Privacy Policy
As of: 07.05.2026.As of: 07.05.2026.
1. Controller1. Controller
The controller for the purposes of the General Data Protection Regulation (GDPR) is:The controller for the purposes of the General Data Protection Regulation (GDPR) is:
Erich Hartmann Ges.m.b.H.Erich Hartmann Ges.m.b.H.
Singerstraße 8, 1010 Vienna, AustriaSingerstraße 8, 1010 Vienna, Austria
Phone: +43 1 512 14 89Phone: +43 1 512 14 89
E-Mail: office@hartmann-wien.atE-Mail: office@hartmann-wien.at
Further information about the company can be found in our imprint.Further information about the company can be found in our imprint.
2. Website Provision and Server Logs2. Website Provision and Server Logs
When you access our website, technical data is automatically collected and stored in server logs. This includes, in particular, IP address, date and time of access, page accessed, browser and operating system used, and the referrer URL.When you access our website, technical data is automatically collected and stored in server logs. This includes, in particular, IP address, date and time of access, page accessed, browser and operating system used, and the referrer URL.
Legal Basis: Art. 6 para. 1 lit. f GDPR (legitimate interest in the secure and stable operation of the website).Legal Basis: Art. 6 para. 1 lit. f GDPR (legitimate interest in the secure and stable operation of the website).
Hosting: Our website is hosted by Webflow Inc., 398 11th Street, 2nd Floor, San Francisco, CA 94103, USA. The associated transfer of data to the USA is secured by standard contractual clauses according to Art. 46 para. 2 lit. c GDPR and by Webflow Inc.'s certification under the EU-US Data Privacy Framework.Hosting: Our website is hosted by Webflow Inc., 398 11th Street, 2nd Floor, San Francisco, CA 94103, USA. The associated transfer of data to the USA is secured by standard contractual clauses according to Art. 46 para. 2 lit. c GDPR and by Webflow Inc.'s certification under the EU-US Data Privacy Framework.
3. Cookies and Consent Management3. Cookies and Consent Management
Our website uses cookies and similar technologies. We distinguish between technically necessary cookies (e.g., for storing your cookie selection, for language and session settings) and cookies that are only set with your consent (analysis, marketing, personalization).Our website uses cookies and similar technologies. We distinguish between technically necessary cookies (e.g., for storing your cookie selection, for language and session settings) and cookies that are only set with your consent (analysis, marketing, personalization).
Consent Management Tool: To manage your consent, we use "Consent Pro" from Finsweet (USA). Consent Pro stores your cookie preferences and proof of your consent (timestamp and selected categories) on a cloud infrastructure operated by Finsweet. Proof of consent is required according to Art. 7 para. 1 GDPR.Consent Management Tool: To manage your consent, we use "Consent Pro" from Finsweet (USA). Consent Pro stores your cookie preferences and proof of your consent (timestamp and selected categories) on a cloud infrastructure operated by Finsweet. Proof of consent is required according to Art. 7 para. 1 GDPR.
Legal Basis: For technically necessary cookies, § 165 para. 3 TKG 2021 and Art. 6 para. 1 lit. f GDPR; for all other cookies, your consent according to Art. 6 para. 1 lit. a GDPR in conjunction with § 165 para. 3 TKG 2021.Legal Basis: For technically necessary cookies, § 165 para. 3 TKG 2021 and Art. 6 para. 1 lit. f GDPR; for all other cookies, your consent according to Art. 6 para. 1 lit. a GDPR in conjunction with § 165 para. 3 TKG 2021.
Withdrawal: You can adjust or withdraw your consent at any time via the "Cookie Settings" link in the website footer. The withdrawal is effective for the future.Withdrawal: You can adjust or withdraw your consent at any time via the "Cookie Settings" link in the website footer. The withdrawal is effective for the future.
4. Appointment Booking4. Appointment Booking
You can book an appointment at our store via the booking form on our website. We process your first and last name, email address, phone number, selected service, and the date and time of your desired appointment.You can book an appointment at our store via the booking form on our website. We process your first and last name, email address, phone number, selected service, and the date and time of your desired appointment.
