Privacy Policy

1 Commitment

Thomas Lorenz ZT GmbH, as the controller responsible for data processing, considers the protection of personal data to be important. When using personal data, Thomas Lorenz ZT GmbH therefore complies with all provisions of the General Data Protection Regulation (GDPR) and the Data Protection Amendment Act (DSG) and strives for the greatest possible transparency.

Thomas Lorenz ZT GmbH processes personal data in accordance with the principles of lawfulness, fairness and transparency, accuracy, purpose limitation, data minimization and storage limitation.

2 Purpose and lawfulness

Thomas Lorenz ZT GmbH processes personal data exclusively for the provision of services and the fulfillment of orders and/or to be able to carry out pre-contractual measures. The following legal bases may apply:

2.1 Fulfillment of contract obligations pursuant to Art. 6(1)(b) GDPR

The processing of personal data is necessary in order to be able to provide our services and fulfill our orders.

The purposes of data processing serve in particular:

§ the initiation, establishment, administration and handling of business relationships,

§ strengthening the existing business relationship and communication,

§ billing for services and sending invoices and, where applicable, reminders.

If you do not wish to provide us with the data, the conclusion of the contract or the execution of the order and/or the consulting may, under certain circumstances, be impossible. Under these circumstances, an existing contract can no longer be performed and may have to be terminated.

2.2 Fulfillment of legal obligations pursuant to Art. 6(1)(c) GDPR

Legal obligations may require the processing of personal data.

2.3 Consent pursuant to Art. 6(1)(a) GDPR

If the processing of personal data goes beyond contractual or legal obligations, Thomas Lorenz ZT GmbH obtains the consent of its business partners.

In the event of consent, the data will be processed exclusively for the stated purpose.

Consent that has been given may be withdrawn at any time. Withdrawal of consent does not affect the lawfulness of the processing of your personal data carried out up to the time of withdrawal. The withdrawal may be made in writing or orally: +43 316/81 92 48 0 or office@tlorenz.at

2.4 Safeguarding legitimate interests pursuant to Art. 6(1)(f) GDPR

If processing is carried out on the basis of our overriding legitimate interest, Thomas Lorenz ZT GmbH will inform you in advance so that you are able to safeguard your rights.

3 Personal data

Thomas Lorenz ZT GmbH processes personal data that is collected or transmitted by business partners in the course of a business relationship.

The following categories of personal data are—depending on the order—subject to processing:

• Personal details: name/company/other business designation, title, address, contact details (tel., email, fax), date of birth, place of birth, nationality
• Register data (e.g. commercial register, land register)

4 Source

As a rule, we collect personal data directly from you. However, it is also possible that we record data from public registers (e.g. land register, commercial register) or other publicly accessible sources of information (telephone directory, the company’s website).

5 Recipients & processors

Recipients of personal data are employees of Thomas Lorenz ZT GmbH who require it to fulfill contractual or statutory obligations and, where applicable, to safeguard legitimate interests.

Depending on the order, it may be necessary to pass the data on to third parties (for example, IT service providers or back-office service providers).

Depending on the purpose of processing, Thomas Lorenz ZT GmbH passes data on to processors commissioned by it, insofar as this is necessary to fulfill the respective task. When selecting its processors, Thomas Lorenz ZT GmbH ensures compliance with data protection regulations, and agreements (data processing agreements) have been concluded with the processors to ensure that personal data is processed confidentially and with due care. The most important obligations arising from these agreements are:

• to ensure measures for data security
• to take all possible technical and organizational measures to protect the rights of data subjects
• to maintain a record of processing activities
• cooperation with the data protection authority
• to carry out a risk analysis with regard to personal data received

Processors commissioned by Thomas Lorenz ZT GmbH may only commission further sub-processors with the written approval of Thomas Lorenz ZT GmbH.

The data collected is not sold or passed on to uninvolved third parties without justification.

If the personal data is not collected from the data subject, we will provide the data subject with information about the source of the personal data.

6 Storage limitation

Personal data is stored for the duration of the business relationship and beyond that in accordance with statutory retention periods. In this regard, Thomas Lorenz ZT GmbH is subject to retention obligations under the following laws:

• Austrian Commercial Code (UGB),
• Federal Fiscal Code (BAO),
• Austrian General Civil Code (ABGB),
• Value Added Tax Act (UStG),
• Civil Engineers Act 1993 (ZTG).

Withdrawal of consent and requests for deletion of data will be complied with as quickly as possible, insofar as there is no longer any obligation to retain it.

