It is very important to voestalpine Railway Systems GmbH, Kerpelystraße 199, 8700 Leoben, Austria (hereinafter “we,” “us,” or “our”) to protect your personal data. We comply with the legal requirements applicable to the protection, lawful handling, and confidential treatment of data as well as with those pertaining to data security, specifically the European General Data Protection Regulation (“GDPR”) and pertinent national data privacy rules and regulations.
This Data Protection Notice informs you of the type, scope, and purposes of the collection and use by us of your personal data when you visit and use our website www.voestalpine.com/railway-systems ("website"), our social media accounts (LinkedIn and YouTube) and when you contact us.
Here you will find separate Data Protection Notices applicable to separate issues:
Who is responsible for data processing and who can you contact?
voestalpine Railway Systems GmbH
8700 Leoben, Austria
Email address: firstname.lastname@example.org
What is personal data?
The term “personal data” refers to information concerning an identified or identifiable natural person ( “data subject”). For example, this includes the person’s name, email address, or IP address.
Processing of data when you use our website
Your data is processed for the following purposes:
Data transfers to third countries
Given the complexity of prevailing data processing processes, we engage so-called processors to process your data. To the extent possible in this connection, we only engage processors that are domiciled within the European Union (EU) or the European Economic Area (EEA) and are thus subject to the GDPR.
There are scenarios, however, where we process data in third countries (i.e. outside the EU and/or the EEA) or where the processing takes place in connection with the use of service providers domiciled outside of the EU and/or the EEA. The level of data protection in some of these third countries may not correspond to EU standards. For example, the processing of personal data by law enforcement agencies may not be restricted to that which is absolutely necessary, and data subjects may only have limited rights of legal recourse.
We do, however, always ensure that European data protection and data security standards are maintained.
- First of all, under certain circumstances, we may be able to transfer data to those third countries that the European Commission has certified, pursuant to an adequacy decision under Art. 45 GDPR, as possessing an adequate level of data protection.
- If the European Commission has not adopted an adequacy decision regarding a specific third country, we only transfer data subject to appropriate safeguards pursuant to Art. 46 GDPR. In particular, we then apply the standard contractual data protection clauses approved by the European Commission or binding internal data protection regulations; we may also ensure by other means that an adequate level of data protection is put in place (e.g., recipient’s participation in an approved certification system).
- In individual cases, the aforementioned appropriate guarantees pursuant to Art. 46 GDPR as well as the additional measures taken may not be effective enough, thus leaving gaps in legal protections. In cases like these, we process your data in accordance with the exemption under Art. 49 GDPR. Depending on the case at hand, therefore, and to legitimize data transfers we rely on a variety of factors, including (i) your express consent (Art. 49 (1) (a) GDPR); (ii) the need to fulfill the contract (Art. 49 (1) (b) GDPR); or (iii) the need to establish, exercise, or defend our legal claims (Art. 49 (1) (e) GDPR).
You may use the contact information provided to obtain further information as well as a copy of the implemented measures.
Rights of data subjects and option to file a complaint
Article 15 GDPR gives you the right to request confirmation as to whether your data is processed by the controller and the right to access information regarding this data.
Article 16 GDPR gives you the right to request immediate rectification of inaccurate data concerning your person and/or completion of incomplete data.
Article 17 GDPR gives you the right to have your data erased.
Article 18 GDPR gives you the right to restrict the processing of your data.
Article 20 GDPR gives you the right to data portability.
Article 21 GDPR gives you the right to object to the processing of your data.
Finally, you also have the option of filing a complaint with the competent regulatory authority.
If your data is processed pursuant to your consent thereto, you have the right to withdraw your consent at any time; doing so, however, does not affect the legality of the processing carried out until you withdrew your consent.
If you have any questions regarding issue of data protection and the assertion of your rights as enumerated in the foregoing, you may contact our data protection organization at email@example.com or by postal mail to voestalpine Railway Systems GmbH, Kerpelystraße 199, 8700 Leoben, Austria.
This Data Protection Notice is amended from time to time.