Thank you for your interest in the information on our website!
This privacy policy informs users of our website about the nature, scope and purposes of our processing of personal data. In this context, personal data means any information that can identify you personally as a user of our website, even theoretically, indirectly or by combining different data. This includes your IP address. Cookies and similar technologies may contain personal data or enable recognition. Additional statutory requirements apply to storing and accessing information on your device; we use non-essential technologies only with your consent.
The general section of this privacy policy provides information that applies to our data processing generally, including data collected on our website. In particular, it explains your rights as a data subject.
The terminology in this privacy policy and our data protection practices follow the EU General Data Protection Regulation (“GDPR”) and other applicable national legislation.
Controller
Tamburi Holding GmbH
FN 524226x
Döblerhofstraße 16
1110 Vienna
Austria
Email: info@tamburi.com
Phone: 0800 100 550
Data collection on our website
We collect personal data when you expressly provide it to us. Other data, particularly technical data, is collected automatically when you visit our website. Some of this data is collected to ensure that our website functions correctly; other data may be used for analysis. In principle, you can use our website without providing personal details.
Technologies on our website: cookies and local storage
We use cookies to make our website more user-friendly and functional. Some cookies remain stored on your device.
Cookies are small data packages exchanged between your browser and our web server when you visit our website. They cause no damage and serve to recognise website visitors. Cookies can only store information supplied by your browser, meaning information you have entered into it or that is available on the website. Cookies cannot execute code and cannot be used to access your device.
When you next visit our website using the same device, information stored in cookies may be sent back to us (“first-party cookies”) or to the third-party web application to which the cookie belongs (“third-party cookies”). This stored and returned information allows the relevant web application to recognise that you have previously visited the website using your device’s browser.
Cookies contain the following information:
Cookie name
Name of the server from which the cookie originally came
Cookie ID number
A date on which the cookie is automatically deleted
We classify cookies by purpose and function as follows:
Technically necessary cookies ensure the technical operation and basic functions of our website. For example, they retain your settings as you navigate or keep important information available throughout a session, such as login or shopping basket information.
Statistics cookies help us understand how visitors interact with our website. Personal data and pseudonymous identifiers may be processed. This gives us valuable insights for improving our website, products and services.
Marketing cookies enable targeted advertising activities for users on our website.
Unclassified cookies are cookies we are currently working to classify together with their individual providers.
We also distinguish between session and persistent cookies according to storage duration. Session cookies store information used during your current browser session and are automatically deleted when you close the browser, leaving no information on your device. Persistent cookies store information between visits. This information allows you to be recognised as a returning visitor on your next visit and the website to respond accordingly. The cookie provider determines its lifespan.
The legal basis for using technically necessary cookies is our legitimate interest in the technically correct operation and smooth functionality of our website. Our website cannot function properly without these cookies. Statistics and marketing cookies require your consent. You may withdraw your consent to cookies at any time with effect for the future. Consent is voluntary, and there are no disadvantages if you do not give it. Further information about the cookies we actually use, particularly their purposes and storage periods, is available in this privacy policy and the cookie information in our cookie banner.
You can also configure your browser to prevent cookies from being stored on your device altogether, or to ask each time whether you agree to a cookie being set. You can delete existing cookies at any time. Your browser’s help function explains how to do this.
Please note that disabling cookies altogether may restrict website functionality.
We also use local storage functions on our website. These store data locally in your browser’s cache. Unless you clear the cache or the data is held in session storage, it remains available and readable after the browser is closed.
Third parties cannot access data stored in local storage. Where particular plugins or tools use local storage, this is described in the section for that plugin or tool.
If you do not want plugins or tools to use local storage, you can control this in your browser settings. Please note that this may restrict functionality.
Google Analytics
Provider: Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland; parent company: Google LLC (USA)
Purpose: web analytics, performance measurement, conversion tracking, collection of statistical data
Category: Statistics
Recipients: EU, USA
Data processed: IP address, website visit information, user data
Data subjects: users
Technology: JavaScript calls, cookies
Legal basis: consent, Data Privacy Framework, https://www.dataprivacyframework.gov/s/participant-search/participant-detail?id=a2zt000000001L5AAI&status=Active
Website: https://www.google.com
Further information:
https://policies.google.com/privacy
https://safety.google/intl/de/principles/
https://business.safety.google/adsprocessorterms/
Information about Google’s data centre locations: https://www.google.com/about/datacenters/locations/
We use Google Analytics to analyse usage behaviour and optimise our website. Reports supplied by Google help us analyse website performance and measure the success of possible campaigns on our website.
