We take the protection of your personal data very seriously. We process your personal data in accordance with the General Data Protection Regulation (GDPR; EU 2016/679) and the Liechtenstein Data Protection Act (DSG) / the Austrian Telecommunications Act (TKG).
To the extent that personal data (such as name, address, email address, IP address, location data) is collected on our pages, this is done based on your explicit consent.
Responsible
Dr. Thomas Schröck
CEO & Director
Habsburg Fine Arts AG
Mitteldorf 1
9490 Vaduz
Liechtenstein
office@habsburgfinearts.com
(+)43 1 512 41 89
Data Processors & Recipients
We process your personal data with the support of data processors who assist us in providing the services (e.g., web hosting providers, email newsletter dispatch service).
These data processors are obligated to strictly protect your personal data and may only process your personal data for the purpose of providing our services.
Your personal data will only be disclosed to typical service providers such as banks (in case of transfers to you), tax advisors (if you are included in our accounting), shipping service providers (in case of shipping to you), etc.
Using our website is generally possible without providing personal data. If personal data (such as name or email addresses) is collected on our pages, this will, as far as possible, always be on a voluntary basis (e.g., through a contact form or comment function).
This data will not be shared with third parties without your explicit consent.
In connection with your access to our pages, data will be temporarily stored on our servers for the purpose of data security, which may allow identification (e.g., IP address, date, time, and the name of the requested file). The IP address may, under the GDPR, be considered personal data. Analysis, except for statistical purposes in anonymized form, does not take place.
Generally, the following types of data may be collected on our website:
- Usage data (e.g., visited URLs, interest in content, access times)
- Meta & communication data (e.g., device information, IP addresses)
- Contact data (e.g., name, email – if actively entered by the user (forms))
- Content data (e.g., text input – if actively entered by the user (forms))
We process this data for the following purposes:
- Providing the online services, including the offered features and content
- Responding to contact inquiries and communicating with users
- Security measures
- Reach measurement & marketing
Server Log Files
This website processes the following personal data in a server log file for the purpose of monitoring the technical function and increasing the operational security of the web server based on the overriding legitimate interest of the controller (technical security measures):
- Accessed content
- Time of server request
- Browser type / browser version
- Operating system used
- Referrer URL
- IP address
- Hostname
This data is only temporarily stored as personal data for a period of four weeks. After that, the IP address and the hostname are anonymized.
We have concluded an appropriate data processing agreement with the hosting provider.
Contact Form
After submitting the contact form, the personal data you entered will be processed for the purpose of processing your inquiry based on the consent you granted by submitting the form.
There is no legal or contractual obligation to provide personal data. Non-provision will only result in the inability to submit your inquiry, and we cannot process it.
You have the right to withdraw your consent at any time by written notice, without affecting the lawfulness of the processing based on consent before the withdrawal.
The data will be further processed if it is compatible with the original processing purpose, based on the same legal basis for direct marketing purposes in non-consent-based forms, such as addressed postal advertising, until objection. In this case, the data will be passed to the mailing service provider.
You have the right to object to the use of your personal data for the purpose of direct advertising at any time by written notice. In the case of objection, your personal data will no longer be processed for direct advertising purposes.
Registration Form
After submitting the registration, the above-mentioned data will be processed for the purpose of fulfilling the contract based on the contract concluded with the registration for the duration of the contract.
There is no legal or contractual obligation to provide personal data. Non-provision will only result in the inability to register / conclude the contract / use the service.
The data will be further processed if it is compatible with the original processing purpose, based on the same legal basis for direct marketing purposes in non-consent-based forms, such as addressed postal advertising, until objection. In this case, the data will be passed to the mailing service provider.
You have the right to object to the use of your personal data for the purpose of direct advertising at any time by written notice. In the case of objection, your personal data will no longer be processed for direct advertising purposes.
Webshop
In the context of the webshop, the data you enter and the products you select will be processed to carry out the offer, contract conclusion, contract fulfillment, and to fulfill any post-contractual obligations based on the pre-contractual relationship you initiated and after contract conclusion based on the contract. Contract data will be processed until the expiration of any post-contractual obligations.
Shopping carts of non-registered users will be deleted after 14 days. User accounts of registered users remain until the account is deleted by the user.
There is no legal or contractual obligation to provide personal data. However, provision is required for contract conclusion. Non-provision will result in the inability to conclude the contract.
The data will be further processed if it is compatible with the original processing purpose, based on the same legal basis for direct marketing purposes in non-consent-based forms, such as addressed postal advertising, until objection. In this case, the data will be passed to the mailing service provider.
