For the x-tention group of companies (see section 2) data protection and information security are the basis for stable and successful customer relationships and are a high priority within the group. Therefore, the protection of your personal data is important to us.
When handling data, we comply with all relevant guidelines - particularly the General Data Protection Regulation (GDPR) and the Telecommunications Act (TKG) - in their latest versions. We have taken all technical and organisational measures necessary for appropriate data protection.
In the following, we would like to inform you in detail about which data is collected when visiting our website and using x-tention group offers (see section 2) and how it is processed or used.
1. Website www.x-tention.com
Our website www.x-tention.com (in the following referred to as "website") is operated by x-tention Informationstechnologie GmbH Austria. If you only use our website to gather information, it is generally not necessary to provide personal data. However, for the operation of the website it is necessary to process certain data by which a personal reference can be established. This is only data that is transmitted by your internet browser. Following information will be collected:
- Date and time of accessing one of our web pages
- Your browser type
- Your browser settings
- Your operating system
- The last page you visited
- The transferred data volume and access status (file transferred, file not found etc.)
- Your IP address
This is done to enable retrieval and use of the web pages you requested.
The legal basis for this is our legitimate interest in accordance with article 6 paragraph 1 GDPR to guarantee the operation of our website, to conduct error and availability analysis and for protection against cyber attacks.
These data can be transmitted to processors, but not to third parties.
The data will only be stored for a maximum of four weeks, unless there is a legal obligation to retain them beyond that period. Data could be stored for a longer should it be required for investigating detected attacks on our website.
To enable you to use our website without restriction, we use "cookies". Cookies are small text files that enable the recognition of users and an analysis of our website use. A randomly generated unique identification number is stored in them. A cookie also contains information about its origin and the retention period. Cookies cannot store any other data. The setting of cookies does not allow us to view files on your computer.
The cookies set by our website do not pose any risk to the user's computer, as they do not cause any damage and do not contain viruses or similar.
We distinguish three types of cookies that we use for the operation of our website:
- Functionally necessary cookies to ensure technical operation and basic functions of our website. This type of cookie is used to store your selection in the cookie disclaimer.
- Statistical/marketing cookies to understand how visitors interact with our website and to be able to set targeted advertising activities. Information is only collected and analysed anonymously. In this way we gain valuable insights to optimize the website and our product range.
- Third-party cookies if third-party media content is requested, for example when playing YouTube videos.
The legal basis for using functionally necessary cookies is our legitimate interest according to article 6 paragraph 1 GDPR to ensure technical operability and basic functions of our website and to save your chosen cookie settings and operate the website accordingly.
The legal basis for using cookies for marketing and analysis purposes (see "Matomo" section below), which you can select in the cookie disclaimer, is your consent in accordance with article 6 paragraph 1 GDPR.
The legal basis for using third-party cookies is exclusively your consent in accordance with article 6 paragraph 1 GDPR, which you can give either via cookie disclaimer or by retrieving respective content - for example when playing a YouTube video (see section "YouTube videos").
Notice of withdrawal, notice of objection:
You can revoke your given consent at any time. Under certain circumstances, you have the right to object to processing operations based on a legitimate interest of the data controller. For more information on your rights as a data subject, see section 5.
This data is transmitted to processors, but not to third parties.
The retention period of a cookie can be found in the table above.
Provided that you have given your consent for statistics/marketing cookies, our website uses the software "Matomo" (www.matomo.org) as a web analysis tool in order to align our website even better and more specifically. The software sets cookies on your computer, which enable recognising your browser. If subpages of the website are loaded, following data is stored:
- Date and time of accessing one of our web pages
- Your browser type
- Your browser settings
- Your operating system
- The last page you visited
- The transferred data volume and access status (file transferred, file not found etc.)
- Your IP address
The data collected with Matomo is stored on our own servers.
YouTube videos which are stored on "www.youtube.com" are integrated in our website and can be played directly from our website. YouTube is operated by Google Inc., 1600 Amphitheatre Parkway, Mountain View, CA 94043 USA (hereinafter referred to as "Google"). Here we use the "extended privacy mode" option provided by YouTube, which means that no data about you as a user is transferred to YouTube if you do not play the videos.
