Privacy policy

This is an English translation for your convenience. The German version is legally binding.

Introduction and overview

We have written this privacy policy to explain to you, in accordance with the requirements of the General Data Protection Regulation (EU) 2016/679 and applicable national laws, which personal data (data for short) we as the controller – and the processors commissioned by us (e.g. providers) – process, will process in future, and what legal options you have.
In short: we inform you comprehensively about the data we process about you.

Privacy policies usually sound very technical and use legal jargon. This privacy policy, on the other hand, aims to describe the most important things to you as simply and transparently as possible. Where it helps transparency, technical terms are explained in a reader-friendly way and links to further information are provided. If you still have questions, please contact the responsible body named below or in the legal notice.

Scope

This privacy policy applies to all personal data processed by us in the company and to all personal data processed by companies commissioned by us (processors). By personal data we mean information within the meaning of Art. 4 No. 1 GDPR, such as a person's name, email address and postal address. Processing personal data ensures that we can offer and invoice our services and products, whether online or offline. The scope of this privacy policy covers:

• all online presences (websites, online shops) that we operate
• social media presences and email communication
• mobile apps for smartphones and other devices

In short: the privacy policy applies to all areas in which personal data is processed in a structured way within the company via the channels mentioned. Should we enter into legal relationships with you outside these channels, we will inform you separately if necessary.

Legal bases

In the following privacy policy we give you transparent information about the legal principles and regulations – i.e. the legal bases of the General Data Protection Regulation – that allow us to process personal data. As far as EU law is concerned, we refer to REGULATION (EU) 2016/679 OF THE EUROPEAN PARLIAMENT AND OF THE COUNCIL of 27 April 2016, which you can read on EUR-Lex: https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=celex%3A32016R0679.

We only process your data if at least one of the following conditions applies:

1. Consent (Article 6(1)(a) GDPR): you have given us your consent to process data for a specific purpose, for example storing the data you enter in a contact form.
2. Contract (Article 6(1)(b) GDPR): we process your data in order to fulfil a contract or pre-contractual obligations with you.
3. Legal obligation (Article 6(1)(c) GDPR): we process your data if we are subject to a legal obligation, for example retaining invoices for accounting purposes.
4. Legitimate interests (Article 6(1)(f) GDPR): in the case of legitimate interests that do not restrict your fundamental rights, we reserve the right to process personal data – for example to operate our website securely and economically.

Other conditions such as performing tasks in the public interest, exercising official authority or protecting vital interests do not generally apply to us. Should such a legal basis apply, it will be indicated in the relevant place.

In addition to the EU regulation, national laws also apply:

• In Austria this is the Federal Act on the Protection of Individuals with regard to the Processing of Personal Data (Datenschutzgesetz, DSG).
• In Germany the Federal Data Protection Act (BDSG) applies.

Contact details of the controller

If you have any questions about data protection, you will find the contact details of the responsible person or body below:
Evolus IT Solutions GmbH
Kellergasse 239, 2103 Langenzersdorf,
Austria
Authorised representative: Moritz Meier
Email: info@evolus-it.com
Phone: +43 670 3082976
Legal notice: evolus-it.com/en/legal-notice

Contact details of the data protection officer

Name: Moritz Meier
Email: info@evolus-it.com
Phone: +43 670 3082976

Storage period

Our general rule is that we only store personal data for as long as is absolutely necessary to provide our services and products. This means we delete personal data as soon as the reason for processing no longer exists. In some cases we are legally obliged to keep certain data even after the original purpose has ceased, for example for accounting purposes.

If you wish your data to be deleted or withdraw your consent to data processing, the data will be deleted as quickly as possible, provided there is no obligation to retain it.

Your rights under the GDPR

Under Article 13 GDPR you have the following rights to ensure fair and transparent processing of data:

• Under Article 15 GDPR you have the right to know whether we process your data. If so, you have the right to receive a copy of the data and to be informed of the purpose of processing, the categories of data, the recipients (and, for transfers to third countries, how security is guaranteed), the storage period, your rights to rectification, erasure, restriction and objection, your right to lodge a complaint with a supervisory authority, the origin of the data if not collected from you, and whether profiling takes place.
• Under Article 16 GDPR you have the right to rectification of your data.
• Under Article 17 GDPR you have the right to erasure (“right to be forgotten”).
• Under Article 18 GDPR you have the right to restriction of processing.
• Under Article 20 GDPR you have the right to data portability.
• Under Article 21 GDPR you have the right to object – in particular to processing based on Article 6(1)(e) or (f), to direct marketing and to profiling.
• Under Article 22 GDPR you may have the right not to be subject to a decision based solely on automated processing (e.g. profiling).

If you believe that the processing of your data violates data protection law, you can lodge a complaint with the supervisory authority. In Austria this is the Data Protection Authority (https://www.dsb.gv.at/); in Germany you can contact the Federal Commissioner for Data Protection and Freedom of Information (BfDI).

