Privacy Policy

With this privacy policy, we inform you about the types of your personal data (hereinafter "data") we process, for what purposes, and to what extent within the scope of our company, our online presence (websites, online shops, apps), and our external online presences (e.g. social media profiles).

Avica GmbH

Kreindlgasse 10/6

1190 Vienna, Austria

Inventory data (e.g. names, addresses, dates of birth, power of representation).

Contact data (e.g. email addresses, phone numbers).

Contract data (e.g. subject matter of contract, term, customer category).

Payment data (e.g. bank details, credit card details, payment history, invoices).

Usage data (e.g. visited websites, interest in content, access times, click paths).

Meta/communication data (e.g. device information, IP addresses, browser types).

Location data (geographic positions of devices/persons).

Content data (e.g. entries in online forms, comments, chat content).

Image and/or video recordings (e.g. in media productions, events, video conferences).

Facebook Event Data and Facebook contact information (via pixel/interfaces).

Customers, prospects, and contractual partners.

Users (website visitors, app users).

Communication partners (via email, phone, messengers, chat).

Sweepstake and contest participants.

Participants in events, seminars, and training sessions.

Depicted persons (on photos, videos, or within the scope of media productions).

Provision of contractual services (e-commerce, web design, IT services, rental, media production, logistics, property management).

Customer service, answering inquiries, and contact management.

Provision of the online offer, optimization of usability, and IT infrastructure.

Security measures (spam defense, protection against DDoS attacks, integrity assurance).

Direct marketing, online marketing, remarketing, tracking, and target group formation (Custom Audiences).

Reach measurement, conversion measurement, A/B testing, and economic analysis.

Conducting sweepstakes, contests, surveys, and evaluation procedures.

Office organization, bookkeeping, and administrative processes.

We process data on the basis of the GDPR as well as the Austrian Data Protection Act (DSG) and the Telecommunications Act (TKG 2021). The specific legal bases are:

Consent (Art. 6 para. 1 lit. a GDPR): The data subject has consented to the processing for a specific purpose (e.g. optional cookies, marketing newsletters).

Performance of contract & pre-contractual measures (Art. 6 para. 1 lit. b GDPR): Required to fulfill a contract or to prepare a contract upon request of the customer (e.g. online shop orders, web design projects).

Legal obligation (Art. 6 para. 1 lit. c GDPR): Required to fulfill legal obligations to which we are subject (e.g. 7-year retention period under Section 132 of the BAO for tax documents).

Legitimate interests (Art. 6 para. 1 lit. f GDPR): Required to safeguard our legitimate economic, technical, or organizational interests, provided that the interests of the data subjects do not prevail (e.g. IT security, administrative organization, functional LocalStorage entries).

Technical and organizational measures (TOMs)

We take appropriate technical and organizational measures in accordance with legal requirements, taking into account the state of the art, to ensure a level of security appropriate to the risk. This includes in particular TLS encryption (https) for our online presence to protect data transmission, as well as technological and physical security measures for our offices and storage locations of our data storage systems.

Data erasure and retention periods

The data will be deleted as soon as the purpose of its processing no longer applies and no statutory retention obligations prevent deletion.

Tax and corporate records: Are generally stored for 7 years (or longer if relevant for pending proceedings) in accordance with Section 132 of the BAO and corporate regulations.

Contractual claims: Data can be stored for up to 3 years (general limitation period) or in exceptional cases up to 30 years to defend against or assert claims.

Server log files: Are deleted after a maximum of 720 days or anonymized and stored permanently.

Sweepstake data: Are generally deleted 6 months after the end of the sweepstake, unless winner data must be stored longer (up to 3 years) due to warranty reasons.

Webhosting & CDN (Cloudflare)

Our website infrastructures are provided and hosted via Cloudflare Pages and the global Content Delivery Network (CDN) of Cloudflare Inc. (101 Townsend St, San Francisco, CA 94107, USA). When using our website, personal data (such as IP address, meta and communication data, as well as access times) is transmitted and processed on Cloudflare's servers to ensure a fast, reliable, and secure provisioning of our websites.

