Privacy Policy
Candera GmbH (hereinafter “Candera”) recognizes its important responsibility to protect personal information with which it is entrusted and shall strive to protect said information. In regard to its handling of such information, Candera defines this Privacy Policy.
The purposes for which Candera shall use personal information are defined below. In the event that Candera obtains or uses personal information pertaining to an individual for a purpose other than those defined below, Candera shall explain the purpose for which it shall be used, by what means it shall be used, and the scope of its use to said individual. Candera shall then receive the individual’s consent before using the information.
Article I Company which shall Protect and Manage Personal Information
The name of the company, address of the company, and representative of the company which shall protect and manage personal information are as follows:
- Company Name:
・Candera GmbH
- Company Address:
・Semmelweisstrasse 34, 4020 Linz, Austria
Company Representative:
・General Manager Reinhard Füricht
- Contact Information:
The contact details of Candera and the contact details for data protection inquiries are set out in Article XIII of this Privacy Policy.
Article II Collection and Use of Personal Information
- Candera shall obtain and use personal information for one or more of the purposes defined in Article IV below.
- Candera shall obtain and use personal information based on the following grounds:
・Consent (in the event that the handling of personal information is based on the consent of the individual in question, the individual retains the right to revoke their consent)
・Fulfillment of a contract
・Fulfillment of a legal obligation
・Protection of public interests/exertion of public authority
・Protection of the vital interests of the individual in question or those of a third party
・Protection of legitimate interests (performance of duties, improvement to products and services, etc.) of Candera in regards to the conducting of its business
3. Use of Cookies and Similar Technologies
Where Candera uses cookies, pixels, local storage, session recording technologies or similar technologies that are not strictly necessary for the operation of the website or for a service expressly requested by the user, such technologies shall only be activated after the user has given their consent.
The legal basis for the related processing of personal information is Article 6(1)(a) GDPR. The storage of or access to information on the user’s terminal device is based on Section 165(3) of the Austrian Telecommunications Act 2021, where applicable.
- Withdrawal of Consent
The user may withdraw their consent at any time with effect for the future by accessing the Cookie Settings available on the website. The withdrawal of consent shall not affect the lawfulness of processing carried out before the withdrawal.
5. Refusal of Consent
The refusal or withdrawal of consent to analytics or marketing technologies shall not prevent the user from accessing the essential functions of Candera’s websites. Certain non-essential functions may, however, be unavailable or provide limited functionality.
Article III Protection of Children’s Personal Information
Candera’s websites, products and online services are primarily intended for business users, professionals, developers, students and other persons interested in Candera’s products and services. They are not specifically directed at children under the age of 16.
Candera does not knowingly collect personal information from children in violation of applicable data protection laws.
Where Candera offers an information society service directly to a child and the processing of personal information is based on consent, the child may provide valid consent independently if the child has reached the minimum age required under the applicable national law. In Austria, this minimum age is 14 years.
Where the child has not reached the applicable minimum age, processing based on consent shall only take place where consent has been given or authorized by the holder of parental responsibility for the child, to the extent required by applicable law.
Candera shall make reasonable efforts to verify that the required consent or authorization has been provided, taking into consideration the available technology and the nature of the service.
If Candera becomes aware that personal information relating to a child has been collected without the required consent or other valid legal basis, Candera shall take reasonable steps to delete the information without undue delay.
Parents, legal guardians or other holders of parental responsibility who believe that Candera has collected personal information relating to a child without the required authorization may contact Candera using the contact details provided in Article XIII.
Article IV Purposes of Use
- Candera shall use personal information provided by the individual for one or more of the purposes defined in each of the Items below. In the event that the purpose(s) for which the information would be used deviates from or exceeds the scope of one or more of the purposes of use, Candera shall receive consent from the individual to whom the information pertains in advance.
1) Personal information (such as names, addresses, and email addresses) entrusted to Candera by a client or business partner as part of outsourced work
・To perform work outsourced to Candera by a client or business partner, or to provide after-sales service
・To perform duties such as payment, the creation of invoices, or correspondence regarding such topics as the conducting of business or purchase of materials as it relates to the outsourced work
2) Personal information (such as names, addresses, and email addresses) entrusted to Candera by an individual as part of service duties (including such duties as the sale of products)
・For identity verification when using a given service
・To sell, provide, and lend services (including receipt of applications, payment of fees, shipment, etc.)
