The protection of your personal data is very important to us. We therefore process your data solely on the basis of the applicable legal provisions (GDPR, Austrian Data Protection Act – DSG, Telecommunications Act 2021 – TKG 2021).

This Privacy Policy informs you about the most important aspects of data processing in the context of our website.

1. Controller

The controller responsible for processing your personal data on this website is:

RNExp Handels GmbH
Zimmermanngasse 8
1090 Vienna
Austria

Phone: +43 660 379 77 23
E-mail: office@rnexp.at

2. Visiting our website / Server log files

Each time you access our website, your browser automatically transmits certain information to our server and/or the server of our hosting provider, where it is stored in so-called server log files. This may include, in particular:

- IP address
- Date and time of access
- Pages/files accessed
- Referrer URL (previous page visited)
- Browser type and operating system

This data is technically necessary to correctly deliver the contents of the website, ensure system stability and security (e.g. error analysis, protection against attacks) and, where required, investigate potential misuse.

Legal basis: Art. 6(1)(f) GDPR (our legitimate interest in the secure and trouble-free operation of our website).

Log files are stored only for a limited period and are automatically deleted afterwards, unless longer storage is required in individual cases for security or evidential purposes (e.g. in the event of a security incident).

3. Contact (contact form, e-mail, phone)

If you contact us via the contact form on our website, by e-mail or by phone, we process the personal data you provide, in particular:

- Name
- E-mail address
- Phone number
- Content of your message

We use this data solely for the purpose of processing and responding to your enquiry and for possible further business communication with you.

Legal bases:

- Art. 6(1)(b) GDPR (performance of a contract or pre-contractual measures), insofar as your enquiry relates to the conclusion or performance of a contract;
- Art. 6(1)(f) GDPR (legitimate interests), our legitimate interest being the proper handling of enquiries and the maintenance of business relationships.

We store this data only for as long as necessary to process your enquiry and as long as statutory retention obligations (e.g. under commercial or tax law) do not require longer storage.

4. Cookies and similar technologies

Our website is configured so that we do not use any analytics, tracking or marketing cookies. In particular, we do not use tools such as Google Analytics, Facebook Pixel or comparable services.

We aim to reduce the use of cookies to the technically necessary minimum or to avoid them entirely. If, in individual cases, technically necessary cookies are set by our hosting provider and/or website builder (e.g. to maintain a technical session or to ensure basic security functions), these are used solely for the operation of the website and not for analysing your behaviour.

Legal basis:

- Section 165(3) of the Austrian Telecommunications Act 2021 (TKG 2021) for technically necessary cookies,
- Art. 6(1)(f) GDPR (our legitimate interest in operating a functional and secure website).

We do not intentionally use analytics, tracking or advertising cookies.

5. Use of processors (hosting and site builder)

For operating this website, we use an external hosting provider and/or website builder. The website and related data are stored on the servers of this provider and made available technically. In this context, IP addresses, server log files and – where required – technically necessary cookies may be processed to ensure the secure and stable operation of the website.

We have concluded a data processing agreement with the hosting provider in accordance with Art. 28 GDPR. The provider processes personal data solely on our instructions and under appropriate technical and organisational security measures.

Processing by the hosting provider is based on our legitimate interest in a professional, secure and efficient provision of our online services (Art. 6(1)(f) GDPR).

6. Transfers to third countries

As a rule, we do not actively intend to transfer your personal data to countries outside the European Union (EU) or the European Economic Area (EEA).

If, in individual cases, our hosting provider and/or website builder uses servers or subprocessors located outside the EEA, such processing takes place only in compliance with the requirements of Art. 44 et seq. GDPR (e.g. on the basis of adequacy decisions of the European Commission or appropriate safeguards such as standard contractual clauses).

7. Storage period

Unless otherwise specified in this Privacy Policy, the following applies:

- we store personal data only for as long as necessary to fulfil the purposes described above;
- beyond that, we store data only if and for as long as statutory retention obligations (e.g. commercial or tax law requirements) require it.

After the purposes have been fulfilled or legal retention periods have expired, personal data is deleted or anonymised.

8. Overview of legal bases

We process personal data solely on the basis of one of the following legal grounds:

- Art. 6(1)(a) GDPR – consent (we currently do not use processing that requires your explicit consent for marketing or analytics purposes);
- Art. 6(1)(b) GDPR – performance of a contract or pre-contractual measures;
- Art. 6(1)(c) GDPR – compliance with legal obligations (e.g. retention obligations);
- Art. 6(1)(f) GDPR – legitimate interests (in particular operation and security of the website, handling of enquiries, enforcement of legal claims).

9. Your rights as a data subject

Under the GDPR, you have the following rights:

- Right of access (Art. 15 GDPR): to obtain information about whether and which personal data we process about you.
- Right to rectification (Art. 16 GDPR): to have inaccurate data corrected and incomplete data completed.
- Right to erasure (Art. 17 GDPR): to request deletion of your personal data, unless statutory retention obligations or other legal reasons prevent this.
- Right to restriction of processing (Art. 18 GDPR).
- Right to data portability (Art. 20 GDPR), where applicable.
- Right to object (Art. 21 GDPR): you may object at any time, on grounds relating to your particular situation, to processing based on Art. 6(1)(f) GDPR (legitimate interests).

To exercise your rights, you can contact us at any time:
E-mail: office@rnexp.at

Furthermore, you have the right to lodge a complaint with a supervisory authority if you believe that the processing of your personal data infringes data protection law. In Austria, the competent authority is:

Austrian Data Protection Authority
Barichgasse 40–42
1030 Vienna
Austria
Website: www.dsb.gv.at

10. Data security

We take appropriate technical and organisational measures to protect your personal data against loss, misuse, unauthorised access and unauthorised disclosure. These measures are regularly reviewed and adapted to the state of the art where necessary.

11. Updates to this Privacy Policy

This Privacy Policy is currently valid.
We may update it from time to time to reflect changes in our processing activities or in legal requirements. The latest version is always available on this website.