Privacy Policy

1. Scope and our role

This Privacy Policy explains how we collect, use, share and retain personal data in connection with our website and our downloadable business databases. “We” and “our” refer to the operator of the website b2blist.at, who is responsible (controller) for the processing of personal data described here. In particular, Regulation (EU) 2016/679, the General Data Protection Regulation (“GDPR”), and the Austrian Data Protection Act (“DSG”) apply.

The policy concerns two different groups: persons who visit our website, open an account, place an order or contact us; and persons whose publicly accessible business or professional contact details are included in a database. You do not have to be a customer to request information about an entry concerning you, to have it corrected, to object to its processing or to request its deletion.

Information that relates only to a legal entity is generally not personal data. However, the business email address of a specific employee, the data of a sole proprietorship or another entry that makes a natural person identifiable can be personal data, even if it is published in a business context. The fact that information is publicly accessible does not in itself permit unrestricted collection, sharing or commercial use.

We decide on the purposes and means of our own collection, preparation and licensing of the databases and are responsible for this processing. Customers who download a database generally determine its further use themselves and are independently responsible for it. A customer does not become our processor by buying a database. We do not shift our own data protection obligations onto customers.

This policy serves as information (Art. 13 and 14 GDPR). Visiting the website, accepting our Terms and Conditions or buying a database does not in itself constitute consent to all uses of personal data described here.

2. Data of website users and customers

Depending on how you use the service, we process the following categories of data:

• Account and contact data: name, email address, company, business contact details, account identifier and login data.
• Order and billing data: products purchased, prices, currency, invoice details, billing address, tax-relevant information, transaction references, payment status and refunds.
• Evidence of acceptance and delivery: the accepted version of the Terms and Conditions, the required declarations on immediate provision, timestamps, identifiers of the databases, access and downloads, status of the file transfer and the related technical logs.
• Customer service data: messages, attachments you voluntarily send us, information on complaints or refunds, data protection requests and our replies.
• Technical data: IP address, browser and device information, operating system, session identifiers, pages visited, security events and the approximate location derived from the IP address.
• Preferences: your choice about cookies, subscriptions to marketing communications and unsubscribe or removal records.

Optional analytics or advertising tools may, if activated, generate additional information about the use of the website or identifiers, as explained in section 7 and in the Cookie Policy. We do not use customers’ private account data, billing data or data on payment disputes as material for the contact databases that we license.

Payments are processed through the payment service provider named in the ordering process. We use the transaction references, the payment status and the billing data necessary to process the order. Please do not send us full card details or the security code in messages to customer service. The payment service provider’s privacy policy explains its own processing and responsibility.

The data necessary to process an order, deliver a file or meet a statutory invoicing obligation is required for these purposes. Without it, we may not be able to carry out the order. Optional marketing communications and tracking are not a prerequisite for buying a database.

3. Data in the databases and its sources

Our databases contain the business information described on the respective product page. Depending on the database, entries may contain the name of a company or organization, its sector, location, business address, website, business email address, phone number and published business contact details. Entries that concern a natural person (for example, a sole proprietorship or a medical practice) may also contain their business name, activity, professional affiliation, a link to a professional profile and information on the source.

Sources are public listings of companies and organizations (in particular Google Maps), publicly accessible company websites, business directories, public registers and publicly visible professional profiles, to the extent that their collection and further use are lawful. A person or company can also send us corrections directly. The product description names the relevant categories of sources; on request, we will provide you with the available information on the specific source of an entry concerning you.

Our databases are intended for business and professional information. For these databases, we do not intentionally collect special categories of personal data (Art. 9 GDPR), private login data, private messages or information obtained by circumventing access restrictions. If you believe that an entry contains inappropriate or sensitive personal information, contact us so that we can review it and, where appropriate, delete or restrict the entry.

Information from sources may be inaccurate, incomplete or out of date. Our Terms and Conditions explain the limits of data from public sources and the commitments for each product. These limits do not restrict the rights of the data subjects, including the rights to rectification and erasure.

4. Purposes and legal bases

We process data only for a specified purpose and on a legal basis under Art. 6 GDPR:

Our interest in the processing for the databases consists in organizing relevant professional information in useful business directories, supporting lawful market research and providing the data products described. An economic benefit or public accessibility alone is not a sufficient legal basis.