Legal basis: Art. 6 para. 1 lit. b GDPR (performance of contract or pre-contractual measures) and Art. 6 para. 1 lit. f GDPR (legitimate interest in a fast, stable, and secure provisioning of our online offer).

Database & Hosting Services (Supabase)

For the storage of user data, registrations, and other application data, we use the cloud database platform Supabase, provided by Supabase Inc. (970 Summer St, Stamford, CT 06905, USA). Personal data (such as email addresses, names, and other form data entered by you) is processed and stored on Supabase's servers. We use European server locations of Supabase to ensure data privacy-compliant storage within the EU. We have concluded a data processing agreement (DPA) with the provider.

Legal basis: Art. 6 para. 1 lit. b GDPR (performance of contract or pre-contractual measures) and Art. 6 para. 1 lit. f GDPR (legitimate interest in a secure, scalable, and high-performance database infrastructure).

Webhosting ALL-INKL

For certain online projects and email services, we also use ALL-INKL.COM - Neue Medien Münnich (Hauptstraße 68, 02742 Friedersdorf, Germany). We have concluded a data processing agreement (DPA) with the provider.

Legal basis: Art. 6 para. 1 lit. f GDPR (IT infrastructure).

Technical Storage (LocalStorage & Cookies)

Essential LocalStorage

Our web presence uses the local storage of your browser ("LocalStorage") to store purely functional settings locally. This is technically mandatory for the operation of the site (Legal basis: Art. 6 para. 1 lit. f GDPR):

language: Stores the selected language (DE/EN).

theme: Stores the visual design (dark/light mode).

cookie-consent: Stores the privacy settings granted in the consent banner.

cf-turnstile-response: Stores the security token of the spam defense of Cloudflare.

Cookie Consent Management

We use an in-house cookie consent solution. When calling up the website, you are asked which categories (statistics, marketing) you allow. Without your explicit consent (Art. 6 para. 1 lit. a GDPR), only technically necessary functions/cookies are loaded. You can revoke your consent at any time via the cookie settings on the website.

Content Delivery Networks (CDNs) & Fonts

Jetpack CDN: We integrate scripts and media files via the CDN of Aut O'Mattic A8C Ireland Ltd. (Grand Canal Dock, 25 Herbert Pl, Dublin, Ireland). Legal basis: Art. 6 para. 1 lit. f GDPR.

Google Fonts (Self-Hosted): To protect your privacy maximumly, we integrate Google Fonts locally via our Next.js system. The fonts are loaded exclusively from our own servers. No connection to Google servers is made.

Google Fonts (retrieval from Google servers): For special projects or specific platform solutions, fonts are loaded directly from Google Ireland Ltd. Here, the IP address is transmitted to Google. Legal basis: Art. 6 para. 1 lit. a GDPR (consent via consent banner).

Font Awesome (Self-Hosted): Icons are provided locally from our server; no data is transmitted to the third-party provider.

IT Security & Spam Protection

Cloudflare Turnstile: We use Turnstile of Cloudflare Inc. (101 Townsend St, San Francisco, CA 94107, USA) to prevent automated bot entries in forms. As we use the invisible Captcha variant, we refer you to the Turnstile Privacy Addendum: https://www.cloudflare.com/en-gb/turnstile-privacy-policy/ . It processes meta and device data in LocalStorage for verification. Legal basis: Art. 6 para. 1 lit. f GDPR (security).

Google reCAPTCHA: Alternatively, we use reCAPTCHA from Google Ireland Limited for bot detection. Legal basis: Art. 6 para. 1 lit. f GDPR.

Akismet Anti-Spam Check: For our blog and community systems, we use Akismet (Aut O'Mattic A8C Ireland Ltd.) for spam detection in comments. Comment data is temporarily matched for analysis. Legal basis: Art. 6 para. 1 lit. f GDPR.

Contact forms and email management

When contacting us (form, email, phone), your details are processed to process the request on the basis of Art. 6 para. 1 lit. b GDPR (contractual/pre-contractual) or Art. 6 para. 1 lit. f GDPR.