Note on Health Data: Some of the selectable services (e.g., eye examination, OCT, biometric vision correction, contact lens fitting) constitute health data due to their optometric or ophthalmological nature, and are therefore special categories of personal data according to Art. 9 para. 1 GDPR.Note on Health Data: Some of the selectable services (e.g., eye examination, OCT, biometric vision correction, contact lens fitting) constitute health data due to their optometric or ophthalmological nature, and are therefore special categories of personal data according to Art. 9 para. 1 GDPR.
Legal Basis: Art. 6 para. 1 lit. b GDPR (performance of pre-contractual measures) for general contract data. Insofar as health data is processed, we base the processing on Art. 9 para. 2 lit. h GDPR in conjunction with Art. 9 para. 3 GDPR (provision of healthcare by personnel bound by professional secrecy).Legal Basis: Art. 6 para. 1 lit. b GDPR (performance of pre-contractual measures) for general contract data. Insofar as health data is processed, we base the processing on Art. 9 para. 2 lit. h GDPR in conjunction with Art. 9 para. 3 GDPR (provision of healthcare by personnel bound by professional secrecy).
Recipients: The data is exclusively accessed by employees of Erich Hartmann Ges.m.b.H. and transmitted via the form infrastructure of Webflow Inc. (see Section 2).Recipients: The data is exclusively accessed by employees of Erich Hartmann Ges.m.b.H. and transmitted via the form infrastructure of Webflow Inc. (see Section 2).
Retention Period: Booking data is stored until the appointment takes place and for the duration of any statutory retention obligations (e.g., § 132 BAO for invoice-related transactions: 7 years).Retention Period: Booking data is stored until the appointment takes place and for the duration of any statutory retention obligations (e.g., § 132 BAO for invoice-related transactions: 7 years).
5. Contact Form and Email Inquiries5. Contact Form and Email Inquiries
If you contact us via the contact form or by email, we process the data you provide (name, email address, content of your message, and any other voluntary information) to respond to your inquiry.If you contact us via the contact form or by email, we process the data you provide (name, email address, content of your message, and any other voluntary information) to respond to your inquiry.
Legal basis: Art. 6 para. 1 lit. b GDPR for inquiries related to a contract, otherwise Art. 6 para. 1 lit. f GDPR (legitimate interest in responding to inquiries).Legal basis: Art. 6 para. 1 lit. b GDPR for inquiries related to a contract, otherwise Art. 6 para. 1 lit. f GDPR (legitimate interest in responding to inquiries).
Storage duration: Inquiries are stored for the duration of processing and for at least six months thereafter; after any statutory retention periods expire, the data will be deleted.Storage duration: Inquiries are stored for the duration of processing and for at least six months thereafter; after any statutory retention periods expire, the data will be deleted.
6. Applications via the Careers Page6. Applications via the Careers Page
If you apply via the application form on our careers page, we process your first and last name, email address, phone number, the chosen position, an optional link to your LinkedIn profile, and your uploaded CV.If you apply via the application form on our careers page, we process your first and last name, email address, phone number, the chosen position, an optional link to your LinkedIn profile, and your uploaded CV.
CV file upload: Your CV is uploaded and stored via the third-party tool "Flowdrive", operated by Manuel Ogomigo LLC, South Governors Avenue 1111b, Dover, DE 19904, USA. The transfer of data to the USA associated with the use of Flowdrive is secured by standard contractual clauses according to Art. 46 para. 2 lit. c GDPR and the EU-US Data Privacy Framework. Your CV file is stored on a cloud storage infrastructure used by Flowdrive.CV file upload: Your CV is uploaded and stored via the third-party tool "Flowdrive", operated by Manuel Ogomigo LLC, South Governors Avenue 1111b, Dover, DE 19904, USA. The transfer of data to the USA associated with the use of Flowdrive is secured by standard contractual clauses according to Art. 46 para. 2 lit. c GDPR and the EU-US Data Privacy Framework. Your CV file is stored on a cloud storage infrastructure used by Flowdrive.
Special categories of personal data: Your application documents may contain personal data, including a photograph, and potentially special categories of personal data according to Art. 9 GDPR (e.g., information on health, religious or philosophical beliefs, trade union membership). We ask you to include only the data necessary for assessing your professional suitability in your CV.Special categories of personal data: Your application documents may contain personal data, including a photograph, and potentially special categories of personal data according to Art. 9 GDPR (e.g., information on health, religious or philosophical beliefs, trade union membership). We ask you to include only the data necessary for assessing your professional suitability in your CV.
