1. Controller

The controller responsible for processing personal data is:

ROCOON Automation GmbH
Mariazeller Straße 1a
8605 Kapfenberg
Austria

Company register number: FN 687953x
VAT ID: ATU83679725
EORI number: ATEOS1000168583

Email: info@rocoon.at
Phone: +43 720 111099

For support enquiries: support@rocoon.at

This Privacy Notice applies in particular to ROCOON websites and services relating to IOZER, including the online shop shop.iozer.pro, unless supplementary privacy information is provided for individual services.

2. Accessing our websites and server logs

When our websites are accessed, the web server processes technical connection data required for operation. This may include:

• IP address
• date and time of access
• requested address or resource
• HTTP status code
• amount of data transferred
• referrer
• browser and operating-system information

The data is processed for technical delivery, troubleshooting, IT security and the prevention of misuse.

The legal basis is Art. 6(1)(f) GDPR. Our legitimate interest lies in the secure, stable and reliable operation of our systems.

Regular web-server logs are generally retained for no more than 14 days. In the event of specific security incidents, relevant log data may be retained for longer until the incident has been fully investigated.

3. Hosting

Our web and online-shop services are hosted on servers operated by netcup. The server location used for the IOZER online shop is Vienna, Austria.

The hosting provider processes technical data on our behalf for the provision and protection of the server infrastructure.

Where the hosting provider processes personal data on our behalf, this is based on a data processing agreement in accordance with Art. 28 GDPR.

4. Cookies and local storage

We use technically necessary cookies and comparable storage technologies where these are required to provide a service expressly requested by the user.

This includes functions relating to:

• session management
• security and login
• shopping cart
• language settings
• privacy settings
• customer account
• selection of private or business customer view

Services that are not technically necessary are activated only after voluntary consent has been given.

The applicable legal bases arise from Art. 6 GDPR and Section 165(3) of the Austrian Telecommunications Act 2021 (TKG 2021).

The following cookies are currently used in particular:

Name	Purpose	Duration
iozer_web	Session, security and form protection	10 minutes of inactivity
iozer_privacy_consent	Stores privacy choices including version and timestamp	180 days
iozer_connect	Login and secure session for IOZER connect	1 hour
iozer_shop_audience	Stores selected private or business customer view	1 year
_ga	Google Analytics, only after consent	up to 2 years
_ga_*	Google Analytics session and measurement information, only after consent	up to 2 years

The cookies actually used and their retention periods are also shown in the website’s privacy settings.

Consent for optional services can be changed or withdrawn at any time using “Cookies” in the website footer.

5. Google Analytics

After voluntary consent, we use Google Analytics 4 for audience measurement.

Provider:

Google Ireland Limited
Gordon House
Barrow Street
Dublin 4
Ireland

Google Analytics processes information including page views, sessions, approximate geographical origin and browser and device information.

Our Google Analytics configuration is not used for personalised advertising. Advertising personalisation functions are not activated unless they are expressly offered separately in the consent system.

User and event data is retained in our Analytics property for no more than 14 months. Aggregated analyses may continue to exist for longer.

Google states that IP addresses from users in the EU and Switzerland are not permanently logged or stored in Google Analytics.

The legal basis is exclusively your consent pursuant to Art. 6(1)(a) GDPR in conjunction with Section 165(3) TKG 2021.

Recipients may include Google Ireland Limited, Google LLC and service providers used by Google. Personal data may be processed in the United States. Where applicable, the legally required safeguards for international data transfers are used.

Consent may be withdrawn at any time via the privacy settings.

6. Google reCAPTCHA

We use Google reCAPTCHA to protect forms against automated submissions and misuse.

reCAPTCHA is not automatically activated when a normal page is loaded. A connection to Google is established only after the corresponding user action or consent.

The following information may be processed in particular:

• IP address
• browser and device information
• referrer
• interaction and usage information
• technically necessary cookies or comparable information

The provider is Google Ireland Limited. Processing by Google LLC in the United States cannot be completely excluded.

The legal basis is Art. 6(1)(a) GDPR in conjunction with Section 165(3) TKG 2021.

Users who do not wish to activate reCAPTCHA can alternatively contact us by email or telephone.

7. Contact and support

If you contact us by contact form, email or telephone, we process the information you provide for the purpose of handling your enquiry.