Communication via messenger services

We offer communication via various messenger services. If end-to-end encryption is activated, the message contents are not visible to the providers. However, the providers process technical metadata. The communication takes place at your request on the basis of Art. 6 para. 1 lit. b or lit. f GDPR.

Apple iMessage: Apple Inc., Cupertino, CA, USA.

Instagram / Facebook Messenger / WhatsApp: Meta Platforms Ireland Ltd., Dublin, Ireland. We use these services on the basis of an EU data transfer addendum (Standard Contractual Clauses).

Microsoft Teams: Microsoft Ireland Operations Limited, Dublin, Ireland.

Signal: Signal Messenger LLC, Mountain View, CA, USA.

Slack: Slack Technologies Inc., San Francisco, CA, USA.

Telegram: Telegram FZ-LLC, Dubai, UAE.

Shipping service providers

Brevo: For our central newsletters and the processing of forms, we use Brevo (Sendinblue GmbH, Köpenicker Straße 126, 10179 Berlin, Germany). Data is processed on the basis of your consent.

Mailchimp: Rocket Science Group LLC, Atlanta, GA, USA (secured via Standard Contractual Clauses).

MailPoet: Aut O'Mattic A8C Ireland Ltd., Dublin, Ireland.

Double Opt-In and success measurement

Registration takes place in a double opt-in process (logging of IP address and time). Our newsletters contain web beacons (tracking pixels) with which we analyze opening and click behavior to optimize our content. The legal basis for sending and measurement is your explicit consent in accordance with Art. 6 para. 1 lit. a GDPR in conjunction with Section 174 of the TKG 2021. A separate revocation of the success measurement is not possible; the entire subscription must be cancelled.

Reminder emails for the order process

If you cancel a purchase in the online shop, we will send you a reminder email with a link to your shopping cart based on your prior consent (Art. 6 para. 1 lit. a GDPR).

Payment processing

To fulfill contracts (Art. 6 para. 1 lit. b GDPR), we use secure payment service providers. The data processing takes place directly at the respective payment provider according to its privacy policy:

American Express: American Express Europe S.A., Frankfurt, Germany.

Apple Pay: Apple Inc., Cupertino, CA, USA.

giropay: giropay GmbH, Frankfurt, Germany.

Google Pay: Google Ireland Limited, Dublin, Ireland.

Klarna / Sofortüberweisung: Klarna Bank AB, Stockholm, Sweden.

Mastercard: Mastercard Europe SA, Waterloo, Belgium.

PayPal: PayPal (Europe) S.à r.l., Luxembourg.

Stripe: Stripe Inc., San Francisco, CA, USA.

Visa: Visa Europe Services Inc., London, UK.

EPS: Studiengesellschaft für Zusammenarbeit im Zahlungsverkehr GmbH, Vienna, Austria.

Coinbase Commerce (cryptocurrencies): Coinbase Commerce, Singapore. The processing of transaction data on the blockchain takes place within the scope of our legitimate interests (Art. 6 para. 1 lit. f GDPR).

External Sales Channels (Marketplaces and Service Platforms)

We also sell products and offer our services via external online marketplaces, brokerage, and booking platforms. In this context, we process inventory, contact, and contract data for proper order processing and mediation.

Legal basis: Art. 6 para. 1 lit. b GDPR (performance of contract and pre-contractual measures).

In addition to our privacy policy, the privacy policies and terms of use of the respective platform operators apply:

Amazon: Amazon EU S.à r.l., 38 avenue John F. Kennedy, L-1855 Luxembourg.

eBay: eBay Marketplaces GmbH, Helvetiastrasse 15/17, 3005 Bern, Switzerland.

Etsy: Etsy Ireland UC, 66/67 Great Strand Street, Dublin 1, Ireland (for users in the EU) or Etsy, Inc., Brooklyn, NY, USA.

Willhaben: willhaben Internet Service GmbH & Co KG, Marxergasse 4a, 1030 Vienna, Austria.

Geizhals: Geizhals Internet Services GmbH, Schönbrunner Straße 7, 1040 Vienna, Austria.

