Privacy policy

Information

On this page, we inform you about the processing of your personal data. If you wish to change your privacy settings (give consent or revoke already given consent), you can change your settings at any time.

Responsible party

Responsible for processing your personal data on our website is:

Bizibits Sales GmbH
Wasserwerkstraße 20
4053 Ansfelden
Austria
Tel.: +43 720 257442
E-mail: office@bio-stefan.at

Data Protection Officer

You can reach our data protection officer at:

Erwin Sabic
Austria
Tel.: +43 720 257442
E-mail: erwin@bio-stefan.at

Consent Management Tool

LEGALWEB.IO via KEY CDN

On our website, we use the consent management tool of the data processor LEGALWEB.IO, legalweb GmbH, Bayerhamerstraße 14, 5020 Salzburg, Austria. This tool sets a cookie on your device to store the services you have selected or not selected. This cookie is not assigned any user-related ID and does not store any other personal data. The contents are stored for a maximum of 365 days and then automatically deleted. The legal basis for storing this data is § 165 para. 3 TKG 2021. The consent management tool is loaded via the sub-processor Key CDN, proinity LLC, Faerberstrasse 9, CH-8832 Wollerau, Switzerland. Key CDN only collects your IP address to ensure the security of the data center. No data transmission of your IP address to legalweb GmbH takes place. The transmission of data to Switzerland is based on Art. 45 GDPR in conjunction with the adequacy decision C(2000) 2304 of the European Commission.

Data processing on your device

The processing operations described in the following text use technologies such as scripts, cookies, WebSQL, LocalStorage, Session Storage, ... . These technologies store data on your device or read data from it.

Webhost

Shopify International Limited

When visiting this website, personal data is processed. Categories of data processed: technical connection data from server access (IP address, date, time, requested page, browser information). Purpose of processing: monitoring the technical function and increasing the operational security of our web server, delivery and provision of the website, and anonymization and creation of statistics. Legal basis for processing: a legitimate interest that outweighs the rights and freedoms of the data subjects (Art. 6 (1) f GDPR). Legitimate interests in this context: strong economic interest in a secure and functioning operation of the technical systems. Data is transferred to the processor Shopify International Limited, Victoria Buildings, 2nd floor, 1-2 Haddington Road, D04 XN32 Dublin 4, Ireland.

Content Delivery Network

Cloudflare

When visiting this website, personal data is processed. Categories of data processed: technical connection data from server access (IP address, date, time, requested page, browser information). Purpose of processing: delivery and provision of the website. Legal basis for processing: a legitimate interest that outweighs the rights and freedoms of the data subjects (Art. 6 (1) f GDPR). Legitimate interests in this context: strong economic interest in a secure and functioning operation of the technical systems. Data is transferred to the processor Cloudflare Germany GmbH, Rosental 7, 80331 Munich, Germany. This may also involve the transfer of personal data to a country outside the European Union. The transfer of data is based on standard data protection clauses issued by the Commission according to the examination procedure under Article 93 paragraph 2 GDPR.

Key CDN

When accessing certain partial services of our website, additional personal data is processed. Categories of data processed: technical connection data from server access (IP address, date, time, requested page, browser information). Purpose of processing: delivery and provision of the website. Legal basis for processing: a legitimate interest that outweighs the rights and freedoms of the data subjects (Art. 6 (1) f GDPR). Legitimate interests in this context: strong economic interest in a secure and functioning operation of the technical systems. Data is transferred to the processor proinity LLC, Färberstrasse 9, CH-8832 Wollerau, Switzerland. This may also mean a transfer of personal data to a country outside the European Union. The transfer of data to Switzerland is based on Art. 45 GDPR in conjunction with the adequacy decision C(2000) 2304 of the European Commission.