Google Analytics uses cookies that enable analysis of how our website is used.
Information about website use, such as browser type and version, operating system, previously visited page, hostname of the accessing computer (IP address) and time of the server request, is generally transmitted to a Google server and stored there. We have entered into an agreement with Google for this purpose.
On our behalf, Google uses this information to evaluate website use, compile reports on activity within our website and provide us with further services relating to website and internet use. According to Google, the IP address transmitted by your browser is not combined with other Google data.
We use Google Analytics only with IP anonymisation enabled by default. This means Google truncates a user’s IP address within EU Member States or other countries party to the Agreement on the European Economic Area. Only in exceptional cases is the full IP address transmitted to a Google server in the USA and truncated there. According to Google, the IP address transmitted by a user’s browser through Google Analytics is not linked to other Google data.
During a website visit, usage behaviour is recorded as events. These may include:
Page views and a user’s click path
First visit to our website
Websites visited
Session start
Interaction with our website
Usage behaviour, such as clicks, scrolling, time spent and bounce rates
File downloads
Advertisements viewed or clicked
Video interactions
Internal search queries
The following are also recorded:
Approximate location (region)
Date and time of the visit
IP address (in truncated form)
Technical information about the browser or devices used, such as language settings and screen resolution
Internet service provider
Referrer URL (the website or advertisement through which a user reached our website)
Google primarily processes this data for its own purposes, such as profiling, over which we have no control.
Data about use of our website is deleted promptly once the retention period we have set expires. Google Analytics sets a default retention period of 2 months for user and event data, with a maximum of 14 months. This period also applies to conversion data. For all other event data, the available periods are 2 months, 14 months, 26 months (Google Analytics 360 only), 38 months (Google Analytics 360 only) and 50 months (Google Analytics 360 only). We choose the shortest period appropriate for our purpose. You can ask us at any time which retention period we currently use.
Data that has reached the end of its retention period is deleted automatically once a month.
Google Fonts
Provider: Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland; parent company: Google LLC (USA), https://www.dataprivacyframework.gov/s/participant-search/participant-detail?id=a2zt000000001L5AAI&status=Active
Purpose: embedding fonts
Category: Statistics
Recipients: EU, USA (possible)
Data processed: IP address, language settings, screen resolution, browser version and name
Data subjects: website visitors
Technology: JavaScript calls
Legal basis: consent, Data Privacy Framework
Website: www.google.com
Further information: https://developers.google.com/fonts/faq
https://policies.google.com/privacy
https://www.google.com/about/datacenters/inside/locations/
Our website uses web fonts supplied by Google to display typefaces consistently.
To display Google Web Fonts, your browser must connect to Google’s servers. Google thereby learns that our website has been accessed through your IP address. Google also stores the IP address of the browser on the visitor’s device. If your browser does not support web fonts, a standard font from your device is used.
Each Google Fonts request automatically transmits information such as language settings, screen resolution, browser version and name to Google’s servers, in addition to the IP address. Google can use the collected usage data to determine font popularity. It publishes the results on internal analytics pages, such as Google Analytics.
Google Fonts allows us to use fonts on our website without uploading them to our own server. Google Fonts is an important part of maintaining our website’s quality. All Google fonts are automatically optimised for the web, saving data volume, which is particularly useful on mobile devices. Small file sizes help the website load quickly. Google Fonts are also secure web fonts and support all common browsers.
Google stores requests for CSS assets on its servers for one day. This enables us to use fonts through a Google stylesheet. Google stores font files for one year. To have data deleted earlier, contact Google Support ( https://support.google.com ).
Microsoft Clarity
We use Microsoft Clarity to understand how our website is used and to improve its usability and content. The provider for EU customers is Microsoft Ireland Operations Limited, Ireland; Microsoft Corporation, USA, may also participate in processing.
Clarity creates heatmaps and session recordings (session replays). These show, for example, which areas of a page are viewed or clicked, how far visitors scroll and where usability problems occur. Processing may include page views, mouse movements, clicks, scrolling, timestamps, URLs visited, referral sources and technical information about the browser and device. The IP address is also transmitted when connecting to Microsoft. Cookies and pseudonymous identifiers allow page views to be assigned to a session and a browser to be recognised again.
