PRIVACY POLICY / DUTY TO INFORM
We place particular importance on protecting your data. Therefore, when processing your personal data (e.g. master data), we comply with the applicable data protection regulations, especially the GDPR and the Austrian Data Protection Act (DSG).
Below you will find detailed information about the data processing activities we carry out:
Contents
- Controller – 1 –
- Rights of data subjects / Right to object and withdraw / Right to lodge a complaint – 1 –
- Information about the processing of your personal data – 2 – 3.1. Website visit – 2 – 3.2. Electronic contact requests via the website – 3 – 3.3. Cookies / Web analytics service – 3 – 3.4. Use of Google services – 4 – 3.5. User account – 5 – 3.6. Customer management, accounting, logistics, and bookkeeping – 6 – 3.7. Customer support and marketing for own purposes – 7 – 3.8. Payment systems – 8 – 3.9. Applicant management – 11 – 3.10. Social media – 11 – 3.11. Website shop system: WooCommerce – 14 – 3.12. Images and learning content – 15 –
- Information on data transfers to third countries or international organizations – 16 –
- Change management – 16 –
- Controller Bogner Academy GmbH Peter-Behrens-Platz 10 4020 Linz Phone: +43 677 6436 5253 Email: support@bogneracademy.com
- Rights of Data Subjects / Right to Object and Withdraw / Right to Lodge a Complaint 2.1. You have the following rights with regard to your personal data:
- Right of access (Art. 15 GDPR),
- Right to rectification (Art. 16 GDPR),
- Right to restriction of processing (Art. 18 GDPR),
- Right to data portability (Art. 20 GDPR),
- Right to object to processing (Art. 21 GDPR).
- Right to withdraw consent (Art. 7 para. 3 GDPR). If you have given us consent to process your personal data, you may withdraw that consent at any time. The withdrawal does not affect the lawfulness of data processing carried out before the withdrawal.
- Information about the Processing of Your Personal Data 3.1. Website Visit
- Purpose: If you use our website purely for informational purposes (i.e. without registering or otherwise transmitting information), personal data will be collected that your browser transmits to our server. This is technically necessary to display our website to you and to ensure the website’s stability and security.
- Data subjects: Website visitors
- Legal basis: Legitimate interest (Art. 6 para. 1 lit. f GDPR), § 165 para. 3 TKG 2021
- Legitimate interests: Provision of a stable, secure, and user-friendly information society service (website, online shop, appointment scheduling) to inform about our company, to promote our business and our services and products
- The following data is processed: IP address, date and time of the request, time zone difference to GMT, content of the request (specific page), access status / HTTP status code, amount of data transferred in each case, requesting
- Retention period: As long as you use our website.
- Recipients / Categories of recipients: Processors
- Purpose: Processing contact inquiries via email or the website contact form.
- Data subjects: Website visitors who use the contact form
- Legal basis: Performance of a contract or pre-contractual measures (Art. 6 para. 1 lit. b GDPR), legitimate interest (Art. 6 para. 1 lit. f GDPR), § 165 para. 3 TKG 2021
- Legitimate interests: Provision of a stable and user-friendly information society service (website, online shop, appointment scheduling) for receiving and responding to inquiries
- The following data is processed: Master data, content data of the inquiry
- Retention period: Until the inquiry is answered. If legal retention obligations apply, processing will be restricted until that time.