Legal basis: Art. 6 para. 1 lit. b GDPR (implementation of pre-contractual measures) and Art. 9 para. 2 lit. b GDPR (exercise of rights arising from employment law and social security law), insofar as your application documents contain special categories of personal data.Legal basis: Art. 6 para. 1 lit. b GDPR (implementation of pre-contractual measures) and Art. 9 para. 2 lit. b GDPR (exercise of rights arising from employment law and social security law), insofar as your application documents contain special categories of personal data.
Storage duration: If your application is successful, your data will be transferred to your personnel file. If rejected, we will store your application data – including the uploaded CV – for six months from the completion of the application process to address any claims under the Equal Treatment Act (GlBG). Subsequently, your data and files will be deleted from our systems and from the storage used by Flowdrive.Storage duration: If your application is successful, your data will be transferred to your personnel file. If rejected, we will store your application data – including the uploaded CV – for six months from the completion of the application process to address any claims under the Equal Treatment Act (GlBG). Subsequently, your data and files will be deleted from our systems and from the storage used by Flowdrive.
Recipients: Your application documents will only be viewed by authorized employees of Erich Hartmann Ges.m.b.H. who are involved in the selection process. No data will be passed on to other third parties.Recipients: Your application documents will only be viewed by authorized employees of Erich Hartmann Ges.m.b.H. who are involved in the selection process. No data will be passed on to other third parties.
7. Online Shop and Payment Processing7. Online Shop and Payment Processing
If you place orders via our website, we process the data required for contract fulfillment (name, delivery and billing address, email address, phone number, and order data).If you place orders via our website, we process the data required for contract fulfillment (name, delivery and billing address, email address, phone number, and order data).
Payment service providers: Payment processing is carried out via the payment service providers integrated into Webflow Ecommerce: Stripe Payments Europe Ltd., 1 Grand Canal Street Lower, Grand Canal Dock, Dublin, Ireland (for card and wallet payments including Apple Pay and Google Pay) and PayPal (Europe) S.à r.l. et Cie, S.C.A., 22-24 Boulevard Royal, 2449 Luxembourg.Payment service providers: Payment processing is carried out via the payment service providers integrated into Webflow Ecommerce: Stripe Payments Europe Ltd., 1 Grand Canal Street Lower, Grand Canal Dock, Dublin, Ireland (for card and wallet payments including Apple Pay and Google Pay) and PayPal (Europe) S.à r.l. et Cie, S.C.A., 22-24 Boulevard Royal, 2449 Luxembourg.
Legal basis: Art. 6 para. 1 lit. b GDPR (contract processing) and Art. 6 para. 1 lit. c GDPR (fulfillment of legal obligations, especially tax and commercial law retention obligations).Legal basis: Art. 6 para. 1 lit. b GDPR (contract processing) and Art. 6 para. 1 lit. c GDPR (fulfillment of legal obligations, especially tax and commercial law retention obligations).
Storage duration: Order and invoice data are stored for seven years in accordance with § 132 BAO.Storage duration: Order and invoice data are stored for seven years in accordance with § 132 BAO.
8. Integrated Third-Party Services8. Integrated Third-Party Services
Google MapsGoogle Maps
Our contact page includes a map from the "Google Maps" service. The provider is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. When the map is loaded, data – particularly your IP address and browser information – is transmitted to Google; a transfer to Google LLC in the USA may occur.Our contact page includes a map from the "Google Maps" service. The provider is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. When the map is loaded, data – particularly your IP address and browser information – is transmitted to Google; a transfer to Google LLC in the USA may occur.
Consent: The map is only loaded after you have consented to the integration of Google Maps via our consent banner.Consent: The map is only loaded after you have consented to the integration of Google Maps via our consent banner.
Legal basis: Art. 6 para. 1 lit. a GDPR (consent). The transfer to the USA is secured by Google's certification under the EU-US Data Privacy Framework and by standard contractual clauses.Legal basis: Art. 6 para. 1 lit. a GDPR (consent). The transfer to the USA is secured by Google's certification under the EU-US Data Privacy Framework and by standard contractual clauses.