The enquiry forms provided in our website theme are masked for Clarity. The contents of these form areas should therefore not appear in readable form in session recordings. This does not guarantee complete anonymity of all usage data.
Clarity is loaded on our website only after you consent to the “Statistics” category in the cookie settings. The legal basis for processing personal data is your consent under Article 6(1)(a) GDPR; storing and accessing non-essential information on your device is based on your consent under Section 165(3) TKG 2021. You can withdraw your consent at any time with effect for the future through “Cookie settings” in the footer. Withdrawal does not affect the lawfulness of processing carried out before it.
Clarity cookies include “_clck”, which recognises a browser, and “_clsk”, which combines page views into a session. Microsoft publishes further cookie information at:
https://learn.microsoft.com/en-us/clarity/setup-and-installation/clarity-cookies
According to Microsoft, standard session recordings are stored for 30 days. Sessions saved as favourites or labelled, and heatmap data, are retained for up to nine months.
Microsoft has access to the data collected and describes its role in Clarity as an independent controller. Microsoft may also process data for its own purposes under its privacy policies. Processing in the USA is possible. Microsoft identifies standard contractual clauses as a safeguard for transfers between Microsoft Ireland and Microsoft Corporation. Information on Microsoft’s processing, transfer mechanisms and your rights is available in its privacy statement:
https://privacy.microsoft.com/de-de/privacystatement
Google Maps
Provider: Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland; parent company: Google LLC (USA)
Purpose: embedding map services
Category: Statistics
Recipients: EU, USA
Data processed: IP address, website visit information, user data
Data subjects: users
Technology: JavaScript calls, cookies
Legal basis: consent, Data Privacy Framework, https://www.dataprivacyframework.gov/s/participant-search/participant-detail?id=a2zt000000001L5AAI&status=Active
Website: https://www.google.com
Further information:
https://policies.google.com/privacy
https://safety.google/intl/de/principles/
https://business.safety.google/adsprocessorterms/
Information about Google’s data centre locations: https://www.google.com/about/datacenters/locations/
We embed Google Maps to present geographical location information more clearly to users.
Google Maps is an online map service that makes geographical information easier to read on a device. It can display directions or embed a map of a location in a website, among other functions.
When Google Maps is opened, the browser connects to Google’s servers. Google thereby learns that our website has been accessed through the user’s IP address. Using Google Maps allows Google to collect and process data about use of the service.
To provide this service, Google Maps processes information based on the IP address, including search terms entered and latitude and longitude coordinates. When its route planner is used, the starting address entered is also stored. This processing is carried out solely by Google and is outside our control.
Please note that Google sets a cookie called “NID” when this service runs. Google Maps currently does not allow us to operate the service without this cookie. The NID cookie contains information about your usage behaviour, which Google uses to optimise its own services and provide personalised advertising.
Google anonymises data in server logs by deleting part of the IP address after 9 months and cookie information after 18 months.
Location and activity data is stored for either 3 or 18 months and then deleted. Users can also manually delete their history through a Google account at any time. To prevent location recording completely, a user must turn off “Web & App Activity” in their Google account.
Google Tag Manager
Provider: Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland; parent company: Google LLC (USA)
Purpose: managing tools and plugins
Category: Technically necessary
Recipients: EU, USA
Data processed: IP address
Data subjects: users
Technology: JavaScript calls
Legal basis: legitimate interest, Data Privacy Framework, https://www.dataprivacyframework.gov/s/participant-search/participant-detail?id=a2zt000000001L5AAI&status=Active
Website: https://www.google.com
Further information:
https://policies.google.com/privacy
https://safety.google/intl/de/principles/
https://business.safety.google/adsprocessorterms/
Information about Google’s data centre locations: https://www.google.com/about/datacenters/locations/
We use Google Tag Manager on our website.
Tag Manager allows us to manage website tags through a single interface. This lets us embed code snippets, such as tracking codes or conversion pixels, without editing the website’s source code. Tag Manager only forwards data; it does not collect or store it. Tag Manager itself is a cookie-free domain and does not process personal data, as it serves solely to manage other services on our website.
When Google Tag Manager starts, the browser connects to Google’s servers, which are mainly located in the USA. Google thereby learns that our website has been accessed through a user’s IP address.
Tag Manager triggers other tags, which may themselves collect data. However, Tag Manager does not access this data. If tracking has been disabled at domain or cookie level, that setting remains effective for all tracking tags implemented through Tag Manager.