- Recipients / Categories of recipients: Processors
- Purpose: Improving service offerings, web presence, and direct marketing
- Data subjects: Website visitors
- Legal basis: Consent (Art. 6 para. 1 lit. a GDPR), performance of a contract or pre-contractual measures (Art. 6 para. 1 lit. b GDPR), legitimate interest (Art. 6 para. 1 lit. f GDPR), § 165 para. 3 TKG 2021
- Legitimate interests: Improvement of our own services, technical stability, plausibility check of billing resulting from the use of cookies and web analytics services
- The following data is processed: IP address
- Retention period: See cookie banner
- Recipients / Categories of recipients: Analytics service provider / Contractor
- Purpose: Capturing interactions on the website and forwarding them to connected services; managing and modifying web analysis tools without programming knowledge
- Data subjects: Website visitors
- Legal basis: Consent (Art. 6 para. 1 lit. a GDPR)
- The following data is processed: IP address
- Retention period: During the website session
- Transfers to countries outside the EU / EEA: possibly USA (see details in section 3.4)
- Purpose: Cross-platform, uniform presentation of our web content
- Data subjects: Website visitors
- Legal basis: Legitimate interest (Art. 6 para. 1 lit. f GDPR)
- Legitimate interests: Improvement of own services, technical stability, consistent presentation, fast website loading times
- Data processed: IP address
- Retention period: During the website session
- Transfers to countries outside the EU / EEA: possibly USA (details in section 3.4)
- Purpose: Improving service offerings, website presence, and direct marketing. We use behavioral analysis to optimize both our online offerings and our advertising.
- Data subjects: Website visitors who have given their consent
- Legal basis: Consent (Art. 6 para. 1 lit. a GDPR), explicit consent (Art. 49 para. 1 lit. a GDPR)
- Data processed: IP address, number of sessions and accesses, click behavior, duration of website visit, approximate location (country, city)
- Retention period: See cookie banner
- Recipients / Categories of recipients: Processors
- Transfers to countries outside the EU / EEA: possibly USA (details in section 3.4)
- Purpose: Creation and management of the registered user profile
- Data subjects: Individuals who create a user account
- Legal basis: Consent (Art. 6 para. 1 lit. a GDPR), legitimate interest (Art. 6 para. 1 lit. f GDPR)
- Legitimate interests: Defense, exercise, and enforcement of legal claims; security measures, particularly protection against unauthorized access to user accounts
- Data processed: Salutation, title, first name, last name, address data, email address, date of birth, payment preferences, and for purchases, additional contract data, duration of access rights to specific digital products […]
- Retention period: Data may be stored until the end of the seventh year after the last contact with the customer, unless longer contractual or legal retention obligations apply
- Recipients / Categories of recipients: Processors
- Purpose: Processing of personal data in the context of all business relationships with customers and suppliers in the course of business activities, including systematic documentation of all transactions relating to income and expenses
- Data subjects: Customers, suppliers, employees
- Legal basis: Consent (Art. 6 para. 1 lit. a GDPR), performance of a contract or pre-contractual measures (Art. 6 para. 1 lit. b GDPR), compliance with a legal obligation (Art. 6 para. 1 lit. c GDPR), legitimate interest (Art. 6 para. 1 lit. f GDPR)
- Legitimate interests: Defense, exercise, and enforcement of legal claims; evaluation of customer relationships (especially duration of business relationship, number of complaints)
- Data processed: Master data, VAT ID number
- Retention period: Until the termination of the business relationship or until the expiry of the warranty, guarantee, limitation, and statutory retention periods applicable to the customer (especially under the Austrian Federal Fiscal Code – BAO); beyond that, until the conclusion of any legal disputes in which the data is required as evidence
- Recipients / Categories of recipients: Tax authorities, courts and regulatory bodies, suppliers, debt collection agencies, banks involved in payments to the data subject or third parties, legal representatives, auditors, payroll accountants
- Purpose: Processing of own or acquired customer and prospect data for business development regarding our own products or services, as well as for conducting marketing activities and newsletter distribution; customer relationship management
- Data subjects: Suppliers, customers