・For other services that go along with the sale, provision, and lending of services (including advertisements for additional goods/services, maintenance, and necessary correspondence or confirmation as part of the conducting of business)
・To send service-related campaign information, surveys, direct mail, or newsletters, or to send products, samples, or gifts
・For usage analyses, the results of which would be used for Candera service-related improvements, development, and advertising
・To identify persons who have violated this privacy policy or the separately defined Terms of Use, or persons using Candera’s services for improper purposes, and to subsequently terminate the person’s use of the services
・To respond to inquiries
3) Personal information (such as names, addresses, and email addresses) relating to other inquiries or consultations
・To contact or confirm with a party in regards to an inquiry, consultation, or complaint
4) Personal information (such as names, addresses, and email addresses) related to Candera employees or applicants for employment
・For affairs related to human resources regarding Candera employees, applicants for employment, or ex-employees, or correspondence or inquiries for other general business affairs
5) Website usage, analytics and online marketing data
Candera may process technical information and information about the use of its websites, including IP addresses, pseudonymous online identifiers, cookie identifiers, browser and device information, operating system information, approximate geographical location, referring URLs, pages viewed, clicks, scrolling activity, session information, form interaction events, downloads and conversion events, for the following purposes:
・To provide, secure and maintain Candera’s websites
・To detect and prevent misuse, fraud and security incidents
・To understand how users interact with Candera’s websites
・To create aggregated website and campaign statistics
・To improve website navigation, content, usability and performance
・To measure the effectiveness of marketing and advertising campaigns
・To attribute downloads, inquiries and other conversions to marketing channels
・To optimize campaigns and marketing activities
・Where separately consented to, to create or use advertising audiences and provide more relevant advertising
Processing for strictly necessary website operation and security may be based on Article 6(1)(f) GDPR. Candera’s legitimate interest is the secure, reliable and efficient operation of its websites.
Processing for analytics, campaign measurement, session recording, conversion attribution, advertising optimization or audience creation is based on the user’s consent pursuant to Article 6(1)(a) GDPR.
- Excluding cases in which a purpose of use other than those listed above is stated separately, Candera shall treat information relating to an individual (such as identifiers or behavior history) which it receives from third parties which do not possess information that can be used to identify the individual (such as a name) as personal information by linking the information received to an individual whose personal information Candera is managing. Candera shall use said information for the purposes detailed in the previous Section. In the event that Candera receives such information, it shall properly handle the personal information in accordance with the applicable laws and regulations.
- Personal information provided to Candera shall be in the possession of and be managed by Candera for the duration of the time in which it is under the obligation to possess the information, based on the period of time necessary to achieve the purpose(s) stated in Section 1, as detailed in Candera’s Personal Information Management Register, or based on other such laws or regulations. Candera shall not possess personal information for purposes other than those for which the information was obtained or for those required as part of the applicable laws or regulations. The specific retention periods applicable to website analytics, cookies and similar technologies are described in Article VIII and in the Cookie Settings available on the relevant website.
Article V Disclosure of Personal Information to Recipients and Third Parties
Candera shall not sell personal information.
Candera may disclose or make personal information available to the following categories of recipients where this is necessary for the purposes described in this Privacy Policy:
- Service providers and processors that process personal information on Candera’s behalf and in accordance with Candera’s instructions
- Providers of analytics, marketing and advertising services that process personal information as independent controllers or, depending on the service and configuration, jointly with Candera
- Candera group companies, where necessary for administration, customer support, product provision or other legitimate business purposes
- Public authorities, courts or other recipients where disclosure is required by law or is necessary for the establishment, exercise or defence of legal claims
- Parties involved in a corporate transaction, such as a merger, acquisition, restructuring or transfer of business
For optional analytics and marketing services, personal information shall only be disclosed after the user has provided the required consent.
The following providers may receive personal information in connection with Candera’s website analytics and online marketing activities:
・Google Ireland Limited and Google LLC
・HubSpot Germany GmbH, HubSpot Ireland Limited and HubSpot, Inc.
・Reddit Netherlands B.V. and Reddit, Inc.
・Microsoft Ireland Operations Limited and Microsoft Corporation
Details regarding the applicable services, data categories, purposes, legal bases and retention periods are provided in Articles VI, VII and VIII.
Article VI Processing of Personal Information by Processors and Service Providers
Candera, within the scope of one or more of the purposes of use, may partially or wholly entrust the handling of personal information to an outside party. In such an event, Candera shall thoroughly evaluate the qualifications of the outside party, enter into a contract with the outside party which includes an obligation to confidentiality, and appropriately supervise the outside party as necessary.