You have the right to object to the use of your personal data for the purpose of direct advertising at any time by written notice. In the case of objection, your personal data will no longer be processed for direct advertising purposes.
Cookies
This website uses cookies. “Cookies” are small files that are stored on users’ computers. Various data can be stored within cookies.
A cookie is primarily used to store information about a user (or the device on which the cookie is stored) during or after their visit to an online service. Temporary cookies, or “session cookies,” are deleted after a user leaves the online service and closes their browser. For example, such cookies may store the content of a shopping cart in an online shop or a login status. “Permanent” or “persistent” cookies remain stored even after the browser is closed. For instance, a login status may be saved when users revisit after several days. Such cookies can also store users’ interests, which are used for reach measurement or marketing purposes. “Third-party cookies” are cookies provided by parties other than the controller who operates the online service (otherwise, when only their cookies are involved, they are called “first-party cookies”).
We may use temporary and permanent cookies and provide more information about them in our privacy policy.
If users do not wish for cookies to be stored on their computers, they are asked to disable the corresponding option in their browser’s system settings. Stored cookies can be deleted in the system settings of the browser. Disabling cookies may lead to limitations in the functionality of this online service.
Google Analytics
This website uses Google Analytics, a web analysis service by Google LLC, 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA (“Google”). We have concluded an appropriate data processing agreement with the provider.
Data processing is based on the legal provisions of § 96 para. 3 TKG, as well as Art. 6 para. 1 lit a) (consent) of the GDPR.
No data will be transmitted to Google before the user has explicitly consented to the use of Google Analytics on this website.
The version of Google Analytics used (Google Analytics 4) has IP pseudonymization enabled by default, so your IP address will be shortened by Google within the EU member states or in other contracting states of the European Economic Area Agreement. Only in exceptional cases will the full IP address be transmitted to a Google server in the USA and shortened there.
The ECJ classifies the USA as a country with inadequate data protection according to EU standards. Since Google falls under 50 U.S. Code §1881a in the USA, the transfer of the IP address and other data to the USA must be regarded as a transfer to an insecure third country, and therefore it will only take place after explicit user consent.
Google Analytics uses “cookies,” text files that are stored on your computer and allow an analysis of your usage of the website. The information generated by the cookie about your usage of this website is generally transmitted to a Google server in the USA and stored there. You can prevent this by setting your browser to not store cookies.
These cookies are used by Google Analytics in your browser:
| Cookie | Duration | Description |
| _ga | 24 months | This cookie is used by Google Analytics to distinguish between individual users and sessions. |
| _gat_UA-ID | 10 minutes | This cookie is used to throttle the request rate, limiting the collection of data on high traffic sites. |
| _gid | 24 hours | This cookie is also used by Google Analytics to distinguish between individual users and sessions. |
For more details on the types of cookies used by Google, visit https://policies.google.com/technologies/types?hl=de
On behalf of the operator of this website, Google uses the information generated by these cookies to evaluate your use of the website, compile reports on website activity, and provide additional services related to website and internet usage.
The IP address transmitted from your browser as part of Google Analytics will be anonymized and will not be combined with other data from Google.
You can prevent the storage of cookies by adjusting the settings in your browser software. However, please note that if you do so, you may not be able to fully use all features of this website. Furthermore, you can prevent the collection of data generated by the cookie regarding your use of the website (including your IP address) and the processing of this data by Google by downloading and installing the browser plugin available at Google Analytics Opt-out Browser Add-on.
Alternatively, especially on mobile browsers, you can prevent the collection by Google Analytics by clicking the following button and adjusting your privacy and data protection settings:
Google Marketing and Remarketing Services
This website also uses marketing and remarketing services (referred to as “Google Marketing Services”) provided by Google LLC, 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA (“Google”). Google Marketing Services allow us to display advertisements on other websites in a more targeted manner, showing users ads that are potentially relevant to their interests.
Since Google falls under 50 U.S. Code §1881a in the U.S., the transfer of IP addresses and other data to the U.S. is considered a transfer to an insecure third country. Therefore, it will only occur with the explicit consent of the user.
“Remarketing” refers to the practice where a user sees ads for products they have shown interest in on other websites. For this purpose, when visiting our website and other websites where Google Marketing Services are active, Google immediately runs a code from Google, embedding (Re)marketing tags (invisible graphics or code, also referred to as “Web Beacons”) into the website. These tags help store a unique cookie on the user’s device, which is a small file (similar technologies can also be used instead of cookies). The cookies can be set by various Google domains, including google.com, doubleclick.net, invitemedia.com, admeld.com, googlesyndication.com, or googleadservices.com. This file records the websites the user has visited, what content they are interested in, and which offers they clicked on, along with technical information about the browser and operating system, referring websites, visit times, and further data on the use of the online service.
