Privacy
I. Overview#
If we welcome you as a customer or business partner, please read from point III.
If you visit our website or you use the online application "Timelapserobot", please read from point II.
II. What data do we process when you visit our website or use Timelapserobot?#
Welcome to our website! Please get an idea of how we process your personal data when you visit our website (Art 13, Art 14 GDPR; section 165 para 3 Austrian Telecommunication Act (“TKG”)).
When you visit our website, the following data may be processed:
Browser type (user agent),
Public IP address1 and pages visited on our website including entry and exit pages,
country,
operating system,
display resolution,
Device data: We may store personal data from your device. Such data includes geolocation data, IP address, unique identifiers (e.g. MAC address),
date, time and duration of access,
data you enter via a contact form,
e-mail address,
first and last name,
password,
language, time zone & region,
timestamp of last successful login,
timestamp of registration,
Timestamp of login attempts,
number of login attempts,
photos stored in Timelapserobot,
S/FTP access data (host name, IP address, user name, password),
number of FTP connection attempts,
Timestamp of the last failed FTP connection attempt,
Dropbox Access Token,
Related to Timelapserobot smartphone app: smartphone model name, operating system & version, battery level, installed Timelapserobot app version, charging status, WIFI connection status, time zone and region,
E-mail in the course of newsletter distribution.
The processing of this data is necessary to manage the security of the operation of the website or Timelapserobot and to ensure the functionality of the website or Timelapserobot from a technical point of view. The collection of this data is partly carried out via technical cookies. These technical cookies are only used to the extent necessary (section 165 para 3 TKG). The processing of this data is justified by our legitimate interest in operating our website or Timelapserobot (Art 6 para 1 lit f GDPR).
For the operation of our website or Timelapserobot, it may be necessary for us to disclose your data to the following recipients:
Recipient data: myLoc managed IT AG (webtropia)
Purpose of data processing: Hosting provider
Legal basis of data processing: Predominantly legitimate interest (Art 6 para 1 lit f GDPR)
Place of business: Germany
Basis for transfer to a third country : Within the EU.
Recipient data: Meta (WhatsApp, Facebook, Instagram)
Purpose of data processing: Social media provider
Legal basis for data processing: Consent (Art 6 para 1 lit a GDPR); measuring sign-ups and subscriptions (section II.6): legitimate interest (Art 6 para 1 lit f GDPR)
Place of business: USA
Basis for transfer to a third country: Art 49 para 1 lit a GDPR or adequacy decision of the EU Commission (EU-US Data Privacy Framework, Art 45 GDPR)
Recipient data: DropBox, Inc
Purpose of data processing: Storage provider
Legal basis for data processing: Predominant legitimate interest (Art 6 para 1 lit f GDPR)
Place of business: USA
Basis for transfer to a third country: standard data protection clauses according to Art 46 para 2 lit c GDPR.
Recipient data: Amazon AWS
Purpose of data processing: Cloud computing provider.
Legal basis of data processing: Predominant legitimate interest (Art 6 para 1 lit f GDPR).
Place of business: USA
Basis for transfer to a third country: standard data protection clauses according to Art 46 para 2 lit c GDPR.
Recipient data: Alphabet, Inc (Google Analytics, Google Recaptcha).
Purpose of data processing: Statistical evaluation of the website and security tool.
Legal basis of data processing: Consent (Art 6 para 1 lit a GDPR) and legitimate interest (Art 6 Abs 1 lit f GDPR)
Place of business: USA
Basis for transfer to a third country: standard data protection clauses according to Art 46 para 2 lit c GDPR.
Recipient data: Microsoft Corporation (Microsoft Clarity)
Purpose of data processing: Analysis of website usage (heatmaps, session recordings)
Legal basis of data processing: Consent (Art 6 para 1 lit a GDPR)
Place of business: USA
Basis for transfer to a third country: adequacy decision of the European Commission (EU-US Data Privacy Framework, Art 45 GDPR).
Recipient data: Wasabi Technologies, Inc.
Purpose of data processing: Cloud computing provider
Legal basis of data processing: Predominant legitimate interest (Art 6 para 1 lit f GDPR)
Place of business: USA
Basis for transfer to a third country: standard data protection clauses according to Art 46 para 2 lit c GDPR.
