Privacy Policy

This is a courtesy translation. The German version (Datenschutzerklärung) is the legally binding version.

1. Controller

The controller within the meaning of the General Data Protection Regulation (GDPR) and the Austrian Data Protection Act (DSG) is:

XENTRA GmbH
Leopold-Kronsteiner-Straße 5
4060 Leonding
Austria

Phone: +43 720 302010
Email: office@xentra.at
Companies Register number: FN 678593g
Companies Register court: Landesgericht Linz
VAT ID: ATU83306012

2. Data Protection Officer

Under Art. 37 GDPR, our company is not required to appoint a data protection officer. If you have any questions about data protection, please contact us directly using the contact details listed under section 1.

3. General Information on Data Processing

3.1 Scope of Processing

As a matter of principle, we process personal data of our users only to the extent necessary to provide a functioning website and our content and services. Processing takes place regularly only with the consent of the data subject or where a statutory legal basis applies.

3.2 Legal Bases

Where we obtain consent for processing operations, Art. 6(1)(a) GDPR serves as the legal basis. For processing necessary for the performance of a contract or for pre-contractual measures, Art. 6(1)(b) GDPR serves as the legal basis. Where processing is necessary to comply with a legal obligation (for example statutory retention obligations under tax law), Art. 6(1)(c) GDPR serves as the legal basis. Where processing is necessary to safeguard a legitimate interest of our company or a third party, and the interests of the data subject do not override that interest, Art. 6(1)(f) GDPR serves as the legal basis.

3.3 Storage Period and Erasure

Personal data is erased or blocked as soon as the purpose of storage no longer applies. Storage beyond that period only takes place where required by statutory retention obligations (for example 7 years pursuant to Section 132 of the Austrian Federal Fiscal Code, BAO, for tax-relevant records).

4. Provision of the Website

4.1 Hosting

Our website is provided via the Cloudflare Workers platform of Cloudflare, Inc. (see section 5). The pages are delivered to your browser from Cloudflare's servers; we do not operate a web server of our own. A data processing agreement pursuant to Art. 28 GDPR is in place with Cloudflare.

4.2 Access Data

Each time our website is accessed, Cloudflare automatically processes data transmitted by your browser:

• IP address of the user
• Date and time of access
• Page/file accessed and volume of data transferred
• Notification of successful retrieval (HTTP status code)
• Browser used and its version
• Operating system used
• Referrer URL (previously visited page)

This data is technically required to deliver the website to you and to protect it against attacks. We do not keep server log files of our own, and the data is not combined with other personal data. Legal basis: Art. 6(1)(f) GDPR (legitimate interest in the secure and stable operation of the website and in defending against attacks). Cloudflare stores this data only for a short period in accordance with its own policies (see section 5).

4.3 SSL/TLS Encryption

For security reasons and to protect the transmission of confidential content, this website uses SSL or TLS encryption. You can recognise an encrypted connection by the browser address bar changing from "http://" to "https://" and by the padlock symbol in your browser bar.

5. Use of Cloudflare (CDN and Security Service)

For our website we use the Cloudflare service provided by Cloudflare, Inc. (101 Townsend St, San Francisco, CA 94107, USA) for hosting (see section 4.1), as a content delivery network (CDN) and for protection against abusive use and DDoS attacks. The website is delivered to your browser through Cloudflare's globally distributed servers. In doing so, Cloudflare processes in particular:

• IP address of the visitor
• Content accessed and time of access
• Browser and device information
• Technically necessary cookies (for example "__cf_bm" for bot detection)

The legal basis is Art. 6(1)(f) GDPR. Our legitimate interest lies in providing our website in a secure, high-performance and fail-safe manner and in protecting it against cyberattacks. A data processing agreement (DPA) pursuant to Art. 28 GDPR has been concluded with Cloudflare. Cloudflare is certified under the EU-US Data Privacy Framework; in addition, EU Standard Contractual Clauses are used. Personal data may be transferred to the USA. Further information: cloudflare.com/privacypolicy

Cloudflare Turnstile: To protect our forms (contact form, staff request and application form) against automated submissions, we additionally use Cloudflare Turnstile. The script required for this is loaded only on pages containing one of these forms, not across the rest of the website. It processes your IP address and technical characteristics of your browser in order to distinguish whether an entry was made by a human or by an automated program. Turnstile works without puzzles or image tasks and, according to the provider, does not set any cookies for advertising or tracking purposes. The legal basis is Art. 6(1)(f) GDPR; our legitimate interest lies in preventing abusive and automated submissions. The same bases for transfers to the USA as described above apply.