7 Data subject rights & contact

Pursuant to Art. 16 et seq. GDPR, business partners have the right to access the personal data processed, to have it rectified or erased, and to restrict processing by Thomas Lorenz ZT GmbH, insofar as statutory or contract provisions do not conflict with these rights. Furthermore, you have the right to data portability and/or to be provided with the data stored by us, and the right to object after changes to processing have been implemented.

If you have questions about the processing of your personal data, wish to object to the processing of your data, wish to withdraw consent you have given, or feel that your data protection rights have been violated, please contact:

Thomas Lorenz ZT GmbH, Raiffeisenstraße 30, 8010 Graz (Telephone: +43 316 819 248 F ext. 30, Email: datenschutz@tlorenz.at)

In addition, you have the right to lodge a complaint with the supervisory authority: Austrian Data Protection Authority, Wickenburggasse 8-10, 1080 Vienna, email: dsb@dsb.gv.at.

8 Website

8.1 Personal data

As part of your visit to our website, we process the following personal data:

• date and time of access to the website,
• your IP address,
• name and version of your web browser,
• the website (URL) you visited before accessing our website,

certain cookies (see the next point).

8.2 Cookies

Our website uses so-called cookies. These are small text files that are stored on your device with the help of the browser. They do not cause any harm. We use cookies to make our website user-friendly. Some cookies remain stored on your device until you delete them. They enable us to recognize your browser the next time you visit. If you do not wish this, you can configure your browser so that it informs you when cookies are set and you only allow this in individual cases. If cookies are disabled, the functionality of our website may be limited.

The so-called “cookie policy” stipulates that the storage of cookies requires your consent. For strictly necessary cookies, legitimate interests pursuant to Art. 6(1)(f) GDPR apply even if no consent has been given; these are usually of an economic nature. To enable a pleasant user experience, certain cookies are often strictly necessary.

Cookies that are not strictly necessary are used exclusively with your consent pursuant to Art. 6(1)(a) GDPR.

8.3 Web analytics

Our website uses software to evaluate the behavior of website visitors. Data is collected and stored, managed and processed by the analytics tool used. With the help of this data, analyses of user behavior on our website are created, enabling us to provide the best possible web offering.

What type of data is stored depends on the tool used. As a rule, it is stored which content you view, which buttons and links you click, when you access the page, which browser and device you use, and your IP address (pseudonymized).

In general, data processing takes place only for as long as is strictly necessary for the provision of our services or as required by law.

You may withdraw your consent to the use of cookies and/or third-party providers at any time.

The use of web analytics requires your consent pursuant to Art. 6(1)(a) GDPR, which is obtained via the cookie pop-up. In addition to this consent, Thomas Lorenz ZT GmbH has a legitimate interest pursuant to Art. 6(1)(f) GDPR in analyzing the behavior of website visitors. However, we use web analytics only with your consent pursuant to Art. 6(1)(a) GDPR.

8.4 Legal basis and purposes of data processing

We process the personal data collected on this website on the legal basis of our overriding legitimate interest pursuant to Art. 6(1)(f) GDPR, which consists of achieving the following purposes:

• Provision, further development and improvement of this website,
• creation of usage statistics,
• identification, prevention and tracking of attacks on the website.

Despite the overriding legitimate interest pursuant to Art. 6(1)(f) GDPR, data processing takes place only following your consent pursuant to Art. 6(1)(a) GDPR.

9 Social media

In addition to our website, we are also present on various social media platforms. The data stored and processed by users primarily serves the purpose of carrying out web analyses. These analyses allow a more precise and personalized marketing and advertising strategy to be developed, and interested users can thus be addressed in a targeted manner via social networks. The evaluated data therefore allows conclusions to be drawn about your interests.

On most social media channels, cookies are set in your browser for this purpose, which store data about your user behavior.

In principle, we assume that we are responsible under data protection law. However, in the case of social media platforms, the CJEU has decided that in certain cases the operator of the social media platform may be jointly responsible pursuant to Art. 26 GDPR. This will be pointed out in the relevant cases.

Please note that when using social media platforms, your data may also be processed outside the EU, which may make it more difficult for you to assert or enforce your rights in relation to your personal data.

Which data is stored depends on the respective provider of the social media platform. Typically, data such as telephone numbers, email addresses, data you enter into a contact form, user data such as which buttons you click, whom you like or follow, when you visited which pages, information about your device and your IP address are stored.

The data is stored on the providers’ servers, and only these providers have access to the data and can provide you with information or make changes. The storage period depends on the respective provider.

You may withdraw your consent to the use of cookies and/or third-party providers at any time.