Details of the parties to which personal information may be provided for outsource work are as follows:
- Google Analytics
Provider: Google Ireland Limited, Ireland, and Google LLC, United States
Data processed: Pseudonymous online identifiers, cookie identifiers, browser and device information, website usage data, events, approximate geographical information and IP address during transmission
Purpose: Website measurement, statistics, performance analysis and campaign analysis
Role: Processor where Google Analytics is configured in accordance with Google’s Data Processing Terms and additional data sharing is disabled
Duration: According to Candera’s configured Google Analytics retention period and the applicable cookie lifetime
- HubSpot CRM and Form Services
Provider: HubSpot Germany GmbH, Germany; HubSpot Ireland Limited, Ireland; and HubSpot, Inc., United States
Data processed: Name, email address, company, position, country, form entries, communication history, download information, CRM activity and other information voluntarily provided by the user
Purpose: Processing inquiries and download requests, contact management, customer relationship management, communication, support and marketing administration
Role: Processor for personal information processed within the HubSpot CRM and related subscription services on Candera’s behalf
Duration: For as long as necessary for the respective inquiry, contractual relationship, communication or legal retention requirement, or until a valid deletion request is fulfilled
Article VII Transfer of Personal Information to Third Countries
Candera may transfer personal information to Candera group companies, processors, service providers and other recipients located outside the European Economic Area.
This may include transfers to Japan, the United States of America and other countries in which Candera’s service providers or their subprocessors operate.
Where personal information is transferred to a country for which the European Commission has adopted an adequacy decision, Candera may rely on that adequacy decision.
For transfers to recipients in the United States, Candera may rely on the EU-U.S. Data Privacy Framework where the relevant recipient is validly certified under that framework.
Where no applicable adequacy decision or valid certification exists, Candera shall use appropriate safeguards pursuant to Article 46 GDPR. These safeguards may include the European Commission’s Standard Contractual Clauses, contractual commitments, technical measures and organizational measures.
The providers that may process personal information outside the EEA include:
・Google LLC
・HubSpot, Inc. and HubSpot subprocessors
・Reddit, Inc. and Reddit subprocessors
・Microsoft Corporation and Microsoft subprocessors
・Candera Japan, Inc.
Users may request further information about the applicable transfer safeguards by contacting Candera using the contact details provided in Article XIII.
Article VIII Use of Cookies and Similar Technologies
1) General Information about Cookies and Similar Technologies
Candera’s websites use cookies and similar technologies, including pixels, scripts, local storage and session recording technologies.
These technologies may be classified as follows:
・Strictly necessary technologies required for the operation, security and functionality of the website
・Preference technologies used to remember user selections
・Analytics technologies used to measure and understand website usage
・Marketing technologies used to measure campaigns, attribute conversions and, where enabled, create advertising audiences
Strictly necessary technologies may be used without consent where they are required to provide a service expressly requested by the user.
Analytics and marketing technologies shall only be activated after the user has provided the corresponding consent.
2) Cookie Settings and Withdrawal of Consent
When users first access a Candera website, they are provided with a consent interface through which they may accept or reject individual categories of cookies and similar technologies.
Users may change or withdraw their selection at any time through the Cookie Settings available on the website.
Details about individual cookies and technologies, including their provider, purpose, category and lifetime, are available in the Cookie Settings.
The withdrawal of consent shall take effect for the future and shall not affect the lawfulness of processing carried out before the withdrawal.
3) Google Tag Manager
Candera uses Google Tag Manager, a tag management service provided by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland.
Google Tag Manager is used to manage and deploy website tags. The analytics and marketing services managed through Google Tag Manager are described separately in this Article.
Candera configures Google Tag Manager so that tags requiring consent are not activated before the corresponding consent has been provided.
When Google Tag Manager is loaded, technical connection data, including the user’s IP address and browser information, may be transmitted to Google.
Further information is available in the Google Privacy Policy.
4) Google Analytics 4
Candera uses Google Analytics 4, a website analytics service provided by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. Google Ireland Limited may involve Google LLC and other Google group companies or subprocessors.
Google Analytics processes information about the use of Candera’s websites, which may include:
・Pseudonymous client and session identifiers
・Cookie identifiers
・Pages viewed and referring URLs
・Events such as clicks, downloads, form interactions and conversions
・Browser type and browser settings
・Device type, operating system and screen resolution
・Approximate geographical information
・Date, time and duration of website visits
・IP address during transmission
Google states that IP addresses are used during collection but are not logged or stored by Google Analytics.
Candera uses this information to create aggregated statistics, understand website usage, measure website and campaign performance, improve website content and navigation and attribute conversions to marketing channels.
The legal basis is the user’s consent pursuant to Article 6(1)(a) GDPR and Section 165(3) of the Austrian Telecommunications Act 2021.
Google Analytics shall not be activated before analytics consent has been provided.
