Privacy policy for partner notaries

Version 1.0 (January 2022)

1. General

We take the protection of your data very seriously and treat your personal data and that of your clients confidentially and in accordance with the legal requirements (and beyond). This privacy statement informs you about the nature, scope and purpose of the processing of personal data (hereinafter referred to as “data”) on our platform (available at https://app.notarity.com and hereinafter referred to as “webapp” or “platform”). Furthermore, this privacy policy informs you about the general conditions under which your data (or those of your clients) are passed on to processors. With regard to the terms used, such as “personal data” or their “processing”, we refer to the definitions in Art. 4 of the General Data Protection Regulation (GDPR). Transparency is important to us, which is why we are informing you with this data protection declaration beyond the minimum legal requirements.

It is our goal, in cooperation with our service providers and partners, to protect all data processing procedures as well as possible and in accordance with the current state of technology against unauthorised access, loss, misuse or unauthorised changes.

With regard to the type, scope and purpose of data processing on our landing page (available at https://notarity.com), we refer to the data protection declaration available there (https://notarity.com/datenschutz/privacy).

We ask you to regularly inform yourself about the content of our data protection declaration. We adapt the data protection declaration if changes to the data processing carried out by us make this necessary. We will inform you as soon as the changes require an act of cooperation on your part (e.g. consent) or other individual notification.

2. Security measures

We shall take appropriate technical and organisational measures to ensure a level of protection appropriate to the risk in accordance with Article 32 of the GDPR, taking into account the state of the art, the costs of implementation and the nature, scope, context and purposes of the processing, as well as the varying likelihood and severity of the risk to the rights and freedoms of natural persons.

The measures include, in particular, ensuring the confidentiality, integrity and availability of data by controlling physical access to the data, as well as the access, input, transfer, security, availability and separation of the data. Furthermore, we have established procedures to ensure the exercise of data subjects’ rights, e.g. to delete data and to respond to any compromise of data. Furthermore, we already take the protection of personal data into account in the development and selection of hardware, software and procedures, in accordance with the principle of data protection through technology design and through data protection-friendly default settings (Art. 25 of the GDPR).

The security measures include, in particular, the encrypted transmission of data between your browser and our server (see also point 6).

3. Responsible body (within the meaning of Art. 4 No. 7 DSGVO)

notarity GmbH, represented by the managing directors Alexander Gugler (also data protection officer), Max Pointinger, Jakobus Schuster, Sebastian Wodniansky-Wildenfeld, Währinger Straße 48/2. Hof, AT-1090 Vienna, is responsible for compliance with the data protection of our webapp.

notarity GmbH is an Austrian technology company based in Vienna. We operate a platform for the digital establishment of notarial documents (“Remote Online Notarisations”) for the Austrian and European market.

We will be happy to answer any questions you may have regarding data protection. You can use the following contact options:

• Phone: +43 (0) 676 58 23 602
• E-mail: [email protected]

When contacting us via e-mail, the data you provide will be stored by us in order to be able to process your enquiry. The data accruing in this context will be deleted by us if the storage is no longer necessary. We store your enquiry and the correspondence relating to it for thirteen months after the end of the processing and any follow-up questions so that we can present them in the event of any proceedings before the data protection authority.

4. Legal bases of data processing

We use your data on the basis of various legal bases, depending on

• the services you use (contract or pre-contractual measures Art. 6 para. 1 lit. b DSGVO);
• Following a legal obligation (Art. 6 para. 1 lit. c DSGVO)
• your consent that you have given us (consent Art. 6 para. 1 lit. a DSGVO); or
• for a legitimate interest, e.g. to ensure the security of the webapp, to send you information on the use of our platform or on products insofar as they are similar to those you have already purchased from us or requested from us and you have not deactivated such communications (Art. 6 para. 1 lit. f DSGVO).

5. Purpose of the data processing

The purposes for which we process your data may include:

• To provide you with our service on our platform and to maintain it. The purpose is therefore the execution of the contract and the fulfilment of our contractual and pre-contractual obligations (Article 6 para. 1 b) DSGVO);
• To notify you of any changes to our service;
• Provide customer services;
• to improve our service;
• monitor the use of our service;
• identify, prevent and correct technical problems; provide you with news and general information about other products, services and events offered by us where they are similar to those you have already purchased from or requested from us and you have not opted out of such communications.

6. Encryption of our platform (app.notarity.com)

For security reasons and to protect the transmission of confidential content, such as enquiries you send to us, we use SSL/TLS encryption on our website. You can recognise an encrypted connection by the fact that the address line of the browser changes from “http://” to “https://” and, depending on the browser, by the lock symbol in your browser line.

If SSL or TLS encryption is activated, data and information that you transmit to us cannot be read by third parties.

We would like to point out that data transmission on the Internet (e.g. when communicating by e-mail) can have security gaps. Complete protection of data against access by third parties without the use of e-mail encryption, such as PGP or S/MIME, is not possible and is at your own risk.

7. Your rights

In accordance with the provisions of the GDPR (Data Protection Regulation), you have the following rights vis-à-vis us:

• Right to information

You have the right to be informed about what data we hold about you and how we process that data.

• Right of rectification

If you find that stored data is incorrect, you can ask us to correct it at any time.

• Right to erasure (“right to be forgotten”)

You can ask us to delete the data we hold about you at any time.

• Right to restrict processing

If you do not wish to delete your data but do not want us to process it further, you can ask us to restrict the processing of your personal data. In this case, we will archive your data and integrate it into our operational systems only if you wish us to do so. However, you will not be able to use our services during this time, otherwise we will process your data again.