5. Recipients

We share only the data necessary for the respective purpose, and only in compliance with the applicable legal requirements:

• Service providers: providers of hosting, storage, account infrastructure, email delivery, customer service, security and payment processing; providers of analytics or advertising only if such tools are lawfully activated. Depending on the service, they act as processors or as independent controllers.
• Customers of the databases: companies and self-employed persons who buy the respective database for market research and other permitted professional activities. The delivery of a database may include the business contact details described in section 3.
• Advisers and authorities: legal, accounting and other advisers, courts, supervisory authorities and other authorities, where necessary and lawful.
• A legal successor: a potential or actual acquirer in a merger, acquisition or restructuring, with appropriate safeguards, the applicable restrictions and the information or consent required by law.

We license the databases for a fee. If a database contains protected personal data, its delivery to customers is a disclosure to third parties that is subject to the GDPR. We do not present it otherwise merely because it is structured as a license or because the original source was public.

Our license prohibits unauthorized sharing and obliges customers to use the data lawfully.

6. Processing and transfers to third countries

Our service is international. Data may be processed by us or our service providers in Germany, where our servers are located, and Georgia, where we are based. The delivery of a database to a customer in another country may also be a disclosure of personal data abroad if the applicable law classifies it as such.

If a transfer to a country outside the European Economic Area requires safeguards, we first create an appropriate legal basis: depending on the destination, an adequacy decision of the European Commission, the standard contractual clauses approved by the Commission, or another safeguard or exception under Art. 45 to 49 GDPR. A recipient’s contract with us does not in itself meet all requirements for international transfers.

You can request information about the applicable safeguards and find out how to obtain a copy or an explanation, with the necessary redactions where appropriate. The choice-of-law clause in our Terms and Conditions does not take precedence over mandatory data protection law and the rules on transfers abroad.

7. Cookies, analytics and marketing communications

Cookies and similar technologies may be used for logging in, account security, storing necessary settings, the ordering process and recording your privacy choice. Optional analytics or advertising technologies are used only if they are activated, and only with your consent in accordance with § 165(3) TKG 2021.

Where consent is required, optional tracking is not activated beforehand; you can refuse it or withdraw your consent without losing the normal purchasing functions. We list the names or categories, providers, purposes and storage periods of the active technologies in the Cookie Policy and in the “Cookie settings” window, which you open via the link at the bottom of every page.

You can also manage cookies in your browser; however, blocking necessary cookies may impair logging in or purchasing. The browser setting does not replace a required consent procedure.

If we send marketing communications, you can unsubscribe via the method indicated in the message or by sending us a message. Essential notices about orders, security and legal matters may still be sent. Unsubscribing from our marketing emails and requesting the removal of your contact from a database are different requests; you can make either or both.

If your browser sends the Global Privacy Control signal, we respect it by keeping optional analytics and advertising cookies deactivated. If a browser signal cannot be matched to a specific database entry, you can send us the minimal business contact details with which we can find it, following the procedure in section 10.

8. Retention and deletion

We retain personal data only for as long as is reasonably necessary for its purpose and to comply with statutory obligations. The criteria depend on the type of data:

• Account data: for as long as the account is active, and after it is closed only to the extent necessary for open orders, statutory obligations or the assertion or defense of claims.
• Billing and transaction data: for the applicable commercial and tax retention period (generally seven years, § 132 of the Federal Fiscal Code, BAO), longer only if a statutory retention obligation or an open claim justifies it.
• Evidence of delivery and acceptance: for the periods for payment disputes and legal claims, limited to the information reasonably necessary to prove an order and protect rights.
• Routine technical and security logs: for 14 days, unless individual entries must be retained longer because of an active security incident, a statutory obligation or a dispute.
• Database entries: for as long as they are relevant and lawful for the described purpose of business information, taking into account their currency, reliability, the date of collection, changes to the sources and requests for rectification, restriction or erasure. We retain historical versions only with a continuing lawful purpose and mark them as historical where appropriate.
• Removal and preference records: the minimum data necessary to continue to respect an unsubscribe, an objection or an erasure request and to prevent accidental re-inclusion.

Deleting an account does not automatically mean deleting an invoice, a necessary removal record or other information that we must or may retain. We explain the applicable exceptions when responding to a request.