Data associated with cookies is retained according to the cookie lifetime shown in the Cookie Settings. User-level data and key event data within Google Analytics are retained for 14 months. Other event data is retained for 2 months. The data is then automatically deleted in accordance with Google Analytics’ retention settings.
Where Candera enables Google Signals, Google Analytics advertising features, audience functions or a connection to Google Ads, these functions shall only be activated after the user has provided marketing consent. Such functions may allow information from the website to be combined with information from other Google services.
Candera shall not intentionally transmit names, email addresses or other directly identifying form content to Google Analytics.
Further information is available in the Google Privacy Policy and Google’s information for websites using Google Analytics.
5) HubSpot
Candera uses HubSpot services for contact management, online forms, download requests, customer relationship management, website analysis and marketing administration.
For customers located in Austria, the relevant HubSpot contracting entity is HubSpot Germany GmbH, Am Postbahnhof 17, 10243 Berlin, Germany. HubSpot Ireland Limited, HubSpot, Inc. and other HubSpot group companies or subprocessors may also be involved in providing the services.
a) Forms and CRM
When a user submits a contact form, download request or other HubSpot form, Candera may process:
・Name
・Email address
・Company and position
・Country
・Form content
・Requested downloads
・Communication history
・Date and time of the submission
・Technical information required to process and secure the form
Where a form is used to request information, software, a download or another service, processing is based on Article 6(1)(b) GDPR to the extent that it is necessary to take steps at the user’s request.
Processing of general business inquiries and CRM administration may be based on Article 6(1)(f) GDPR. Candera’s legitimate interest is the efficient handling of inquiries and management of business relationships.
Newsletter communication and other optional electronic marketing communication is based on consent pursuant to Article 6(1)(a) GDPR, unless another legal basis expressly applies.
b) HubSpot Tracking
HubSpot tracking technologies may process:
・Cookie and browser identifiers
・IP address
・Browser and device information
・Pages viewed
・Referring URLs
・Date, time and duration of visits
・Downloads and form interactions
・Campaign and conversion information
HubSpot tracking is used to understand website usage, measure marketing activities and associate website interactions with contact records where legally permitted.
HubSpot tracking shall only be activated after the user has provided analytics or marketing consent, depending on the purpose of the respective processing.
HubSpot acts as Candera’s processor when processing CRM, form and other customer personal data on Candera’s behalf. In connection with the HubSpot tracking code and certain enrichment functions, Candera and HubSpot may each process personal data as independent controllers.
Further information is available in the HubSpot Privacy Policy and HubSpot Data Processing Agreement.
6) Reddit Pixel
Candera uses the Reddit Pixel to measure and analyze the effectiveness of advertising campaigns on Reddit.
The service is provided for users in the EEA by Reddit Netherlands B.V., Looiersgracht 43, 1016 VR Amsterdam, Netherlands. Reddit, Inc. and other Reddit group companies or service providers may also process information.
The Reddit Pixel may process:
・IP address
・Cookie and online identifiers
・Browser and device information
・Referring URL and pages viewed
・Date and time of website interactions
・Information about Reddit advertisements viewed or clicked
・Events such as page views, downloads, form submissions and other conversions
Candera uses this information to determine whether users interacted with Candera’s website after viewing or clicking a Reddit advertisement, to measure campaign performance and to optimize advertising campaigns.
Where audience creation or remarketing functions are enabled, the information may also be used to create advertising audiences or deliver more relevant advertising.
The legal basis is the user’s consent pursuant to Article 6(1)(a) GDPR and Section 165(3) of the Austrian Telecommunications Act 2021.
The Reddit Pixel shall not be activated before marketing consent has been provided.
The applicable cookie lifetimes are shown in the Cookie Settings. Further processing and retention by Reddit is governed by the Reddit Privacy Policy and the applicable Reddit Business Tool Terms.
7) Microsoft Clarity
Candera uses Microsoft Clarity, a behavioral analytics service provided to customers in the European Union by Microsoft Ireland Operations Limited, One Microsoft Place, South County Business Park, Leopardstown, Dublin 18, Ireland.
Microsoft Corporation and other Microsoft group companies or service providers may also process information.
Microsoft Clarity allows Candera to understand how users interact with its websites through aggregated behavioral metrics, heatmaps and session recordings.
Clarity may process:
・Pseudonymous user and session identifiers
・IP address and approximate location
・Browser, operating system, device and screen information
・Pages viewed and navigation paths
・Mouse movements
・Clicks and touch interactions
・Scrolling behavior
・Page rendering and layout information
・JavaScript errors
・Date, time and duration of sessions
Input fields are masked by Microsoft Clarity. Candera additionally configures Clarity to mask or exclude confidential or sensitive website content.
