It is important to EfficientIO GmbH, Holzhausenplatz 1, 1140 Vienna, office@efficientio.com (“efficientio”, “we”, “us”) to adequately protect your personal data. We therefore observe the applicable legal provisions, in particular the General Data Protection Regulation (“GDPR”), the Austrian Data Protection Act (“DSG”) and the Telecommunications Act (“TKG”) for the protection, lawful handling, and confidentiality of personal data as well as data security.

Below you will find out which information we may collect, process, and use if you are interested in our services and enter a business relationship with us:

1. What is personal data?

Personal data is information about those affected whose identity is determined or at least determinable. This includes, for example, your name, your address, your IP address, or your e-mail address.

2. What data do we collect from you?

2.1. Contact

If you contact us by e-mail or other channels, we process the personal data you voluntarily provide (name, e-mail address, telephone number, type of request or subject of your message and the content of the message).

We only process your personal data transmitted when you contact us to process your request, to contact you later and to transmit the information you want. This data processing is therefore necessary to fulfill our (pre-)contractual obligations.

2.2. Handling of the business relationship

If you are our customer and we provide services for you (software-as-a-service including support), we collect and process the following data: name, address, e-mail address, telephone number, mobile phone number, payment type, block, UID Number, data on your payment behavior, transaction data, contract data and conditions, customer-specific orders, bank details, complaint data, survey results (aggregated). This is done for contract management, delivery of our products and performance of services, including communication, accounting and invoicing, customer service and handling of complaints and thus for the fulfillment of the contract in accordance with Art 6 Para 1 lit b DSGVO. Insofar as the processing serves the purpose of sending advertising, including online advertising, newsletter campaigns and vouchers, satisfaction and marketing surveys, analysis of customer behavior and customer segmentation, or improving customer relationships, we base your processing on your consent (Art Paragraph 1 lit a GDPR).

In addition, we may process certain data from any other contact persons or other natural persons working for customers, namely: name, address, e-mail address, telephone number, position. We also process this data for communication within the framework of contract processing and this also serves to fulfill the contract in accordance with Art 6 Para 1 lit b GDPR.

We only process the following data from potential customers: name, address, e-mail address, telephone number, position. On the one hand, to carry out pre-contractual measures at the request of the data subject (Art 6 Para. 1 lit b DSGVO), on the other hand, processing can also be used to send advertising, newsletters, campaigns, and vouchers, provided you have given your consent.

If your personal data is necessary for the performance of a contract with you, we may not be able to provide our services if you do not provide us with the data mentioned above. However, you are neither legally nor contractually obliged to provide the personal data.

Insofar as we process your personal data based on your consent, you are entitled to revoke this at any time without giving reasons for all or individual purposes and with effect for the future, without this having any effect on any services to be provided by us. If we rely on our legitimate interests to process your data, for direct marketing purposes, you can object to this data processing at any time without giving a reason.

2.3. Newsletter

If you have given your consent, we will process the personal data (title, name, and e-mail address) you provided when registering for the newsletter in order to send you newsletters by e-mail for the following purposes: (i) Information about our current products and promotions, (ii) marketing and product information related to our Services, and (iii) satisfaction surveys related to our Services.

You can revoke this consent at any time free of charge and without giving reasons with effect for the future by contacting us (e.g. by e-mail, clicking the unsubscribe link in the e-mail footer, etc.).

2.4. References

If we want to use your name, the company and information about the services provided for reference purposes, we will only do so with your separate consent and the corresponding processing is therefore based on Art 6 Para 1 lit a DSGVO.

3. How do we collect your data?

We receive your personal data mainly directly from you by providing it directly, as well as through the processing of the business relationship with you, in which case we collect and store necessary information about you (e.g. contract data and conditions). If necessary, we also receive data from partner companies (processors, sales, or other cooperation partners – see https://www.efficientio.com/partner/ and from publicly available company directories.

4. Will your data be passed on to third parties?

We pass on your personal data to the following external service providers (processors) to the required extent:

• IT service providers and/or providers of data hosting or data processing or similar services;
• Other service providers, providers of tools and software solutions who also support us in providing our services and work on our behalf (including providers of marketing tools, marketing agencies, communication service providers and call centers).

All of our processors only process your data on our behalf and on the basis of our instructions for the provision of the above services.

In addition, we transfer your personal data to the required extent to the following recipients:

• to any third parties who are involved in the fulfillment of our obligations to you (e.g. payment service providers, banks for payment processing, sales partners);
• to other external third parties to the extent necessary on the basis of our legitimate interests (e.g. auditors, insurance companies in the event of an insured event, legal representatives in the event of an incident, etc.);
• to authorities and other public bodies to the extent required by law (e.g. tax authorities, etc.).

If we process your data in a third country outside the European Union (EU) or the European Economic Area (EEA) or if this happens within the framework of the use of third-party services, we have implemented suitable and appropriate guarantees to prevent the transfer of your data to the respective third country to be data protection compliant (e.g. by concluding so-called “standard data protection clauses”). At your request, we will send you a copy of these suitable guarantees if we process your data or have your data processed in third countries.

5. How is your data protected?

We take appropriate technical and organizational security measures to protect your personal data against accidental or unlawful deletion, alteration, damage, or loss and against unauthorized disclosure or unauthorized access. In addition, we and our employees are obliged to maintain data secrecy.

6. Duration of storage

We only store your personal data for as long as it is necessary to fulfill our obligations to you. However, for reasons of our storage obligations, we generally store your personal data provided in connection with orders for seven years after the fulfillment of the contract. In principle, we store all personal data that is relevant for tax or business accounting, i.e. books and records, as well as business correspondence for seven years.

If you have only registered for the newsletter and to receive advertising information and are not a customer of ours, we will store your data until you revoke your consent.

If you contact us, we will process your personal data for a period of six months to be able to respond to any queries.

We store data that we need to assert or defend against a claim for the duration of the applicable limitation period. In addition, we also store your personal data beyond the specified periods if legal claims can be asserted from the relationship between you and us or until a specific incident or legal dispute has been finally clarified. This longer storage is carried out to protect our legitimate interests in the assertion, clarification, and defense of legal claims.

Quality management data from surveys, questionnaires and feedback forms are stored for a maximum of seven years to assess and improve the development of our customer relationship.

7. What rights do you have?

You have the right to receive information in a clear, transparent, and easily understandable manner about how we process personal data and about your rights as a data subject (Article 13f GDPR). You have the right to information about the personal data we process about you (Article 15 GDPR). In addition, you have the right to have incorrect data corrected and your data deleted (“right to be forgotten”, Art. 16 and 17 GDPR). You can also revoke your consent to the processing of personal data with effect for the future (Article 7 GDPR). You may also have the right to restrict the processing of your data (Article 18 GDPR), to object (Article 21 GDPR) and to have the data you have provided released in a structured, common, and machine-readable format (“data portability”, Article 20 GDPR). You have the option to lodge a complaint with the above-mentioned data protection officer or with a data protection supervisory authority (Article 77 GDPR). The data protection supervisory authority responsible for us is: Austrian Data Protection Authority, Barichgasse 40-42, 1030 Vienna.

Before filing a complaint with the data protection authority or when pursuing your or any other questions, please contact us, for example by using our online contact form at www.efficientio.com/contact or by email to office@efficientio.com.

In order for us to be able to process your request regarding your above-mentioned rights and to ensure that personal data is not disclosed to unauthorized third parties, please send the request clearly identifying yourself and giving a brief description of the extent to which you are exercising your rights as a data subject listed above.

Status: March 2022