6. Contact, Enquiries and Applications

If you contact us by email, phone, WhatsApp or via the contact form on our website, we process the data you provide (in particular your name, contact details, the content of your message and the time of transmission) in order to handle your enquiry.

The legal basis is Art. 6(1)(b) GDPR (pre-contractual measures or performance of a contract) and Art. 6(1)(f) GDPR (legitimate interest in the efficient handling of enquiries). Your data is erased once your enquiry has been fully dealt with and no statutory retention obligations stand in the way.

Sending of online forms: Messages via our contact form, staff requests and applications submitted through the forms on this website are delivered by email to our mailbox via the webantis form service of Antis GmbH, Bockgasse 3, 4020 Linz, Austria. The service runs on Cloudflare's infrastructure (see section 5) and sends the emails via Microsoft 365 (Microsoft Ireland Operations Limited, One Microsoft Place, South County Business Park, Leopardstown, Dublin 18, Ireland). It processes the details you enter in the form, any files you upload and the page from which the request was sent. Your IP address is used solely to prevent abuse (limiting requests per address and the Turnstile check) and is not stored.

The content and attachments of your request are held by the form service only until delivery, attachments in storage located in the EU. They are then deleted, at the latest after 14 days. Only technical data without content or contact details is stored permanently (identifier, time, delivery status). No copy of the email is kept by the form service when it is sent. A data processing agreement pursuant to Art. 28 GDPR is in place with Antis GmbH; Cloudflare and Microsoft are involved as further processors. A transfer to the USA cannot be ruled out in this context (see section 10). The legal bases are those of the preceding paragraph; for applications, the following paragraphs apply in addition.

WhatsApp: If you contact us via WhatsApp, WhatsApp Ireland Limited (4 Grand Canal Square, Dublin 2, Ireland; parent company Meta Platforms, Inc., USA) additionally processes metadata of your communication in accordance with its own privacy policy (whatsapp.com/legal). Use of this channel is voluntary; you can always address the same matters to us by email or phone.

Applications: If you submit an application to us, we process your applicant data (CV, qualifications, references, contact details) to carry out the application process and to place you with or assign you to our client companies. The legal basis is Art. 6(1)(b) GDPR. Your data is only passed on to client companies after consultation with you. Applicant data is erased no later than 7 months after the process has been completed, unless you have consented to a longer storage of your data in our applicant database (talent pool) (Art. 6(1)(a) GDPR); you may withdraw this consent at any time.

Online application form: Applications submitted via the form on this website reach us by email through the form service described above. The data transmitted comprises the details you enter (salutation, first and last name, date of birth, email address and, optionally, mobile number, qualification, message and CV) as well as the time of your consent, which serves as evidence of it. The legal basis is Art. 6(1)(b) GDPR (pre-contractual measures) in conjunction with the consent you give in the form pursuant to Art. 6(1)(a) GDPR, which you may withdraw at any time with effect for the future. Cloudflare Turnstile is placed in front of the form to prevent automated submissions (see section 5). The retention period stated in the preceding paragraph applies.

7. Cookies and Consent Management

We use technically necessary cookies for the secure operation of the website, in particular the Cloudflare security cookie "__cf_bm" for bot detection (see section 5). In addition, we store your cookie choice locally in your browser. Legal basis: Art. 6(1)(f) GDPR and Section 165(3) of the Austrian Telecommunications Act (TKG 2021).

Statistics cookies (Google Analytics, see section 7a) are only set with your express consent via the cookie banner (Art. 6(1)(a) GDPR). You can change or withdraw your choice at any time: via the "Cookies" button at the bottom left of every page or via the "Cookie settings" link in the footer.

7a. Web Analytics with Google Analytics 4 (Only with Your Consent)

With your consent we use Google Analytics 4 (measurement ID G-VTKR5Z3R2C), a web analytics service provided by Google Ireland Limited (Gordon House, Barrow Street, Dublin 4, Ireland), parent company Google LLC (USA).

The data processed includes: truncated (anonymised) IP address, pages visited, time on site, click paths, device and browser information and the approximate region. IP anonymisation is enabled. Analytics data and the cookies set are each retained for a maximum of 14 months. In addition, Google Consent Mode v2 is in place: without your consent, no analytics signals are transmitted to Google and Google Analytics is not loaded at all.