Candera uses Clarity to identify usability problems, improve website navigation and content, analyze page performance and understand how visitors use the website.
Microsoft states that it acts as a controller in connection with Microsoft Clarity.
The legal basis is the user’s consent pursuant to Article 6(1)(a) GDPR and Section 165(3) of the Austrian Telecommunications Act 2021.
Microsoft Clarity shall not set analytics cookies or activate full session tracking before valid consent has been communicated to Microsoft.
Session playback data is generally retained for 30 days. Labeled or favorited sessions and heatmap data may be retained for up to 13 months.
Further information is available in the Microsoft Privacy Statement and the Microsoft Clarity documentation.
8) Data Minimization
Candera does not intentionally transmit passwords, payment information, sensitive personal information or the contents of free-text form fields to analytics or advertising services.
Candera shall configure analytics events, tags and session recording services so that directly identifying personal information is not included in page URLs, event names, event parameters or tracking identifiers.
9) Google reCAPTCHA
In order to ensure sufficient data security when submitting forms, Candera may use Google reCAPTCHA. This service is used to distinguish whether the input is made by a real person or by an automated process. Google reCAPTCHA includes the sending to Google of an individual’s IP address and, if necessary, other data required for the reCAPTCHA service.
The provider is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. The processing is based on Article 6(1)(f) GDPR. Candera’s legitimate interest is the prevention of automated submissions, misuse and attacks. Google LLC and other Google companies or subprocessors may process information in the United States.
10) Google Web Fonts
This website uses web fonts provided by Google in order to uniformly display fonts. When an individual opens a web page, the individual’s browser loads the required web fonts into the browser cache in order to correctly display text and fonts. To do this, the browser being used must connect to Google’s servers. As a result, Google gets informed via the individual’s IP address that Candera’s website has been accessed. Candera uses Google Web Fonts to present Candera’s online services in a consistent and attractive manner. This constitutes a legitimate interest as detailed in the General Data Protection Regulation (GDPR) Article 6 Section 1 Point (f). If an individual’s browser does not support web fonts, a default font will be used by the individual’s computer. More information about Google Web Fonts can be found here.
11) Google Maps
Candera uses Google Maps to display interactive maps and to make it easier for users to locate Candera’s offices and other locations.
Google Maps is provided by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. Google Ireland Limited may involve Google LLC, 1600 Amphitheatre Parkway, Mountain View, California 94043, United States, and other Google group companies or service providers.
Google Maps content is not loaded until the user has provided the corresponding consent through the Cookie Settings or the activation mechanism provided for the map.
When Google Maps is activated, the following information may be transmitted to and processed by Google:
・IP address
・Browser and device information
・Operating system information
・Date and time of access
・The page from which the map is accessed
・Interactions with the map
・Search terms and requested locations
・Location information, where the user has enabled location services or actively provided location data
・Cookie and online identifiers
Google may set or read cookies and similar technologies when the map is loaded. If the user is logged into a Google account, Google may associate the use of Google Maps with that account.
Candera uses Google Maps solely to provide interactive maps, location information and route planning functions.
The legal basis for the processing is the user’s consent pursuant to Article 6(1)(a) GDPR and Section 165(3) of the Austrian Telecommunications Act 2021.
The user may withdraw their consent at any time with effect for the future through the Cookie Settings. After consent has been withdrawn, Google Maps content will no longer be loaded unless the user provides consent again.
Candera and Google process personal information as independent controllers within their respective areas of responsibility.
Personal information may be transferred to Google companies and service providers located outside the European Economic Area, including the United States. Such transfers are carried out on the basis of an applicable adequacy decision, including the EU-U.S. Data Privacy Framework where applicable, or other appropriate safeguards such as the European Commission’s Standard Contractual Clauses.
Candera does not determine the duration for which Google retains information processed independently by Google. Further information about Google’s processing activities, retention periods and data protection practices is available in the Google Privacy Policy and the Google Maps Platform Terms of Service.
12) Social Plug-ins
This website uses embedded content or social media functions provided by Facebook, YouTube, LinkedIn and X. These services are deactivated by default and are only activated after the user has provided the required consent or actively requested the respective content.
(1) Facebook
Candera uses plug-ins from the social media platform Facebook. For users in the European Union, the platform is operated by Meta Platforms Ireland Limited, Merrion Road, Dublin 4, D04 X2K5, Ireland.
When a user activates a Facebook plug-in, a direct connection between the user’s browser and Meta’s servers is established. Personal data, including the user’s IP address and information about the visited page, may be transmitted to Meta. If the user is logged in to Facebook, Meta may associate the visit to Candera’s website with the user’s Facebook account. Interactions with the plug-in, such as clicking the “Like” or “Share” button, may also be assigned to the user’s account.