- Legal basis: Consent (Art. 6 para. 1 lit. a GDPR), performance of a contract or pre-contractual measures (Art. 6 para. 1 lit. b GDPR), compliance with a legal obligation (Art. 6 para. 1 lit. c GDPR), legitimate interest (Art. 6 para. 1 lit. f GDPR)
- Legitimate interests: Defense, exercise, and enforcement of legal claims; evaluation of open rates and campaign success statistics to optimize customer communication; commercial interest in customer and supplier retention
- Data processed for newsletter dispatch via our website: Master data
- Retention period: Data may be retained until the end of the third year after the last contact with the client, unless longer contractual or legal retention periods apply
- Recipients / Categories of recipients: Analytics service provider / contractor
- Purpose: Processing customer data related to the issuance and use of vouchers, discount codes, and rebates as part of marketing activities
- Data subjects: Existing customer, new customer
- Legal basis: Consent (Art. 6 para. 1 lit. a GDPR), performance of a contract or pre-contractual measures (Art. 6 para. 1 lit. b GDPR), compliance with a legal obligation (Art. 6 para. 1 lit. c GDPR), legitimate interest (Art. 6 para. 1 lit. f GDPR)
- Legitimate interests: Defense, exercise, and enforcement of legal claims; implementation of promotional activities within the referral partner program (e.g. voucher validity periods)
- Data processed: Email address of the referral partner, date and voucher code including validity period, master data of the new user, order data, accounting of referral benefits
- Retention period: Data may be retained until the end of one year after the last contact with the client, unless longer contractual or legal retention periods apply
- Recipients / Categories of recipients: Analytics service provider / contractor
- Purpose: Processing online payments
- Data subjects: Users who order paid content and select this payment service provider
- Legal basis: Consent (Art. 6 para. 1 lit. a GDPR), performance of a contract or pre-contractual measures (Art. 6 para. 1 lit. b GDPR), legitimate interest (Art. 6 para. 1 lit. f GDPR), § 165 para. 3 TKG 2021
- Legitimate interests: Integration and provision of various payment systems; displaying and forwarding requests to payment providers; analyzing failed transactions to improve processes; defense, exercise, and enforcement of legal claims
- Data processed: PayPal ID, master data, contract data, IP address, device data necessary for the setup and technical processing of the payment, especially IP address, date and time of request, time zone difference to GMT, content of the request (specific page), access status / HTTP status code, amount of data transferred in each case, referring website, browser, operating system and interface, language and version of the browser software
- Retention period: Until the completion of the payment process, including the time required for processing a refund. Certain billing data will be stored for the statutory retention period of seven years
- Recipients / Categories of recipients: Online payment service provider and the sub-payment service provider selected by the user, processors
- Purpose: Processing online payments
- Data subjects: Users who order paid content and select this payment service provider
- Legal basis: Consent (Art. 6 para. 1 lit. a GDPR), performance of a contract or pre-contractual measures (Art. 6 para. 1 lit. b GDPR), legitimate interest (Art. 6 para. 1 lit. f GDPR), § 165 para. 3 TKG 2021
- Legitimate interests: Integration and provision of various payment systems; displaying and forwarding requests to payment providers; analysis of failed transactions to improve processes; defense, exercise, and enforcement of legal claims
- Data processed: First and last name, address, email address, contract data, device data required for setup and technical processing of the payment, in particular IP address, date and time of request, time zone difference to GMT, content of the request (specific page), access status / HTTP status code, amount of data transferred in each case, referring website, browser, operating system and interface, language and version of the browser software
- Retention period: Until completion of the payment process, including time required for processing a refund. Certain billing data is stored for the statutory retention period of seven years
- Recipients / Categories of recipients: Online payment service provider and sub-payment service provider selected by the user, processors
- Purpose: Processing online payments
- Data subjects: Users who order paid content and select this payment service provider