Shopify International Limited

When visiting this website, personal data is processed. Categories of data processed: technical connection data from server access (IP address, date, time, requested page, browser information). Purpose of processing: delivery and provision of the website. Legal basis for processing: a legitimate interest that outweighs the rights and freedoms of the data subjects (Art. 6 (1) f GDPR). Legitimate interests in this context: strong economic interest in a secure and functioning operation of the technical systems. Data is transferred to the processor Shopify International Limited, Victoria Buildings, 2nd Floor, 1-2 Haddington Road, D04 XN32 Dublin 4, Ireland.

Hextom Inc

When visiting this website, personal data is processed. Categories of data processed: technical connection data from server access (IP address, date, time, requested page, browser information). Purpose of processing: delivery and provision of the website. Legal basis for processing: a legitimate interest that outweighs the rights and freedoms of the data subjects (Art. 6 (1) f GDPR). Legitimate interests in this context: strong economic interest in a secure and functioning operation of the technical systems. Data is transferred to the processor Hextom Inc, 702-5255 Yonge St., M2N 6P4 North York ON, USA.

Web analysis

Matomo Agency

When visiting this website, personal data is processed. Categories of data processed: data for creating usage statistics. Purpose of processing: analysis of usage behavior. Legal basis for processing: a legitimate interest that outweighs the rights and freedoms of the data subjects (Art. 6 (1) f GDPR). Legitimate interests in this context: strong economic interest in the proper operation of the website.

Remarketing

Bing Ads

When visiting this website, personal data is processed. Categories of data processed: data about the use of the website as well as logging of clicks on individual elements. Purpose of processing: investigation of user behavior, analysis of the effectiveness of online marketing measures, and selection of online advertising on other platforms, which is automatically selected via real-time bidding based on user behavior. The legal basis for processing: your consent according to Art. 6 (1) a GDPR. Data is transmitted to: the independent controller Microsoft Ireland Operations Limited, One Microsoft Place South County Business Park, Leopardstown Dublin, 18 D18 P521, Ireland. The legal basis for data transmission to Microsoft Ireland Operations Limited is your consent according to Art. 6 (1) a GDPR. This may also involve the transfer of personal data to a country outside the European Union. The transfer of data to the USA is based on Art. 45 GDPR in conjunction with the adequacy decision C(2023) 4745 of the European Commission, as the data recipient has committed to comply with the principles of data processing of the Data Privacy Framework (DPF).

Meta Pixel

When visiting this website, personal data is processed. Categories of data processed: data about the use of the website as well as logging of clicks on individual elements. Purpose of processing: investigation of user behavior, analysis of the effectiveness of online marketing measures, and selection of online advertising on other platforms, which is automatically selected via real-time bidding based on user behavior. The legal basis for processing: your consent according to Art. 6 (1) a GDPR. Data is transmitted to: the independent controller Meta Platforms Ireland Ltd., 4 Grand Canal Square, Grand Canal Harbour, Dublin 2, Ireland. The legal basis for data transmission to Meta Platforms Ireland Ltd. is your consent according to Art. 6 (1) a GDPR. This may also involve the transfer of personal data to a country outside the European Union. The transfer of data to the USA is based on Art. 45 GDPR in conjunction with the adequacy decision C(2023) 4745 of the European Commission, as the data recipient has committed to comply with the principles of data processing of the Data Privacy Framework (DPF).

Google GTag

When visiting this website, personal data is processed. Categories of data processed: data about the use of the website as well as logging of clicks on individual elements. Purpose of processing: investigation of usage behavior, analysis of the effect of online marketing measures, and selection of online advertising on other platforms, which are automatically selected by real-time bidding based on usage behavior. The legal basis for processing: your consent according to Art. 6 (1) a GDPR. Data is transferred to: the independent controller Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. The legal basis for data transfer to Google Ireland Limited is your consent according to Art. 6 (1) a GDPR. This may also mean a transfer of personal data to a country outside the European Union. The transfer of data to the USA takes place based on Art. 45 GDPR in conjunction with the adequacy decision C(2023) 4745 of the European Commission, as the data recipient has committed to comply with the principles of data processing of the Data Privacy Framework (DPF). The privacy policy of Google Ireland Limited: https://business.safety.google/privacy.