Only when you play the videos, YouTube cookies are stored on your computer and data is transferred to the YouTube operator Google. If you play videos stored on YouTube, following data will be transmitted to Google: IP address and cookie ID, specific address of the accessed page on our site, language setting of the browser, system date and time of the access and identification of your browser. The data transfer takes place regardless of whether you are logged in to YouTube or whether you do not have a user account. If you are logged in, this data is directly assigned to your account. You can prevent this assignment by logging out before clicking the play button. YouTube or Google stores this data as user profiles and uses them for advertising, market research and/or demand-oriented design of their website. You have a right of objection to the creation of user profiles, which you must address directly to YouTube's operator Google.
We use the "Google Maps" component by Google on our website.
When using "Google Maps" no cookies are set. Please note that data is only transferred to Google when you actively select it, i.e. click on the map and use the component. Google is solely responsible for processing personal data (e.g. IP address, location); we do not have access to this data.
2. Data transmissions within the x-tention group
The x-tention group consists of following companies:
- x-tention Informationstechnologie GmbH, Römerstraße 80A, 4600 Wels, Austria;
- x-tention Informationstechnologie GmbH, Bürgermeister-Wegele-Straße 12, 86167 Augsburg, Germany;
- x-tention Informationstechnologie AG, Bellerivestraße 3, 8008 Zürich, Switzerland;
- x-tention Limited, The Echo Bournemouth, BH1 1BZ, Great Britain;
- soffico GmbH, Bürgermeister-Wegele-Straße 12, 86167 Augsburg, Germany;
- InterComponentWare AG, Altrottstraße 31, 69190 Walldorf, Germany;
- FAKTOR D consulting GmbH, Bürgermeister-Wegele-Straße 12, 86167 Augsburg, Germany;
- It for industries GmbH, Römerstraße 80A, 4600 Wels, Austria
(in the following called "x-tention group".).
Within the framework of activities carried out by members of the x-tention group, it may be necessary to obtain expertise and/or support within the x-tention group in order to fulfil the respective processing purpose. In this context personal data may be transferred. To the extent that there is no individual or joint responsibility of supporting x-tention group members for respective processing purposes, they act as a processor for the requesting company and process personal data exclusively for selected purposes.
To this end, we have taken all necessary information security (article 32 GDPR) and data protection law measures to ensure the protection of personal data. The required agreements as per article 26 and article 28 GDPR have been made between the members of x-tention Group.
3. Individual processings
Following information concerns the processing of personal data by x-tention Austria, x-tention Germany and x-tention Switzerland.
If you contact us via the website contact form, by email or telephone, we will store the data you provide to process your enquiry and for follow-up questions.
Our legitimate interest according to article 6 paragraph 1 GDPR is to answer your inquiry or to initiate or fulfil a contract according to article 6 paragraph 1 GDPR.
Data will only be stored as long as necessary to achieve respective purposes or within the scope of legal retention periods.
Your personal data may be passed on within the x-tention group (see section 2) or to external processors, but in no case to third parties.
You can subscribe to our newsletter via the website. This will keep you up to date and you will receive interesting company news, relevant information and invitations to our events. For this purpose we need your name, email address and declaration that you agree to receiving the newsletter. When you register for our newsletter, we will also save your IP address and date and time of your registration. In case a third party misuses your email address and subscribes to our newsletter without your knowledge, this will serve as safeguard on our part and as proof of your consent. We use the Double-Opt-In-Procedure.
Additionally, statistics on opening, reading and clicking behaviour are generated in connection with the newsletter. This enables us to offer better services and to send you only the information that really interests you.
Legal basis for sending the newsletter is your consent in accordance with article 6 paragraph 1 GDPR. The compilation of statistics is based on our legitimate interest pursuant to article 6 paragraph 1 GDPR, whereby our interest results from the aforementioned purpose. An objection is of course also possible by cancelling the newsletter.
Apart from subscribing to the newsletter via website, we will also use your email address, which is known to us as part of an existing contractual relationship with you, to send you a newsletter. However, you will have the clear and unambiguous opportunity to refuse to receive the newsletter free of charge and without any problems, both when the e-mail address is collected and for each subsequent mailing. In this case, the legal basis is our legitimate interest in keeping you up to date with the information mentioned under "Purpose" - in connection with the exception for business relationships pursuant to § 107 (3) of the Telecommunications Act (TKG 2003).