- Legal basis: Consent (Art. 6 para. 1 lit. a GDPR), performance of a contract or pre-contractual measures (Art. 6 para. 1 lit. b GDPR), legitimate interest (Art. 6 para. 1 lit. f GDPR), § 165 para. 3 TKG 2021
- Legitimate interests: Integration and provision of various payment systems; displaying and forwarding requests to payment providers; analysis of failed transactions to improve processes; defense, exercise, and enforcement of legal claims
- Data processed: Transaction data, contract data, master data, device data required for setup and technical processing of the payment, in particular IP address, date and time of request, time zone difference to GMT, content of the request (specific page), access status / HTTP status code, amount of data transferred in each case, referring website, browser, operating system and interface, language and version of the browser software
- Retention period: Until completion of the payment process, including time required for processing a refund. Certain billing data is stored for the statutory retention period of seven years
- Recipients / Categories of recipients: Online payment service provider, processors
- Purpose: Use and retention of personal data provided by applicants, when such data has been submitted by the individual
- Data subjects: Applicants, interested parties
- Legal basis: Consent (Art. 6 para. 1 lit. a GDPR), explicit consent (Art. 9 para. 2 lit. a GDPR), as well as for the establishment, exercise, or defense of legal claims (Art. 9 para. 2 lit. f GDPR), and legitimate interest (Art. 6 para. 1 lit. f GDPR; Art. 10 GDPR in conjunction with § 4 para. 3 Z 2 DSG)
- Legitimate interests: Defense, exercise, and enforcement of legal claims; documentation of the selection process, including evaluations and interview notes
- Data processed: Master data, CV, voluntarily submitted data
- Retention period: Applicant data will be deleted without delay after the position has been filled or after the expiration of the claim period under the Equal Treatment Act (7 months), unless consent for data retention has been given. Unsolicited applications will be retained for future reference as appropriate, and only until withdrawal by the data subject
- Recipients / Categories of recipients: Applicant data is not shared
- Purpose: In addition to our website, we also operate presences on social networks, specifically YouTube, Instagram, LinkedIn, and X (formerly Twitter), to increase the visibility of our company and for marketing purposes. When you visit one of our online profiles, personal data may be transmitted to the operator of the respective social network. If you are logged in to the network, the operator may also associate your profile with ours
- Legal basis: Consent (Art. 6 para. 1 lit. a GDPR), explicit consent (Art. 49 para. 1 lit. a GDPR)
- Data subjects: Visitors to our social media profiles
- Data processed: Date and time of actions performed, user ID (for logged-in users only), location data (country/city), language setting, age/gender group (for logged-in users, based on profile data), previously visited website, identification of hardware (computer/mobile device)
- Retention period: If a person contacts us via social media, the message is treated like an electronic inquiry via the website (see section 3.2). The data will be stored until the inquiry is answered. If legal retention obligations exist, processing will be restricted accordingly
- Recipients / Categories of recipients: Operators of the visited social media platforms
- Transfer to the following data protection third countries: USA: Companies that have successfully completed the Data Privacy Framework Program are considered to have an adequate level of protection under the EU-U.S. and Swiss-U.S. Data Privacy Frameworks. It is legally permissible to transfer information to these companies under the framework. Details on data collection and processing by the respective provider can be found at: https://www.youtube.com/static?gl=DE&template=terms&hl=de and https://policies.google.com/privacy Google LLC, the parent company of the YouTube platform, has committed to complying with the requirements of the EU-U.S. and Swiss-U.S. Data Privacy Frameworks by certifying under the Data Privacy Framework Program. Information about participation can be found by searching “Google LLC” at: https://www.dataprivacyframework.gov/s/participant-search
- Transfer to the following data protection third countries: USA: Companies that have successfully completed the Data Privacy Framework Program are considered to have an adequate level of protection under the EU-U.S. and Swiss-U.S. Data Privacy Frameworks. It is legally permissible to transfer information to these companies under the framework.