Web hosting

Web hosting summary Data subjects: website visitors Purpose: professional hosting of the website and securing its operation Data processed: IP address, time of visit, browser used and other data Storage period: usually 2 weeks Legal basis: Art. 6(1)(f) GDPR (legitimate interests)

When you visit our website, our web server – the computer on which this website is stored – usually automatically stores data such as the complete URL of the page accessed, browser and browser version, operating system, the referrer URL, the host name and IP address of the accessing device, and the date and time, in so-called web server log files. This serves the professional hosting of the website, operational and IT security and, where necessary, the prosecution of claims.

This data is usually stored for two weeks and then deleted automatically. We do not pass this data on, but cannot rule out that it may be inspected by authorities in the event of unlawful conduct. The legal basis is Art. 6(1)(f) GDPR, as professional hosting is necessary to present the company on the internet securely and in a user-friendly way.

Contact form and enquiries

Contact form summary Data subjects: people who contact us via the form, email or phone Purpose: handling your enquiry Data processed: name, email address and any data you provide voluntarily (company, phone number, message) Storage period: until your enquiry has been fully handled, or as long as statutory retention obligations apply Legal bases: Art. 6(1)(a) GDPR (consent), Art. 6(1)(b) GDPR (pre-contractual measures)

If you send us an enquiry via the contact form, your details from the form, including the contact details you provide, are sent to us by email and stored to handle the enquiry and any follow-up questions. We do not pass this data on without your consent. You can withdraw your consent at any time by emailing info@evolus-it.com.

Cookies and consent

Cookies are small text files that your browser stores on your device. We only set analytics cookies (Google Analytics, see below) with your consent. Without consent, no analytics cookies are set and no analytics data is transferred to third parties.

Language selection: if you choose a language using the language switcher (DE/EN), we store this choice in the cookie “lang” (content: “de” or “en”, storage period 12 months) so that the website is shown in your chosen language in future. Without a choice, we redirect you to the German or English version when you open the home page, based on your browser's language settings; no data is stored in this case. This cookie is technically necessary for the function you requested (§ 165(3) TKG 2021, Art. 6(1)(f) GDPR).

We store your decision in the cookie banner in your browser's local storage (entry “evolus-consent”) so that we don't have to ask you again on every page. It only contains your choice and the time, is not transmitted to us and is requested again after 12 months.

You can grant or withdraw your consent at any time with effect for the future: open cookie settings. If you withdraw consent, we delete the Google Analytics cookies in your browser.

Google Analytics

Google Analytics summary Data subjects: website visitors who have given consent Purpose: analysing website usage to improve our offer Data processed: device and browser information, approximate location (derived from the IP address), pages visited, time spent, clicks, referrer, pseudonymous user ID Storage period: cookies up to 2 years; analytics data according to the retention period set in Google Analytics: 2 months (Google Analytics 4 default setting) Legal basis: Art. 6(1)(a) GDPR (consent), § 165(3) TKG 2021

We use Google Analytics 4, a web analytics service of Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland (“Google”). Google Analytics is only loaded after you click “Accept” in the cookie banner. It sets the following cookies:

• _ga – distinguishes visitors using a random ID; stored for up to 2 years
• _ga_P2W1G0VLTH – stores the session state; stored for up to 2 years

Google Analytics 4 does not store complete IP addresses; they are only used briefly to derive the approximate location and are then discarded. The data collected may be transferred to servers of Google LLC in the USA. Google LLC is certified under the EU-US Data Privacy Framework, for which there is an adequacy decision by the European Commission (Art. 45 GDPR). We have concluded a data processing agreement with Google.

More information: Google Privacy Policy and Safeguarding your data in Google Analytics.

Cloudflare Turnstile (spam protection in the contact form)

Cloudflare Turnstile summary Data subjects: visitors to the contact page Purpose: protecting the contact form against spam and automated attacks Data processed: IP address, browser and device information, interaction data to distinguish humans from bots Storage period: according to Cloudflare, only as long as necessary for the check Legal basis: Art. 6(1)(f) GDPR (legitimate interest in a secure, spam-free website)

On our contact page we use Cloudflare Turnstile by Cloudflare, Inc., 101 Townsend St., San Francisco, CA 94107, USA. When the contact page is opened, Turnstile checks whether the input comes from a human and does not use cookies for advertising or tracking purposes. Data may be transferred to Cloudflare servers in the USA; Cloudflare is certified under the EU-US Data Privacy Framework (Art. 45 GDPR). Turnstile is only loaded on the contact page.

More information: Turnstile privacy notice and Cloudflare privacy policy.

External content and links

Fonts are loaded locally from our own server. Apart from Google Analytics (only with consent) and Cloudflare Turnstile (contact page only), no third-party content (e.g. Google Fonts, Google Maps, YouTube or social media plugins) is embedded.

Links to external websites (e.g. Instagram, Google Maps, Trustpilot) are simple hyperlinks. Only when you click such a link do you leave our website, and the privacy policy of the respective provider applies.