Your personal data may be transferred within the x-tention group (see section 2) or to external processors, but in no case third parties. We use the EWORX NETWORK & INTERNET GMBH Mailworx tool for sending newsletters. This company has undertaken to comply with data protection regulations.
Deletion or non-processing for the above purpose takes place after cancellation of the newsletter.
You can cancel your subscription to the newsletter at any time by pressing the "Unsubscribe newsletter" button. Your cancellation will be sent to following email address: firstname.lastname@example.org. You can also contact us by email or telephone. We will then immediately delete your data in connection with the newsletter. The lawfulness of processing that took place between your consent and the revocation remains unaffected.
The personal data you provide during an application (including correspondence) will be processed for recording and storing and for coordination and evaluation in the application process. With your consent, your application data may be kept available for subsequent application procedures. We store your application data for the assertion and defence of legal claims. We also carry out an anonymous statistical evaluation of the applicant structure.
Without provisioning your data, it is not possible to consider an application, as we would not be able to assess whether you are suitable for the position.
The processing is based on the following legal bases:
- Initiation of a contract in the context of specific application procedures - article 6 paragraph 1 letter b GDPR.
- Consent in terms of keeping records - article 6 paragraph 1 letter a GDPR.
- The legitimate company interest to keep applicant data as evidence in the event of a defence against a claim for compensation under the öGlBG or dAAG - article 6 paragraph 1 letter f GDPR.
For x-tention Austria moreover:
- Statistical purposes which do not aim at personal results - paragraph 7 (1) DSG.
After rejection, personal data will be stored for eight (8) months and deleted thereafter. If you give your consent within the scope of keeping records, your application data will only be deleted after two years from rejection.
Different for x-tention Germany:
Received data will be stored for six (6) months after rejection.
Your personal data may be transferred within the x-tention group (see section 2) or to external processors, but in no case to third parties. For the administration of applications we use a software solution provided by Sage GmbH.
Depending on the contract, it may be necessary to process certain data in order to either use respective services or to be able to provide them on our part.
We process required data for the initiation of a contract (submission of offers, participation in tenders, etc.).
Within straight business relations, data is processed required for provisioning our services, customer care and information, including internal documentation and administration. Data is also stored to comply with legal obligations (in particular the Federal Fiscal Code (Bundesabgabenverordnung BAO)) and to assert and defend legal claims.
Following legal bases apply in this case:
- Initiation or fulfilment of a contract - article 6 paragraph 1 letter b GDPR.
- Compliance with legal obligations - article 6 paragraph 1 letter c GDPR.
- The legitimate company interest to retain data as evidence for the assertion and defence of legal claims - article 6 paragraph 1 letter f GDPR.
Data is only stored as long as necessary for the fulfilment of mutual contractual obligations.
In order to comply with legal obligations (§ 132 BAO, §§ 190, 212 UGB), data is stored for a period of 7 years from the end of a calendar year. In certain cases, such as for the assertion and defence of legal claims, data can be stored for longer. Especially contracts and related data are stored for 30 years due to the general limitation period according to § 1489 ABGB. Until the time of deletion, data will be restricted so that no further processing or access takes place.
Deviating for x-tention Germany:
Data is stored for ten years from the end of a calendar year (§ 147 AO, §§ 238 and 257 HGB).
Deviating for x-tention Switzerland:
Data is stored for ten years from the end of a calendar year (article 958f ZGB, article 70 Z 2 MWSTG).
To provide our services, we use members of the x-tention group (see section 2) and various external contractual or business partners, who participate in the delivery or service to the required extent. They are contractually bound to secrecy. Data will be passed on to authorities or courts if we are legally obliged to do so.
Photo and/or video recording at company events
As is customary at any company event, photos and/or videos are taken by members of the x-tention group. Our aim is not to identify individual persons, but purely to document the event. For documentation purposes, the photos and/or videos are stored securely and published on the internet (on our homepage), in our company magazine or our newsletter. They are also archived. It may happen that we present the photos/videos at future x-tention group events (e.g. annual/anniversary events).