Pinterest Profiling

When visiting this website, personal data is processed. Categories of data processed: data about the use of the website as well as logging of clicks on individual elements. Purpose of processing: investigation of usage behavior, analysis of the effect of online marketing measures, and selection of online advertising on other platforms, which are automatically selected by real-time bidding based on usage behavior. The legal basis for processing: your consent according to Art. 6 (1) a GDPR. Data is transferred to: the independent controller Pinterest Europe Ltd., Palmerston House, 2nd Floor, Fenian Street, Dublin 2, Ireland. The legal basis for data transfer to Pinterest Europe Ltd. is your consent according to Art. 6 (1) a GDPR. This may also mean a transfer of personal data to a country outside the European Union. The transfer of data is based on your consent pursuant to Art. 6 para. 1 lit. a in conjunction with Art. 49 para. 1 lit. a GDPR. You were already informed before giving your consent that the USA does not have a data protection level corresponding to EU standards. In particular, US intelligence agencies can access your data without you being informed and without you being able to take legal action against it. For email contact with the data protection officer of Pinterest Europe Ltd.: https://help.pinterest.com/de/data-protection-officer-contact-form. The privacy policy of Pinterest Europe Ltd.: https://policy.pinterest.com/de/privacy-policy.

TikTok Pixel

When visiting this website, personal data is processed. Data categories processed include: data about website usage as well as logging of clicks on individual elements. Purpose of processing: investigation of usage behavior, analysis of the effectiveness of online marketing measures, and selection of online advertising on other platforms, which is automatically selected via real-time bidding based on usage behavior. The legal basis for processing: your consent according to Art. 6 (1) a GDPR. Data is transmitted to: the independent controller TikTok Technology Limited, 10 Earlsfort Terrace, Dublin, D02 T380, Ireland. The legal basis for data transmission to TikTok Technology Limited is your consent according to Art. 6 (1) a GDPR. This may also involve the transmission of personal data to a country outside the European Union. The transmission of data is based on your consent pursuant to Art. 6 para. 1 lit. a in conjunction with Art. 49 para. 1 lit. a GDPR. For email contact with the data protection officer of TikTok Technology Limited: https://www.tiktok.com/legal/report/DPO. The privacy policy of TikTok Technology Limited: https://www.tiktok.com/legal/privacy-policy-eea?lang=de.

Live Chats

Tidio Chat

When activating the chat function on our website, additional personal data is processed. Data categories processed include: technical connection data from server access (IP address, date, time, requested page, browser information), information about your inquiry, and contact details such as name or email address. Purpose of processing: investigation of usage behavior, support of website visitors with technical or content-related questions, and optimization of content. The legal basis for processing: your consent according to Art. 6 (1) a GDPR. Data is transmitted to: the processor Tidio LLC, 149 New Montgomery St 4th Floor, San Francisco, CA 94105, USA (https://www.tidio.com)represented by Tidio Poland Sp. z o.o., 81 Wojska Polskiego Street, 70-481, Szczecin, Poland. This may also involve the transfer of personal data to a country outside the European Union. The transfer of data to the USA is based on Art. 45 GDPR in conjunction with the adequacy decision C(2023) 4745 of the European Commission, as the data recipient has committed to comply with the principles of data processing of the Data Privacy Framework (DPF).

Embeddings

Elfsight Google Reviews

When accessing certain partial services of our website, additional personal data is processed. Categories of data processed include: technical connection data from server access (IP address, date, time, requested page, browser information), data for creating usage statistics, and data about the approximate location of the device. Purpose of processing: delivery of content provided by third parties. The legal basis for processing: your consent according to Art. 6 (1) a GDPR. Data transfer occurs: to the independent controller Elfsight, LLC, 0015, Yerevan, Paronyana str., 19/3, 201, Armenia. The legal basis for data transfer to Elfsight, LLC is your consent according to Art. 6 (1) a GDPR. This may also involve the transfer of personal data to a country outside the European Union. The transfer of data is based on your consent pursuant to Art. 6 para. 1 lit. a in conjunction with Art. 49 para. 1 lit. a GDPR. The privacy policy of Elfsight, LLC: https://elfsight.com/privacy-policy/.