Kleinanzeigen: Kleinanzeigen GmbH, Albert-Einstein-Ring 26, 14532 Teltow, Germany.

MyHammer: MyHammer GmbH, Müllerstraße 135, 13349 Berlin, Germany.

TaskRabbit: TaskRabbit, Inc., 237 Kearny Street, San Francisco, CA 94108, USA (secured via EU Standard Contractual Clauses).

RentAHuman: RentAHuman, Inc., San Francisco, California, USA (secured via EU Standard Contractual Clauses).

Vinted: Vinted, UAB, Švitrigailos g. 13, 03228 Vilnius, Lithuania.

These services are activated without exception only after your explicit consent via our cookie banner (Art. 6 para. 1 lit. a GDPR). They serve to measure the success of campaigns and display interest-based advertising.

Google Marketing Services

Google Analytics (UA / GA4) & Google Optimize: Analyzes user behavior on the basis of pseudonymous IDs. IP addresses are shortened on EU servers by default (IP masking) before data is transmitted to the USA.

Google Ad Manager / Google Ads / AdSense: Displays personalized or non-personalized advertisements in the Google advertising network. By means of Enhanced Conversions, hashed (mathematically encrypted) customer data (e.g. email addresses) is matched with Google accounts for more precise success measurement.

Responsible service provider in Europe: Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland (Parent company: Google LLC, 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA).

Meta Marketing Services

Meta Pixel (formerly Facebook Pixel) & Custom Audiences: Captures interactions on our website so that we can show visitors tailored advertisements on Facebook/Instagram. By means of Advanced Matching, contact data is transmitted to Meta as hash values to define target groups more precisely.

Responsible service provider in Europe: Meta Platforms Ireland Limited, 4 Grand Canal Square, Grand Canal Harbour, Dublin 2, Ireland (Parent company: Meta Platforms, Inc., 1 Hacker Way, Menlo Park, CA 94025, USA).

Other Advertising Pixels & Analytics

These tools capture conversions and click behavior on our website within the scope of the marketing consent you have granted. Below you will find the exact details of the respective operating companies:

LinkedIn Insights Tag / LinkedIn Conversion Tracking

Responsible service provider in Europe: LinkedIn Ireland Unlimited Company, Wilton Plaza, Wilton Place, Dublin 2, Ireland (Parent company: Microsoft Corporation, One Microsoft Way, Redmond, WA 98052-6399, USA).

Microsoft Advertising (formerly Bing Ads)

Responsible service provider in Europe: Microsoft Ireland Operations Limited, One Microsoft Place, South County Business Park, Leopardstown, Dublin 18, D18 P521, Ireland (Parent company: Microsoft Corporation, One Microsoft Way, Redmond, WA 98052-6399, USA).

TikTok Pixel

Responsible service provider in Europe: TikTok Technology Limited, 10 Earlsfort Terrace, Dublin, D02 T380, Ireland (Parent company: ByteDance Ltd., Beijing, China).

Adobe Analytics

Responsible service provider in Europe: Adobe Systems Software Ireland Limited, 4-6 Riverwalk, Citywest Business Campus, Dublin 24, Ireland (Parent company: Adobe Inc., 345 Park Avenue, San Jose, CA 95110-2704, USA).

Jetpack Stats (WordPress Stats)

Responsible service provider in Europe: Aut O’Mattic A8C Ireland Ltd., Grand Canal Dock, 25 Herbert Place, Dublin, D02 AY86, Ireland (Parent company: Automattic Inc., 60 29th Street #343, San Francisco, CA 94110, USA).

Note on data transfer to third countries: Insofar as the European subsidiaries mentioned above transfer data to their respective parent companies in the USA or other third countries, this takes place on the basis of valid adequacy decisions of the EU Commission (such as the EU-US Data Privacy Framework) or by concluding EU Standard Contractual Clauses (SCC) to guarantee an equivalent level of data protection.

Presences in social networks (Social Media)

We operate company pages on various platforms. When visiting these pages, the operators process your data for market research and advertising purposes (creation of usage profiles).