Processing (production, presentation and publication of photos/videos) is based on our justified interest in documenting x-tention group events and archiving them (article 6 paragraph 1 letter f GDPR, for Austria also § 12 DSG). This also includes our interest of informing the public, customers and other interested parties about company events and documenting our own company history with photo and video recordings for future generations.
The photos/videos are stored as long as required for their purpose. Photo/video recordings are generally deleted immediately if they are not suitable for the above-mentioned purposes, if they would violate the legitimate interests of depicted persons or in case of an objection by affected persons.
There is no obligation to be photographed or recorded. If you do not agree with the photograph or publication, please immediately inform the photographer on site. You can also contact us after the photo/video has been taken. More about the right of objection below.
Live streaming of events
At selected events we would like to offer people who cannot be present an opportunity to participate via live stream. Speakers are usually mentioned by name. It is also possible that persons may be depicted as visitors to a trade fair stand in the recorded area. An identification of these persons is not intended, but cannot be excluded.
The live streams will be offered via common channels such as YouTube and will usually be accessible to everyone. A further use of the recordings than the live broadcast is not planned.
Processing (recording and simultaneous transmission of videos) is based on our legitimate interest in making the event accessible to as many people as possible. Visitors to events are informed about live broadcasts on site and thus have the opportunity to avoid entering the camera's field of view.
Storage of recordings beyond the duration of a live broadcast is not planned. Recorded images and sound files are therefore deleted immediately after broadcasting.
There is no obligation to be filmed. If you do not wish to be filmed, we will offer possibilities to use our services without being filmed.
Administration of requests for data subject rights
The purpose is to process applications related to rights of data subjects under GDPR. We store this data beyond the completion of an application to prove that we have fulfilled our legal obligation to process an application in a timely and appropriate manner.
The legal basis for processing applications is article 12 ff GDPR. We must send you all communications related to your rights as a data subject. Storage beyond the processing of applications is based on our legitimate interest in accordance with article 6 paragraph 1 letter f GDPR, whereby this interest results from the above-mentioned purpose.
Data will be stored for three years after completing the application. This is due to the general statute of limitations according to § 24 (4) öDSG and § 195 dBGB. Until the time of deletion, data will be restricted so that no further processing for other purposes takes place.
4. Social media
This section for appearance in social media applies to the entire x-tention group (see section 2).
For a detailed description of respective data processing and the possibilities for objection or revocation, we refer to the data protection information of respective social media (see section on social media in detail below).
During our appearances in social media, we also process your user name, name, contact and communication data if you contact us and share this data with us.
Learn more about our social media netiquette.
We use our appearances in social media to inform about us, job vacancies and our products or services and to get in contact with users. We receive statistical evaluations of usage data collected by respective social media in anonymised form to better adapt our offers to user interests.
Legal basis for communication is either the initiation or fulfilment of a contract (article 6 paragraph 1 letter b GDPR), if you contact us in this regard, or our legitimate interest (article 6 paragraph 1 letter f GDPR) in answering other inquiries.
Legal basis for processing in joined responsibility with respective social media is our legitimate interest (article 6 paragraph 1 letter f GDPR) in the above described processing of data for analysis and marketing purposes for continuous improvement of our social media presence.
Since the members of x-tention group have various appearances in social media (see a detailed list in section Appearances of the x-tention group in social media below), we consider current developments in data protection in social media and take them very seriously. We therefore inform you that, based on the current case law of the European Court of Justice, there is a joined responsibility as per article 26 GDPR between the operator of a media presence and respective provider of social media for processing your usage data. We have taken the necessary precautions for this joined responsibility, as this was made possible for us by respective provider.
At this point, we would like to point out that the primary processing of your usage data in social media is done by respective social media provider and we receive this data - if at all - exclusively in anonymised form and therefore primary responsibility lies with the social media provider in accordance with GDPR. We also recommend you assert your rights directly with respective social media providers. Corresponding links to data protection information can be found in detail in the social media section below. You can also assert your rights of data subjects within the scope of our joined responsibility towards us. In this case we will immediately contact respective social media providers.
Personal data may be passed on within x-tention group or to external processors, but in no case to third parties.
With some social media, it may occur that usage data is processed outside the European Union. Regarding US providers certified under the Privacy-Shield, we would like to point out that they thereby comply with data protection standards of the European Union, in particular the GDPR. Transmission of data to the USA is permitted in accordance with article 45 GDPR as long as respective social media providers hold a Privacy-Shield certificate.