9. Your rights

Under Art. 15 to 22 GDPR and the DSG, depending on the legal basis of the processing, you have the right to:

• Access: information about the processing and a copy of the personal data concerning you;
• Rectification: correction of inaccurate or incomplete data;
• Erasure (“right to be forgotten”) and restriction of processing;
• Object to processing based on legitimate interests;
• Data portability: receiving or transmitting the data for which this is possible in a structured format;
• withdraw your consent at any time, without affecting the lawfulness of the processing carried out before;
• not be subject to a decision based solely on automated processing with legal or similarly significant effects;
• act through an authorized representative; and
• lodge a complaint with the Austrian Data Protection Authority (Datenschutzbehörde, Barichgasse 40–42, 1030 Vienna, www.dsb.gv.at) or another competent supervisory authority, without needing our consent.

The rights are subject to the conditions and exceptions of the applicable law. Exercising them is free of charge; we do not require a general waiver through our Terms and Conditions or any fee because you are not our customer.

10. Exercising rights or requesting removal

Write to [email protected] with a subject such as “Data protection request”, “Correction of an entry”, “Delete my contact” or “Objection”. Include a short description of the request and the minimum information with which we can find the account or the database entry, such as the email address, the company name or the link to the public source. You need neither an account nor a purchase.

We may take proportionate steps to verify your identity or authority to act on someone’s behalf where this is necessary and permitted by law, but we do not routinely require an ID document or sensitive, irrelevant information. We may ask specific questions to find the right entry.

We respond within one month of receiving the request (Art. 12(3) GDPR); this period may be extended by a further two months where necessary because of the complexity or number of requests — in that case we will inform you within the first month, stating the reasons. If we refuse a request in whole or in part, we will state the reasons and your right to lodge a complaint with the Data Protection Authority.

If we grant a request to delete or restrict an entry, we delete or restrict the information concerned in the copies and future deliveries under our control and retain only the lawful minimum data for removal or evidence. Where required by law (Art. 19 GDPR), we notify the recipients of the erasure or rectification. We cannot physically retrieve a file already downloaded by an independent customer; however, this technical limitation does not release us from notification, cooperation or other obligations incumbent on us. Independent recipients remain responsible for their own use and for responding to requests concerning them.

11. Further information under the GDPR and the DSG

The controller, purposes, legal bases, categories of sources, recipients, retention criteria, safeguards for transfers abroad and your rights are described in the preceding sections. As a controller based outside the European Union that offers services to persons in the Union, we designate a representative under Art. 27 GDPR where required; their details are shown in the contact box above.

If we do not collect data from the data subject (Art. 14 GDPR), we provide the information in this policy on the website. Under Art. 14(5)(b) GDPR, we do not send an individual notification to each company included where this is impossible or would require disproportionate effort; instead, we publish this policy and answer every request without any purchase requirement.

We assess statutory exceptions or presumptions for a specific entry or a specific relationship on the basis of the actual circumstances; they are not assumed merely because of the label “business data”.

12. Data security and automated processing

We take technical and organizational measures appropriate to the information and the risks (Art. 32 GDPR) and restrict access to persons and service providers who need it for permitted purposes. No online system, email delivery or downloaded file is absolutely secure. Customers are responsible for protecting the downloaded files, and we remain responsible for the security of our own processing.

Automated tools may help to collect, organize, deduplicate or classify business information and to detect security or payment anomalies. This processing can cause errors. If an automatic security restriction affects your account or your order, contact customer service and request a review.

Our database service is not intended to decide on a person’s suitability for employment, credit, insurance or a similarly significant outcome. Should we introduce processing involving automated decisions regulated by law, we will first provide the required additional information and safeguards; this policy alone does not permit such an activity.

13. Minors

The service is aimed at professional users and at persons who can conclude a valid purchase contract, not at minors. Under § 4(4) DSG, we do not process data of children under 14 on the basis of their own consent. We do not intentionally include personal data of minors in the contact databases that we license. If you believe that a minor has provided us with data or is included in a database, contact us so that we can review it and take the measures required by law.

14. Third-party websites and use by customers

Our website and our databases may refer to third-party websites. Their privacy practices are governed by their own notices. A public source website does not automatically endorse our service or a customer’s use of its information.

Customers of the databases need the necessary legal bases, information and safeguards for international transfers for their own processing, including informing the data subjects under Art. 14 GDPR. These obligations of customers do not restrict our own obligations in collecting, preparing and delivering a database.

15. Changes to this policy

We adapt this policy when our processing or our legal obligations change and indicate the date of the version above. Before a material change takes effect, we will provide additional information or obtain new consent where required. Continued use of the website is not deemed consent to a new activity for which the law requires separate consent.

16. Contact

For questions or to exercise your rights, write to [email protected]. If your message concerns an order, you can state its number. If it concerns a database entry, you need no order number, no account and no proof of purchase.