Further information about the collection and use of personal data, users’ rights, and available privacy settings can be found in the Meta Privacy Policy.
(2) YouTube
Candera uses embedded videos from the YouTube platform. For users in the European Economic Area, YouTube is provided by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland.
When a user activates an embedded YouTube video, a connection to Google’s servers is established. Personal data, including the user’s IP address, device and browser information, and information about the visited page, may be transmitted to Google. If the user is logged into a Google or YouTube account, Google may associate this information with the user’s account.
Further information about the collection and use of personal data, users’ rights, and available privacy settings can be found in the Google Privacy Policy.
(3) LinkedIn
Candera uses plug-ins from the social media platform LinkedIn. For users in the European Economic Area, the platform is operated by LinkedIn Ireland Unlimited Company, Wilton Place, Dublin 2, Ireland.
When a page containing such a plug-in is accessed or the plug-in is activated, a connection to LinkedIn’s servers may be established. Personal data, including the user’s IP address and information about the visited page, may be transmitted to LinkedIn. If the user is logged into LinkedIn, LinkedIn may associate the visit and any interaction with the user’s LinkedIn account.
Further information about the collection and use of personal data, users’ rights, and available privacy settings can be found in LinkedIn’s Data Privacy Policy.
(4) X
Candera uses plug-ins from the social media platform X. For users in the European Union, the platform is operated by X Internet Unlimited Company, One Cumberland Place, Fenian Street, Dublin 2, D02 AX07, Ireland. These plug-ins can be identified by the X logo or labels such as “Post” or “Share on X”.
When a page containing such a plug-in is accessed, a connection to X servers may be established and data, including the user’s IP address and information about the visited page, may be transmitted to X. Further information about the collection and use of personal data, users’ rights, and available privacy settings can be found in the X Privacy Policy.
(5) Instagram
Candera uses plug-ins from the social media platform Instagram. For users in the European Union, the platform is operated by Meta Platforms Ireland Limited, Merrion Road, Dublin 4, D04 X2K5, Ireland.
When a user activates an Instagram plug-in, a direct connection between the user’s browser and Meta’s servers is established. Personal data, including the user’s IP address and information about the visited page, may be transmitted to Meta. If the user is logged in to Instagram, Meta may associate the visit to Candera’s website with the user’s Instagram account. Interactions with the plug-in, such as viewing, liking, sharing, or commenting on content, may also be assigned to the user’s account.
Further information about the collection and use of personal data, users’ rights, and available privacy settings can be found in the Meta Privacy Policy.
13) Candera asks that individuals refer to the website of the proprietor of their browser for information on how to cease the provision of information for cookies.
Article IX Exercise of Data Subject Rights (Disclosure/Correction/Deletion/Cessation of Use)
Candera shall, upon request of an individual and in accordance with the applicable laws and regulations, notify or disclose (including disclosure of the record of Candera’s provision of personal information to third parties) the purposes of use of the personal information which it possesses pertaining to the individual in question, or supplement, delete, or cease the use of said personal information.
1) Disclosure
In the event that an individual requests information pertaining to themselves to be disclosed, Candera shall disclose the information to the individual without delay. Candera shall attempt to disclose the information via the method of contact requested by the individual. However, in the event that any of the following would apply as a result of said disclosure, Candera may refrain from partial or full disclosure of the information. In the event that Candera decides to refrain from partial or full disclosure of the information, Candera shall notify the individual to whom the information pertains without delay.
(i) In the event that there is a risk of harm being done to the life, physical well-being, assets, or other rights and interests of the individual to whom the information pertains or a third party
(ii) In the event that there is a risk of a remarkable impediment to the proper conduct of Candera’s business operations
(iii) In the event that any law or regulation would be violated
2) Correction/Deletion of Incorrect Information
(i) In the event that personal information which Candera possesses is incorrect, upon request of the individual to whom the information pertains, Candera, following the procedure that it has established, shall correct or delete the information.
(ii) In the event that Candera deems that it is necessary to fulfill a request as described in (i), it shall correct or delete the personal information without delay and notify the individual to whom the information pertains of its correction or deletion.
3) Deletion/Cessation of Use of Information
In the event that an individual requests Candera to delete or cease the use of personal information pertaining to themselves for one or more of the following reasons, Candera shall conduct a necessary investigation without delay.