Your data, which we process during your social media contact, is processed up to the deletion of your account in respective social media, unless a longer storage is necessary due to the processing purpose, legal regulations or for the assertion or defense of rights. As soon as these reasons are any longer present, your data will be deleted.
We receive and process usage data exclusively in anonymous form. For more information about storage periods, please visit the data protection information of respective social media.
Individual social media
|Company||Facebook Ireland Ltd.|
|Address||4 Grand Canal Square, Grand Canal Harbour, Dublin 2, Irland|
|Company||LinkedIn Ireland Unlimited Company|
|Address||Wilton Plaza, Wilton Pl, Saint Peter’s, Dublin 2, Irland|
|Company||New Work SE|
|Address||Dammtorstraße 30, 20354 Hamburg, Germany|
|Address||1355 Market Street, Suite 900 San Francisco, California 94103, USA|
|Company||Google Ireland Limited|
|Address||Gordon House, 4 Barrow Street, Dublin, D4 E5W5, Irland|
Appearances of x-tention group in social media
The members of the x-tention group are represented in various social media with their own appearances:
x-tention Informationstechnologie GmbH (AT)
- Facebook: https://www.facebook.com/xtentionIT
- LinkedIn: https://www.linkedin.com/company/19005518
- XING: https://www.xing.com/companies/x-tentioninformationstechnologiegmbh
- YouTube: https://www.youtube.com/user/xtentiongmbh
x-tention Limited (UK)
- Twitter: https://twitter.com/itwithcare
- Facebook: https://www.facebook.com/sofficoGmbH/
- LinkedIn: https://www.linkedin.com/company/soffico-gmbh/
- XING: https://www.xing.com/companies/sofficogmbh
- Twitter: https://twitter.com/soffico_gmbh
- YouTube: https://www.youtube.com/channel/UCt2-2ynI4idYkOPF-kx6GVw
- XING:- https://www.xing.com/companies/intercomponentwareag
FAKTOR D consulting GmbH
5. Your rights
If your data is processed by us (collected, recorded, stored, evaluated, modified, read out, queried, disclosed, disseminated, compared, linked, restricted, deleted, destroyed, etc.), you are a person affected as per GDPR.
At this point we would like to point out again that the primary processing of your usage data is done by respective social media providers and we receive this data - if at all - exclusively in anonymised form. The primary responsibility lies with the social media providers in accordance with GDPR. We recommend that you assert your rights concerning usage data directly with respective social media. You can also assert your rights of data subjects within the scope of our joined responsibility towards us. In this case we will immediately contact respective social media provider.
As a data subject, you have following rights towards any data controller who processes your data:
Right of information access
In accordance with article 15 GDPR, you have the right to make a request for access to information and to be informed of all data relating to you processed within the company. In that case, information must be provided to you. You also have the right to obtain following information:
- The processing purposes
- The categories of personal data processed
- The recipients or categories of recipients to whom the personal data has been or will be disclosed, particularly recipients in third countries or international organisations
- If possible, the planned duration for which the personal data will be stored or, if this is not possible, the criteria for determining this duration
- The existence of a right of rectification or erasure of personal data or of a right of opposition to or limitation of the processing by the controller
- The existence of a right to appeal to a supervisory authority
- If the personal data is not collected from you, all available information about the data origin
- The existence of automated decision making, including profiling and meaningful information about the logic involved and the scope and intended impact of such processing on yourself
- Appropriate safeguards in accordance with article 46 GDPR when personal data is transferred to a third country or an international organisation
As per article 16 GDPR, you have the right to request the correction and/or completion of incorrect personal data without delay.
According to article 17 GDPR, you have the right to request that your personal data be deleted immediately. The responsible person is obliged to delete personal data immediately if one of the following reasons applies:
- Your personal data is no longer required for the purposes which it was collected for or otherwise processed.
- You revoke your consent on which the processing is based on under article 6(1)(a) or article 9(2)(a) GDPR and there is no other legal basis for the processing.
- You object to the processing in accordance with article 21(1) GDPR and there are no legitimate grounds for the processing. Or you object to the processing as per article 21(2) GDPR.