Data processing via social media platforms requires your consent pursuant to Art. 6(1)(a) GDPR. In addition to this consent, Thomas Lorenz ZT GmbH has a legitimate interest pursuant to Art. 6(1)(f) GDPR in fast and effective communication with you or other customers and business partners. However, we use the tools only with your consent pursuant to Art. 6(1)(a) GDPR.

9.1 Facebook tools & fan page

We use selected Facebook tools and we also have a Facebook fan page for our website. Facebook is a social media network of Meta Platforms Inc. or, for the European region, Meta Platforms Ireland Limited, 4 Grand Canal Square, Grand Canal Harbour, Dublin 2, Ireland.

If data about you is collected and forwarded via our embedded Facebook elements or via our Facebook page (fan page), both we and Facebook Ireland Ltd. are responsible for this.

However, responsibility for further processing of the data lies with Facebook. Facebook is also responsible for the data security of its products. We, on the other hand, are obliged to clearly inform you about the use of Facebook tools on our website and to integrate the tools into our website in a data-protection-compliant manner.

The responsibilities are precisely defined in the publicly accessible agreement at https://www.facebook.com/legal/controller_addendum.

The purpose of using these tools is to design tailored advertising campaigns on Facebook based on the information obtained about wishes and needs.

Facebook refers to the data about your behavior on our website as “event data”. It is also used for measurement and analytics services. Facebook also uses this “event data” for security, protection, development and research purposes.

By using individual Facebook tools & the fan page, personal data such as name, address, telephone number and IP address may be sent to Facebook. This data is used by Facebook to match it with data already available about you (if you have a Facebook account).

Facebook stores the data until it is no longer needed for its own purposes.

You can prevent data storage by disabling, deleting or managing individual or all cookies. Complete deletion of your data is only possible if you completely delete your Facebook account.

Data processing via Facebook requires your consent pursuant to Art. 6(1)(a) GDPR. In addition to this consent, Thomas Lorenz ZT GmbH has a legitimate interest pursuant to Art. 6(1)(f) GDPR in fast and effective communication with you or other customers and business partners. However, we use the tools only with your consent pursuant to Art. 6(1)(a) GDPR.

As Facebook also processes your data in the USA, we point out that, in the opinion of the CJEU, there is currently no adequate level of protection for data transfers to the USA.

We refer to Facebook’s data processing terms at https://www.facebook.com/legal/terms/dataprocessing.

If you have further questions about how Facebook uses your data, we recommend reading the following data policy https://www.facebook.com/about/privacy/update

9.2 Instagram

We have integrated functions from Instagram into our website. Instagram is a social media platform of Instagram LLC, 1601 Willow Rd, Menlo Park, CA 94025, USA. Since 2012, it has been a subsidiary of Meta Platforms Inc. and is part of Facebook’s products. Embedding content on our website is referred to as embedding. Content such as buttons, photos and videos from Instagram can therefore be displayed directly on our website. When you access websites that have an Instagram function integrated, your data is transmitted to Instagram, stored and processed. As Instagram is part of Meta Platforms Inc. and uses the same technologies and systems, your data is processed across all Facebook companies.

When you open our website, your browser automatically connects to Instagram’s servers, and data is sent to Instagram, stored and processed. This happens regardless of whether you have an Instagram account or not. The data collected includes information about our website, your computer, purchases made, advertisements you see, etc. The date and time of your interaction with Instagram are also stored.

A distinction is made between customer data and “event data”. Customer data includes, for example, name, address, telephone number and IP address. Customer data is only transmitted to Instagram after it has been “hashed”. This means that a data record is converted into a character string and the customer data is thereby ciphered. The collected contact data is matched with the data Instagram already has about you.

It is assumed that data processing at Instagram works in the same way as at Facebook. If you have an Instagram account or visit www.instagram.com, Instagram has set at least one cookie. In this case, your browser sends information to Instagram via the cookie. After 90 days (and matching of the data), the data is at least anonymized.

The information received is shared between Instagram, the Facebook companies, external partners and people with whom you connect worldwide.

You can manage your data in your Instagram settings. If you delete your account completely, your own posts will be deleted, but information that other people have shared about you will not be deleted as a result.

Instagram stores your data primarily via cookies. You can manage, disable or delete these in your browser.

Data processing via social media elements requires your consent pursuant to Art. 6(1)(a) GDPR. In addition to this consent, Thomas Lorenz ZT GmbH has a legitimate interest pursuant to Art. 6(1)(f) GDPR in fast and effective communication with you or other customers and business partners. However, we use the tools only with your consent pursuant to Art. 6(1)(a) GDPR.

As Instagram and/or Facebook also processes your data in the USA, we point out that, in the opinion of the CJEU, there is currently no adequate level of protection for data transfers to the USA.

