Privacy policy

Name & ContactInformation WebsiteInformation for customersInformation for suppliersInfo for event visitorsInformation Online MeetingsSocial MediaData securityMore infos & rights
  1. Name and contact details of the controller
    Calmit Holding GmbH
    Friedrich-Schmid-Straße 165
    2754 Waldegg, Austria
    Email: office@calmit.com
  2. Information about the website
    1. Visiting the website: The following data is processed or logged when you visit our website:
      • Browser type/version
      • Operating system used
      • Referrer URL (the previously visited page)
      • Host name of the accessing computer (IP address)
      • Time of the server request
      • URL requested

      We use this data for our legitimate interest in accordance with GDPR Art. 6 (1) lit. f solely for the purpose of optimising the display and as evidence in the event of illegal use of our website, and delete it after seven days unless there is a legal basis for a longer storage period.

      We do not publish your personal data. As part of this data processing, the data is transferred to an IT processor within the affiliated calm companies. In some cases, this service provider may in turn commission sub-processors.

    2. Cookies:
      1. General description: We also use cookies or similar technologies such as pixels, also known as web beacons (hereinafter generally referred to as “cookies”), to make our website user-friendly. Cookies are small text files that are stored on your device with the help of your browser. However, this does not mean that we immediately obtain knowledge of your identity. Cookies do not cause any damage. The stored and returned information enables our website to recognise that you have already accessed and visited it using the browser on your device. We use this information to optimise the design and display of the website according to your preferences. We divide the use of cookies on our website into the following three categories: Necessary cookies are cookies that are required for the website to function properly (e.g. session cookies). These cookies are necessary for the operation of the website and cannot be disabled. You can set your browser to block these cookies, but this may prevent our website from functioning. Analysis & statistics cookies are cookies that serve statistical purposes. These cookies allow us to determine visitor frequency and record the origin by collecting information in data sets. These help us to understand which products and activities are more popular than others. Marketing & retargeting cookies are usually set by our marketing and advertising partners. They are used by them to create a profile of your interests in order to then show you advertising that is relevant to you. If you do not agree to the use of these cookies, you will not be able to enjoy personalised advertising.
      2. Legal basis for processing: We use necessary cookies on the basis of our legitimate interest in optimising our offering and making our website available (GDPR, Art. 6(1)(f)). Analysis & statistics and marketing & retargeting cookies are subject to the visitor’s consent and therefore have consent pursuant to GDPR, Art. 6 (1) (a) as their legal basis. This consent can be revoked at any time. Note: If you completely disable cookies, the functionality of our website may be limited.
      3. Deleting cookies: Most cookies have a limited lifespan, after which they are deleted from the user’s device. There are also persistent cookies that can only be deleted manually by the user. Such cookies are used by providers on a case-by-case basis. If the user revokes their consent (by deactivating cookies in the cookie settings), the cookies used up to that point will no longer be queried. This means that the cookies will no longer be processed with immediate effect and will be automatically deleted once their lifetime has expired. For technical reasons, persistent cookies must be deleted by the user themselves. This can be done in the cookie settings of the respective browser.
    3. Services used:
      1. Google Maps: We use Google Maps to locate our sites. This enables visitors to use the optimal route to reach us, saving valuable time. For this service, we use a service provided by Google Ireland Inc., Dublin.
      2. Legal basis and revocation: We process browser-based data on the basis of your voluntary consent (GDPR Art. 6(1)(a)). You can revoke your consent in the cookie settings.
    4. Contact form:
      1. General description, purpose, recipients: When ordering samples, you provide us with the following data, which we then collect and process:
        • Name
        • Email
        • Telephone
        • Subject/message text

        The data you provide in the online form is used exclusively for the purpose of processing your contact request. We will not publish your personal data. As part of this data processing, the data will be transferred to an IT processor within the affiliated companies.

      2. Legal basis: We process the data from the input fields on the basis of your voluntary consent and use it to personalise communication (GDPR Art. 6 (1) (a)).
      3. Revocation, deletion: We only use your data for as long as is necessary to fulfil this purpose, at most 6 months after the last contact.
    5. Sample order:
      1. General description, purpose, recipient: When ordering samples, you provide us with the following data, which we then collect and process:
        • Name
        • Company
        • Email
        • Telephone number
        • Postal address
        • Subject/message text

        The data you provide in the online form will be used exclusively for the purpose of processing your sample order. We will not publish your personal data. As part of this data processing, the data will be transferred to an IT processor within the affiliated companies.