As part of remarketing, Google may set the following cookies on our site in your browser:
| Cookie | Duration | Description |
| 1P_JAR | 12 Monate | These are set by Google to track how you use our website and to show you advertisements that may be of interest to you. |
| CONSENT | 20 years | This cookie stores user preferences and additional information. This includes, in particular, the preferred language, the number of search results to be displayed on the page, and the decision whether the SafeSearch filter by Google should be activated or not. |
| IDE | 12 months | Used by Google AdWords via a DoubleClick domain to register and report user actions on the website after viewing or clicking on one of the provider’s ads. The purpose is to measure the effectiveness of an ad and to display targeted advertising to the user. |
| NID | 6 months | Google uses cookies such as the NID and SID cookies to customize ads in Google products like Google Search. With these cookies, Google tracks, for example, your most recent search queries, your previous interactions with a marketer’s ads or search results, and your visits to a marketer’s website. This allows Google to display tailored ads. |
| DV | 12 months |
|
The IP address of users is also recorded, with the clarification that, within the framework of Google Analytics, the IP address is anonymized (pseudonymized) within member states of the European Union or other contracting states of the Agreement on the European Economic Area and only in exceptional cases will the full IP address be transmitted to a Google server in the USA and anonymized there (see the section on the use of Google Analytics).
The IP address is not merged with user data from other Google services. The aforementioned information may also be linked by Google with data from other sources. When the user subsequently visits other websites, ads tailored to their interests may be shown to them.
User data within the Google Marketing Services framework is processed pseudonymously, meaning that Google does not store or process, for example, the user’s name or email address, but processes the relevant data related to cookies within pseudonymous user profiles. From Google’s perspective, ads are not managed and displayed for a specifically identified person but for the cookie holder, regardless of who the cookie holder is. This does not apply if a user has explicitly allowed Google to process data without pseudonymization. The information collected by Google Marketing Services about the user is transmitted to Google and stored on Google’s servers in the USA.
The Google Marketing Services we use include, among others, the online advertising program “Google Ads.” In the case of Google AdWords, each Ads customer receives a different “conversion cookie.” Cookies cannot be tracked across AdWords customer websites. The information collected using the cookie is used to create conversion statistics for us as AdWords customers. This way, we learn the total number of users who clicked on our ad and were redirected to a page containing a conversion tracking tag. However, we do not receive any information that would allow us to personally identify users.
For more information about data usage for marketing purposes by Google, please visit the overview page: https://www.google.com/policies/technologies/ads.
If you wish to opt-out of interest-based advertising by Google Marketing Services, you can use the opt-out and settings options provided by Google: www.google.com/ads/preferences.
Meta Pixel & cAPI
We use the Meta Pixel or Meta’s Facebook cAPI on our website, a JavaScript code that links user behavior on our site to user profiles on Meta services (Facebook, Instagram). As part of this technical process, Meta gains knowledge of which specific page of our website the affected users visit and, if applicable, which actions were performed there. The pixel collects data that helps us track conversions, optimize ads, and define target audiences.
The operator of the service is Meta, Inc., 1 Hacker Way, Menlo Park, CA 94025, USA. For the processing of personal data, the data controller is Meta Platforms Ireland Limited, 4 Grand Canal Square, Dublin 2, Ireland, if the affected person resides outside the USA or Canada.
The data processing is based on the legal provisions of § 96 Abs 3 TKG, as well as Art 6 Abs 1 lit a (consent) of the GDPR. No data will be transmitted to Meta before the user has explicitly consented to the use of the Meta Pixel / cAPI on this website.
The European Court of Justice classifies the USA as a country with inadequate data protection according to EU standards. Since Meta falls under 50 U.S. Code §1881a in the USA, the transfer of the IP address and other data to the USA must be considered as a transfer to an insecure third country, and therefore only occurs after the explicit consent of the user.
If the affected person is simultaneously logged into Meta, Meta recognizes, with each visit to our website and throughout the user’s stay on our site, which specific page of our website the user visits. This information is collected by the Meta Pixel or cAPI and linked to the user’s Facebook or Instagram account.
Meta receives information about the user’s visit to our website whenever the user is logged into Facebook or Instagram at the time of visiting our site. If the user does not want this transmission of information to Facebook, they can prevent it by logging out of their Facebook or Instagram account before visiting our site.
