Data protection

1. Controllers

The controllers within the meaning of the EU General Data Protection Regulation (hereinafter referred to as “GDPR”) are:

Oberlaa Süßwarenproduktion GmbH
FN 302836y (HG Vienna)
Seilergasse 15
1010 Vienna, Austria

Oberlaa Konditorei GmbH & Co KG
FN 165465g (HG Vienna)
Seilergasse 15
1010 Vienna, Austria

Contact email:

2. Processing of personal data

The data controllers process personal data provided to them by data subjects in the form of messages submitted using the contact form provided on the website . Such personal data includes their title, first name, surname, company, address, telephone number, email address.

3. Data processing

Processing is carried out for the purpose of establishing personal contact, initiating a contract and conducting the business relationship. The legal basis for this processing is the fulfilment of a contract or the implementation of pre-contractual measures to which the controller is subject and, if applicable, the consent of the data subject.

Subject to the next paragraph, the processing of personal data is not required by law, but is necessary for the purposes mentioned above. If this data is not provided or not provided in full, the data subject cannot be contacted and it may not be possible to initiate or conclude a contract with them.

The personal data of the data subject is passed on to the companies of the Oberlaa Group. In addition, the personal data of the data subject is passed on to external service providers (commissioned data processors) such as IT service providers, as necessary. Furthermore, personal data may be passed on to courts and other authorities as required.

By submitting a separate declaration, the data subject consents to their personal data being processed by the controller for the above purposes described under point 2.

This consent may be revoked at any time, for example by sending an email to If consent is withdrawn, the controller will no longer use this data for the stated purposes. In cases where data has been transferred to third parties, the controller will ensure that those third parties also no longer use the transferred data if consent is withdrawn.

4. Storage period

The personal data is erased once the purpose for which it was collected ceases to exist or on revocation of consent by the data subject, provided that no other legitimate interests of the data controller (e.g. storage of the data for evidence purposes, for example, or for the assertion or defence of legal claims, taking into account the applicable limitation periods) stand in the way of its erasure.

5. Information about the rights of data subjects

Right to information: The data subject has the right to obtain confirmation as to whether or not personal data concerning them is being processed.

Right to rectification: If personal data is processed incorrectly or incompletely, the data subject may request rectification or completion of the data.

Right to erasure: The data subject has the right to demand immediate erasure of the data if one of the following applies:

  • the personal data is no longer required for the purpose for which it was originally collected or otherwise processed;
  • the data subject withdraws their consent and there is no other legal basis for the processing;
  • the data subject lodges an objection and there are no overriding legitimate grounds for the processing, or the objection is made against processing for purposes of direct marketing;
  • the personal data has been processed unlawfully;
  • erasure is necessary to fulfil a legal obligation;
  • the personal data was collected from a child in relation to information society services offered.

As already mentioned above, there may be reasons that prevent immediate erasure, for example if the controller is subject to a statutory retention obligation.

Right to restriction of processing: The data subject has a right to restriction of processing if:

  • the accuracy of the data is contested by the data subject, for a period enabling the controller to verify the accuracy of the data;
  • the processing of the data is unlawful and the data subject refuses to have the data erased and instead requests that use of the data be restricted;
  • the controller no longer needs the data for the intended purpose, but the data subject still needs this data for the assertion or defence of legal claims;
  • the data subject has objected to processing of the data and it has not yet been established whether the legitimate grounds of the controller override those of the data subject.

Right to data portability: The data subject has the right to receive the data provided to the controller in a structured, commonly used and machine-readable format, provided that

  • the processing is based on the consent of the data subject or on a contract and
  • the processing is carried out using automated procedures.

Right to object: If the controller processes the data subject’s data for the performance of tasks carried out in the public interest, for the exercise of official authority or on the basis of an overriding legitimate interest, the data subject may object to this data processing. The controller must cease processing unless it can demonstrate compelling legitimate grounds for the processing which override the interests, rights and freedoms of the data subject, or the processing serves to establish, exercise or defend legal claims. Objection to processing for marketing purposes is possible at any time.

Assertion of rights: The data subject can assert the rights listed above at any time free of charge. The controller can be contacted via the following email address:

Right to lodge a complaint: If the data subject believes that the controller is violating the provisions of the GDPR, they have the right to lodge a complaint with the competent supervisory authority (in Austria, the Data Protection Authority).

6. Profiling

The controller does not use automated decision-making, including profiling.