Data protection

The protection of your personal data is very important to point25(Teilzwei Betriebs GmbH).

Your data will not be passed on to third parties without your explicit consent.

It is important for us to inform you about the kind of data we process, how we use it and the options you have in this context. This data protection notice answers your most important questions.

1. Personal data

Once you conclude a contract with us, in other words, if you create an account at point25 and you want to access one of the point25 locations or if you buy items in the point25 app, then the following personal data will be processed:

Upon registration in the point25 app point25 processes: gender, name, email address, mobile phone number, date of birth, photo* and photo ID* (optional).
At the terminal (account creation without app) point25 processes: gender, name, email address, mobile phone number, date of birth, photo* and photo ID* (optional).
On purchasing an item in the point25 App point25 prcoesses: name, the PIN you assigned yourself to secure future payments and payment information**.
The point25 location in context also processes access data and information regarding misconduct (see FAQ section "I have been banned in a point25 location. What does that mean?").
Processing includes the collection, capture, saving, selection, scanning, use, alignment, linkage and the provision of your personal data.

* Simple face recognition is used locally on the device to determine whether a face and its correct orientation is on the picture. In this process, face data is neither compared, transmitted, stored, nor used to authenticate people.

** The payment information is entered during the payment process in an integrated input mask provided by the payment service provider. You transmit payment information directly to the payment service provider – it is neither viewed nor saved by point25.

2. point25 transmits

Your personal data to the extent necessary for the fulfillment of the contract, to technical service providers and other processors commissioned by point25,
if there is a legal obligation to authorities and courts,
when purchasing an item in the point25 app to processing banking institutes and payment service providers to conclude or fulfill your contract with the point25 location whose item you are purchasing,
when passing on an article in the point25 App your name to the recipient of the item and
in other cases only with your additional consent.

3. point25 deletes

Your personal data at the latest after termination of all legal duties to preserve records.
It is possible that instaed of a deletion an anonymization of your data is made. In this case, any personal reference is removed, which is why cancellation obligations deriving from data protection law will not be applicable.

4. Processing of your personal data

We process your personal data for the purposes of conducting our contract, for communication purposes, for system notices (for instance alerts when you accidentally left something at an point25 location), to provide features, analyze performance, troubleshoot, improve the usability and effectiveness of the point25 app, improve services as well as in particular for access and entrance control.
The above referenced processing of your data is necessary for the conclusion, respectively fulfillment of your contract with us. In the case you do not provide us with your data or do not provide the entire data, then we could possibly not be able to fulfill our obligations to you, or we cannot enter into an agreement with you.
These data processing operations are based on Art 6 Paragraph 1 lit a GDPR (consent), Art 6 Paragraph 1 lit b GDPR (necessary for fulfillment of the contract or for the implementation of precontractual processes), Art 6 Paragraph 1 lit c GDPR (legal obligation), Art 9 Paragraph 2 lit a GDPR (consent) and Art 10 GDPR in conjunction with Section 4 Paragraph 3 GDPR (consent and legitimate interests, e.g. house ban).
From your first connection to an point25 location or from the purchase of an item of a point25 location in the point25 app your personal data stored at point25 can also be processed by them, i.e. only you can share your personal data with a point25 location.

5. If you provided us with the corresponding consent, we shall process your data to where

point25 and point25 locations can provide you with information regarding services, events and products, and can send you newsletters. We will use the following communication channels if agreed by you: telephone, email, text messages, push messages or social media.
Please note: you can always withdraw your consent at any time. Simply use our contact options or the point25 app. The revocation of your consent does not affect the legality of the processing up to that point.

6. Taking pictures (event photos)

At events in point25 locations (the full list of all locations can be found at the top of https://www.point25.at or inside the point25 app), photographers from these point25 locations my be taking photos that show you. On the one hand, this data processing is based on the justified documentation interests of the point25 locations (Art 6 Paragraph 1 lit f GDPR and § 12 Paragraph 2 Z 4 in conjunction with Paragraph 3 Z 3 DSG) and, on the other hand, on the verbal consents that you give to the photographer of the point25 locations - especially when shooting portrait- or similar photos (Art 6 Paragraph 1 lit a and § 12 Paragraph 2 Z 2 DSG).

7. Data security measures

The protection of your personal data is extremely important to us, the Teilzwei Betriebs GmbH. We take all necessary measures to ensure that your data is protected. This includes technical and organizational security measures that are regularly reviewed and adjusted to ensure they meet current security standards.

point25 ensures, among other things:

encrypted data transfers
encrypted access data or the encryption of the PIN you have assigned yourself to secure future payments
encrypted pictures

8. With regard to the processing of your data you have the following rights

Information right (Art 15 GDPR)
You can request to receive a confirmation from us, if and to what extent we process your personal data from you.
Right to rectification (Art 16 GDPR)
If we process your personal data which is incomplete or inaccurate, then you have the right to request the rectification, respectively the completion from us at any time.
Right to erasure (Art 17 GDPR)
You have the right to request the erasure of your personal data, if we processed it unlawfully or the processing unduly violates your legitimate protection rights. Please note that certain reasons exist that contradict an immediate erasure, like for instance the legal duty to preserve records.
Right to restriction of processing (Art 18 GDPR)
You can request the restriction of processing of your personal data if
lit a) the accuracy of the personal data is contested for a period of time enabling us to verify the accuracy of the data, lit b) the processing is unlawful and you oppose the erasure and instead request the restriction of the data use, lit c) we no longer need the data for the defined purposes of the processing, and they are required by you for the establishment or defense of legal claims, or lit d) you have objected to the processing of the data.
Right to data portability (Art 20 GDPR)
You have the right to receive the data you provided to us in a structured commonly used and machine-readable format if
lit a) the processing of the data is based on consent or on a contract and lit b) the processing is carried out by automated means.
Right to object (Art 21 GDPR)
You have the right to object to the processing of your personal data, if the processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller, or is necessary for the purpose of the legitimate interests pursued by us or by a third party. A prerequisite for such objection is that you cite the grounds relating to your particular situation and which contradict the processing of your personal data. You can, at any time, object to the mailing of advertisement.
Right to lodge a complaint (Art 77 GDPR)
If you believe that our processing of your personal data contradicted Austrian or European data protection laws, then of course you have the right to lodge a complaint with the Austrian data protection authorities.
Claiming your rights (except Right to lodge a complaint)
If you want to claim any of the rights cited above - except your right to ladge a complaint with the Austrian data protection authorities - please contact us at:
Contact / Responsible
Teilzwei Betriebs GmbH
Data protection
Volksgartenstraße 1, 8020 Graz, Austria
m.office Alternatively, you may also contact our data protection officer:
Data protection officer of Teilzwei Betriebs GmbH
Volksgartenstraße 1, 8020 Graz, Austria
m.dataprotection
Confirmation of identity (Art 12 Paragraph 6 GDPR)
If there exists any doubt with regard to your identity, we are entitled to request additional information regarding your identity. This process protects your rights and your privacy.
Excessive (abusive) use of rights (Art 12 Paragraph 5 GDPR)
When your requests with regard to the cited rights are manifestly unfounded or excessive, in particular because of their repetitive character, then we can charge a reasonable fee for the administrative efforts, or refuse to act on the request.

9. Contact form

If you contact us by using our contact form (point25 app), then the data you provided in the contact form as well as any contact data provided by you will be saved for the purposes of addressing your request as well as any follow up questions. Such data we will not pass on without your consent.