Joint responsibility (Joint Controller): For the collection of data on our Facebook / Instagram fan page (so-called "Page Insights"), we are jointly responsible with Meta Platforms Ireland Limited. We have concluded an agreement in accordance with Art. 26 GDPR. You can primary assert your data subject rights directly with Meta.

Other profiles: LinkedIn, Pinterest, TikTok, Twitter/X, Vimeo, YouTube, Xing.

Integration of Media, Map Services and Content of Third-Party Providers

We integrate functional, media, and content elements into our online presence that are obtained from the servers of the respective third-party providers to provide you with advanced convenience functions.

Legal basis: If you have consented to activation via our cookie or content consent banner, processing takes place on the basis of your consent (Art. 6 para. 1 lit. a GDPR). In the case of technically mandatory displays (or systems that are loaded purely functionally without cookie injection), we base processing on our legitimate interest in a user-friendly and modern design of our online presence (Art. 6 para. 1 lit. f GDPR).

Below you will find the exact details of the companies responsible for data processing:

Map Services (Interactive Maps)

Google Maps: Responsible service provider in Europe: Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Irland (Parent company: Google LLC, 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA).

OpenStreetMap: Responsible service provider: OpenStreetMap Foundation (OSMF), St John’s Innovation Centre, Cowley Road, Cambridge, CB4 0WS, United Kingdom.

Video Player (Embedded Video Content)

YouTube Videos: Responsible service provider in Europe: Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Irland (Parent company: Google LLC, 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA).

Vimeo: Responsible service provider: Vimeo.com, Inc. (formerly Vimeo LLC), 555 West 18th Street, New York, New York 10011, USA.

Note on technical process and third-country transfers: By retrieving the embedded content, your browser automatically establishes a direct connection to the servers of the respective provider. In this context, at least your IP address and the information about which of our web pages you accessed is transmitted to the third-party provider. Insofar as processing takes place outside the EU/EEA (in particular with US providers or in the United Kingdom), an appropriate level of data protection is guaranteed either by existing adequacy decisions of the EU Commission (such as the EU-US Data Privacy Framework) or by concluding strict EU Standard Contractual Clauses (SCC).

We participate in review and evaluation procedures to evaluate, optimize, and advertise our services. We integrate rating widgets on our web pages that display quality seals or customer opinions. These widgets load data directly from the servers of the respective providers, which receive your IP address and technical access data.

To verify real reviews, we transmit the required data (name, email address, and order/item number) to the respective platform after your purchase - exclusively after your explicit consent (Art. 6 para. 1 lit. a GDPR). Otherwise, the mere display of the widgets takes place on the basis of our legitimate interest in professional marketing (Art. 6 para. 1 lit. f GDPR).

Below you will find the exact commercial details of the responsible platform operators:

bewertet.de: Responsible service provider: salesworker.com GmbH, Kattenbug 2, 50667 Cologne, Germany.

Google Customer Reviews: Responsible service provider in Europe: Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland (Parent company: Google LLC, USA).

kununu: Responsible service provider: kununu GmbH, Schloßhofer Straße 4-6, 1210 Wien, Austria (A company of New Work SE, Am Strandkai 1, 20457 Hamburg, Germany).

Trusted Shops (Trustedbadge): Responsible service provider: Trusted Shops AG (or Trusted Shops GmbH), Subbelrather Str. 15C, 50823 Cologne, Germany.

Trustpilot: Responsible service provider: Trustpilot A/S, Pilestræde 58, 5th floor, 1112 Copenhagen K, Denmark.

Yelp: Responsible service provider in Europe: Yelp Ireland Limited, 70 Sir John Rogerson’s Quay, Dublin 2, Ireland (Parent company: Yelp Inc., 140 New Montgomery Street, San Francisco, CA 94105, USA).

We integrate so-called affiliate links or advertising references (e.g. discount codes, search masks, widgets) into our online presence. If you follow these links to the offers of third parties and purchase products or book services there, we receive a commission from these providers.

To enable the respective third-party providers to track the mediation and correctly bill the commission, it is technically necessary for them to know that you were redirected from our website. For this purpose, certain values (such as referrer URL, time, partner ID) are transmitted in a cookie or as part of the link.