Social Media LinkingSocial Media Linking
In the footer of our website, you will find a link to our Instagram profile. This is purely a link; data is only transferred to Instagram if you actively click on the link. Embedded content or plugins are not loaded.In the footer of our website, you will find a link to our Instagram profile. This is purely a link; data is only transferred to Instagram if you actively click on the link. Embedded content or plugins are not loaded.
9. Overview of Service Providers Used9. Overview of Service Providers Used
10. Data Transfer to Third Countries10. Data Transfer to Third Countries
For some of the services mentioned in Section 9, personal data is transferred to the USA. This transfer is secured by standard contractual clauses in accordance with Art. 46 para. 2 lit. c GDPR, as well as by the certification of the respective providers under the EU-US Data Privacy Framework in accordance with the European Commission's adequacy decision of 10.07.2023. Beyond these mentioned transfers, your data will not be transferred to third countries outside the European Economic Area.For some of the services mentioned in Section 9, personal data is transferred to the USA. This transfer is secured by standard contractual clauses in accordance with Art. 46 para. 2 lit. c GDPR, as well as by the certification of the respective providers under the EU-US Data Privacy Framework in accordance with the European Commission's adequacy decision of 10.07.2023. Beyond these mentioned transfers, your data will not be transferred to third countries outside the European Economic Area.
11. Your Rights as a Data Subject11. Your Rights as a Data Subject
Subject to the conditions of the GDPR, you have the following rights:Subject to the conditions of the GDPR, you have the following rights:
- Right of Access Right of Access (Art. 15 GDPR)
- Right to Rectification Right to Rectification (Art. 16 GDPR)
- Right to erasure Right to erasure (Art. 17 GDPR)
- Right to restriction of processing Right to restriction of processing (Art. 18 GDPR)
- Right to data portability Right to data portability (Art. 20 GDPR)
- Right to object Right to object (Art. 21 GDPR)
- Right to withdraw consent Right to withdraw consent (Art. 7 para. 3 GDPR) – the withdrawal takes effect for the future and does not affect the lawfulness of processing carried out before the withdrawal
To exercise your rights, please refer to the contact details mentioned in Section 1.To exercise your rights, please refer to the contact details mentioned in Section 1.
Automated decision-making: Automated decision-making: Exclusively automated decision-making, including profiling, within the meaning of Art. 22 GDPR does not take place.Exclusively automated decision-making, including profiling, within the meaning of Art. 22 GDPR does not take place.
12. Right to lodge a complaint with a supervisory authority12. Right to lodge a complaint with a supervisory authority
You have the right to lodge a complaint with a data protection supervisory authority regarding the processing of your personal data. The supervisory authority responsible for us is:You have the right to lodge a complaint with a data protection supervisory authority regarding the processing of your personal data. The supervisory authority responsible for us is:
Austrian Data Protection AuthorityAustrian Data Protection Authority
Barichgasse 40-42, 1030 ViennaBarichgasse 40-42, 1030 Vienna
Phone: +43 1 52 152-0Phone: +43 1 52 152-0
Email: dsb@dsb.gv.atEmail: dsb@dsb.gv.at
Web: www.dsb.gv.atWeb: www.dsb.gv.at
Introduction
This Privacy Policy explains how Hartmann Wien ("we", "us", or "our") collects, uses, shares, and protects personal information about you when you visit or interact with https://www.hartmann-wien.at/ (our "website") or use our services.
We are committed to protecting your personal information and being transparent about how we process it. This policy describes the types of information we collect, how we use it, the circumstances in which it may be shared, and the rights you may have regarding your information.
If you have any questions about this Privacy Policy or our data practices, you can contact us using the details in the Contact Us section below.
Last updated: 09/30/2026
Information We Collect
We may collect the following categories of information about you.
Information you provide directly
This includes information you provide when you:
- Identifiers (name, email, phone, IP address)
- Payment / financial data
- Sensitive / special-category data
This information may include your name, email address, postal address, phone number, payment information, and any other information you choose to provide.
Information collected automatically
When you visit our website, we automatically collect certain technical and usage information. This may include:
- Location / geolocation
- Device and browser information
- Usage data / browsing activity
- Cookies and tracking identifiers
This information helps us understand how our website is used and allows us to improve our services. Some of this information may be collected through cookies and similar technologies.