This may include your name, contact details, company, message content and, in the case of technical support enquiries, device information, serial numbers, firmware information and configuration information.

For pre-contractual or contractual enquiries, processing is based on Art. 6(1)(b) GDPR.

For other enquiries, the legal basis is Art. 6(1)(f) GDPR. Our legitimate interest lies in processing enquiries and providing effective customer support.

General correspondence is usually deleted six months after the communication has been completed unless there is an ongoing contractual relationship, a statutory retention obligation, security requirement or other legitimate interest requiring longer retention.

8. Customer account

Creating a customer account is voluntary.

For the customer account, we process in particular:

• name
• email address
• company information
• VAT identification number, where provided
• billing and delivery addresses
• login credentials or password hash
• order history
• account settings

Processing is carried out to provide the customer account requested by the user and to process associated contracts pursuant to Art. 6(1)(b) GDPR.

The customer account may be deleted on request. Data relating to completed orders will not be deleted where statutory retention periods or other legitimate reasons require continued storage.

9. Orders in the online shop

When an order is placed, we process the information necessary to perform the contract.

This includes in particular:

• name and contact details
• billing and delivery address
• email address
• telephone number, where provided
• private or business customer status
• company name and VAT identification number
• products and quantities ordered
• prices and shipping costs
• payment method
• order, invoice, payment and shipping status
• communications and support information relating to the order

Processing is carried out pursuant to Art. 6(1)(b) GDPR for performance of the contract and Art. 6(1)(c) GDPR for compliance with statutory obligations.

Documents relevant under tax and commercial law are generally stored for at least seven years in accordance with statutory retention obligations.

10. Verification of VAT identification numbers

Where a VAT identification number is provided for a business-customer order, it may be checked for validity.

For this purpose, the VAT identification number may be transmitted to the competent governmental or European validation service.

Processing serves the correct tax treatment of the transaction and is based on Art. 6(1)(b) and (c) GDPR.

11. Payment processing

Advance payment and purchase on account

For advance payment and purchase on account, we process payment information required for accounting, receipt of payment and allocation of payments.

Processing is based on Art. 6(1)(b) and (c) GDPR.

PayPal

If PayPal is selected, information required for payment processing is transmitted to:

PayPal (Europe) S.à r.l. et Cie, S.C.A., Luxembourg

PayPal determines some of the additional data processing carried out in connection with the PayPal account, payment processing, fraud prevention or statutory obligations under its own data-protection responsibility.

The legal basis for the transmission initiated by ROCOON is Art. 6(1)(b) GDPR.

12. Shipping

For delivery of orders, we transmit the necessary shipping information to our shipping service provider.

At market launch, we use in particular Österreichische Post AG.

Only information required for shipping, delivery, shipment tracking and, where applicable, delivery notifications is transmitted, in particular:

• name
• delivery address
• company, where applicable
• email address or telephone number where required for the selected shipping service

The legal basis is Art. 6(1)(b) GDPR.

13. Electronic invoices and accounting

Invoices are generally provided electronically.

Invoice, payment and accounting information is processed to meet contractual, tax and commercial-law obligations.

The legal bases are Art. 6(1)(b) and (c) GDPR.

Accounting and business records subject to statutory retention requirements are generally retained for seven years from the relevant starting date and, where proceedings are pending, for longer where required.

14. Email services

We use services provided by ALL-INKL for the technical operation of our email communications.

Sender and recipient addresses, technical message information and email content may be processed in this context.

Where processing takes place on our behalf, an agreement pursuant to Art. 28 GDPR is in place.

15. Newsletter

If you subscribe to our newsletter, we process your email address and any voluntarily provided information for the purpose of sending the newsletter.

The legal basis is your consent pursuant to Art. 6(1)(a) GDPR and the applicable provisions of the TKG 2021.

Consent can be withdrawn at any time with effect for the future, in particular using the unsubscribe link contained in the newsletter or by contacting info@rocoon.at.

After unsubscribing, the email address is removed from the active mailing list. A minimal suppression or evidence record may remain stored where this is necessary to document the unsubscribe request and prevent further mailings.

16. Firmware updates for IOZER devices

Firmware updates can be obtained without registering for IOZER connect.

When an IOZER device actively requests an online check for available firmware updates, the following information is transmitted in particular:

• serial number of the device, and
• currently installed firmware version.

