This privacy policy explains which personal data is processed when you visit this website, for what purpose, and what rights you have. It relates exclusively to the website; separate information applies to the firm’s legal services.
1. Controller
The controller responsible for data processing on this website is:
GCP Rechtsanwälte Gruber Partnerschaft KG
Wipplingerstraße 20
1010 Wien, Austria
Telephone: +43 1 533 14 17
E-mail: office@gcp.co.at
No data protection officer has been appointed, as the statutory requirements for a mandatory appointment (Art. 37 GDPR) are not met.
2. General
We process personal data only to the extent necessary to operate the website and to handle your enquiries. The legal bases are Art. 6(1)(a) GDPR (consent, e.g. for the Google Maps map), Art. 6(1)(b) GDPR (handling your enquiry as a pre-contractual measure) and Art. 6(1)(f) GDPR (legitimate interest in the secure and error-free operation of the website).
No automated decision-making, including profiling, within the meaning of Art. 22 GDPR takes place. The website does not use any analytics, tracking or advertising services, does not load fonts or scripts from third-party servers and contains no social media plugins.
3. Hosting and server log files
The website is hosted by: Hetzner Online GmbH, Industriestr. 25, 91710 Gunzenhausen, Deutschland.
Each time the website is accessed, the web server processes technically necessary data in so-called log files: the IP address of the requesting device, date and time of access, the page or file requested, the amount of data transferred, the previously visited page (referrer) and the browser type and operating system. This data is required to deliver the pages and serves security, the prevention of attacks and error analysis.
The legal basis is Art. 6(1)(f) GDPR (legitimate interest in secure operation). The log files are stored by the hosting provider only for a short period and then deleted automatically, unless they are needed longer to investigate a specific security incident. They are not combined with other data.
4. Contact form
If you write to us via the contact form, we process the details entered in the form: your name, your e-mail address, optionally your telephone number and the content of your message. This data is transmitted by e-mail to office@gcp.co.at and used there to handle your enquiry.
The legal basis is Art. 6(1)(b) GDPR insofar as your enquiry concerns the provision of a service, and otherwise Art. 6(1)(f) GDPR (legitimate interest in responding to enquiries). By ticking the checkbox before sending, you confirm that you have taken note of this privacy policy.
To protect against automated spam submissions, the website checks – exclusively on its own server – a hidden form field, the time between page load and submission, and the number of submissions per sender. For this purpose a day-specific, non-reversible hash value of your IP address is stored for a maximum of 10 minutes. No external services (such as reCAPTCHA) are used.
Your enquiry is not stored in the website database; it exists only in the e-mail. We delete the e-mail once your enquiry has been dealt with and no statutory retention obligation applies – at the latest after 30 days. Longer storage takes place only where statutory retention obligations apply or your enquiry leads to a client relationship; in that case the retention periods applicable to it apply.
Please note that e-mail is not an encrypted means of transmission. For confidential matters we recommend contacting us by telephone on +43 1 533 14 17 or arranging a personal appointment.
5. Cookies and consent
The website uses only technically necessary cookies and storage entries. On your first visit a dialog asks for your choice; nothing is pre-selected. There are two categories:
- Necessary: the cookie
gcp_consent, which stores your choice for 180 days, and – only when editors log in – the WordPress login cookies. This category is always active. - External media: the Google Maps map on the contact page (see section 6). It is loaded only with your consent.
The legal basis for storing and accessing non-essential information on your device is your consent pursuant to Art. 6(1)(a) GDPR in conjunction with section 165(3) of the Austrian Telecommunications Act (TKG 2021). You can change or withdraw your choice at any time via “Cookie settings” in the footer of every page; the withdrawal takes effect immediately for the future. The individual cookies are described in the Cookie Policy.
Your decision is documented exclusively in the cookie on your device. In addition, the website counts anonymously how often per day “Accept all” or “Necessary only” was chosen – without IP address, browser identifier or any other personal reference.
6. Google Maps
On the contact page you can load an interactive map from Google Maps. The provider is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. Before you give your express consent, no connection to Google is established; instead you see a locally stored map image with a notice about the data transfer.
Only when you allow the category “External media” or click “Load map” is the map loaded from Google servers. In the process, your IP address, device and browser information and the page visited, among other data, are transmitted to Google; Google may set its own cookies. The legal basis is your consent pursuant to Art. 6(1)(a) GDPR. You can withdraw your consent at any time via “Cookie settings” in the footer; the map is then immediately replaced by the local map image again.
Google may also process data in the USA. Google LLC is certified under the EU-US Data Privacy Framework (adequacy decision of the European Commission of 10 July 2023); in addition, Google uses the standard contractual clauses of the European Commission. Further information can be found in Google’s privacy policy at policies.google.com/privacy.
7. Recipients and processors
Your data is passed on only to the following recipients:
- Hosting and e-mail dispatch: Hetzner Online GmbH, Industriestr. 25, 91710 Gunzenhausen, Deutschland – operates the web server and the mail server through which contact form messages are sent (data processing pursuant to Art. 28 GDPR).
- Google Ireland Limited: only if you load the Google Maps map (see section 6).
Data is not passed on for advertising purposes and is not sold. Authorities or courts receive data only where we are legally obliged to provide it.
8. Retention periods
- Server log files: stored only for a short period, then deleted automatically by the hosting provider (section 3).
- Contact form spam protection: hash value of the IP address for a maximum of 10 minutes, form token for a maximum of 24 hours (section 4).
- Contact enquiries by e-mail: until finally dealt with, at the latest 30 days; correspondingly longer where statutory retention obligations apply (e.g. section 132 of the Austrian Federal Fiscal Code (BAO): seven years for documents of tax relevance) or where the enquiry leads to a client relationship (section 4).
- Cookie
gcp_consent: 180 days from your decision; the session release of the map (“Load map” without “Remember my choice”) ends when the browser tab is closed. - Anonymous consent count: daily figures without personal reference, for a maximum of 400 days.
9. Your rights
You have the following rights vis-à-vis the controller:
- access to the personal data processed about you (Art. 15 GDPR),
- rectification of inaccurate data (Art. 16 GDPR),
- erasure (Art. 17 GDPR),
- restriction of processing (Art. 18 GDPR),
- data portability (Art. 20 GDPR),
- objection to processing based on Art. 6(1)(f) GDPR (Art. 21 GDPR),
- withdrawal of consent with effect for the future (Art. 7(3) GDPR); the lawfulness of processing carried out before the withdrawal remains unaffected.
To exercise these rights, contact office@gcp.co.at or write to the postal address given above.
10. Right to lodge a complaint
If you believe that the processing of your data infringes data protection law, you can lodge a complaint with the supervisory authority:
Österreichische Datenschutzbehörde (Austrian Data Protection Authority)
Barichgasse 40–42, 1030 Vienna, Austria
Telephone: +43 1 52 152-0
E-mail: dsb@dsb.gv.at
Website: www.dsb.gv.at
11. Currency of this policy
Last updated: . We will amend this privacy policy if the website’s features or the legal situation change. The version published on this page at any given time applies.