Privacy Policy

I. Overview

Please get a picture of how we process your personal data when you visit our website, administer your account or your use of our routing services, or otherwise have a business relationship with us. We refer to these collectively as our "Services" in this policy (Art 13, Art 14 GDPR; section 165 para 3 TKG [“Austrian Telecommunication Act”]).

This Privacy Policy does not apply where CORTECS processes personal data on behalf of a CUSTOMER under the Data Processing Agreement.

II. What data do we process when you use our Services and who may receive your data?

When administering an account or business relationship, the following account data may be processed of the users of the Services as well as employees of the user:

• Log-In data (e.g. name, e-mail)
• Services preferences (e.g. settings)
• Documents and personal data required in a business relationship (eg. invoices, billing address)
• Data required in the course of maintenance (e.g. request volume)
• Screening (clients)/Incident tickets in case of maintenance
• Date, time and duration of account access.

The processing of this data is necessary to provide, manage, and secure the operation of our Services and to ensure their functionality from a technical point of view. The processing of this data is justified by our legitimate interest in the operation of our Services as well as contractual and legal obligations (Art 6 para 1 lit b, c and f GDPR).

To provide essential functions for Services, such as managing your user account, processing payments, providing customer support and hosting our application, we may disclose account data to the following providers. These services are necessary for the establishment and fulfillment of our contractual relationship with you or are based on our legitimate interest in operating a secure and performant service.

III. Overview of cookies

We use technical cookies to recognize you and store temporary data of the website visitor. We only use cookies to the extent necessary to communicate with you via the website. These cookies are activated as soon as you visit our website.

The following cookies are used on our website on the basis of our legitimate interest (Art. 6 para. 1 lit. f GDPR).

IV. For what purposes do we process your data when we have a business relationship or you use our Services?

In the course of our business relationship, we process personal data based on contractual obligations, legal obligations and our legitimate interests. Specifically, we process your data for the following purposes:

• for the purpose of providing and administering access to and use of the Services, including authentication, account and project management, saved service preferences, project membership, budget controls, aggregated usage statistics and and customer support;
• for the purpose of commercial administration, including the generation of invoices based on usage logs, processing and managing your business case, and necessary correspondence with you;
• all of your data that we collect may be transferred to a third party if we undergo a merger, acquisition, bankruptcy or other transaction in which that third party assumes control of our business (in whole or in part). Should one of these events occur, we will make reasonable efforts to notify you before your information becomes subject to different privacy and security policies and practices;
• for the purpose of law enforcement;

The processing of your data serves the initiation, maintenance and handling of our business relationships. If you do not provide us with this data, we will unfortunately not be able to provide you with the Services.

The processing of your data can also be based on consent (Art 6 para 1 lit a GDPR). This consent can be revoked at any time. The revocation of consent does not affect the lawfulness of the processing carried out on the basis of the consent until the revocation.

V. How long do we store your data?

Account data is retained for the duration of the active business relationship and, where necessary, for applicable statutory or limitation periods. Records subject to §132 of the Austrian Federal Fiscal Code are retained for seven years and, where applicable, for longer while relevant proceedings are pending.

VI. Collection of data from other sources

In the course of a business relationship or the initiation thereof, it is naturally necessary to conduct research on the business partner. This is done exclusively to the extent required for this purpose. In this context, data may be retrieved and processed from the following sources:

VII. Does automated decision-making and/or profiling take place (Art 13 (2) lit f GDPR)?

No automated decision-making or profiling takes place in our company.

VIII. What rights do you have with regard to data processing?

We would like to inform you that you have the right, provided that the legal requirements are met:

• You have the right to request information about which of your data is processed by us (see in detail Art 15 GDPR).
• You have the right to request the correction or completion of incorrect or incomplete data concerning you (see in detail Art. 16 of the GDPR).
• The right to have your data deleted (see in detail Art 17 GDPR).
• The right to object to processing of your data that is necessary to protect our legitimate interests or those of a third party (see in detail Art 21 of the GDPR). This applies in particular to the processing of your data for advertising purposes.
• You have the right to receive the transfer of the data provided by you in a structured, common and machine-readable format.

If we process your data on the basis of your consent, you have the right to revoke this consent at any time by e-mail. This will not affect the lawfulness of the data processing carried out up to this point (Art 7 para 3 GDPR).

IX. Do you have a right to complain?

If, contrary to our expectations, there is a violation of your right to lawful processing of your data, please contact us by mail or e-mail. We will make every effort to process your request promptly. You also have the right to lodge a complaint with the supervisory authority responsible for data protection matters. In Austria, this is the: Data protection authority (“Datenschutzbehörde”) based in Vienna, Austria.

X. Opportunity to get in contact

If you have any further questions about the processing of your data, please feel free to contact our data protection coordinator using the contact details below.

XI. Controller

* "Third Country" includes all countries other than (1) the Member States of the European Union and (2) the Member States of the European Economic Area, which means, in addition to the EU Member States, Iceland, Liechtenstein and Norway.

**"ZDR" denotes Zero Data Retention. In the absence of an explicit policy from the provider, a conservative assumption of 'No ZDR' is applied.