Meta’s published data policy, which can be accessed at https://de-de.facebook.com/about/privacy/, provides information about the collection, processing, and use of personal data by Meta. It also explains the privacy protection settings that Meta offers to the affected person.
Newsletter
By subscribing to our newsletter, you agree to receive and participate in the described procedures.
We send newsletters, emails, and other electronic notifications with promotional information (hereinafter “Newsletter”) only with the consent of the recipients or a legal authorization. If the content of the newsletter is specifically outlined during the registration process, this will be essential for the user’s consent.
Registration for our newsletter is done via a so-called double opt-in procedure. This means you will receive an email after registering, asking you to confirm your registration. This confirmation is necessary to prevent someone from registering with another person’s email address.
The registrations for the newsletter are logged to document the registration process according to legal requirements. This includes storing the time of registration and confirmation, as well as the IP address.
For sending our community emails and newsletters, we use the software “Brevo” from the provider Sendinblue GmbH, Köpenicker Str. 126, 10179 Berlin (Germany). Sendinblue provides a technical solution to design and send emails to our subscribers. Your data is forwarded to Sendinblue GmbH solely for the purpose of sending the newsletter. The servers of Sendinblue are located within the EU.
Statistical Collection and Analysis
The newsletters contain a so-called “web beacon,” i.e., a pixel-sized file that is retrieved from the Sendinblue server when the newsletter is opened. During this retrieval, technical information such as browser and system information, as well as your IP address and the time of retrieval, is collected. This information is used to improve our services technically based on the technical data or the audience’s reading behavior, including their access locations (which can be identified via the IP address) or access times.
Statistical surveys also include determining whether the newsletters are opened, when they are opened, and which links are clicked. These details can be assigned to individual newsletter recipients for technical reasons. However, neither we nor Sendinblue aim to monitor individual users. The analyses are intended to help us understand our users’ reading habits and adjust our content accordingly, or send different content based on users’ interests.
There are instances where we direct newsletter recipients to Sendinblue’s website. For example, our newsletters contain a link that allows recipients to view the newsletter online (e.g., in case of display issues in their email program). Additionally, recipients can correct their data, such as email addresses, afterward. Sendinblue’s privacy policy is only available on their website at https://www.brevo.com/de/legal/privacypolicy/.
You can unsubscribe from our newsletter at any time, i.e., revoke your consent. This will simultaneously revoke your consent for sending the newsletter via Sendinblue and the statistical analysis. A separate withdrawal of consent for sending via Sendinblue or for statistical analysis is not possible.
You will find a link to unsubscribe from the newsletter at the end of each newsletter.
Calendly
To arrange appointments on our website, we use the scheduling tool Calendly. The scheduling module will only be loaded after the user’s consent (Art 6 Abs 1 lit a DSGVO).
The service provider is Calendly, Inc., 115 E Main St., Ste. A1B, Bufort, GA 30518, USA, represented by DPO Centre Europe, Friedrichstraße 88, 10117 Berlin, Germany, eurep@calendly.com.
Entering additional personal data (contact information such as name or email address) for the purpose of selecting and scheduling appointments is carried out to fulfill an agreement or pre-contractual measures based on your request (Art 6 Abs 1 lit b DSGVO). This may also involve the transfer of personal data to a country outside the European Union.
There is no legal or contractual obligation to provide the personal data. If not provided, it will result in the inability to use this service.
Your Rights
You have the right to access, correct, delete, and restrict the processing of your personal data.
If the legal basis for processing your personal data is your consent or a contract with you, you also have the right to data portability.
You have the right to withdraw any consent given for the processing of your personal data. The lawfulness of the processing of your personal data until the withdrawal is not affected by the withdrawal.
You have the right to object to the processing of your personal data for direct marketing purposes. In the event of an objection, your personal data will no longer be processed for direct marketing purposes.
Additionally, you have the right to file a complaint with the supervisory authority (Austrian Data Protection Authority, Wickenburggasse 8, 1080 Vienna, dsb@dsb.gv.at) / Data Protection Authority Liechtenstein, Städtle 38, Postfach 684, FL-9490 Vaduz, T +423 236 60 90, info.dss@llv.li.
//
Sources: Sample disclaimer from www.disclaimer.de, lawyer in traffic law Hamburg, as well as samples for fulfilling the data protection information obligations for websites by the Economic Chamber of Vienna. Information about the newsletter is also based on the sample from lawyer Dr. Thomas Schwenke.