view that a legitimate interest could be assumed where the data subject is a customer of the controller (Recital 47, sentence 2, GDPR).

Where the processing of personal data is based on Article 6(1)(f) GDPR, our legitimate interest is the conduct of our business for the wellbeing of all our employees and our shareholders.

The criterion for the duration of storage of personal data is the respective statutory retention period. After the period expires, the data are routinely erased unless they are still required for the performance or initiation of a contract.

We inform you that the provision of personal data is partly required by law (for example tax rules) or may also result from contractual provisions (for example information about the contracting party). Sometimes it may be necessary, in order to conclude a contract, that a data subject provide us with personal data which must subsequently be processed by us. The data subject is, for example, obliged to provide us with personal data when our business concludes a contract with them. Failure to provide the personal data would mean that the contract with the data subject could not be concluded. Before providing personal data, the data subject must contact one of our employees. Our employee will clarify, in the individual case, whether the provision of the personal data is required by law or contract or is necessary for the conclusion of a contract, whether there is an obligation to provide the personal data, and what the consequences of failure to provide them would be.

As a responsible business we do not use automatic decision-making or profiling.

The cookies below are technically necessary cookies.

Cookies from WordPress

Cookies from DSGVO AIO for WordPress