• Right to data portability

You can request us to transmit the data stored about you in machine-readable form to you or another responsible person. In this context, we will provide you with the data in JSON format.

• Right to complain to the supervisory authority.

If you think that we have done something wrong with your data or in connection with your rights, you can always contact the competent supervisory authority.

The competent authority for us is:

Austrian Data Protection Authority Barichgasse 40-42 1030 Vienna Tel. +43 1 52152 2550 E-mail: [email protected]

To exercise your rights, you can also contact [email protected] at any time.

8. Collection of server log files

Our web app can generally be visited before registration and can also be used to a very limited extent. In the process, information such as the pages called up or the name of the file called up, the date and time are stored anonymously on the server for statistical purposes without this data being able to be directly related to your person. We automatically collect and store information in so-called server log files, which your browser automatically transmits to us. These are:

• IP address in anonymised form;
• Date and time of the request Time zone difference from GMT;
• Content of the request (specific page);
• Browser;
• Operating system;
• Access status/http status code;
• Amount of data transferred;
• Website from which the request comes.

This information cannot be assigned to a specific person. This data is not merged with other data sources. We reserve the right to check this data retrospectively if we become aware of concrete indications of illegal use.

9. Use of Matomo

On our platform (as well as on our landing page), we use the web analysis service Matomo to analyse and check the use of our platform. The statistics obtained enable us to improve our offer and make it more interesting for you as a user.

We operate Matomo in a version that does not require cookies. Thus, no Matomo cookies are stored on your computer for the purpose of web analysis. For the analysis of website usage, your IP address and information such as timestamp, web pages visited and your language settings are collected. We process the information collected in this way exclusively on our server. It is not transmitted to third parties.

This website uses Matomo with the extension “AnonymizeIP”. This means that IP addresses are processed in a shortened form and a direct link to a person is excluded. The IP address transmitted by your browser via Matomo is not merged with other data collected by us. The legal basis for the use of Matomo is our overriding interest in better adapting our platform to the needs of our users (Art. 6 para. 1 p. 1 lit. f DSGVO).

The Matomo programme is an open source project. Information from the third-party provider on data protection is available at matomo.org/privacy-policy/.

10. Two-way audio-visual connection (peer-to-peer video chat)

The digital notary appointment takes place by way of a two-way audio-visual connection in which you are connected to the respective end-users in real time.

The video chat is always peer-to-peer. This means that the video chat is only operated on the end devices of the people who participate in the video chat. This allows us to offer the most data protection-friendly solution. In cases where a server is interposed (this can make sense with a larger number of participants to ensure the resilience of the web application), a (turn) server hosted in Germany is used.

During the notary appointment, we provide you with some end user data by displaying it in the web app (evidence data from the video identification procedure, master data, documents, etc.). The specific procedure and the associated data processing of the notary appointment is your responsibility.

11. Cooperation with other processors and third parties

If, in the course of our processing, we disclose data to other persons and companies (processors or third parties), transmit it to them or otherwise grant them access to the data, this will only be done on the basis of a legal permission, if you or the end user have consented, if a legal obligation provides for this (e.g. if a transfer of data to third parties, such as to our signature partner, is required for the fulfilment of a contract pursuant to Art. 6 (1) lit.e.g. if the transfer of data to third parties, such as our signature partner, is necessary for the performance of a contract pursuant to Art. 6 (1) lit. b DSGVO) or on the basis of our overriding legitimate interests (e.g. prevention of fraud, misuse of services or money laundering, enforcement of claims under private law, etc.).

If we commission third parties with the processing of data on the basis of a so-called “order processing agreement”, this is done on the basis of Art. 28 DSGVO. If we conclude an agreement with third parties for the processing of data on the basis of joint responsibility, this is done on the basis of Art. 26 of the GDPR.

If we use external service providers for individual parts of our offer, we will always carefully select and monitor these service providers and inform them in detail about the respective processes.

In the points below (points 13 ff) you will find details of our most important processors and cooperation partners.

Apart from this, there are order processing contracts with the following additional entrepreneurs on the following legal bases:

In the course of our business relationship, it may be necessary for us to transfer your data to the following recipients:

12. Place of data processing

We generally process your data within the European Union (EU) and the European Economic Area (EEA). All our carefully selected partners are based in the EU or EEA and guarantee us to process your data within the EU and EEA.

Only one of our processors (Google Ireland Limited) has a parent company based in the USA. Google Ireland Limited guarantees us that the storage of notarial deeds and documents as well as identification data takes place on servers located in Frankfurt/Main, Germany (europe-west3).

The GDPR sets high requirements for the transfer of personal data to third countries. If your data is transferred to recipients in third countries, we ensure that this is done exclusively under the conditions contained in Chapter V of the GDPR.

13. In particular: Hosting and backend infrastructure (PaaS - Platform as a Service)

Data protection, data security and reliability have the highest priority for us. We therefore use a high-security back-end infrastructure that meets the highest security standards and is continuously maintained and improved by leading IT security experts. This enables us to guarantee the highest possible IT security.

All of the backend services we source are certified to key data protection and security standards (ISO 27001, ISO 27017, ISO 27018, SOC 1, SOC 2 and SOC 3).

All backend services sourced from us encrypt data in transit using HTTPS and logically isolate customer data. In addition, the backend services sourced from us also encrypt your data at rest.

We have ensured through an agreement with the service provider that notarial deeds and documents are stored and processed exclusively on servers located in Frankfurt/Main. Where processing of personal data in third countries is required, we have ensured that this is only carried out in compliance with the conditions set out in Chapter V of the GDPR.

Additional information and a copy of the relevant standard contractual clauses for data processing and transfer can be requested from us by e-mail.