1) Information on personal data collection and the controller’s contact details
1.1 We are pleased that you are visiting our website and thank you for your interest. Below we explain how we handle your personal data when you use our website. Personal data means any data that can identify you personally.
1.2 The controller for data processing on this website under the GDPR is Dr Marta-Katarzyna Chalupa, Austria, email: office@chalupa-steuerberatung.eu. A controller is the natural or legal person who, alone or jointly with others, determines the purposes and means of processing personal data.
1.3 For security and to protect the transmission of personal data and other confidential content, such as orders or enquiries to the controller, this website uses SSL or TLS encryption. An encrypted connection is indicated by “https://” and the padlock symbol in your browser bar.
2) Data collection when visiting our website
When you use our website for information only, without registering or otherwise providing information, we collect only data your browser sends to our server (“server log files”). When you access the website, we collect the following data technically necessary to display it:
The page visited on our website
Date and time of access
Amount of data sent in bytes
Source or referring page from which you arrived
Browser used
Operating system used
IP address used, where applicable in anonymised form
Processing is based on Article 6(1)(f) GDPR and our legitimate interest in improving the website’s stability and functionality. Data is not disclosed or otherwise used. We nevertheless reserve the right to review server logs later if there are specific indications of unlawful use.
4) Contacting us
4.1 Personal data is collected when you contact us, for example by form or email. The relevant form shows which data is collected. Data is stored and used solely to answer your enquiry, contact you and perform related technical administration. The basis is our legitimate interest in answering your enquiry under Article 6(1)(f) GDPR. If contact aims to conclude a contract, Article 6(1)(b) GDPR is an additional basis. Data is deleted after final handling of the enquiry, when the circumstances indicate that the matter is resolved, unless statutory retention duties prevent deletion.
4.2 WhatsApp Business
Visitors may contact us through WhatsApp, operated by WhatsApp Ireland Limited, 4 Grand Canal Square, Grand Canal Harbour, Dublin 2, Ireland. We use the Business version of WhatsApp.
If you contact us through WhatsApp about a specific transaction, such as an order, we store and use your WhatsApp mobile number and, if supplied, first and last names under Article 6(1)(b) GDPR to process and answer the enquiry. On the same basis, we may request further details, such as an order or customer number, address or email, to identify the relevant matter.
For general WhatsApp enquiries, such as about services, availability or the website, we store and use your number and, if supplied, first and last names under Article 6(1)(f) GDPR for our legitimate interest in providing the requested information efficiently and promptly.
Your data is used only to answer your enquiry through WhatsApp. We do not disclose it to third parties.
WhatsApp Business accesses the address book of the mobile device we use and automatically transfers stored phone numbers to a server of its parent company Facebook Inc. in the USA. We use a device whose address book contains only WhatsApp details of users who have contacted us through WhatsApp.
This ensures that everyone whose WhatsApp details are stored in our address book has, by accepting WhatsApp’s terms on first use, consented under Article 6(1)(a) GDPR to transfer of their WhatsApp number from their chat contacts’ address books. Data of people who do not use WhatsApp and/or have not contacted us through it is therefore excluded from transfer.
For the purpose and scope of collection, further processing and use by WhatsApp, and your rights and privacy settings, see WhatsApp’s privacy information: https://www.whatsapp.com/legal/?eea=1#privacy-policy
5) Online appointment booking
Our own online appointment booking function
We process personal data through the online appointment function provided. The booking form or appointment enquiry shows the data collected; required fields are marked. A free-text field allows you to describe your enquiry and choose what additional information to provide. Data is stored and used solely to arrange the appointment. Processing necessary to perform a contract or take pre-contractual steps is based on Article 6(1)(b) GDPR. Where you have consented, processing is based on Article 6(1)(a) GDPR. Consent may be withdrawn at any time by contacting the controller named at the beginning.
6) Use of customer data for direct marketing
6.1 Email newsletters to existing customers
If you supplied your email when buying goods or services, we reserve the right to send regular offers for similar goods or services from our range. Under section 7(3) UWG, no separate consent is required. Processing is based solely on our legitimate interest in personalised direct marketing under Article 6(1)(f) GDPR. If you objected initially, no emails are sent. You may object at any time with future effect by contacting the controller, incurring only standard transmission costs. On receipt of your objection, advertising use of your email will stop promptly.
6.2 WhatsApp newsletter
If you subscribe to our WhatsApp newsletter, we regularly send information about our offers. Only your mobile number is required.
To receive the newsletter, add our supplied mobile number to your contacts and send “Start” through WhatsApp. Sending this message gives consent under Article 6(1)(a) GDPR to use your personal data for newsletter delivery. We then add you to the mailing list.
Subscription data is processed solely for newsletter advertising. You may unsubscribe at any time by sending “Stop” through WhatsApp. Your number is promptly removed from the list unless you expressly consent to further use or we reserve another legally permitted use described in this policy.
WhatsApp accesses the address book of the device used for newsletter delivery and automatically transfers stored numbers to a Facebook server in the USA.
We therefore use a device whose address book contains only our newsletter recipients’ WhatsApp details. This ensures that they consented under Article 6(1)(a) GDPR, by accepting the terms on first use, to transfer of their number from chat contacts’ address books. Data of people who do not use WhatsApp and/or have not contacted us through it is excluded from transfer.