The IP address is also technically generated as part of the communication and may be recorded in standard server logs.

This information is used exclusively to provide the requested update, verify device and firmware compatibility, maintain IT security and comply with update and product-safety obligations.

The normal update function does not continuously transmit process, sensor or usage data to ROCOON.

Alternatively, firmware files can be downloaded and manually uploaded to the device.

17. IOZER connect

Use of IOZER connect is generally optional.

When an active IOZER connect connection exists, the device transmits periodic technical keep-alive messages required to provide the service activated by the user.

Further device, process or application data is processed only where the user explicitly activates or enables the relevant functions.

ROCOON does not use telemetry or process data transmitted through IOZER connect for general product improvement or advertising purposes without a separate legal basis.

Supplementary service-specific privacy information may be provided for individual IOZER connect functions.

18. Recipients and processors

Personal data is made available only to internal departments and external recipients that require it for the purposes described.

These may include in particular:

• hosting providers
• email service providers
• payment service providers
• banks
• shipping providers
• IT and security service providers
• accounting and tax advisers
• authorities and courts where required by law

Where service providers act as processors, we conclude the required agreements pursuant to Art. 28 GDPR.

19. Transfers to third countries

The majority of our own infrastructure is located within the European Union.

For individual service providers, in particular Google or globally operating payment service providers, processing outside the European Economic Area cannot be completely excluded.

Any such transfer takes place only where the requirements of Art. 44 et seq. GDPR are satisfied, in particular on the basis of an adequacy decision, appropriate safeguards or another lawful transfer mechanism.

20. Data security

We implement appropriate technical and organisational measures to protect personal data against loss, manipulation, unauthorised access and other unlawful processing.

Security measures are reviewed and adapted in line with technical developments and the relevant level of risk.

21. Rights of data subjects

Subject to the applicable statutory requirements, you have in particular the right to:

• access,
• rectification,
• erasure,
• restriction of processing,
• data portability, and
• object to certain processing.

Consent that has been given may be withdrawn at any time with effect for the future.

To exercise your rights, please contact:

info@rocoon.at

You also have the right to lodge a complaint with a data protection supervisory authority. In relation to ROCOON, the Austrian Data Protection Authority is the competent supervisory authority in particular.

22. Changes to this Privacy Notice

We update this Privacy Notice if our services, systems used or applicable law change.

Where a change affects an existing consent and renewed consent is legally required, such consent will be obtained again.

Online withdrawal declarations

When you use “Withdraw from contract”, we process your name, contract or order reference, email address, any affected items and quantities, and any optional message. We also record the declaration, its language, the time of receipt with its time zone, and a unique reference ID. We use these details to receive, document and process your withdrawal and promptly send an electronic acknowledgement.

The legal bases are Article 6(1)(c) GDPR in conjunction with section 13a of the Austrian Distance and Off-Premises Contracts Act (FAGG) and, where required to handle the contract, Article 6(1)(b) GDPR. Where retention is necessary for establishing, exercising or defending legal claims, it is based on Article 6(1)(f) GDPR; our legitimate interest is documenting the business transaction.

The data is processed by the responsible staff and our hosting and email service providers acting as processors. The original declaration is protected against subsequent changes. Necessary additions or corrections are recorded separately. We retain the data for the time needed to process the withdrawal, meet applicable statutory retention requirements and, where relevant, conclude related legal disputes. It is then removed through a controlled deletion procedure unless another legal basis requires continued retention.

The function requires neither a customer account nor consent to analytics or marketing. The necessary session and security checks serve only to secure the submission and prevent accidental duplicate submissions. No reason for withdrawal is required; please do not include sensitive data that is unnecessary for your withdrawal.

Voluntary returns and free parcel labels

For voluntary return requests we process the contact details and contract references described above, the stated receipt date, affected items and quantities, the message, language, legal basis and receipt timestamp with a reference ID. Where possible we match the request to the order and the return policy promised at purchase. We retain a traceable record of the declaration and promise and record the manual dispatch of the Post parcel label with its timestamp and responsible staff member.

We process this information to fulfil the voluntary return promise and provide free return shipping under Article 6(1)(b) GDPR. The legal bases and retention periods described above apply where needed for statutory retention requirements or legal claims. We disclose only the shipping and contact details needed for the return to the commissioned carrier. No customer account or analytics/marketing consent is required.