Hosting
All data processed in connection with operating our website is stored as part of its hosting. This is necessary to operate the website. We therefore process this data on the basis of our legitimate interest in optimising our website. To provide our online presence, we use web hosting providers and make the above data available to them under data processing arrangements.
iThemes Security
We use iThemes Security, provided by iThemes Media, LLC, 2703 Ena Drive Lansing, MI 48917, USA (“iThemes Security”), to secure our website and protect it against unwanted access and bots. Our website connects to iThemes Security servers to compare website access records with its database and potentially block access.
Visitors’ IP addresses, logged-in users’ user IDs and usernames used in login attempts are logged under certain conditions to detect malicious activity and protect our website against particular attacks. Examples include login attempts, logout requests, requests for suspicious URLs, changes to site content and password updates. This information is retained for 180 days.
A QR code image is generated for users who have set up two-factor authentication for this site. This image is generated using the Google Chart API. Your username is sent to the API as part of generating the image. Further information on Google Chart’s privacy practices is available at https://developers.google.com/chart/interactive/docs/security_privacy
Sucuri SiteCheck checks our website for potential malware and vulnerabilities. We do not send personal data to Sucuri. However, Sucuri may find personal information published publicly during a scan, for example in comments. Further information is available in Sucuri’s privacy policy: https://sucuri.net/privacy/
To ensure data integrity, iThemes Security retrieves data from wordpress.org, ithemes.com and amzonaws.com. No personal data is sent to these sites. Requests to wordpress.org include the WordPress version, site locale, a list of installed plugins and their individual versions. Requests to ithemes.com and amzonaws.com include installed iThemes products and their versions.
When Security Check runs, it contacts ithemes.com to determine whether the site supports TLS/SSL requests. No personal data is sent to ithemes.com during this process. Requests include the site URL.
iThemes Security secures our website and protects visitors from attacks and unwanted access. This constitutes a legitimate interest under Article 6(1)(f) GDPR.
Further information about how iThemes Security collects and uses data is available at: https://www.liquidweb.com/about-us/policies/privacy-policy/
Further information:
WordPress privacy policy: https://wordpress.org/about/privacy/
Amazon Web Services privacy information: https://aws.amazon.com/de/compliance/data-privacy-faq/
Contacting us
When you contact us, we use your details to handle and respond to your enquiry in connection with fulfilling pre-contractual rights and obligations. Processing your data is necessary to handle and answer the enquiry; otherwise, we may be unable to respond or only able to respond to a limited extent. Your details may be stored in a customer and prospect database on the basis of our legitimate interest in direct marketing.
We delete your enquiry and contact details once the enquiry has been fully answered, provided no statutory retention periods prevent deletion, for example in connection with a subsequent contract. This is usually the case when we have had no contact with you for three consecutive years.
Matomo
We use Matomo (www.matomo.org), provided by InnoCraft Ltd., 7 Waterloo Quay PO625, 6140 Wellington, New Zealand (“Matomo”), for statistical analysis of usage behaviour and for optimisation and marketing purposes. Matomo is open-source software.
Data collected through Matomo is stored on our own servers and is not shared with third parties. Our cookie table explains whether cookies are used.
Audience measurement involves processing the following data:
Your browser type and version
Your operating system
Your country of origin
Date and time of the server request
Number of visits
Time spent on the website
External links you click
The IP address is anonymised before storage. Pseudonymised usage profiles may be created and evaluated from the data collected through this service.
Information generated in a pseudonymous user profile is not used to identify website visitors personally or combined with personal data relating to the person behind the pseudonym.
Processing is based on your consent under Article 6(1)(a) GDPR. You may withdraw this consent at any time with effect for the future.
Further information about Matomo’s privacy practices:
https://matomo.org/matomo-cloud-privacy-policy/ and
https://matomo.org/privacy-policy/ or https://matomo.org/gdpr-analytics
(in English).
Server log files
For technical reasons, particularly to ensure a functional and secure website, we process technically necessary access data in server log files, which your browser automatically transmits to us.
The access data we process includes:
Name of the website accessed
Browser type and version
Visitors’ operating system
Previously visited page (referrer URL)
Time of the server request
Volume of data transferred
Hostname of the accessing computer (IP address used)
This data is not assigned to natural persons and is used solely for statistical evaluation, operation and improvement of our website, and the security and optimisation of our online services. It is transmitted only to our website hosting provider and is not linked or combined with other data sources. If we suspect unlawful use of our website, we reserve the right to review this data subsequently. Processing is based on our legitimate interest in displaying our website correctly and optimising it.
