Privacy Policy

1. Controller

The controller within the meaning of the General Data Protection Regulation (GDPR) and the Austrian Data Protection Act (DSG) is:

We are not required to appoint a data protection officer under Art. 37 GDPR, as our company does not reach the statutory thresholds. The contact person for data protection enquiries is Yusuf Rolle, who can be reached via the contact details given above.

2. General information

Protecting your personal data is a matter of particular importance to us. We process your data exclusively on the basis of the statutory provisions (GDPR, DSG, TKG 2021).

When you contact us via this website, book a repair or use our pickup service, we collect personal data. This policy informs you which data we process, for what purpose, on which legal basis, and which rights you have.

3. Contacting us

When you contact us via the contact form, by phone or by e-mail, we process the data you provide (name, phone number, e-mail address, content of your message) in order to respond to your enquiry.

Legal basis: Art. 6(1)(b) GDPR (steps prior to entering into a contract) or Art. 6(1)(f) GDPR (legitimate interest in responding efficiently).

Retention period: Until your enquiry has been dealt with, at most 6 months after the last contact. Where a contractual relationship exists, longer statutory retention periods apply.

4. Appointment booking & repair processing

When you book an appointment, request a repair or use our pickup service, we process the following data:

• Name
• Address (for pickup and return delivery)
• Phone number
• E-mail address
• Device information (model, serial number, description of the fault)
• Selected repair service and price
• Diagnostic results and repairs carried out
• Photos/videos of the device (optional, for documentation)
• IMEI/serial number of the device
• Booking confirmations and communication

Legal basis: Art. 6(1)(b) GDPR (performance of a contract).

Retention period: For the duration of the repair plus the 6-month warranty period. Invoices are retained for 7 years in accordance with § 132 BAO (Austrian Federal Fiscal Code). Once the warranty has expired, personal booking data in the repair archive is deleted automatically.

5. Processors

To provide our services we use the following service providers, which process your data on our behalf (Art. 28 GDPR):

Data processing agreements (DPA) pursuant to Art. 28 GDPR are in place with all processors. For transfers to third countries (USA, Singapore), the EU Standard Contractual Clauses apply (Standard Contractual Clauses pursuant to Decision (EU) 2021/914).

6. Cookies and tracking technologies

Our website uses cookies and similar technologies. Necessary cookies serve the operation of the website and are set without your consent (legal basis: § 165(3) TKG 2021 or Art. 6(1)(f) GDPR).

For all other cookies (statistics, marketing) we obtain your explicit consent via our cookie banner (Art. 6(1)(a) GDPR, § 165(3) TKG 2021).

Each time consent is given, the following is logged in order to fulfil our obligation to demonstrate consent under Art. 7(1) GDPR:

• Consent ID (randomly generated UUID, not linked to a person)
• Timestamp of the consent
• Selected categories (statistics, marketing)
• Anonymised IP hash and user-agent hash (hashed with a cryptographic salt, no tracing back possible)
• URL of the page on which consent was given

A detailed list of all cookies set can be found in our separate Cookie Policy (German).

You can withdraw or adjust your consent at any time via the link "Change cookie settings" in the footer. After 6 months we automatically ask you again.

7. Google Tag Manager

This website uses Google Tag Manager (GTM) provided by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. GTM is a tool that allows us to integrate other tools (analytics, marketing tags) on the website. The Tag Manager itself does not set cookies and does not process personal data — it serves only to centrally manage other tags.

Only once you have consented to the "Statistics" or "Marketing" categories via our cookie banner does GTM load the corresponding tools (Consent Mode v2). Without consent, no analytics or marketing cookies run.

8. Google Analytics 4

This website uses Google Analytics 4, a web analytics service provided by Google Ireland Limited. Google Analytics uses cookies that enable an analysis of your use of the website. We have enabled IP anonymisation, so your IP address is truncated within EU member states before transmission. Only in exceptional cases is the full IP address transmitted to a Google server in the USA and truncated there.

