Privacy Policy - B2B Customers
(As of 05/2026)
The following privacy notice is intended in particular for customers, prospective customers, applicants, and persons authorised to act on their behalf or authorised representatives. It is therefore possible that not all provisions of this notice apply to every data subject to the same extent.
1. Name and address of the controller
The controller responsible for processing your personal data in accordance with data protection regulations is:
medaia GmbH
Am Eisernen Tor 5/1/12
8010 Graz
The contact details of the data protection officer are: datenschutz@skinscreener.at.
2. What data is processed and for what purposes?
We collect and process personal data when you contact us – for example, as a prospective customer, applicant, client, company representative, or at a trade fair or event. This applies in particular if you are interested in our products, fill in quotation forms, submit applications, or already have a business relationship with us.
Insofar as necessary for the provision of our services, we also process personal data that we lawfully collect from publicly available sources (e.g. commercial registers, the press, the internet).
The personal data processed in the context of enquiries and quotation processes includes, in particular, master data such as:
- title, surname, first name
- Role or position within the company
- Address, telephone number(s), email address(es), fax number
- Other contact details that you provide to us in the course of our communication.
3. Legal basis for data processing under data protection law
We process personal data exclusively in accordance with the provisions of the General Data Protection Regulation (GDPR), the Data Protection Act (DPA) and other relevant national legislation.
a. Fulfilment of contractual obligations (Art. 6(1)(b) GDPR)
Your data is processed to fulfil contracts or to take pre-contractual measures, for example in connection with the preparation of quotations, the implementation of joint projects or the evaluation of a completed project. The specific purposes are set out in the relevant contract.
b. Balancing of interests (Art. 6(1)(f) GDPR)
In individual cases, we process personal data beyond the scope of contractual fulfilment if this is necessary to safeguard the legitimate interests of our company or third parties.
This may include, in particular:
- Optimisation of internal processes and customer communication,
- implementation of advertising and marketing measures (provided no objection has been raised),
- asserting and defending legal claims,
- ensuring IT and data security,
- preventing and investigating potential criminal offences,
- access and building security measures,
- internal management and further development of our services and products.
c. Processing based on your consent (Art. 6(1)(a) GDPR)
If you have given us your consent to process certain personal data – for example, to receive email updates, product news or invitations to events – the processing will take place exclusively for these purposes. You may withdraw your consent at any time with effect for the future. Withdrawal does not affect the lawfulness of processing carried out up to the point of withdrawal.
4. Duration of storage
We process and store your personal data only for as long as is necessary to fulfil our contractual or legal obligations, or for as long as you act as an authorised representative of a legal or natural person in dealings with our company.
Once the data is no longer required for these purposes, it is regularly deleted, provided that no statutory retention obligations require it to be stored for a longer period.
Such retention obligations arise in particular from the
- Austrian Commercial Code (UGB),
- the Federal Tax Code (BAO) and, where applicable,
- other specific statutory provisions.
5. Recipients of the data
Within our company, access to your personal data is restricted to those departments and employees who require it to fulfil contractual, legal or regulatory obligations.
In addition, service providers and external specialists commissioned by us may have access to personal data in the course of their duties, insofar as this is necessary for the proper performance of the relevant task.
Binding agreements regarding confidentiality, discretion and the secure handling of personal data in accordance with the provisions of the GDPR are in place with all affiliated companies and external contractual partners.
The service providers typically involved include, in particular, companies from the following sectors: finance and payments (credit institutions), tax consultancy and auditing, IT and telecommunications services, data and document destruction, debt collection, sales and marketing.
All these partners are contractually obliged to process personal data exclusively within the scope of their respective service relationships and to implement appropriate technical and organisational security measures.
The periods specified therein are generally seven years, but may – depending on the type of document – also be longer.
6. Your rights
You may request information about the personal data we process, as well as request the rectification, erasure or restriction of processing. You also have the right to object, the right to withdraw consent with effect for the future, and the right to data portability – in each case subject to the legal requirements.
Furthermore, you have the right to lodge a complaint with the Austrian Data Protection Authority or with another data protection supervisory authority within the EU, in particular at your place of residence or work.
If you believe that the processing of your personal data violates data protection regulations, we ask you to first contact our Data Protection Officer by email at datenschutz@skinscreener.at so that we can promptly review and resolve your concern.