- Your personal data was processed unlawfully.
- The deletion of your personal data is necessary to comply with a legal obligation under Union or national law to which the controller is subject.
- Your personal data has been collected in relation to information society services offered in accordance with article 8(1) GDPR.
The right of deletion does not exist if the processing is necessary:
- to the exercise the right to freedom of expression and information
- to comply with a legal obligation requiring processing under Union or national law to which the controller is subject or to perform a task carried out in the public interest or in the exercise of official authority vested in the controller
- on grounds of public interest in the field of public health as per article 9(2)(h) and (i) and article 9(3) GDPR
- for archiving, scientific or historical research purposes in the public interest or for statistical purposes in accordance with article 89 (1) GDPR, if above-mentioned law is likely to render impossible or seriously impede the processing objectives, or
- to assert, exercise or defend legal claims.
If the controller has made your personal data public and is obliged to delete it, they shall take reasonable measures, including technical measures, considering available technology and implementation costs, to inform data controllers who process the data that a subject has requested deletion of all links or copies or replications of their personal data.
According to article 18 GDPR, you have the right to request the restriction of processing if:
- you dispute the accuracy of personal data, for a period that would enable the controller to verify the data accuracy
- the processing is unlawful and you object to the deletion of the personal data and request instead the restriction of data usage
- the controller no longer needs your personal data for the processing purposes, but you need it to assert, exercise or defend legal claims, or
- you have lodged an objection to the processing in accordance with article 21 (1) GDPR, until it is established that the controller's legitimate reasons outweigh yours.
If the processing has been restricted, personal data may be processed, except storage, only with your consent or for pursuing, exercising or defending legal claims or protection of the rights of another natural or legal person or on grounds of an important public interest of the Union or a Member State. The lifting of an imposed restriction must be notified in advance.
If you have asserted the right to rectification, erasure or limitation of processing towards a controller, they are obliged to notify all recipients to whom your personal data has been disclosed of this rectification, erasure or limitation of processing. Unless this proves impossible or involves a disproportionate effort.
You have the right to receive the data, which you have provided to a controller, in a structured, common and machine-readable format. You have the right to have this data transferred to another controller, without interference from the controller whom your data has been transferred to, provided that
- the processing is based on a consent as per article 6(1)(a) or article 9(2)(a) GDPR or on a contract as per article 6(1)(b) GDPR, and
- the processing is done by automated procedures.
You can also request your data to be transferred directly from one responsible person to another, as far as this is technically feasible. It should be noted, that this right to data transfer must not affect the rights and freedoms of other persons.
According to article 21 GDPR, you have the right to object at any time to the processing of personal data carried out on basis of article 6(1)(f) GDPR for reasons arising from your particular situation. The right of objection may be exercised if the processing
- is necessary to safeguard the legitimate interests of the controller or of a third party where those interests or fundamental rights and freedoms, which require the protection of personal data, prevail (in particular child data), and
- the controller cannot demonstrate compelling legitimate reasons for processing that outweigh your interests, rights and freedoms or the processing does not serve to assert, exercise or defend legal claims.
The right of objection may also be exercised where the processing is carried out for direct marketing purposes.
Notwithstanding directive 2002/58/EC, you may exercise your right of objection through automated procedures involving technical specifications when using information society services.
Withdrawal of consent
You have the right to revoke your data protection declaration of consent at any time. Revocation of your consent does not affect the legality of processing that has taken place on basis of your consent until revocation.
If you are of the opinion that the processing of your personal data violates data protection law or your data protection rights have otherwise been violated in any way, please contact us. This will enable us to deal with your concerns. You also have the right to contact the data protection authority.
Your trust is very important to us. Should you have any further questions on data protection related to the x-tention group, you are welcome to use following contact options:
x-tention Informationstechnologie GmbH
Telephone: +43 7242 / 2155-65065
External Data Protecton Officer of x-tention Informationstechnologie GmbH (Austria):
Dipl.-Ing. Johannes Guger
Tel.: +43 7252 / 38897
We would like to point out that by using our appearances in social media copyrights, name and trademark rights and other rights of third parties must be considered. You agree to refrain from abusive use of the entire content (especially pictures, videos, fonts and brands).
27th April 2020