The information generated by Google Analytics is used to evaluate your use of the website, to compile reports on website activity and to provide further services related to website use.

Legal basis: Art. 6(1)(a) GDPR (consent via cookie banner).
Retention period Google Analytics: 14 months.
Third-country transfer: USA (EU Standard Contractual Clauses).

You can prevent collection by Google Analytics by withdrawing your consent in our cookie banner or by installing the browser add-on "Google Analytics Opt-out": tools.google.com/dlpage/gaoptout.

9. Microsoft Clarity

We use Microsoft Clarity, a web analytics service provided by Microsoft Corporation. Clarity helps us analyse user behaviour (clicks, scrolling, session recordings) on an anonymised basis in order to improve the website.

Session recordings are anonymised automatically by Clarity: input fields, passwords and all areas marked as private are not recorded. Individual users are not identified.

Legal basis: Art. 6(1)(a) GDPR (consent).
Retention period Clarity: 12 months.
Third-country transfer: USA (EU Standard Contractual Clauses).

Details: privacy.microsoft.com.

10. Hosting & server log files

Our website is hosted by IONOS SE, Elgendorfer Str. 57, 56410 Montabaur, Germany, within the EU. When you visit the website, technical data is automatically recorded in server log files:

• IP address (anonymised after 7 days)
• Date and time of access
• Page accessed (URL)
• Referring URL (referrer)
• Browser and operating system used

Legal basis: Art. 6(1)(f) GDPR (legitimate interest in IT security and operation).
Retention period: A maximum of 7 days.

11. E-mail communication

E-mails to and from us are processed via Google Workspace (Gmail). Google maintains a level of data protection in line with European standards and is bound by the EU Standard Contractual Clauses.

Legal basis: Art. 6(1)(b) GDPR (performance of a contract) or Art. 6(1)(f) GDPR (communication).
Retention period: Booking-related e-mails until the warranty expires; tax-relevant e-mails for 7 years.

12. Ahrefs Analytics (server-side)

We use Ahrefs Analytics for technical SEO and performance measurement. Measurement takes place server-side and without cookies — no personal data is collected in the process.

Legal basis: Art. 6(1)(f) GDPR (legitimate interest in website optimisation).

13. Legal bases (overview)

14. Your rights as a data subject

You have the following rights against us with regard to the personal data concerning you:

• Right of access (Art. 15 GDPR) — which data we process about you
• Right to rectification (Art. 16 GDPR) — correction of inaccurate data
• Right to erasure (Art. 17 GDPR) — "right to be forgotten"
• Right to restriction of processing (Art. 18 GDPR)
• Right to data portability (Art. 20 GDPR)
• Right to object to processing (Art. 21 GDPR)
• Right to withdraw consent given (Art. 7(3) GDPR) — at any time with effect for the future

To exercise your rights, please contact us at info@reparo-wien.at. We will process your request within the statutory period of one month.

Withdrawing cookie consent: via the link "Change cookie settings" in the footer of our website you can adjust or fully withdraw your consent at any time. For written enquiries regarding your consent, please quote your consent ID (visible in the cookie banner under "Details").

15. Right to lodge a complaint

If you believe that the processing of your data violates data protection law or that your data protection rights have otherwise been infringed, you can lodge a complaint with the competent supervisory authority:

16. No automated decision-making

We do not use solely automated decision-making or profiling within the meaning of Art. 22 GDPR.

17. Data security

We apply appropriate technical and organisational measures (TOMs) to protect your data against loss, manipulation or unauthorised access:

• Encrypted data transmission (TLS 1.3) across the entire website
• Encrypted data storage on servers
• Access control through strong passwords and two-factor authentication
• Regular backups and security updates

18. Changes to this privacy policy

We reserve the right to amend this privacy policy if the legal or technical framework changes. The current English version is available at /en/privacy/, the legally binding German version at /datenschutz/. In the event of material changes, we will ask for your consent again via the cookie banner.