・The information was used for a purpose other than those detailed in Article IV
・The information was obtained via improper means
・The information was used in a manner that was liable to incite or promote illegal or improper acts
・Candera no longer has a need to use the information
・The information was leaked, lost, or damaged
・There was a risk that the rights and interests of the individual would be infringed upon due to how the information was handled
Based on the results of said investigation, Candera shall take such actions as deleting or ceasing the use of the information and notify the individual to whom the information pertains of such actions. However, in the event that the deletion or cessation of use of the personal information would involve a large financial cost or in the event that it would be difficult to delete or cease the use of the information for other reasons, Candera shall take necessary alternative measures to protect the rights and interests of the individual to whom the information pertains, in the event that there are alternative measures that can be taken.
4) Request Form
Individuals requesting the disclosure/correction/deletion/cessation of use of personal information pertaining to themselves must provide the information detailed below, along with a document that can be used to verify the identity of the individual. In the event that the request is being carried out by a proxy, a document that can verify that the proxy is a representative of the individual to whom the information pertains (such as a letter of attorney) must also be provided. All of the necessary information/documents must be sent to the Personal Information Contact found in Article XIII. Candera shall reply upon verifying the identity of the individual and once it has done so, in accordance with its internal policy, shall immediately dispose of the documents used for confirming the identity of the individual. Candera shall not charge individuals for submitting such a request.
Information to provide:
・Name, address, telephone number, and email address
・Kind of request (e.g. disclosure, correction, addition, deletion, cessation of use by Candera/a third party to whom information was provided with consent of the individual as outlined in Article V of this Privacy Policy.)
・Description of request
The following provisions apply to customers residing in Europe, the Middle East, and Africa (EMEA):
An individual may check personal information pertaining to themselves by the method prescribed by Candera and correct, update, or delete the information themselves. Notwithstanding this Article, Candera shall, upon request from the individual, and in accordance with the applicable laws and regulations, provide access to, allow the correction, deletion, restriction, objection to the handling of, or allow the exertion of the right to data portability in regard to the personal information pertaining to the individual which Candera possesses. To the extent permissible by the applicable laws and regulations Candera may charge a reasonable fee to respond to such requests. The individual retains the right to object to Candera’s handling of personal information pertaining to themselves via a regulatory agency. The contact information for exercising the aforementioned rights is as described in Article XIII.
5) Withdrawal of Consent and Objection
Where processing is based on consent, the individual may withdraw that consent at any time with effect for the future.
Consent relating to cookies and similar technologies may be withdrawn through the Cookie Settings available on the respective website.
Where processing is based on Article 6(1)(f) GDPR, the individual may object to such processing on grounds relating to their particular situation. Where personal information is processed for direct marketing purposes, the individual may object to such processing at any time without providing reasons.
Article X Security Measures
- Candera’s websites employ SSL (Secure Socket Layer) encryption. SSL is a communication protocol that encrypts data sent over IP networks such as the internet. SSL encrypts transmissions between two devices that send and receive data, preventing the falsification or modification of data by other devices on the same network, such as a communication relay.
- Candera shall process personal information in accordance with the General Data Protection Regulation, the Austrian Data Protection Act, the Austrian Telecommunications Act 2021 and other applicable data protection laws. To handle personal information in an appropriate manner, Candera shall properly enact the following security measures:
1) Appointment of a person(s) to be responsible for the handling of personal information
2) Clear identification of the employees who handle personal information and the scope of the personal information which they handle, and the establishment of a reporting system to the responsible person(s) in the event that a violation of the Personal Information Protection Act or internal rules regarding the handling of personal information has occurred, or in the event that indications that such a violation could occur become apparent
3) Periodic education of employees on the proper handling of personal information
4) Management of the access to the personal information of employees who handle other personal information, restriction of usage of devices and entry to rooms, and implementation of measures to prevent unauthorized persons from viewing personal information
- Candera shall regularly review its information security guidelines to ensure the proper implementation of the security measures defined in the previous Section.
- In the event that Candera outsources the handling of personal information to a third party, Candera shall enter into a contract with the party to whom the information was outsourced and properly oversee their business operations.
- In the event of an incident (leakage, loss, damage, or infringement) related to personal information (including the threat of such an incident), Candera shall immediately conduct an internal investigation to establish the cause of and facts surrounding the incident, take measures to prevent the occurrence of such an incident in the future, and report the incident to the overseeing authorities and the individual to whom the information pertains in accordance with the applicable laws and regulations.
The following stipulations apply to individuals residing in the State of California, United States of America:
With respect to the handling of personal information of individuals residing in the State of California, United States of America, in addition to this Privacy Policy (hereinafter “Statement”), the following special provisions (hereinafter “Special Provisions”) shall apply. In the event that any conflict between the Statement and the Special Provisions arise, the Special Provisions shall take precedence.