For the purpose and scope of collection, further processing and use by WhatsApp, and your rights and privacy settings, see WhatsApp’s privacy information: https://www.whatsapp.com/legal/?eea=1#privacy-policy
6.3 Postal advertising
Based on our legitimate interest in personalised direct marketing, we reserve the right to store your first and last names and postal address and, if supplied in the contractual relationship, title, academic degree, year of birth and professional, industry or business designation under Article 6(1)(f) GDPR to send offers and product information by post.
You may object to storage and use for this purpose at any time by notifying the controller.
7) Tools and other services
Instagram and other external services are provided as links. Only when you open a link do you visit that provider, whose own privacy and cookie rules then apply. Fonts are served locally.
8) Data subject rights
8.1 Applicable data protection law grants you extensive rights against the controller concerning processing of your personal data, including access and intervention rights, as described below:
Right of access under Article 15 GDPR: in particular, information about the data processed, purposes, data categories, recipients or recipient categories, planned retention period or its criteria, rights to rectification, erasure, restriction, objection and complaint to a supervisory authority, the source of data not obtained from you, automated decision-making including profiling and, where applicable, meaningful information about its logic, significance and envisaged effects. You also have the right to information about safeguards under Article 46 GDPR for transfers to third countries;
Right to rectification under Article 16 GDPR: you may require prompt correction of inaccurate data and/or completion of incomplete data we hold about you;
Right to erasure under Article 17 GDPR: you may request deletion where Article 17(1) conditions are met. This right does not apply in particular where processing is needed for freedom of expression and information, a legal obligation, public interest reasons or the establishment, exercise or defence of legal claims;
Right to restriction under Article 18 GDPR: you may request restriction while contested accuracy is checked; where processing is unlawful but you oppose erasure and request restriction instead; where you need data for legal claims after we no longer need it; or after an objection based on your particular situation, pending verification of whether our legitimate grounds override yours;
Right to notification under Article 19 GDPR: following rectification, erasure or restriction, the controller must notify all recipients of the data unless impossible or disproportionate. You have the right to be informed about those recipients.
Right to portability under Article 20 GDPR: you may receive data you supplied in a structured, commonly used, machine-readable format or request transfer to another controller where technically feasible;
Right to withdraw consent under Article 7(3) GDPR: you may withdraw consent at any time with future effect. We will promptly delete the data unless another basis permits continued processing without consent. Withdrawal does not affect the lawfulness of earlier processing;
Right to complain under Article 77 GDPR: if you believe processing breaches the GDPR, you may, without prejudice to other administrative or judicial remedies, complain to a supervisory authority, particularly in the Member State of your residence, workplace or the alleged infringement.
8.2 RIGHT TO OBJECT
IF WE PROCESS YOUR DATA ON THE BASIS OF OUR OVERRIDING LEGITIMATE INTEREST FOLLOWING A BALANCING OF INTERESTS, YOU MAY OBJECT AT ANY TIME WITH FUTURE EFFECT ON GROUNDS RELATING TO YOUR PARTICULAR SITUATION.
IF YOU OBJECT, WE WILL STOP PROCESSING THE DATA. WE MAY CONTINUE IF WE DEMONSTRATE COMPELLING LEGITIMATE GROUNDS OVERRIDING YOUR INTERESTS, RIGHTS AND FREEDOMS, OR IF PROCESSING SERVES THE ESTABLISHMENT, EXERCISE OR DEFENCE OF LEGAL CLAIMS.
IF WE PROCESS YOUR DATA FOR DIRECT MARKETING, YOU MAY OBJECT TO THAT PROCESSING AT ANY TIME USING THE METHOD DESCRIBED ABOVE.
IF YOU OBJECT, WE WILL STOP PROCESSING YOUR DATA FOR DIRECT MARKETING.
9) Right of access:
You generally have rights of access, rectification, erasure, restriction, portability, withdrawal of consent and objection.
If you believe processing breaches data protection law or your data protection rights have otherwise been infringed, you may complain to the competent authority. In Austria, this is the Datenschutzbehörde, the Data Protection Authority.
Please contact me if you have further questions. I am confident we can find a satisfactory answer.
Dr. Marta-Katarzyna Chalupa
Tax and business advisory services
Porzellangasse 3/5, 1090 Vienna
T: +43 1 9978068
E: office@chalupa-steuerberatung.eu
10) Retention of personal data
Retention depends on the legal basis, processing purpose and, where applicable, statutory retention periods, such as those under commercial and tax law.
Data processed on express consent under Article 6(1)(a) GDPR is retained until consent is withdrawn.
Data subject to statutory retention and processed for contractual or similar obligations under Article 6(1)(b) GDPR is routinely deleted after those periods if no longer needed to perform or enter a contract and/or no legitimate interest in continued storage remains.
Data processed under Article 6(1)(f) GDPR is retained until an objection under Article 21(1), unless we demonstrate compelling legitimate grounds overriding the person’s interests, rights and freedoms, or processing serves legal claims.
Data processed for direct marketing under Article 6(1)(f) GDPR is retained until an objection under Article 21(2) GDPR.
Unless the information on specific processing situations in this policy states otherwise, other stored data is deleted when no longer necessary for the purposes for which it was collected or otherwise processed.