1.3 The controller takes the protection of your personal data very seriously. The controller therefore treats your personal data confidentially and in accordance with the applicable data protection regulations, in particular the GDPR and the Austrian Data Protection Act in the current version (“DSG“).

1.4 In this privacy policy you will find information on the data processing activities carried out. The terms laid down in the GDPR are used accordingly. For better comprehensibility, you will find the most important terms according to their legal definition below:

• Personal data: Any information relating to an identified or identifiable natural person (“data subject”); an identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person.
• Processing: Any operation or set of operations which is performed on personal data or on sets of personal data, whether or not by automated means, such as collection, recording, organisation, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure or destruction.
• Data subject: The person whose personal data is processed.
• Controller: The natural or legal person, public authority, agency or other body which, alone or jointly with others, determines the purposes and means of the processing of personal data.
• Processor: The natural or legal person, public authority, agency or other body which processes personal data on behalf of the controller.
• Consent (of the data subject): Any freely given, specific, informed and unambiguous indication of the data subject’s wishes by which he or she, by a statement or by a clear affirmative action, signifies agreement to the processing of personal data relating to him or her.

2. FOR WHAT PURPOSES AND ON WHAT LEGAL BASIS IS YOUR PERSONAL DATA PROCESSED

2.1 Provision of the website
2.1.1 In order to make the website available to you and to be able to identify, prevent and investigate attacks on our website, QMD Services processes the following personal data on the basis of our aforementioned legitimate interests (Article 6 para 1 lit f GDPR) the URL; the date and time of the visit; the IP address of the computer or mobile device; the name and version of the web browser; the browser type and settings data (screen resolution, colour depth, time zone settings, browser extensions, fonts, language); the operating system; and the website (URL) from which you visit our website (“referrer”). The processing of this data is necessary to provide you with the website and its features.

2.2 Enquiry by website, e-mail, post or telephone
2.2.1 If you send an enquiry to QMD Services via the contact form on the website, by e-mail or by telephone, QMD Services processes the following personal data to answer the enquiry in order to fulfil pre-contractual measures or to fulfil the contract (Article 6 para 1 lit b GDPR) or on the basis of our legitimate interests in being able to process your enquiry (Article 6 para 1 lit f GDPR): Title, name; e-mail address; address; telephone number; company-related data (website, size-related details, VAT and SRN number), details of the requested certification as well as the applicant, further content of the request; other information you provide to us voluntarily; personal information about our services and products. The processing of certain minimum data, such as e-mail address, is necessary to handle your enquiry.

2.3 Services and products offered by QMD Services (incl. customer support and handling)
2.3.1 In the context of our services and products in the areas of certification / declaration of conformity of medical devices, we process (i) personal data that you provide to us, (ii) personal data that our customers as principals of our services and products provide to us and (iii) personal data that we collect ourselves in the course of providing the services and products. For the aforementioned purposes, we process title, name; e-mail address; address; telephone number; company-related data (website, size-related information, VAT and SRN number), details of the requested certification and the applicant, further content of the request; other information that you voluntarily provide to us as part of the certification / declaration of conformity of the respective product. Without the processing of the aforementioned data, we cannot offer the services and products and cannot manage ongoing customer relationships. The legal basis for this processing is the implementation of pre-contractual measures or the fulfilment of the contract (Article 6 para 1 lit b GDPR).

2.4 Marketing communication, newsletter, event participation

2.4.1 We send our customers electronic communications (by e-mail, SMS, MMS or Messenger) to advertise our products or services (“promotional messages“). For this purpose, we process your name, contact details and other information that you provide to us voluntarily in connection with the receipt of promotional messages. The customer can object to the sending of promotional messages at any time by sending an email with the objection. We will also give you the opportunity to opt out of receiving further promotional messages with each promotional message. The legal basis for the sending of promotional messages is Section 174 para 4 Telecommunications Act 2021.

2.4.2 We will send you postal letters with advertising communication on the basis of our legitimate interests in advertising products or services of interest to you (Article 6 para 1 lit f GDPR). For this purpose, we process your name, contact details and other information that you provide to us voluntarily in connection with the receipt of advertising communication. You can exercise your right to object to postal advertising communication by sending an email.

2.4.3 If you voluntarily provide us with your contact details and other data provided by you for the purpose of sending newsletters, participating in events or other information transmissions, we process your data on the basis of your consent (Article 6 para 1 lit a GDPR). You can revoke your consent at any time by sending an email.

2.5 Legal Prosecution

2.5.1 If an administrative or judicial dispute arises, the personal data necessary for the appropriate legal prosecution will be processed and, if necessary, transmitted to legal representatives, courts and/or administrative authorities. In this context, your contact details (first and last name, academic title, address) and other data in connection with the legal dispute in question (your behaviour in relation to the use of the website) will be processed. The aforementioned personal data is processed on the basis of our legitimate legal interests in legal prosecution pursuant to Article 6 para 1 lit f GDPR and pursuant to Article 9 para 2 lit f GDPR.