Access data is deleted shortly after its purpose has been fulfilled, usually after a few days, unless further retention is necessary as evidence. In that case, it is retained until the incident has been conclusively resolved.
SSL encryption
For visits to our website, we use the widely adopted SSL (Secure Socket Layer) method with the highest level of encryption supported by your browser. You can recognise an encrypted page by the closed key or padlock symbol in your browser’s status bar. This is based on our legitimate interest in using appropriate encryption technologies.
We also use appropriate technical and organisational security measures to protect your data against accidental or deliberate manipulation, partial or complete loss, destruction and unauthorised third-party access. We continually improve these measures in line with technological developments and keep them up to date.
Cookie settings and consent records
We use a CookieConsent solution hosted on our server to manage your cookie choices. Optional statistics, marketing and external services remain disabled until you consent. You can change or withdraw your choice at any time through “Cookie settings”. Withdrawal reloads the page to stop optional services that have already loaded.
We record choices, changes and withdrawals on our server. Records include a randomly generated consent ID, an event ID, the time of the browser selection and server receipt, the selected categories, language, country version accessed and the associated archived text version. These records do not contain names, email addresses, full page URLs, IP addresses or browser fingerprints. Technical server access logs are separate. To limit abusive requests, we temporarily use a hashed IP-related key that changes hourly.
The legal basis for documenting consent is Article 6(1)(c) in conjunction with Article 7(1) GDPR. We rely on Article 6(1)(f) GDPR for managing refusals and withdrawals and securing the record endpoint. Our legitimate interest is to respect your choices reliably and prevent misuse. Necessary storage and access to your choice in the browser serves to provide your selected privacy settings.
Records are retained for 365 days from receipt on our server. Deleted events may remain in daily archive copies of this record system for up to 30 additional days. Associated text versions are archived separately from visitor events. Hosting provider backup retention periods may differ; you can request details using the contact information above.
The “tamburi_consent” cookie stores your choice for up to 182 days. A confirmed receipt is retained locally in local storage under “tamburi_consent_receipts_v1” for up to 182 days. Events not yet successfully transmitted are retained there for retrying transmission for a maximum of seven days. Expired local entries are removed on the next page visit. When consent recording is enabled, optional services start only after our server confirms the record. Withdrawal stops optional services even if transmission of the withdrawal is still pending.
If consent wording or processing purposes change materially, we ask you to make your choice again. Previous consents are not retrospectively assigned to a new text version.
General information about data protection
The following provisions apply in principle not only to data collected on our website but also to our other processing of personal data.
Personal data
Personal data is information that can be attributed to you individually, such as your address, name, postal address, email address or telephone number. Information such as the number of users visiting a website is not personal data because it cannot be attributed to an individual.
Legal bases for processing personal data
Unless more specific information is provided in this privacy policy, for example for individual technologies, we may process your personal data on the following legal bases:
Consent under Article 6(1)(a) GDPR: the data subject has consented to processing their personal data for one or more specific purposes.
Performance of a contract and pre-contractual steps under Article 6(1)(b) GDPR: processing is necessary to perform a contract to which the data subject is a party or to take pre-contractual steps.
Legal obligation under Article 6(1)(c) GDPR: processing is necessary to comply with a legal obligation.
Protection of vital interests under Article 6(1)(d) GDPR: processing is necessary to protect the vital interests of the data subject or another natural person.
Legitimate interests under Article 6(1)(f) GDPR: processing is necessary for the legitimate interests of the controller or a third party, unless the data subject’s interests or fundamental rights and freedoms override them.
Please note that national data protection rules in your country or ours may apply in addition to the GDPR.
Transfer of personal data
We do not transfer your personal data to third parties for purposes other than those set out in this privacy policy.
We share your personal data with third parties only if:
You have given express consent under Article 6(1)(a) GDPR;
Sharing is necessary under Article 6(1)(f) GDPR to protect legitimate interests and establish, exercise or defend legal claims, and there is no reason to believe that you have an overriding protected interest in non-disclosure;
There is a legal obligation to share the data under Article 6(1)(c) GDPR, insofar as legally permitted; and/or
It is necessary under Article 6(1)(b) GDPR to manage contractual relationships with you.
