Data Privacy

Data Protection Notice
It is very important to voestalpine Precision Strip GmbH, Waidhofner Strasse 3, 3333 Böhlerwerk, Austria (hereinafter “we,” “us,” or “our”) to protect your personal data. We comply with the applicable legal provisions on the protection, lawful handling and confidential treatment of personal data as well as on data security, in particular the European General Data Protection Regulation (“GDPR”) and the applicable national data protection regulations.
This Data Protection Notice informs you of the nature, scope, and purposes of the collection and use of your personal data by us in connection with your visit to and use of our website (www.voestalpine.com/precision-strip), our social media accounts (Facebook, Instagram, YouTube and LinkedIn) and when you contact us.
Here you will find separate Data Protection Notices applicable to separate issues:

• General Data Protection Notice for Business Partners
• General Data Protection Notice for Event Participants

 
1.   Who is responsible for data processing and who can you contact?
Controller:
voestalpine Precision Strip GmbH
Waidhofner Strasse 3
3333 Boehlerwerk
Austria
E-Mail: <This e-mail address is protected against spam bots, you have to activate JavaScript in your browser to see it.>

2.   What is personal data?
The term “personal data” (“data”) means any relating to an identified or identifiable natural person (“data subject”). This includes, for example, the name, the email address, or the IP address.

3.   Processing of data when you use our website
Your data is processed for the following purposes:
3.1 Availability and protection of the website
Purpose: You may visit our website without providing any further personal information. When you use our website, your end device sends data to our web server. This data is processed by our web servers and automatically stored in so-called “log files.” The processing of your data is necessary in order for us to make our website available to you. We must store the data in log files so that we can ensure the security and functionality of our website.
Categories of data: IT log and detection data (IP address, HTTP header fields, browser type, previously visited website (so-called “referrer”), date and time of access, other web traffic data, such as information on the device used, the volume of data sent, etc.)
Legal basis: It is in our legitimate business interest to make a secure, functional, and user-friendly website available. That is why we process data in accordance with Article 6 (1) (f) GDPR.
Storage period: The aforementioned data is stored for 8 months and is erased upon expiration of this deadline, unless the data is still needed for investigating a security-related event (e.g., a cyber attack) on our website after it has occurred.
Categories of recipients: Processors (IT service providers); in case of a security-related event, possibly also: law enforcement agencies, attorneys, courts, and administrative authorities.
3.2 Use of cookies and Google Analytics
Please see the [Link Cookie Banner] for information on the data protection provisions that apply to the use of cookies and Google Analytics. Among other things, this information explains the nature, scope, purposes, data categories, legal basis, storage periods, and categories of recipients of the cookies used.
3.3 Processing of data after contact
Purpose: You may contact us by email, telephone, or fax if you have any questions about our company, our products, and our services. If you do so, we will process your data for the purpose of processing your inquiry; as a result, your data may also be processed in one of our customer management systems.
Categories of data: Basic data of the data subject (e.g., salutation, title, first and last name); private contact details (e.g., address, telephone number, email address); correspondence data (e.g., content of the inquiry); IT log and detection data (e.g., date and time of the inquiry); as well as all data you make available to us by uploading or attaching documents.
Legal basis: Inquiries are processed either by carrying out (pre-)contractual steps (Article 6 (1) (b) GDPR) or pursuant to our legitimate business interest (Art. 6 (1) (f) GDPR), specifically, our interest in communicating with our customers and website users.
Storage period: We store your data as long as necessary to process your inquiry. Once your inquiry has been fully dealt with, your data will be deleted in compliance with statutory retention periods, unless the further processing of data is necessary to establish, fend off, or defend legal claims and to enforce them in official or judicial proceedings.
Categories of recipients: Processors (IT service providers). In order to fulfill the intended purposes, in some cases, we may also have to transfer your data to other voestalpine Group companies (www.voestalpine.com/locations) in order to ensure that your inquiry is processed quickly.

4. Data transfers to third countries
Due to the complexity of today’s data processing procedures, we engage so-called processors to process your data. To the extent possible in this connection, we only engage processors that are based within the European Union (EU) or the European Economic Area (EEA) and are therefore subject to the GDPR.
However, we may process data in third countries (i.e. outside the EU and/or the EEA) or the processing may be carried out by using service providers based outside the EU or EEA. The level of data protection in some of these third countries may not be equivalent to EU standards. For example, the processing of personal data by law enforcement agencies may not be restricted to that which is absolutely necessary, and data subjects may only have limited rights of legal remedy.
However, we always ensure that European data protection and data security standards are maintained.

• First, we may transfer data according to Article 45 GDPR to those third countries where the European Commission has decided that they ensure an adequate level of protection (transfer on basis of an adequacy decision).
• In the absence of such an adequacy decision by the European Commission, we only transfer data subject to appropriate safeguards pursuant to Article 46 GDPR. In particular, we use the standard data protection clauses approved by the European Commission or binding corporate rules; we may also ensure by other means that an adequate level of data protection is put in place (e.g. participation of the recipient in an approved certification system).
• In individual cases, the aforementioned appropriate guarantees pursuant to Article 46 GDPR as well as the additional measures taken may not be effective enough and thus gaps in legal protection remain. In such cases, we process your data in accordance with the exception of Article 49 GDPR. This means that, depending on the individual case we base the legitimacy of the transfer of you data – among other things - on (i) your explicit consent (Article 49 (1) (a) GDPR); (ii) the need to conclude or perform the contract (Article 49 (1) (b) GDPR); or (iii) the need to establish, exercise, or defend our legal claims (Article 49 (1) (e) GDPR).

Further information as well as a copy of the implemented measures can be obtained via the contact details listed under item 6.

5. Rights of the data subjects and the right to lodge a complaint

• According to Article 15 GDPR, you have the right to obtain confirmation from the controller as to whether or not your personal data is processed and the right to access your data.
• According to Article 16 GDPR you have the right to request rectification of inaccurate data relating to you and/or completion of incomplete data without undue delay.
• According to Article 17 GDPR you have the right to have your data erased.
• According to Article 18 GDPR you have the right to restrict the processing of your data.
• According to Article 20 GDPR you have a right to data portability.
• According to Article 21 GDPR you have the right to object to the processing of your data.

Finally, you also have the possibility to lodge a complaint with the competent supervisory authority.
If the processing of your data is based on your consent, you have the right to withdraw your consent at any time. The withdrawal of your consent shall not affect the lawfulness of processing based on consent before your withdrawal.
 
6. Contact details
If you have any questions about data protection and the assertion of your aforementioned rights, you can contact our data protection organisation at <This e-mail address is protected against spam bots, you have to activate JavaScript in your browser to see it.> or by postal mail to voestalpine Precision Strip GmbH, Waidhofner Strasse 3, A-3333 Boehlerwerk.
This Data Protection Notice is amended from time to time.