GDPR

Privacy Policy

Data protection and data security are of the utmost importance to us!

We would therefore like to inform you below about the purposes for which your personal data is processed, the legal basis for such processing, and the rights you have in this regard.

 

1. Data Controller

The data controller pursuant to Article 4(7) of the General Data Protection Regulation (hereinafter referred to as the “GDPR”) is:

Wildmoser Rechtsanwälte GmbH (hereinafter referred to as “we” or “us”)
Hopfengasse 23
4020 Linz
Telefon: +43 732/66 73 260
E-Mail: office@wildmoser.at

 

2. Definition of Personal Data

Personal data refers to any information relating to an identifiable or identified natural person. This includes, for example, name, address, age, date of birth, gender, email address, Social Security number, or IP address.

 

3. Data Processing

We collect, process, and use your personal data exclusively in accordance with applicable legal provisions. Your personal data may only be processed if this is done in accordance with the principles of the GDPR and there is a legal basis under Article 6 or Article 9 of the GDPR.

3.1. Purpose and Legal Basis of Data Processing

a) Data Processing in the Client-Attorney Relationship

aa) Fulfillment of Contractual and Precontractual Obligations

Our clients’ personal data is processed, in particular, within the framework of the business relationship or the execution of the client-attorney relationship to fulfill our contractual obligations pursuant to Article 6(1)(b) of the GDPR.

If you contact us prior to establishing a client-attorney relationship, your personal data will be processed to carry out pre-contractual measures and to handle your inquiry (Article 6(1)(b) of the GDPR).

Please note that if you refuse to provide your (required) data, we cannot enter into a client relationship with you. However, you are under no obligation to provide data that is not relevant to the performance of the contract or to consent to the processing of such data.

bb) Compliance with Legal Obligations

We also process your personal data when we are legally required to do so, such as to comply with legal, regulatory, or judicial requirements (Art. 6(1)(c) GDPR).

This includes statutory retention obligations or the obligation to report certain information to authorities.

cc) Consent

If you have given us your consent to process your personal data, we will process your data on this basis (Article 6(1)(a) of the GDPR) and exclusively for the purposes agreed upon with you. You may withdraw this consent at any time.

dd) Legitimate Interest

We also process your personal data when this is necessary to protect our own legitimate interests pursuant to Article 6(1)(f) of the GDPR. This occurs only to the extent that no overriding interests on your part prevail.

Our legitimate interests include, for example, the security of our IT systems, the internal organization of our law firm, or the protection and/or enforcement of our own claims.

b) Data Processing During the Application Process

If you apply for a vacant position at our law firm, we will process only the personal data that you provide to us. The purpose of this data processing is to efficiently conduct the application process.

The legal basis for this data processing is the implementation of pre-contractual measures within the meaning of Article 6(1)(b) of the GDPR.

Your application data will be processed exclusively for the current selection process. Any further retention of this data will only take place with your expressed consent, which you may revoke at any time without providing a reason.

 

4. Collection of Personal Data Not Directly from the Data Subject (Art. 14 GDPR)

In the course of our legal representation and assistance, we do not, in certain cases, collect your personal data directly from you, but rather obtain it from third parties. Such information may originate from the following sources:

  • Public registers and databases (e.g., Commercial Register, Land Register, GISA)
  • Insolvency data (Federal Edict File)
  • Registration data (from the relevant registration authorities)
  • Publicly accessible sources on the Internet (e.g., social networks or search engines)
  • Information from third parties, in particular from clients, suppliers, or their business partners

 

This specifically concerns the following categories of personal data within the meaning of Article 14(1)(d) of the GDPR, which we do not collect directly from the data subject in individual cases:

  • Contact information or identification data (e.g., name, address, phone number, email address)
  • Employment-related data or company data (e.g., commercial register or business license data)
  • Financial data (e.g., creditworthiness information, insolvency notes)
  • Procedural and contractual data (e.g., party status in any proceedings, business relationships, correspondence)
  • Registration data (e.g., primary and secondary residences)
  • Publicly available online information from websites, social media platforms, or public registries

 

The purpose of this data processing is to fulfill our legal services and statutory obligations in accordance with Article 6(1)(b) and (c) of the GDPR.