Recipient data: Cloudflare, Inc
Purpose of data processing: Content Delivery Network
Legal basis for data processing: Predominant legitimate interest (Art 6 para 1 lit f GDPR)
Place of business: USA
Basis for transfer to a third country: standard data protection clauses according to Art 46 para 2 lit c GDPR.
Recipient data: Paddle
Purpose of data processing: Software as a Service billing tool, notifies us when a paid TLR-Cloud subscription is taken out (section II.6)
Legal basis for data processing: Predominant legitimate interest (Art 6 Abs 1 lit f GDPR)
Place of business: USA
Basis for transfer to a third country: standard data protection clauses according to Art 46 para 2 lit c GDPR.
Recipient data: Okta, Inc. (Auth0)
Purpose of data processing: Login and authentication service for TLR-Cloud, transmission of the sign-up measurement (section II.6)
Legal basis for data processing: Performance of a contract (Art 6 para 1 lit b GDPR) and legitimate interest (Art 6 para 1 lit f GDPR)
Place of business: USA (data stored in the EU)
Basis for transfer to a third country: Adequacy decision of the EU Commission (EU-US Data Privacy Framework, Art 45 GDPR)
Recipient data: MailChimp, Inc
Purpose of data processing: Newsletter provider
Legal basis for data processing: Consent (Art 6 para 1 lit a GDPR)
Place of business: USA
Basis for transfer to a third country: standard data protection clauses according to Art 46 para 2 lit c GDPR
Recipient data: Sanity Inc.
Purpose of data processing: Content management system, storage of the waitlist (section II.5)
Legal basis for data processing: Consent (Art 6 para 1 lit a GDPR)
Place of business: USA
Basis for transfer to a third country: standard data protection clauses according to Art 46 para 2 lit c GDPR
Recipient data: Netlify, Inc.
Purpose of data processing: Hosting of the website timelapserobot.com and its server functions (including shop orders, waitlist, receiving subscription notifications from Paddle, section II.6)
Legal basis for data processing: Legitimate interest (Art 6 para 1 lit f GDPR)
Place of business: USA
Basis for transfer to a third country: standard data protection clauses according to Art 46 para 2 lit c GDPR.
II.1. Overview of technical cookies#
The data mentioned above is stored via „Cookies“. Cookies are text files that are stored on your computer and enable an analysis of the use of the website. They are used for the recognition and storage of temporary data of the homepage visitor or the users of Timelapserobot. We only use cookies to the extent necessary to communicate with you via the homepage.
These technical cookies are activated as soon as you visit our homepage.
The following cookies are used on our platform on the basis of our predominantly legitimate interest (Art 6 para 1 lit f GDPR):
Name of the cookie: JSESSIONID
Purpose of the cookie: website interaction
Duration of storage: session
Name of the cookie: locale
Purpose of the cookie: improvement of the user experience (adaptation of the language)
Duration of storage: session
Name of the cookie: remember-me
Purpose of the cookie: improvement of the user experience (remember log-in)
Duration of storage: 30 days
Name of the cookie: CloudFront-Key-Pair-Id
Purpose of the cookie: access to photos and gallery on AWS Cloud
Duration of storage: 24 hours
Name of the cookie: CloudFront-Policy
Purpose of the cookie: Access to photos and gallery on AWS Cloud.
Duration of storage: 24 hours
Cookie name: CloudFront-Signature
Purpose of the cookie: Access to photos and gallery on AWS Cloud.
Duration of storage: 24 hours
Name of the cookie: klaro
Purpose of the cookie: Cookie Consent Management
Duration of storage: 1 year
Cookie name: _GRECAPTCHER
Purpose of the cookie: Google Recaptcha Form-Security
Duration of storage: 6 months
Name of the cookie: Consent
Purpose of the cookie: Google Recaptcha Form-Security
Duration of storage: 6 months
Name of the cookie: AEC
Purpose of the cookie: Google Recaptcha Form-Security
Duration of storage: 6 months
Name of the cookie: _Secure-ENID
Purpose of the cookie: Google Recaptcha Form-Security
Duration of storage: 6 months
II.2. Overview of marketing cookies#
In addition to the "technical cookies" described above, we also use so-called advertising cookies (including "statistical cookies"). These advertising cookies enable us to better understand and evaluate your interests. With the help of the advertising cookies, we can merge your "surfing behaviour" across the boundaries of our website with data from other websites. This is to enable us to better understand the interests of our homepage visitors and to target them more effectively.