For more details, please see our Cookie Policy.
Special Category Data
Where we process special category data, we do so only where we have an explicit lawful basis under Article 9 of the EU GDPR or UK GDPR, such as explicit consent or another condition permitted by law. The categories of special category data we process, the purposes, and the applicable lawful basis are:
We process sensitive or special-category data only where permitted by applicable privacy law and for the purposes described in this policy.
Information received from third parties
We may receive information about you from third parties, such as analytics providers, advertising partners, or social media platforms, where you have permitted those services to share information with us.
- Payment Processing
- Analytics & Performance
- Video & Media
- Hosting & Infrastructure
- Customer Support
-
How We Use Your Information
We use the information we collect for the following purposes:
- Providing and maintaining the service
- Payment processing
- Customer support
- Analytics and product improvement
- Legal compliance
-
Lawful Bases for Processing
Consent
We may process personal data where you have given clear consent for us to do so for a specific purpose, such as receiving marketing communications or the use of non-essential cookies.
You may withdraw your consent at any time. Withdrawal of consent does not affect the lawfulness of processing carried out before consent was withdrawn.
Contract Performance
We may process personal data where it is necessary to perform a contract with you or to take steps at your request before entering into a contract. This may include processing information to create accounts, deliver services, or process transactions.
Legal Obligation
We may process personal data where necessary to comply with legal obligations that apply to us. For example, we may be required to retain certain financial records for tax, accounting, or regulatory purposes.
Legitimate Interests
We may process personal data where it is necessary for our legitimate interests or those of a third party, provided that those interests are not overridden by your rights and interests.
Our legitimate interests may include operating and improving our services, maintaining website security, preventing fraud, and analysing how our services are used.
You have the right to object to processing based on legitimate interests in certain circumstances. See our Privacy Rights for more information.
With your consent
We may share information with third parties where you have given us consent to do so.
Cookies and Tracking Technologies
We use cookies and similar technologies to operate our website, analyse usage, and support certain functionality.
Some cookies are necessary for the website to function, while others may be used for analytics, performance monitoring, or advertising purposes.
For detailed information about the cookies we use and how to manage your preferences, please see our Cookie Policy.
Data Retention
We retain personal information only for as long as necessary to fulfil the purposes for which it was collected, including to meet legal, accounting, or reporting obligations.
When determining retention periods, we consider factors such as the nature and sensitivity of the information, the purposes for which it was collected, and applicable legal requirements.
Where personal data is processed on the basis of consent, we retain the data until consent is withdrawn or the data is no longer required for the purpose for which it was collected.
In practice, this means we retain your data for 2 years.
When personal information is no longer required, we will securely delete or anonymise it.
Security
We implement appropriate technical and organisational measures to protect your personal information against unauthorised access, loss, alteration, or disclosure.
While we take reasonable steps to protect your information, no system or transmission of data over the internet can be guaranteed to be completely secure.
Your Privacy Rights
Depending on your location, you may have rights regarding your personal information, such as the right to access, correct, delete, or restrict the use of your data.
For detailed information about your rights and how to exercise them, please see our Privacy Rights.
Changes to This Policy
We may update this Privacy Policy from time to time.
The Last Updated date at the top of this policy shows when it was last revised.
Contact Us
If you have questions about this Privacy Policy or our data practices, you may contact us at:
Company Legal Name: Hartmann Wien
Registered Address: Singerstraße 8, 1010 Wien, Austria
Contact Email: veronika@hartmann-wien.at
Company Phone Number: +43 1 512 14 89
Data Controller
For the purposes of the EU GDPR and UK GDPR, Hartmann Wien is the data controller responsible for your personal data.
If you are located in the UK or the EEA and believe your rights have been violated, you have the right to lodge a complaint with your local data protection authority.
In the UK, the supervisory authority is the Information Commissioner's Office (ICO) at ico.org.uk.
If you are in the EEA, you may contact the data protection authority in your country of residence, place of work, or where the alleged infringement occurred.
Changes to this Privacy Policy
We may update this Privacy Policy from time to time.
The "Last updated" date at the top shows when it was last revised.