1. Types, Purposes, and Sources of Personal Information Collected
The types of personal information which Candera may collect or has collected during the twelve (12) months prior to the last revision of the Statement and the Special Provisions and the purposes of use for said personal information are as described in Article IV and VIII of the Statement. The source of such personal information is the individual to whom the personal information pertains.
2. Sharing of Personal Information
Candera does not sell personal information for monetary consideration.
Depending on the technologies enabled and the interpretation of applicable California privacy law, the disclosure of online identifiers and internet activity information to advertising providers may constitute “sharing” for cross-context behavioural advertising.
Where applicable, California residents may opt out of such sharing through the Cookie Settings or the “Your Privacy Choices” mechanism provided on the website.
3. Disclosure and Deletion Requests
1) An individual may check personal information by the method prescribed by Candera and correct, update, or delete the information themselves. Notwithstanding Article IX, Candera shall, upon request from the individual, and in accordance with the applicable laws and regulations, provide access to or delete personal information pertaining to the individual which Candera possesses. The details of such disclosure and deletion are as follows:
(1) Access: An individual retains the right to, up to twice within a 12-month period, request the disclosure of the following information pertaining to themselves that Candera has collected, used, or disclosed in the 12-month period prior to the disclosure request.
a. Types of personal information collected
b. Specific pieces of personal information collected
c. Types of sources Candera used to collect personal information
d. Purposes of use for personal information collected
e. Types of third parties with whom Candera shares personal information
(2) Deletion: An individual retains the right to request the deletion of specific personal information that Candera has collected from the individual in question.
2) For access or deletion requests, please contact Candera via the following:
◆Candera GmbH
Mailing address: Semmelweisstrasse 34
4020 Linz, Austria
Email address: [email protected]
Phone number: + 43-732-90305-0
3) In order for Candera to protect the privacy of individuals and maintain security, it shall verify the identity of an individual before providing said individual with access to personal information pertaining to themselves or responding to a deletion request.
(1) Candera shall review access or deletion requests from unique accounts only in the event that the request relates to the personal information associated with a password-protected account that has been sufficiently verified as belonging to the individual in question.
(2) In the event that the individual does not possess a password-protected account with Candera or is unable to access their password-protected account, Candera shall validate the access or deletion request according to one of the following procedures:
a. In the event that the product or service associated with the individual has an inquiry function, Candera shall review requests submitted via the inquiry function (the inquiry function performs sufficient verification). However, in the event that Candera suspects that the request was made by an individual other than the actual user of the product or service, Candera shall request the individual to provide information that could only be recognizable by the actual user of the product or service in order to verify the identity of the individual.
b. In the event that the product or service associated with the individual does not have an inquiry function, Candera shall verify the identity of the individual by sending a customer number through the notification function of the applicable product or service and request a response using the same number. However, in the event that the product or service does not have a notification function, or the individual is unable to use the notification function, Candera shall request the individual to provide information that could only be recognizable by the actual user of the product or service in order to verify the identity of the individual.
(3）In the event that the individual makes an access or deletion request through a representative, Candera may request that the individual (i) provide the representative with a signed document granting permission to make the request, (ii) make direct contact with Candera in order to verify the identity of the individual in question, or (iii) confirm directly with Candera that the individual has given their representative permission to submit the request.
4) In the event that the individual chooses to exercise any of the rights detailed in this Section, the individual retains the right to be treated without discrimination by Candera. To the extent permitted by the applicable laws, Candera may charge a reasonable fee to respond to the request of the individual.
Article XI Updates to the Privacy Policy
Candera may update this Privacy Policy where its websites, services, processing activities, service providers or applicable legal requirements change.
The current version and its effective date shall be published on Candera’s websites. Where legally required or appropriate due to the significance of a change, Candera shall provide additional notice.
Material changes affecting consent-based processing shall not result in the activation of new analytics or marketing purposes without obtaining any consent required by applicable law.
Article XII Compliance with Laws, Ordinances, and Standards
Candera complies with Austrian laws, ordinances, and other standards applicable to personal information that Candera possesses.
Article XIII Contact Information
For questions regarding this Privacy Policy or the processing of personal information, or to exercise data subject rights, please contact:
◆Candera GmbH
Semmelweisstrasse 34
4020 Linz, Austria
Phone: + 43-732-90305-0
Fax: + 43-732-90305-100
Individuals also have the right to lodge a complaint with a competent data protection supervisory authority.
The Austrian supervisory authority is:
Austrian Data Protection Authority
Barichgasse 40-42
1030 Vienna
Austria
Email: [email protected]
Established January 1, 2016
Revised July 15, 2026