We respect that not every visitor to the website wants this. Therefore, we only process your data in the course of advertising cookies if you consent to this (Art 6 para 1 lit a GDPR). You can revoke this consent at any time, whereby the data processing carried out until the time of revocation remains justified.
Name of cookie: _ga; ga# (Google) – Google Analytics
Purpose of cookie: Statistical purpose
Duration of storage: 2 years
Location of recipient: USA
How it works: Registers a unique ID that is used to create statistical data about website usage.
Name of the cookie: gid; gat(Google)
Purpose of the cookie: Statistical purposes
Duration of storage: 1 day
Country of residence of the recipient: USA
How it works: Registers a unique ID that is used to create statistical data about how visitors use the website.
Name of the cookie: _fbp; fpc
Purpose of the cookie: Marketing
Duration of storage: 3 months
Country of residence of recipient: USA
How it works: Meta pixels, user tracking on the website, analysis of page views, dwell time, buttons clicked, etc.
Name of the cookie: _clck; _clsk; CLID; MUID (Microsoft Clarity)
Purpose of the cookie: Statistical purposes
Duration of storage: up to 1 year
Country of residence of recipient: USA
How it works: Stores an identifier to analyse clicks, scrolling and sessions on our website in anonymised form (heatmaps, session recordings). Input in form fields is masked.
Name of the cookie: _gcl_au; _gcl_aw (Google Ads)
Purpose of the cookie: Marketing / conversion measurement
Duration of storage: 3 months
Country of residence of recipient: USA
How it works: Stores information about clicks on our Google ads so that purchases and other actions can be attributed to our advertising.
II.3. Google Consent Mode v2 and conversion measurement (Google Ads)#
We use Google's "Consent Mode v2" to measure the performance of our Google advertising. The Google tag loads regardless of your cookie choice, but behaves according to your consent: without your consent, no cookies are set and no persistent identifiers are stored; only cookieless, functional pings are transmitted to Google (e.g. the time of the page view, approximate origin based on the IP address, basic browser information). Google uses these pings exclusively in aggregated form, for example for statistical conversion modelling, without recognising individual visitors. The legal basis for this is our legitimate interest in privacy-preserving measurement of the reach and performance of our advertising (Art 6 para 1 lit f GDPR). Only with your consent (Art 6 para 1 lit a GDPR) are the marketing cookies listed above set and full conversion tracking activated.
If you complete a purchase and have consented to marketing cookies, we additionally transmit your email address or phone number to Google in hashed (pseudonymised) form ("enhanced conversions") so that purchases can be attributed to our advertising more reliably. Google cannot reverse the hash into plain text; it is only used for matching against existing Google accounts.
II.4. Origin of orders and sign-ups#
To understand how customers find our shop and TLR-Cloud, your browser remembers in the storage of the current tab ("sessionStorage") on your first page view which website you came from (address without query parameters), on which page you entered (including campaign parameters such as "utm_source", if any) and whether and which type of advertising click identifier the link contained (e.g. "gclid"), but not its value. This information contains no identifier by which you could be recognised and is deleted automatically when you close the tab. It is passed on in the following cases (for the waitlist see section II.5).
Orders: When you start an order, the information and the time of your first page view are transmitted to our payment provider Stripe together with the order and stored with it. If you have consented to cookies, we additionally transmit your Google Analytics identifier so that the purchase is attributed to your visit in Google Analytics.
Sign-up for TLR-Cloud: If you click a link to sign up for TLR-Cloud for free (my.timelapserobot.com), we add this information to the link, together with the language and address of the page on which you clicked, a label of the button you clicked and, for the plan buttons, the plan you chose. Values of advertising click identifiers are not included. If you then create a new account, we may store this information with your account for as long as it exists, so we can see which pages and channels lead to sign-ups; existing accounts are not changed. With the click we also send the address of your entry page (without parameters) via the Google tag described in section II.3 to Google Analytics and Google Ads; without your consent this happens only as a cookieless ping, as described there.
