This privacy policy provides information on how Variocube GmbH, Franckstraße 45, 4020 Linz, office@variocube.com (controller), handles personal data in the context of its business activities, in particular for the websites operated by Variocube GmbH and for the cloud services offered by Variocube GmbH. The processing of personal data is carried out in accordance with the requirements of the EU General Data Protection Regulation and in compliance with the applicable Austrian data protection regulations. The transfer of data for processing within and outside Variocube GmbH for the purpose of order processing is carried out in compliance with the General Data Protection Regulation. Variocube GmbH takes your data protection very seriously and treats your personal data confidentially and in accordance with the statutory provisions. As new technologies and the constant further development of this website and our services may result in changes to this privacy policy, we recommend that you read the privacy policy again at regular intervals. Definitions of the terms used (e.g. "personal data" or "processing") can be found in Art. 4 GDPR. Automated decision-making (including profiling) within the meaning of Art. 22 GDPR is not used. There is no obligation to provide us with personal data - without the data described below, however, a contractual relationship or advertising approach would not be possible.

4 How long will the data be stored?

We store personal data to the extent necessary for the duration of the entire business relationship from the initiation, implementation / execution to the termination of a contract and beyond in accordance with the statutory retention and documentation obligations. (e.g. retention obligations under commercial and tax law (generally 7 years in accordance with § 132 BAO and §§ 190, 212 UGB), or as long as limitation periods for potential legal claims have not expired (up to 30 years in accordance with the General Civil Code).

1 What data is processed and where does this data come from?

1.1 Directly collected data of data subjects

If you decide to use Variocube lockers, which are commercially offered and operated by us (Variocube GmbH), we collect and process the data required for use, depending on the service used (e.g. Click&Collect; Safe Cube, Service Cube). As a rule, this is your registration, login, usage, communication and, if applicable, billing data, such as name, telephone number, e-mail address, login/registration time, delivery/collection status. Status notifications. If an authorised person authorised by the user accesses the corresponding service, we also process this usage/access data.

1.2 Data not collected from the data subject

We process data of other persons authorised to use/access the website if the registered user provides such other persons including data (including name, telephone number, e-mail address). This data is not collected from the data subjects themselves.

2 For what purposes and on what legal basis is personal data processed?

2.1 Contract initiation; contract processing/fulfilment

The processing of personal data of (potential) users takes place in the context of pre-contractual measures or in the context of the use of the services offered in order to provide and bill them according to the requested/ordered scope. The legal basis in this respect is Art. 6 para. 1 lit. b GDPR (pre-contractual measures on request or fulfilment of contract). Data of other authorised users, which are authorised or specified by the user, are processed on the basis of our legitimate interest (Art. 6 para. 1 lit. f GDPR) for the purpose of smooth processing of the desired service. 

2.2 Fulfilment of legal obligations 

Insofar as the processing of personal data is necessary to fulfil a legal obligation (e.g. storage/documentation obligations) to which our company is subject, Art. 6 para. 1 lit. c GDPR serves as the legal basis for data processing.

2.3 Improving our products and services

In order to improve our products and services, we invite you to take part in surveys. The surveys can be answered without disclosing personal data. Providing personal data is voluntary and not necessary. The legal basis for this is your consent (Art. 6 para. 1 lit. a GDPR) and/or our legitimate interest in the further development and optimisation of our offer (Art. 6 para. 1 lit. f GDPR).

2.4 Newsletter; sending of product information / company-related news

We use personal data to send our users emails (newsletters), letters or advertising brochures. This is generally done on the basis of consent (Art. 6 para. 1 lit. a GDPR) and/or on the basis of our legitimate interest in user retention (Art. 6 para. 1 lit. f GDPR). The user has the right to object to this processing of the user's data for the purpose of direct advertising at any time without giving reasons (please send an email to office@variocube.com or a letter to Variocube GmbH, 4020 Linz, Franckstraße 45). 

3 Who receives personal data?

Access to personal data is granted to those employees, departments, cooperation partners and vicarious agents who need it to fulfil contractual or legal obligations and in the case of legitimate interest. We also transfer your data to tax consultants and auditors for the purposes of tax advice and auditing and, in individual cases, to lawyers and courts if this is necessary for legal advice or law enforcement. In addition, we work together with various processors to whom personal data is transmitted to fulfil the respective service. In individual cases, other recipients may be Authorities, insurers, third-party financiers, investors, companies in the corporate group, otherwise involved business partners, IT service providers. With regard to advertising, these may include, in particular, IT service providers and shipping service providers. Due to the cloud-based software, which is at the core of the functionality of the web-enabled lockers, data is stored by web service providers on servers at EU locations, by housing and hosting providers, on rented data centre infrastructure, by providers of management, sales and administration software, among others. In principle, there is no intention to transfer data to a third country (outside the EU); if such a transfer takes place in individual cases, this is done in compliance with the requirements of data protection law.

4 How long will the data be stored?

We store personal data to the extent necessary for the duration of the entire user relationship from initiation, implementation / execution to termination and beyond in accordance with the statutory retention and documentation obligations. (e.g. retention obligations under commercial and tax law (generally 7 years in accordance with § 132 BAO and §§ 190, 212 UGB), or as long as the limitation periods for potential legal claims have not expired (up to 30 years in accordance with the General Civil Code).