Personal Data

This privacy policy applies to all visitors to our website. All personal references apply equally to male, female, and diverse individuals and should be understood as inclusive.

Privacy Overview

Per Article 12 of the GDPR, website operators must inform visitors precisely, transparently, and understandably about the processing of personal data. We aim to contribute to this by summarizing our privacy policy as follows:

Processing Personal Data for Contracts: We process personal data to establish, execute, and/or terminate contracts using services such as PayPal, Digistore24, Sofortüberweisungen, CopeCart, Mollie, Calendly, Klick-Tipp, Zapier, Woodpecker, and HubSpot.

Processing Based on Consent: We process personal data with your consent for services like Google Analytics, Google Optimize, Google Tag Manager, Hotjar, social networks with advertising tools (Facebook, LinkedIn), Google Ads, Google Remarketing, YouTube, Klick Tipp, and HubSpot.

Processing Based on Legitimate Interest: We process personal data for informational website use, transient cookies, rights management with external legal advice, Trustpilot, and PostAffiliate Pro.

Automated Decision-Making: We do not process personal data through automated decision-making or profiling.

Responsibility

The data controller per Article 4(7) GDPR for processing visitors‘ personal data on this website is:

PATHADVICE International GmbH
Represented by Dr. Michael Suitner (CEO)
Serlesweg 3, 6161 Natters, Austria
Email: info@pathadvice.at
Phone: +43 676 415 9000

Rights

(1) Under the GDPR, individuals have several rights regarding their personal data, including the right to:

1. Access stored personal data,
2. Rectify incorrect personal data,
3. Erase personal data if there is no legal basis for continued storage,
4. Restrict the processing of stored personal data,
5. Data portability,
6. Lodge a complaint with the relevant data protection authority.

(2) We will promptly fulfill your claims if the conditions are met and you can be identified.

Automated Decision-Making Including Profiling

Automated decision-making, including profiling, does not occur. Further details are provided in our separate data protection declaration.

Data Transfer Outside the EU

(1) We may transfer personal data to non-EU entities, ensuring GDPR-level protection per Article 44 GDPR. Non-EU entities may include controllers and processors.

(2) An adequacy decision signifies that the entity offers adequate protection per Article 45 GDPR.

(3) Standard contractual clauses ensure GDPR compliance per Articles 46(1) and (5) GDPR.

(4) Your consent to data transfer includes acknowledgment of all associated risks without adequacy decisions or other safeguards, per Article 49(1)(a) GDPR.

(5) These provisions apply only if referenced in the following declaration.

Special Case: Standard Contractual Clauses and US Entities

(1) Standard contractual clauses for US entities are limited. We only use them after thorough risk assessment and verification of adequate safeguards.

(2) We disclose this precautionarily, and it applies only if referenced in the following declaration.

Special Case: Consent for Data Transfer to US Entities with Risk Notices

(1) Standard contractual clauses for US entities are limited. Consent may be requested, with risk disclosure including:

1. Lack of comprehensive data protection laws in the US,
2. Extensive US legislative access to personal data,
3. Limited effective legal remedies for EU citizens in the US.

Mandatory Processing Based on Legal Obligations

Processing based on Article 6(1)(c) GDPR is mandatory only if referenced in the following data protection declaration.

Contractually Required Processing (Primary Legal Basis: Article 6(1)(b) GDPR)

General Purpose and Legal Basis for Described Processing

(1) Processing aims to establish, execute, and terminate contracts and defend against related claims.

(2) Article 6(1)(b) GDPR is the legal basis for contract-related processing, allowing data processing without consent if necessary for contract fulfillment or pre-contractual measures at your request.

(3) Article 6(1)(c) GDPR mandates data retention for ongoing legal or administrative proceedings.

(4) The same legal basis applies to data processed in your capacity as an applicant, current, or former employee.

(5) Article 6(1)(f) GDPR allows you to object to processing, which, if valid, terminates the processing. No processing obligation exists without explicit Article 6(1)(c) GDPR reference.

General Data Retention Information for Described Processing

(1) Data is retained as necessary for contract establishment, execution, termination, and defense against related claims.

(2) Contractual data is retained until legal retention periods expire, per Article 6(1)(c) GDPR and § 212 UGB, which mandates retention beyond purpose fulfillment for some data types.

(3) Applicant data is retained until the final decision, six months post-rejection for complaint defense (Article 6(1)(f) GDPR), or until consent withdrawal for applicant pool inclusion (Article 6(1)(b) GDPR). No retention obligation is established by this declaration.

(4) Article 6(1)(f) GDPR allows you to object to processing, terminating it if valid. No processing obligation exists without explicit Article 6(1)(c) GDPR reference.