      2. Legal basis: We require data from mandatory fields in the form for our legitimate interest in enabling us to send you your sample order. We process additional voluntary fields on the basis of your voluntary provision of this data and use it to personalise communication (GDPR Art. 6(1)(f); GDPR Art. 6(1)(a)).
      3. Revocation, deletion: We only use your data for as long as is necessary to fulfil this purpose, at most 6 months after the last contact.
  3. Information for customers
    1. Purpose of processing: We process your data as follows for customer processing, to fulfil commercial obligations and for statistical purposes. We process the following categories of data:
      • Master data such as name, address, contact details (telephone number, email address, etc.) – including those of employees and contact persons of the customer
      • Internal customer-specific data such as customer numbers, customer type or category, credit rating, etc.
      • Subject of the delivery and service
      • Payment information such as payment terms, discount scales

      This data is processed in detail for the following purposes:

      Order processing: Order processing includes quotations, order confirmations, delivery documents, invoicing, defect processing, etc. This processing serves to fulfil a contract or involves pre-contractual measures.

      Financial accounting: Financial accounting is used to manage financial assets. In connection with order processing, financial accounting processes data for the purpose of payment transactions with our customers or for the preparation of reports. In addition, information on the creditworthiness of customers is also processed. The majority of activities in this area are based on legal requirements.

      Marketing activities: Marketing activities serve to present the company on the market and to introduce new products and services. In connection with our customer service, we use the data to send newsletters (see also the separate section “Newsletter subscription”), hold information events and training courses, and support our customers’ marketing activities. Please also read the section “Information for event visitors” on the subject of events.

      Statistical evaluations: In order to adapt our product range to market conditions and identify trends at an early stage, we compile internal statistics on the demand for our products. This enables us to adjust our production and thus also generate price advantages.

      Note: If you are not in direct customer contact with us, but we still process your personal data necessary for the fulfilment of the contract, this data is to be regarded as auxiliary data for the fulfilment of the contract and has been transmitted to us for this purpose by persons commissioned by you (e.g. processors, construction companies, intermediaries).

    2. Legal basis for processing:
      • Order processing: Activities in the area of order processing are based on Art. 6 (1) lit. b GDPR. The activities are necessary for the fulfilment of a contract or for the implementation of pre-contractual measures.
      • Financial accounting: Most data processing in the area of financial accounting is subject to legal regulations. Art. 6 (1) lit. c GDPR applies here. If data is processed in addition to the legal requirements, this serves our legitimate interest (Art. 6 (1) lit. f GDPR) in the time- and resource-optimised processing of financial data. This also applies to the optimised management of payment transactions with our customers.
      • Marketing activities: We are interested in regularly informing our customers about the latest developments concerning our products. Therefore, based on our legitimate interest pursuant to Art. 6 (1) (f) GDPR, we take the liberty of informing persons who are in an active customer relationship with us about our products by means of a regular newsletter for the purpose of providing information and news (see also “Newsletter subscription”). Other activities, such as sending marketing articles or invitations to events, are also based on our legitimate interest (Art. 6(1)(f) GDPR) in providing pleasant customer service that satisfies our customers.
      • Statistical evaluations: We are interested in providing our management with up-to-date, valid and reliable figures for decision-making purposes. For this reason, we process data from our customer transactions on the basis of this legitimate interest (Art. 6(1)(f) GDPR) and prepare it accordingly. In the interests of data minimisation, this data is consolidated and/or anonymised as far as possible.
    3. Categories of recipients: We transfer data to the following categories of processors for the purpose of processing:
      • IT service providers for the operation and support of the IT infrastructure
      • Freight forwarders for the delivery of our products
      • Credit agencies for determining the creditworthiness of business partners

      Data is transferred to authorities and/or government organisations if there is a legal requirement to do so. In addition, data is transferred to tax offices in the course of financial statements.

    4. Duration of data storage: Business documents are subject to statutory retention periods, which we naturally comply with in accordance with the law. Unless there is another legal basis, the data is deleted immediately. In some cases, particularly for statistical purposes, data is anonymised for further use and thus loses its personal reference.
  4. Information for suppliers
    1. Purpose of processing: We process your data as follows for the purposes of procurement, the fulfilment of commercial obligations and for statistical purposes. We process the following categories of data:
      • Master data such as name, address, contact details (telephone number, email address, etc.) – including those of employees and contact persons of the supplier
      • Internal customer-specific data such as supplier numbers, supplier type or category, credit rating, etc.
      • Subject of the delivery and service
      • Shipping service providers for sending newsletters
      • Payment information such as payment terms, discount scales, etc.