Sharing data with delivery services:
Types of data shared: when you use our services, we share certain personal data, such as your name, address, email address and telephone number, with selected delivery services (currently DPD). This transfer is solely for automatically setting a Tamburi parcel station as the preferred collection point for parcels delivered by that service or, where necessary, creating a user account with that service.
Purpose of sharing: your data is shared solely to simplify and automate delivery processes, particularly to enable delivery of your parcels to Tamburi parcel stations.
Recipients: recipients are delivery services connected to our system through interfaces (currently DPD). They are required to process your data in accordance with applicable data protection laws and use it only for the purpose stated above.
Legal basis: sharing your data with delivery services is based on your consent under Article 6(1)(a) GDPR.
Delivery service liability and terms: once your data has been shared and the delivery services place your parcels in the lockers, their respective terms and privacy policies apply. We recommend reading those documents to familiarise yourself with them.
Right to withdraw: you can withdraw your consent to sharing data with delivery services at any time. This may, however, restrict your use of our services.
Working with processors
We carefully select service providers that process personal data on our behalf. Where we engage third parties under a data processing agreement, we do so in accordance with Article 28 GDPR.
Transfers to third countries
If we process data in a third country, or if this occurs through using third-party services or disclosing or transferring data to other persons or companies, this takes place only on the legal bases described above for sharing data.
Subject to express consent or contractual necessity, we process data, or arrange for it to be processed, in third countries in accordance with Articles 44–49 GDPR only where an adequate level of protection has been recognised or specific safeguards apply. These may include contractual obligations under the European Commission’s standard contractual clauses, certifications or binding corporate rules.
Data transfers to the USA
When the services described in this privacy policy are used, personal data may also be processed in the USA. A server location within the EU does not, by itself, rule out access from third countries or onward transfers.
For transfers to appropriately certified US companies, the European Commission’s adequacy decision for the EU-US Data Privacy Framework under Article 45 GDPR may be relied on insofar as the certification covers the processing concerned. Other transfers require appropriate safeguards, such as standard contractual clauses under Implementing Decision (EU) 2021/914 and, where necessary, supplementary measures, or an applicable exception under Article 49 GDPR. The conditions must be assessed for each recipient and processing operation.
Transfer mechanisms for individual services are described in the relevant sections of this policy. You can request information about applicable safeguards using the contact details above. Consent to statistics or marketing cookies does not automatically replace the safeguards required for a third-country transfer.
General retention periods
Unless an express retention period is stated when data is collected, for example in a consent declaration, Article 5(1)(e) GDPR requires us to delete personal data once its processing purpose no longer applies. Please note that statutory retention obligations provide a legitimate purpose for continuing to process the personal data they cover.
In principle, we retain data in personally identifiable form until the business relationship ends or applicable guarantee, warranty or limitation periods expire. Where necessary, we retain it until legal proceedings in which it is required as evidence have ended, or in any event until the end of the third year following the last contact with a business partner.
Specific retention periods
Descriptions of individual technologies on our website contain specific information about data retention. Our cookie table provides retention periods for individual cookies. You can also ask us directly about specific data retention periods using the contact details in this policy.
Data subject rights
Data subjects have the right:
(i) Under Article 15 GDPR, to request access to personal data we process about them;
(ii) Under Article 16 GDPR, to request prompt rectification of inaccurate data or completion of personal data we hold;
(iii) Under Article 17 GDPR, in certain circumstances, to request erasure of personal data we hold;
(iv) Under Article 18 GDPR, to request the (temporary) restriction of processing;
(v) Under Article 20 GDPR, to receive their personal data in a structured, commonly used and machine-readable format;
(vi) Under Article 21 GDPR, to object where personal data is processed on the basis of our legitimate interests;
(vii) Under Article 7(3) GDPR, to withdraw consent at any time;
(viii) Under Article 77 GDPR, to complain to a supervisory authority about unlawful processing of their data.
The competent supervisory authority for Tamburi Holding GmbH is:
Austrian Data Protection Authority
Barichgasse 40-42, 1030 Vienna, Austria
Tel.: +43 1 52 152-0, dsb@dsb.gv.at
Exercising data subject rights
You decide how your personal data is used. To exercise any of the rights listed above, contact us by email at info@tamburi.com, by post or by telephone.
Please help us clarify your request by answering questions from our responsible staff about the specific processing of your personal data. If there are reasonable doubts about your identity, we may request a copy of an identity document.
For questions about data protection, contact info@tamburi.com or use the other contact details in this privacy policy.
Vienna, 1 November 2026