For a more detailed review of Instagram’s data policies, please refer to https://help.instagram.com/519522125107875

9.3 Audio & video elements

We have integrated audio and/or video elements into our website so that you can watch videos directly via our website. The services are provided by service providers; all content is therefore obtained from the providers’ respective servers.

These are embedded functional elements from platforms such as YouTube. Use of these platforms is generally free of charge, and with the help of these embedded elements you can listen to or view the respective content via our website.

Viewing the video elements on our website also means that your personal data is transmitted to the service providers, processed and stored.

When you access a page on our website that has an embedded video, your server connects to the service provider’s server. In doing so, data about you is also transmitted to the third-party provider and stored there. Some data is collected and stored regardless of whether you have an account with the third-party provider. This data includes your IP address, browser type, operating system and other general information about your device. In addition, most providers also collect information about web activity, including, for example, session duration, bounce rate, which buttons you clicked, or via which website you use the service.

You can find information about the duration of data storage either in the privacy text of the respective tool or in the provider’s privacy policy. In principle, personal data is only processed for as long as is absolutely necessary for the provision of our services or products.

You can revoke your consent to the use of cookies or third-party providers at any time. You can prevent data collection by cookies by managing, deactivating, or deleting cookies in your browser. The lawfulness of the processing up to the point of revocation remains unaffected.

Data processing via audio and video elements requires your consent pursuant to Art. 6 Para. 1 lit. a GDPR. In addition to this consent, Thomas Lorenz ZT GmbH has a legitimate interest pursuant to Art. 6 Para. 1 lit. f GDPR in quick and effective communication with you or other clients and business partners. However, we only use the tools after obtaining your consent pursuant to Art. 6 Para. 1 lit. a GDPR.

9.4 YouTube

We have embedded YouTube videos on our website, which allows us to present interesting videos directly on our site. YouTube is a video portal that has been a subsidiary of Google since 2006. The portal is operated by YouTube, LLC, 901 Cherry Ave., San Bruno, CA 94066, USA.

When you access a page on our website that has an embedded YouTube video, your browser automatically connects to the servers of YouTube or Google. Depending on the settings, various data is transmitted. Google Ireland Ltd is responsible for all data processing in the European area.

When you watch a YouTube video, YouTube sets at least one cookie that stores your IP address and our URL. If you are logged into a YouTube account, YouTube can usually assign your interactions on our website to your profile using cookies. This includes data such as session duration, bounce rate, approximate location, technical information such as browser type, screen resolution, or your internet provider.

If you are not logged into a Google account or a YouTube account, Google stores data with a unique identifier.

Data processing through embedded YouTube elements requires your consent pursuant to Art. 6 Para. 1 lit. a GDPR. In addition to this consent, Thomas Lorenz ZT GmbH has a legitimate interest pursuant to Art. 6 Para. 1 lit. f GDPR in quick and effective communication with you or other clients and business partners. However, we only use the tools after obtaining your consent pursuant to Art. 6 Para. 1 lit. a GDPR. YouTube also sets cookies in your browser to store data. Therefore, we recommend that you carefully read our privacy text on cookies and review the privacy policy or cookie guidelines of the respective service provider.

Since YouTube also processes your data in the USA, we point out that, according to the opinion of the CJEU, there is currently no adequate level of protection for data transfer to the USA.

As a subsidiary of Google, YouTube maintains a joint privacy policy. For more detailed information on how your data is handled, we therefore refer you to this privacy policy https://policies.google.com/privacy?hl=en

10 Confidentiality

All employees of Thomas Lorenz ZT GmbH have been bound to confidentiality regarding information entrusted to them or that has come to their knowledge in the course of their work.

Civil engineers are obligated to maintain confidentiality regarding matters of their clients that have been entrusted to them or have come to their knowledge in the exercise of their profession.

11 Data Security

Data security is a major concern for us. Thomas Lorenz ZT GmbH has taken all necessary technical and organizational measures to ensure the security of data processing and to process personal data in such a way that it is protected from access by unauthorized third parties. The IT infrastructure of Thomas Lorenz ZT GmbH complies with current security requirements and is regularly reviewed.

12 Source Reference

This privacy policy contains passages from a privacy policy created with the privacy policy generator from AdSimple. The following sections were partially adopted:

5. Recipients & Data Processors
6. Storage Period Limitation
7. Data Subject Rights & Contact
8. Website
   • Cookies
   • Web Analytics
9. Social Media
   • Facebook Tools & Fan Page
   • Instagram
   • Audio & Video Elements
   • YouTube