      This data is processed in detail for the following purposes:

      Procurement: Procurement includes obtaining quotations, placing orders, processing defects, etc. This processing serves to fulfil a contract or involves pre-contractual measures.

      Financial accounting: Financial accounting is used to manage financial assets. In connection with procurement, financial accounting processes data for the purpose of payment transactions with our suppliers and for the preparation of reports. The majority of activities in this area are based on legal requirements.

      Statistical evaluations: In order to optimise our procurement processes, we maintain internal statistics on the procurement process.

    2. Legal basis for processing:
      • Procurement: Activities in the area of procurement are based on Art. 6(1)(b) GDPR. These activities are necessary for the performance of a contract or for the implementation of pre-contractual measures.
      • Financial accounting: Most data processing in the area of financial accounting is subject to legal requirements. This is governed by Art. 6(1)(c) GDPR. If data is processed in addition to the legal requirements, this serves our legitimate interest (Art. 6(1)(f) GDPR) in the time- and resource-optimised processing of financial data. This also applies to the optimised management of payment transactions with our suppliers.
      • Statistical evaluations: We are interested in providing our management with up-to-date, valid and reliable figures for decision-making purposes. For this reason, we process data from our procurement process on the basis of this legitimate interest (Art. 6 (1) (f) GDPR) and prepare it accordingly. In the interests of data minimisation, this data is consolidated and/or anonymised as far as possible.
    3. Categories of recipients: For the purpose of processing, we transfer data to IT service providers for the operation and support of the IT infrastructure. Data is transferred to authorities and/or government organisations if there is a legal requirement to do so. In addition, data is transferred to tax offices in the course of financial statements.
    4. Duration of data storage: Business documents are subject to statutory retention periods, which we naturally comply with in accordance with the law. Unless there is another legal basis, the data is deleted immediately. In some cases, particularly for statistical purposes, data is anonymised for further use and thus loses its personal reference.
  5. Information for event visitors
    1. Registration, implementation and results of the event:
      1. Purpose of processing: The data collected is used to ensure the smooth running of the event. In the case of individual training and coaching sessions, personal data is processed for the purpose of compiling results. In addition, personal data may be required for the issuance of certificates and/or references.
      2. Legal basis for processing: The processing of data is necessary for the performance of the contract for the registration and implementation of the event (GDPR Art. 6 (1) (b)). By registering and providing this data, you consent to the processing of further personal data (GDPR Art. 6 (1) (a)). Due to the nature of the event, revoking your consent may severely restrict or prevent your attendance at the event. Withdrawal does not affect the lawfulness of processing that has already taken place. Processing is not required by law.
      3. Categories of recipients: In some cases, companies entrusted with the organisation of the event, coaching companies and IT service providers.
      4. Duration of data storage: For archiving purposes or as proof of attendance at the event, the data will be stored for a maximum of 3 years. Participant questionnaires, coaching documents and similar items will be kept for a maximum of 6 months after the end of the event. The above does not apply if the data is necessary for asserting, exercising or defending legal claims before a court or authority.
    2. Documentation of the event (photographs):
      1. Purpose of processing: Photographs and video recordings are used to document the event and related activities of Calmit Holding GmbH. In addition, selected recordings may be used in public relations and marketing activities to increase the attractiveness and awareness of Calmit Holding GmbH and thus convey a confidence-building and customer-oriented impression.
      2. Legal basis for processing: The processing is carried out in the legitimate interest of Calmit Holding GmbH, provided that proportionality is maintained and the production of such images can be expected from the event participant. In general, these images serve the documentation interests of Calmit Holding GmbH, as the images are not intended to identify uninvolved persons, but to reflect the content of the event. For all published images, the content and message of the image are carefully checked before publication to ensure that no personal rights are violated and that there are no adverse consequences for the persons depicted. Processing is necessary because the stated purpose is only possible through the visual representation of the event with its participants (often including public figures). Processing is not required by law or contract. – (Art. 6(1)(f) GDPR; §12(2)(4) and §12(5) DSG).
      3. Categories of recipients: Employees of Calmit Holding GmbH, event participants, and the general public in the event of publication of the images on the websites of Calmit Holding GmbH, on social media and in print media. In these cases, it cannot be ruled out that the images may be accessed from third countries or become known in third countries.
      4. Duration of data storage: The images will be stored until the end of the third year after their last use, because it can generally only be assumed that they are no longer required for the purpose of processing at that point. Individual images, especially those featuring public figures, may be stored for longer for archiving purposes. Published images are generally deleted once an objection has been lodged and upheld. The above does not apply if the data is necessary for asserting, exercising or defending legal claims before a court or authority.
  6. Information about online meetings
    1. In the context of online meetings, we process the following personal data:
      • Name
      • Login details such as password, personal meeting ID
      • Contact details such as telephone number, email address
      • Image and/or sound recordings in some cases (consent required)
    2. Purpose, legal basis and recipients: The above categories of data are processed for the purpose of conducting online meetings. The legal basis for processing may vary from case to case:
      • In the case of a business relationship, the contractual or pre-contractual fulfilment of a contract may be considered the basis (Art. 6(1)(b) GDPR).
      • Otherwise, our legitimate interest in efficient communication using modern tools applies (Art. 6(1)(f) GDPR).
      • If image and/or sound recordings are made, the legal basis for this is the consent given by all participants (Art. 6(1)(a) GDPR).