YouTube

When accessing certain partial services of our website, additional personal data is processed. Categories of data processed include: technical connection data from server access (IP address, date, time, requested page, browser information) and data for creating usage statistics. Purpose of processing: delivery of content provided by third parties, selection of online advertising on other platforms automatically selected via real-time bidding based on usage behavior, and transmission and display of video content. The legal basis for processing: your consent according to Art. 6 (1) a GDPR. Data transfer occurs: under joint responsibility to Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. This may also involve the transfer of personal data to a country outside the European Union. The transfer of data to the USA is based on Art. 45 GDPR in conjunction with the adequacy decision C(2023) 4745 of the European Commission, as the data recipient has committed to comply with the principles of data processing under the Data Privacy Framework (DPF).

Webshop

We offer you the possibility to purchase products directly through our webshop. In the context of the webshop, the data you enter as well as data about products you select are processed by the controller for the purpose of making an offer, concluding the contract, fulfilling the contract, and fulfilling any post-contractual obligations before contract conclusion based on the pre-contractual relationship initiated by you and after contract conclusion based on the contract according to Art. 6 para. 1 lit. b GDPR. If the purchase of our products was made via an existing customer account or a customer account was created to process the purchase, your personal data will be processed until your customer account is deleted. For customers who purchased our products via a guest profile, their personal data will be processed until the expiration of the statutory retention periods. There is a further processing of your data compatible with the purpose of contract fulfillment for the purpose of direct marketing in non-consent-required forms such as addressed postal advertising until objection. There is no legal or contractual obligation to provide personal data. However, provision is necessary for contract conclusion. Failure to provide data means that no contract can be concluded. Shopping carts of unregistered users are deleted after a maximum of 14 days. User accounts of registered users remain until the account is deleted by the user. Contract data is processed until the expiration of possible post-contractual obligations.

Payments are processed with:

Google Pay

When entering payment data in our online shop, we process personal data. Categories of data processed: contact details such as name or email address and payment information such as bank details or credit card data. Purpose of processing: fulfillment of agreements. The legal basis for processing: the necessity to fulfill an agreement or pre-contractual measures at your request (Art. 6 (1) b GDPR). Data is transmitted to: the independent controller Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. The legal basis for data transmission to Google Ireland Limited is the necessity to fulfill an agreement or pre-contractual measures at your request (Art. 6 (1) b GDPR). This may also involve the transmission of personal data to a country outside the European Union. The transmission of data to the USA is based on Art. 45 GDPR in conjunction with the adequacy decision C(2023) 4745 of the European Commission, as the data recipient has committed to comply with the principles of data processing under the Data Privacy Framework (DPF). The privacy policy of Google Ireland Limited: https://business.safety.google/privacy.

Klarna

PayPal

Shopify International Limited

Right to Object

If the processing of your personal data is based on legitimate interest, you have the right to object to this processing. If there are no compelling legitimate grounds for the processing on our part, processing of your data on this legal basis will cease. You also have the right to object to the processing of your personal data for direct marketing purposes. In the event of objection, your personal data will no longer be processed for direct marketing purposes. The lawfulness of the data processed up to the objection is not affected by the objection.

Right of withdrawal

You have the right to withdraw consent already given at any time by changing the privacy settings. In the case of consent to receive electronic advertising, the withdrawal of your consent can be made by clicking the unsubscribe link. In this case, processing will cease unless there is another legal basis. The lawfulness of the data processed up to the withdrawal is not affected by the withdrawal.

Other data subject rights

You also have the right to access, rectify, erase, and restrict the processing of personal data. If the legal basis for processing your personal data is your consent or a contract concluded with you, you also have the right to data portability. Furthermore, you have the right to lodge a complaint with the supervisory authority. More information about the supervisory authorities in the European Union can be found here.