 

5. Use of Your Data

Notwithstanding our duty of confidentiality, we do not process your data for any purposes other than those covered by the engagement agreement, your consent, or any other provision in accordance with the GDPR. The only exception to this is the use of your data for internal firm statistical purposes, if the data provided has been anonymized.

 

6. Disclosure of Your Data

Your personal data will be disclosed to the following categories of recipients within the meaning of Article 13(1)(e) of the GDPR or Article 14(1)(e) of the GDPR, given that this is necessary to achieve the respective purpose or is required by law:

  • Courts an government agencies
  • Processors engaged by us as the data controller within the meaning of the GDPR (in particular hosting providers and IT service providers)
  • Experts (extrajudicial and judicial)
  • Business partners (auditors, attorneys, tax and management consultants)
  • The relevant bar association
  • Banks an insurance companies

 

In some cases, some of the above-mentioned recipients of your personal data are located outside your country or process your personal data there. The level of data protection may not correspond to that in Austria. However, we transfer your personal data exclusively to countries for which the European Commission has determined that they have an adequate level of data protection, or we implement measures to ensure that all recipients maintain an adequate level of data protection, for which purpose we enter into standard contractual clauses (2010/87/EC and/or 2004/915/EC).

 

7. Retention Period

Your data will not be stored for longer than is necessary to fulfill our contractual or legal obligations or the purposes stated.

To comply with our legal obligation to retain records, client files are generally retained for five years after the conclusion of the retainer agreement.

Under certain circumstances, files may be retained for 30 years if this is necessary to protect our rights.

For documents subject to tax reporting requirements (accounting documents and records), the statutory retention period is seven years.

Job application documents and related personal data are deleted within six months after the conclusion of the specific application process, unless explicit consent has been given for longer storage.

When you subscribe to a newsletter, data storage and processing occur only as long as your consent remains valid.

 

8. Data Security

8. Data Security To protect your personal data, we implement appropriate technical and organizational measures in accordance with Article 32 of the GDPR to ensure a level of protection appropriate to the risk. These measures are continuously reviewed and refined. Some of the current security measures in place include:

  • Access controls to prevent unauthorized physical and digital access
  • Use of encryption technologies for the secure storage and transmission of data
  • Secure network communication through the use of an ATP firewall, including IDS/IPS systems
  • Regular security updates to our systems and applications
  • Ongoing review, assessment, and evaluation of the effectiveness of our technical and organizational measures.

 

Despite the measures we have taken to ensure an appropriately high level of security and due diligence, it cannot be completely ruled out that data you transmit to us via the Internet may be viewed or used by unauthorized third parties.

 

9. Your Rights

With regard to the processing of your personal data, you have various rights, which we outline below:

  • Right of Access: You may request information about what data we process about you, provided that this does not conflict with our legal obligation of confidentiality (Art. 15 GDPR).
  • Right to Rectification and Erasure (“Right to Be Forgotten”): You may request the correction of inaccurate data and the deletion of unlawfully processed data (Art. 16, 17 GDPR).
  • Right to Withdraw Consent: If you have given us your consent to process your data, you may withdraw it at any time with future effect (Art. 7 GDPR).
  • Right to Restriction of Processing: Under certain conditions, you may request the restriction of data processing (Art. 18 GDPR).
  • Data portability: You may request the data you have provided in a commonly used, machine-readable format or request that it be transferred to another controller (Art. 20 GDPR).

 

Right to Object (Art. 21 GDPR)
You have the right to object to the processing of your data based on a legitimate interest on our part. Processing will generally be discontinued if there are compelling legitimate grounds for not doing so, which must be assessed on a case-by-case basis.

No Automated Decision-Making (Art. 22 GDPR)
We do not use your data for decisions that are based solely on automated processing, including profiling, and that would produce legal effects on you.

 

10. Right to File a Complaint

You have the right to file a complaint with a supervisory authority at any time if you believe that your data protection rights have been violated.

In Austria, the Austrian Data Protection Authority, Barichgasse 40–42, 1030 Vienna, is responsible for this (https://www.data-protection-authority.gv.at/).

 

11. Our Contact Information

We are available at any time to answer your questions or to process your withdrawal. You can reach us at Wildmoser Rechtsanwälte GmbH, Hopfengasse 23, 4020 Linz, or by email at office@wildmoser.at. office@wildmoser.at.