Legal basis: If you have consented via our cookie banner, use takes place on the basis of your consent (Art. 6 para. 1 lit. a GDPR). Otherwise, we base processing on our legitimate interest in economic and efficient monetization of our online presence (Art. 6 para. 1 lit. f GDPR).

Below you will find the complete corporate details of the participating affiliate programs:

Amazon Affiliate Program: Responsible service provider: Amazon EU S.à r.l., 38 avenue John F. Kennedy, L-1855 Luxembourg (Parent company: Amazon.com, Inc., USA).

Booking.com Affiliate Program: Responsible service provider: Booking.com B.V., Herengracht 597, 1017 CE Amsterdam, Netherlands.

Digistore24 Affiliate Program: Responsible service provider: Digistore24 GmbH, St.-Godehard-Straße 32, 31139 Hildesheim, Germany.

eBay Partner Network: Responsible service provider: eBay Partner Network, Inc., 2145 Hamilton Ave., San Jose, CA 95125, USA (For European contractual processes cooperating with eBay Marketplaces GmbH, Helvetiastrasse 15/17, 3005 Bern, Switzerland; data transfers to the USA are secured via EU Standard Contractual Clauses).

Web design & maintenance services

Within the scope of web hosting and maintenance contracts, we may obtain access to client systems containing personal data of their end customers or employees. These processing activities take place strictly within the scope of the main contract and a data processing agreement (DPA) to be concluded separately in accordance with Art. 28 GDPR.

Rental and leasing of equipment

When renting out technical equipment (camera, audio, and IT hardware), we process inventory and identification data (copies of IDs in case of justified suspicion or handover) to protect our property. Legal basis: Art. 6 para. 1 lit. b GDPR and Art. 6 para. 1 lit. f GDPR (protection of property).

Media production (film/photo/audio)

Within the scope of creating media productions, we process image and sound recordings of persons. Insofar as these persons act within the scope of client orders, processing takes place to perform the contract (Art. 6 para. 1 lit. b GDPR) or on the basis of consent declarations (Model Release) (Art. 6 para. 1 lit. a GDPR). For recordings in public spaces or at events, we base processing on our legitimate interest in documentation and reporting (Art. 6 para. 1 lit. f GDPR).

Property management & space rental

When renting out studios, rooms, or properties, we process inventory, contract, and contact data of the tenants to handle the lease relationship and to comply with official and fire safety reporting obligations (Art. 6 para. 1 lit. b and lit. c GDPR).

Transport and logistics services

To carry out freight forwarding and transport transactions, we process address and contact data of recipients and senders. This data is passed on to carriers and transport partners for the delivery of goods. Legal basis: Art. 6 para. 1 lit. b GDPR.

Right of access (Art. 15 GDPR): You can request confirmation as to whether we process data of yours and request a copy of this data.

Right to rectification (Art. 16 GDPR): You can request the immediate correction of incorrect or completion of incomplete data.

Right to erasure / "Right to be forgotten" (Art. 17 GDPR): You can request the erasure of your data, provided that no statutory retention obligations prevent erasure.

Right to restriction of processing (Art. 18 GDPR): You can request that data be blocked and not further processed (e.g. during a verification).

Right to data portability (Art. 20 GDPR): You can request to receive the data you have provided to us in a structured, machine-readable format or to transfer it to another controller.

Right of revocation (Art. 7 para. 3 GDPR): Consent once granted can be revoked at any time with future effect informally (e.g. by email).

Right to object (Art. 21 GDPR): Important: Insofar as your data is processed on the basis of legitimate interests (Art. 6 para. 1 lit. f GDPR), you have the right to object at any time for reasons arising from your particular situation. If the processing is directed against direct marketing, you can object at any time and without justification.

Right to lodge a complaint with the supervisory authority

If you believe that the processing of your data violates data protection law, you have the right to lodge a complaint with the competent supervisory authority of your place of residence. In Austria, this is the:

Austrian Data Protection Authority (DSB)

Barichgasse 40-42

1030 Vienna

Phone: +43 1 52 152-0

Email: ...

Web: www.dsb.gv.at