Molecular Matters GmbH only processes information that users voluntarily provide via web forms or the corresponding dialogs in an application, which are required for the respective functionality.

Data collection

Any data processing that may take place will be carried out in accordance with the General Data Protection Regulation (GDPR) and in accordance with the country-specific data protection provisions applicable to Molecular Matters GmbH as company.

Data controller

The data controller with regard to activation and use of software is Molecular Matters GmbH, i.e.:
Molecular Matters GmbH (owned by Stefan Reinalter, born on 24 March 1982), Brunecker Gasse 15, 2340 Mödling, Austria.

With regard to data protection topics, you may contact Molecular Matters GmbH by email: office@molecular-matters.com.

Data processing

Molecular Matters GmbH does not have a data protection officer.

The data controller processes your personal data and your company's data, both as entered during the software purchase process for the purposes of managing the contract entered between you and Molecular Matters GmbH and thus for fulfilling Molecular Matters GmbH's corresponding contractual obligations (Art 6 para 1 lit b GDPR), respectively for fulfilling Molecular Matters GmbH's legal obligations (Art 6 para 1 lit c GDPR).

With regard to the purposes explained above, the provision of the data is mandatory as per the applicable law or contract, and if the data is not provided, the contract cannot be entered into, respectively the contractual obligations cannot be fulfilled.

Data processors

Molecular Matters GmbH retains the following processors for the following purposes:

• SendOwl (=Concept Den Limited), UK:
  Payment data entered into by you when purchasing the Software for effectuating the payment of the purchase price for the Software.
• SendOwl's Sub-Processor: Stripe Payments Europe Limited, Ireland:
  In providing Stripe Services, Stripe Payments Europe transfers personal data to Stripe, Inc. in the US.
  The Privacy Shield Policy is available here.
• SendOwl's Sub-Processor: PayPal (Europe) S.à r.l. et Cie, S.C.A., Luxembourg:
  Payment data entered into by you when purchasing the Software for effectuating the payment of the purchase price for the Software.

Right to information

Any data subject has the right to request a confirmation of the data controller whether his/her personal data is processed. In case the controller processes his/her personal data, the data subject is entitled to information regarding his/her personal data (copy of the personal data which are processed) as well as to the following information:

• (a) the purposes of the processing;
• (b) the categories of processed personal data;
• (c) the recipients or categories of recipients to which data is or will be disclosed, particularly with a view to recipients in third countries or recipients at international organizations;
• (d) to the extent possible, the envisaged storage-duration of the personal data, or, if this is not possible, the criteria for assessing that duration;
• (e) the existence of the right to have his/her personal data corrected or deleted or the right to restrict the processing by the controller or the right to object against such processing;
• (f) the existence of a right to complain at a supervising authority;
• (g) to the extent the personal data was not obtained from the data subject, all available information regarding the source/origin of the data;
• (h) the (non-)existence of an automated decision making, including profiling.

The controller furnishes one copy of the personal data, which are processed. For all further copies, the controller may request a reasonable fee on the basis of the controller’s administrative costs. In case the data subject lodges his/her request electronically, the information is to be furnished in a common electronic format unless the data subject requests otherwise.

Right to Correction and Deletion

The data subject is entitled to request the controller to correct his/her inaccurate personal data without undue delay. Under consideration of the processing’s purposes, the data subject is entitled to request the completion of his/her incomplete personal data, also by way of a supplementing declaration. Furthermore, the data subject is entitled to request the controller to delete his/her personal data without undue delay, and the controller is obliged to delete personal data without undue delay where one of the following applies:

• (a) the personal data are no longer required for the purposes for which they were collected or otherwise processed;
• (b) the data subject withdraws his/her consent which served as the basis for the processing, and no other legal foundation is available;
• (c) the data subject lodges an objection against the processing (see below);
• (d) the personal data were unlawfully processed;
• (e) the deletion of the personal data is required to fulfil a legal obligation of the controller;
• (f) the personal data were collected with regard to an offer of services of the information society (consent given by a child).

The right to deletion particularly does not apply to the extent the processing is required for fulfilling a legal obligation of the controller or for exercising a task which lies in the public interest or which is exercised in official power vested in the controller, and/or for the establishment, exercise or defence of legal claims.

Right to restrict the processing

The data subject is entitled to request the controller to restrict the processing where one of the following applies:

• (a) the accuracy of the personal data is contested by the data subject. For a period enabling the controller to verify the accuracy of the personal data;
• (b) the processing is unlawful and the data subject opposes the erasure of the personal data and requests the restriction of their use instead;
• (c) the controller no longer needs the personal data for the purposes of the processing, but they are required by the data subject for the establishment, exercise or defence of legal claims;
• (d) the data subject has objected to the processing pending the verification whether the legitimate grounds of the controller override those of the data subject.

Where the processing has been restricted, such personal data may, with the exception of storage, only be processed with the data subject’s consent or for the establishment, exercise or defence of legal claims, or for the protection of the rights of another natural or legal person or for reasons of important public interests of the Union or of a Member State. A data subject who has obtained restriction of processing shall be informed by the controller before the restriction of processing is lifted.

Right to data portability

To the extent the processing is based on consent or on a contract, and the processing is carried out by automated means, the data subject is entitled to receive his/her personal data, which he/she has provided to the controller, in a structured, commonly used and machine-readable format and when exercising his/her right to data portability, the data subject is entitled to have personal data transmitted from one controller to another, where technically feasible.

Right to object

The data subject is entitled to object, on grounds relating to his/her particular situation, at any time to processing of his/her personal data, which is required for the performance of a task carried out in the public interest or in exercise of official authority vested in the controller, or which is required for the purposes of the legitimate interests pursued by the controller or by a third party. The controller shall then no longer process the personal data unless the controller demonstrates compelling legitimate grounds for the processing, which override the interests, rights and freedoms of the data subject or for the establishment, exercise or defence of legal claims. Where personal data are processed for direct marketing purposes, the data subject is entitled to object at any time to the processing of his/her personal data for such marketing, which includes profiling to the extent that it is related to such marketing. Where the data subject objects to the processing for direct marketing purposes, the personal data shall no longer be processed for such purposes.

Right to lodge a complaint with a supervisory authority

Without prejudice to any other administrative or judicial remedy, every data subject in entitled to lodge a complaint a supervisory authority, in particular in the Member State of his/her habitual residence, place of work or place of the alleged infringement if the data subject considers that the processing of his/her personal data infringes these legal requirements.
The competent Austrian Data Protection Authority can be found here.