The sole legal basis is your consent (Art. 6(1)(a) GDPR), which you can withdraw at any time with effect for the future ("Cookies" button). A data processing agreement is in place with Google; any transfer of personal data to the USA takes place on the basis of the EU-US Data Privacy Framework and standard contractual clauses (see section 10).

Further information: policies.google.com/privacy

8. Google Maps (Only with Your Consent)

On our contact page we offer a directions map from Google Maps, a map service provided by Google Ireland Limited (Gordon House, Barrow Street, Dublin 4, Ireland), parent company Google LLC (USA).

When the page is loaded, the map is initially deactivated. No data is transferred to Google. Only when you actively click "Load map" is the map embedded. In doing so, your IP address, browser and device information and, where applicable, location data are transferred to Google; Google may set its own cookies. The legal basis is your consent pursuant to Art. 6(1)(a) GDPR, which you give by clicking. Personal data may be transferred to the USA (see section 10).

Further information: policies.google.com/privacy

9. Recipients of Personal Data

In providing our website, we use the following service providers:

• Cloudflare, Inc. (USA): hosting, CDN, DDoS protection, security, spam protection for the forms (Turnstile) and infrastructure of the form service
• Google Ireland Limited (Ireland) / Google LLC (USA): Google Maps map service, only with your consent (click)
• WhatsApp Ireland Limited / Meta Platforms, Inc. (USA): only if you contact us via WhatsApp (see section 6)
• Antis GmbH (Austria): webantis form service, delivery of your form details by email (see section 6)
• Microsoft Ireland Operations Limited (Ireland) / Microsoft Corporation (USA): email delivery of the form service via Microsoft 365 (see section 6)

In addition, we pass on applicant data to our client companies after consultation with you, where this is necessary for placement or assignment (see section 6).

Where required, data processing agreements pursuant to Art. 28 GDPR have been concluded with the service providers mentioned. Our website also contains links to external services (for example WhatsApp). Simply visiting our website does not transfer any data to these services; only when you click such a link do you enter the area of responsibility of the respective provider.

10. Data Transfers to Third Countries

In connection with the services mentioned under sections 5, 6 (form delivery and WhatsApp) and 8, personal data may be transferred to the USA. Such transfers take place on the following bases:

• EU-US Data Privacy Framework (adequacy decision of the EU Commission of 10 July 2023) for certified companies
• EU Standard Contractual Clauses (SCC) pursuant to Art. 46(2)(c) GDPR
• Where applicable, your express consent pursuant to Art. 49(1)(a) GDPR (in particular for Google Maps)

Please note that the USA currently does not provide a level of data protection comparable to EU law within the meaning of the GDPR. In particular, US authorities may gain access to personal data on the basis of US surveillance laws (for example FISA 702, Cloud Act).

11. Your Rights as a Data Subject

If your personal data is processed, you are a data subject within the meaning of the GDPR and you have the following rights against us:

• Right of access (Art. 15 GDPR)
• Right to rectification (Art. 16 GDPR)
• Right to erasure (Art. 17 GDPR)
• Right to restriction of processing (Art. 18 GDPR)
• Right to data portability (Art. 20 GDPR)
• Right to object to processing (Art. 21 GDPR)
• Right to withdraw consent with effect for the future (Art. 7(3) GDPR)

To exercise your rights, an informal message to the contact details listed under section 1 is sufficient.

Notice of your right to object under Art. 21 GDPR: Where we process personal data on the basis of our legitimate interest (Art. 6(1)(f) GDPR, see sections 4, 5, 6 and 7), you have the right to object to this processing at any time on grounds relating to your particular situation. We will then no longer process the data concerned, unless we can demonstrate compelling legitimate grounds for the processing that override your interests, rights and freedoms.

12. Right to Lodge a Complaint with the Supervisory Authority

Under Art. 77 GDPR, you have the right to lodge a complaint with a data protection supervisory authority if you consider that the processing of your personal data infringes the GDPR. In Austria, the competent supervisory authority is:

Österreichische Datenschutzbehörde (Austrian Data Protection Authority)
Barichgasse 40-42
1030 Vienna
Phone: +43 1 52 152-0
Email: dsb@dsb.gv.at
Website: www.dsb.gv.at

13. Validity and Amendments to This Privacy Policy

This Privacy Policy is currently valid and has the status indicated above. As our website and services develop, or due to changes in legal or regulatory requirements, it may become necessary to amend this Privacy Policy. The current version of the Privacy Policy can be accessed and printed on this page at any time.