      We commission a processor within the European Union to carry out the processing. This processor has a contractual relationship with us within the meaning of the GDPR. The data will not be passed on to other third parties unless the disclosure of the data is necessary for the assertion, exercise or defence of legal claims before a court or authority. Even in this case, however, the data will be deleted immediately after the proceedings have been concluded.

    3. Retention period: The storage period depends on the purpose and content of the online meeting. In general, unless there is another legal basis, the data will be deleted immediately. This does not apply if the data is necessary for asserting, exercising or defending legal claims before a court or authority.
  7. Social networks (social media)
    1. We maintain publicly accessible profiles on social networks. A description of the social networks we use can be found below. Normally, you can access profiles on social networks without providing detailed information about yourself. If you are active on these networks, we will process your user name and any other data you provide. Social networks can usually analyse your user behaviour comprehensively when you visit their website or a website with integrated content from social networks (e.g. like buttons or advertising banners). When you visit one of our social network pages, the operator of that network can assign this visit to you personally. This data is collected, for example, via cookies stored on your device, pixels or by recording your IP address. With the help of the data collected in this way, social network operators can create user profiles (profiling) in which your preferences and interests are stored. In this way, personalised advertising can be displayed to you both within and outside the respective network. Please note that we are not fully responsible for the processing procedures on social networks. Depending on the provider, further processing operations may be carried out by the operators of these networks. For details, please refer to the terms of use and privacy policy of the respective network.
    2. Legal basis and responsibility: Our legitimate interest (Art. 6(1)(f) GDPR) in using social networks is based on achieving the most comprehensive media presence possible on the internet. Any additional processing carried out by social networks may be based on different legal grounds, which must be specified by the operators of the social networks. When you visit one of our social media pages, we are jointly responsible with the network operator for the data processing operations triggered by this visit. Please note that, despite our joint responsibility with the operators, we do not have full control over the data processing operations. Our options are largely determined by the services offered by the respective provider.
    3. Storage period: The data collected directly by us via our social media pages is deleted from our systems as soon as the purpose or legal basis for its storage no longer applies. Stored cookies remain on your device until you delete them or they are automatically deleted. We have no influence on the storage period of your data stored by the operators of social networks for their own purposes. For details, please contact the operators of the social networks directly (e.g. in their privacy policy, see below).
    4. Social networks in detail:
  8. Data security
    1. We will treat your personal information and personal data with the utmost care and discretion, store it securely and only use it for its intended purpose. The provisions of the GDPR and local laws are of course observed and ensured in particular by appropriate organisational and technical precautions.
  9. Further information and your rights
    1. Unless otherwise stated, the processing described above is not required by law or contract. Unless otherwise stated, profiling (creating an overall picture of a person for specific purposes) does not take place. The data from the processing described above will not be transferred to third parties unless the disclosure of the data is necessary for the assertion, exercise or defence of legal claims before a court or authority.
    2. You have the right to obtain information at any time about whether and which personal data we have stored about you. We will also be happy to answer any further questions you may have on the subject of data protection.
    3. You also have the right to rectification, erasure, restriction of processing, data portability and blocking of incorrect or unlawfully processed data. You also have the right to withdraw your consent without affecting the lawfulness of the processing carried out to date. If processing is based on our legitimate interest or the legitimate interest of third parties, you have the right to object on grounds relating to your particular situation.
    4. Depending on the processing, please send a corresponding request to the email address office@calmit.com or adjust your account and software settings with the respective service provider. If you believe that our processing of your personal data violates applicable data protection law, you also have the option of lodging a complaint with the competent supervisory authority. In Austria, this is the Austrian Data Protection Authority (Österreichische Datenschutzbehörde, Barichgasse 40-42, 1030 Vienna, telephone: +43 1 521 52-25 69, email: dsb(at)dsb.gv.at).