The legal basis is our legitimate interest in measuring the performance of our marketing channels (Art 6 para 1 lit f GDPR). For the transmission of your Google Analytics identifier with an order and for transmissions to Google with cookies after your consent (section II.3), the legal basis is your consent (Art 6 para 1 lit a GDPR).
II.5. Waitlist "Notify me when back in stock"#
When a product is sold out, you can leave your email address on the product page so that we can let you know as soon as it is available again. For this we process your email address, the product you are interested in, the language of the page, the time of sign-up and the information about the origin of your visit described in section II.4. The data is stored in our content management system (Sanity) and sent to our team by email. Unless you tick the newsletter box (see below), we use your address solely for this one notification and not for advertising. The legal basis is your consent, given by submitting the form (Art 6 para 1 lit a GDPR). You can withdraw it at any time with an informal message to contact@timelapserobot.com. We delete your waitlist entry after the notification, and at the latest twelve months after you signed up.
In the same form you can also tick an optional box for our newsletter with product updates and construction-timelapse guides. Only then do we also use your email address for the newsletter, and we store the time of your consent. The legal basis is your consent (Art 6 para 1 lit a GDPR). It is independent of the waitlist and can be withdrawn at any time, for example via the unsubscribe link in every newsletter or with a message to contact@timelapserobot.com. For the newsletter we store your address until you unsubscribe.
II.6. Measuring sign-ups and subscriptions in TLR-Cloud (Meta Conversions API)#
When you create a TLR-Cloud account (my.timelapserobot.com), we report this sign-up once, after you have confirmed your email address, directly from our login service to Meta Platforms Ireland Ltd. ("Conversions API"). This lets us measure how many sign-ups result from our advertising on Facebook and Instagram and improve that advertising. We transmit: the type of event ("registration completed") and its time, your email address and your user ID, each only as a hash value (SHA-256, pseudonymised), your country, and the IP address and browser identifier (user agent) at sign-in. Meta matches this information against existing Meta accounts and, where possible, attributes the sign-up to an ad you saw or clicked before; we only receive aggregated statistics. We do not transmit any content of your account, photos or payment data. The legal basis is our legitimate interest in measuring the performance of our advertising (Art 6 para 1 lit f GDPR). We and Meta are joint controllers for the collection and transmission (Art 26 GDPR); the agreement is available at https://www.facebook.com/legal/controller_addendum. We are responsible for informing you about this processing and for a lawful transmission; Meta alone is responsible for any further processing after receipt, for example for delivering and measuring ads. How Meta processes the data and how you can exercise your rights towards Meta is described in Meta's privacy policy at https://www.facebook.com/privacy/policy; you can exercise your rights against us as well as against Meta. Meta may also transfer the data to the USA (adequacy decision of the EU Commission, EU-US Data Privacy Framework, Art 45 GDPR). You can object to this processing at any time (Art 21 GDPR), for example with a message to contact@timelapserobot.com; we then note this in your account and no longer transmit any data about you to Meta. We keep a note in your account that the sign-up was transmitted for as long as the account exists.
If you take out a paid TLR-Cloud subscription (currently the "Professional" and "Business" plans, not storage add-ons), our payment provider Paddle notifies our website (hosted by Netlify), and we transmit this subscription to Meta once as well. We transmit: the type of event ("subscribed") and its time, the chosen plan, its price and currency, an identifier of the subscription (to avoid duplicate reports) and your email address, both only as a hash value (SHA-256, pseudonymised). We do not transmit payment details such as card or account numbers. Purpose, legal basis, joint controllership with Meta, the transfer to the USA and your right to object are the same as described above; an objection covers both reports. We do not store any additional data for this report.
III. For what purposes do we process your data if you are a customer of ours or have a business relationship with us?#
In the course of our business relationship with customers and business partners, we process data on the basis of contractual (processing of the contractual relationship with you, pre-contractual obligations, invoicing of services, dispatch of documents, communication for processing the contract) and legal obligations (legally required storage within the meaning of section 132 BAO) (Art 6 para 1 lit b and c GDPR) as well as on the basis of our legitimate interests or on the basis of the legitimate interests of third parties (Art 6 para 1 lit f GDPR), namely:
for the purpose of internal administration and management of your business case to the extent necessary (e.g.: Processing your business case, forwarding your business case to various departments, filing, archiving purposes, correspondence with you);
for the purpose of providing and processing the services related to Timelapserobot;
assertion and defence of legal claims
in each case to the extent necessary. The processing of your data serves the initiation, maintenance and handling of our business relations. If you do not provide us with this data, we will unfortunately not be able to process your business case.