- Transfer to the following data protection third countries: USA: For companies that have not completed the Data Privacy Framework Program, no adequate level of protection can be guaranteed under legal requirements Details on data collection and processing by the respective provider can be found here: LinkedIn: https://www.linkedin.com/legal/privacy-policy LinkedIn relies on the European Commission’s Standard Contractual Clauses (SCCs) for international data transfers. Details are available here: https://www.linkedin.com/help/linkedin/answer/a1343190
- Transfer to the following data protection third countries: USA: For companies that have not completed the Data Privacy Framework Program, no adequate level of protection can be guaranteed under legal requirements Details on data collection and processing by the respective provider can be found here: https://twitter.com/de/privacy X relies on the European Commission’s Standard Contractual Clauses (SCCs) for international data transfers. Details are available here: https://gdpr.x.com/en/controller-to-controller-transfers.html
- Transfer to the following data protection third countries: TikTok may transfer personal data to countries outside the EU, particularly China and the USA. Transfers are based on the European Commission’s Standard Contractual Clauses pursuant to Art. 46 GDPR. More information can be found in the TikTok privacy policy: https://www.tiktok.com/legal/page/eea/privacy-policy/en
- Purpose: Content display, brand communication, user interaction, marketing
- Data subjects: Visitors to our TikTok presence
- Legal basis: Consent (Art. 6 para. 1 lit. a GDPR), explicit consent (Art. 49 para. 1 lit. a GDPR)
- Data processed: Username, profile picture, date and time of interactions, content data (e.g. comments), device data, location data if applicable
- Retention period: Unless otherwise specified, TikTok’s internal retention periods apply. If a person contacts us, the rules under section 3.2 apply
- Recipients / Categories of recipients: TikTok or Bytedance Ltd.
- Transfer to the following data protection third countries: USA: Meta Platforms Inc., the parent company, is certified under the EU-U.S. Data Privacy Framework. Details on certification: https://www.dataprivacyframework.gov/s/participant-search
- Purpose: Brand communication, reach analysis, social media marketing
- Data subjects: Visitors to our Threads presence
- Legal basis: Consent (Art. 6 para. 1 lit. a GDPR), explicit consent (Art. 49 para. 1 lit. a GDPR)
- Data processed: Username, location data, content data (e.g. comments), device data, interest profiles
- Retention period: Unless otherwise specified, Meta’s internal retention periods apply. If a person contacts us, the rules outlined in section 3.2 apply
- Recipients / Categories of recipients: Meta Platforms Ireland Limited
- Purpose: Provision of our products and services, processing and handling of orders, delivery of important messages and information regarding your account or your purchase
- Data subjects: Website visitors
- Legal basis: Consent (Art. 6 para. 1 lit. a GDPR), legitimate interest (Art. 6 para. 1 lit. f GDPR)
- Legitimate interests: Defense, exercise, and enforcement of legal claims; optimization of our website
- Data processed: Master data, voluntarily submitted data
- Retention period: We retain your personal data only as long as necessary to fulfill the purposes for which it was collected. When your data is no longer needed, it will be securely deleted or anonymized
- Recipients / Categories of recipients: Shipping service providers
- Transfer to data protection third countries: Yes, USA. Companies that have successfully completed the Data Privacy Framework Program are considered to offer an adequate level of protection under the EU-U.S. and Swiss-U.S. Data Privacy Frameworks. It is legally permissible to transfer information to such companies under the framework.
- Purpose: Preparation and presentation of course content in the members’ area
- Data subjects: Users who use Vimeo
- Legal basis: Consent (Art. 6 para. 1 lit. a GDPR), legitimate interest (Art. 6 para. 1 lit. f GDPR), performance of a contract or pre-contractual measures (Art. 6 para. 1 lit. b GDPR)
- Legitimate interests: Defense, exercise, and enforcement of legal claims
- Data processed: Usage data, content data
- Retention period: We retain your personal data only as long as necessary to fulfill the purposes for which it was collected. When your data is no longer needed, it will be securely deleted or anonymized Further information on Vimeo’s privacy policy can be found here: https://vimeo.com/privacy
- Purpose: Preparation and presentation of course content in the members’ area
- Data subjects: Users who use LearnDash
- Legal basis: Consent (Art. 6 para. 1 lit. a GDPR), legitimate interest (Art. 6 para. 1 lit. f GDPR), performance of a contract or pre-contractual measures (Art. 6 para. 1 lit. b GDPR)
- Legitimate interests: Defense, exercise, and enforcement of legal claims
- Data processed: Usage data
- Retention period: We retain your personal data only as long as necessary to fulfill the purposes for which it was collected. When your data is no longer needed, it will be securely deleted or anonymized Further information on LearnDash’s privacy policy can be found here: https://www.learndash.com/privacy-policy/