Where applicable, we process your data based on your voluntary, express consent (Art 6 para 1 lit a GDPR).
IV. How long do we store your data?#
We will only store your data for as long as is necessary for the purposes for which we collected your data. In this context, statutory retention obligations must be taken into account (for example, for reasons of tax law, contracts and other documents from our contractual relationship must generally be retained for a period of seven years (section 132 BAO)). In justified individual cases, such as for the assertion and defence of legal claims, we may also store your data for up to 30 years after termination of the business relationship.
We store data of interested parties for up to one year from the time of the last contact by the interested party.
Photos and content stored in Timelapserobot are deleted one month after termination of the contractual relationship.
V. Who might receive your data?#
In the course of our business relationship, it may be necessary for us to transmit your data to the following recipients:
Recipients: Insurances
Purpose: Insurance of transports
Legal basis: Legal and contractual necessity
Country: Austria
Recipients: Auditors and tax consultants
Purpose: Tax advice
Legal basis: Contractual necessity
Country: Austria
Basis for transfer to third country: Within the EEA
Recipients: Banks
Purpose: Payment processing
Legal basis: Contractual obligation
Country: Within the EEA
Basis for transfer to third country: Within the EEA
Recipients: Lawyers, courts, dispute resolution.
Purpose: Pursuit and defence of legal claims
Legal basis: Predominantly legitimate interests
Country: Austria
Basis for transfer to third country: Within the EEA
Recipients: Crisp IM SARL (live chat)
Purpose: Operating the website live chat when you choose to start a conversation (we process the messages and any contact details you provide to answer your enquiry)
Legal basis: Consent (Art 6 para 1 lit a GDPR), given by actively opening the chat
Country: France — data is hosted within the European Union
Basis for transfer to third country: Within the EEA
VI. Do we receive data from external sources (Art 14 GDPR)?#
In the course of a business relationship or the initiation thereof, it is naturally necessary to conduct research on the business partner. This is done exclusively to the extent required for this purpose. In this context, data may be retrieved and processed from the following sources:
Our company does not obtain personal data from external sources.
VII. Does automated decision making or profiling takes place (Art 13 para 2 lit f GDPR)?#
No automated decision-making or profiling takes place in our company.
VIII. What rights do you have with regard to data processing?#
We would like to inform you that, provided that the legal requirements are met, you have the right to request information about your personal data:
Have the right to request information about which of your data is processed by us (see in detail Art 15 GDPR).
You have the right to request the correction or completion of incorrect or incomplete data concerning you (see in detail Art. 16 GDPR).
Have the right to have your data deleted (see in detail Art 17 GDPR).
Have the right to object to processing of your data that is necessary for the protection of our legitimate interests or those of a third party (see in detail Art 21 GDPR). This applies in particular with regard to the processing of your data for advertising purposes.
Have the right to receive the transfer of the data you have provided in a structured, common and machine-readable format.
If we process your data on the basis of your consent, you have the right to revoke this consent at any time by e-mail. This does not affect the lawfulness of the data processing carried out up to this point (Art 7 (3) GDPR).
IX. Do you have a right to complain?#
If, contrary to expectations, there is a violation of your right to lawful processing of your data, please contact us by mail or e-mail. We will make every effort to process your concerns promptly. However, you also have the right to lodge a complaint with the supervisory authority for data protection matters responsible for you.
The address of the Austrian data protection authority is:
Austrian Data Protection Authority
Barichgasse 40-42,
1030 Vienna
X. How can you get in contact with us?#
If you have any further questions about the processing of your data, please feel free to contact our data protection coordinator using the contact details below.
XI. Controller#
Controller pursuant Art 7 GDPR:
Filmspektakel GmbH
Obere Amtshausgasse 49/2
1050 Vienna
Austria
office [at] filmspektakel.at