Contact us

Exotrade

Privacy Policy

Last updated: October 2026

We take the protection of your personal data seriously. We process personal data in accordance with the applicable data protection laws, in particular the General Data Protection Regulation (EU) 2016/679 (“GDPR”) and applicable Austrian data protection and telecommunications legislation.

This Privacy Policy explains how we process personal data when you visit our website or contact us through our website, including through our enquiry form.

  1. Controller

The controller responsible for the processing of your personal data is:

Exotrade GmbH
An der Zwerchwiese 6
1190 Vienna
Austria

Phone: +43 676 33 11 458
Email: office@exotrade.at
Website: www.exotrade.at

Managing Director: Philip Waitz, M.A.

  1. Personal Data We Process

Depending on how you use our website and whether you contact us, we may process the following categories of personal data:

  • name;
  • company name;
  • business address;
  • VAT identification number;
  • telephone number;
  • email address;
  • the content of your enquiry or other message; and
  • technical information required for the secure operation of our website, such as IP address, date and time of access and technical connection information, where such information is processed by our hosting provider.

We only process personal data that is necessary for the relevant purpose.

  1. Enquiries and Contact Form

If you contact us through our enquiry form, we process the information you provide in order to receive, process and respond to your enquiry.

The enquiry form may request the following information:

  • Name
  • Company name
  • Address
  • VAT number
  • Phone number
  • Email
  • Message

The provision of information is voluntary unless a field is expressly marked as mandatory. Information that is necessary for us to respond to your enquiry, such as your name, company name, email address and the content of your enquiry, may be required in order for us to process your request.

Purposes of processing

We process the information submitted through the enquiry form in particular for:

  • responding to your enquiry;
  • communicating with you regarding your enquiry;
  • answering follow-up questions;
  • providing information about our products and services;
  • preparing or discussing a potential business relationship; and
  • taking steps at your request prior to entering into a contract.

Legal basis

Where processing is necessary to respond to your enquiry or to take steps at your request prior to entering into a contract, the legal basis is Article 6(1)(b) GDPR.

Where processing is necessary for our legitimate business interests and is not covered by Article 6(1)(b) GDPR, the legal basis may be Article 6(1)(f) GDPR. Our legitimate interests include responding to business enquiries, communicating with existing or potential business partners and maintaining and managing business relationships.

Where we are legally required to retain or process certain information, the legal basis is Article 6(1)(c) GDPR.

We do not require your consent as the legal basis for processing that is objectively necessary to respond to a business enquiry or to take pre-contractual steps.

If we request your consent for a separate processing purpose, such as certain forms of electronic marketing, the relevant processing will be based on Article 6(1)(a) GDPR. Such consent may be withdrawn at any time. Withdrawal of consent does not affect the lawfulness of processing carried out before the withdrawal.

  1. Communication by Email or Telephone

If you contact us by email, telephone or by other means, we process the information you provide to us to respond to your request and to manage the resulting business communication.

The legal basis is generally Article 6(1)(b) GDPR where the communication concerns the initiation or performance of a contractual relationship, or Article 6(1)(f) GDPR where processing is necessary for our legitimate interests in handling business communications and enquiries.

  1. Website Hosting and Server Logs

Our website is hosted by:

IONOS SE
Elgendorfer Str. 57
56410 Montabaur
Germany

In connection with hosting and the technical operation and security of our website, IONOS may process personal data on our behalf, including technical information such as IP addresses, timestamps, browser or device information and server log data.

The processing of such data is necessary to ensure the secure and reliable operation of the website and to protect our IT systems against misuse, attacks and other security incidents.

The legal basis is Article 6(1)(f) GDPR, based on our legitimate interest in operating, maintaining and securing our website and IT infrastructure.

Where IONOS processes personal data on our behalf as a processor, the processing is governed by an appropriate data processing agreement pursuant to Article 28 GDPR.

  1. Recipients and Disclosure of Personal Data

We may disclose or make personal data available to service providers who support us in operating our business and website.

This may include, where applicable:

  • website hosting and IT service providers;
  • email and communication service providers;
  • technical maintenance and security providers; and
  • other processors who provide services to us on the basis of a data processing agreement where required by law.

We only disclose personal data where this is necessary for the relevant purpose, where we are legally required to do so, or where disclosure is otherwise permitted by applicable data protection law.

We do not sell your personal data to third parties.

  1. International Data Transfers

Where personal data is transferred to recipients outside the European Economic Area (EEA), we ensure that the requirements of Chapter V GDPR are complied with.

Depending on the circumstances, transfers may be based on an adequacy decision of the European Commission, appropriate safeguards such as EU Standard Contractual Clauses, or another legally permitted transfer mechanism.

  1. Cookies and Similar Technologies

Our website may use cookies and similar technologies.

Cookies are small text files or similar technical information that may be stored on or accessed from your device when you visit a website.

We distinguish between:

  • technically necessary cookies, which are required for the operation, security or functionality of the website; and
  • non-essential cookies or similar technologies, such as analytics or marketing technologies, where applicable.

Technically necessary cookies may be used without prior consent where they are strictly necessary to provide a service expressly requested by the user.

Where the use of cookies or similar technologies requires consent under applicable law, we obtain consent before using them.

You may manage or withdraw cookie consent through the cookie settings provided on our website, where such a consent mechanism is used.

You can also configure your browser to block or delete cookies. Please note that blocking technically necessary cookies may affect the functionality of the website.

Under Austrian law, the storage of or access to information on a user’s device is subject to the requirements of Section 165(3) of the Austrian Telecommunications Act 2021 (TKG 2021) where applicable.

  1. Web Analytics and Tracking

We do not intentionally use web analytics or advertising tracking tools such as Google Analytics for the purpose of analysing individual user behaviour or creating advertising profiles.

We do not intentionally carry out profiling of website visitors for advertising purposes.

If analytics, advertising or other tracking technologies are introduced in the future, the relevant information and, where legally required, the applicable consent mechanism will be updated accordingly.

  1. Data Retention

We retain personal data only for as long as necessary to fulfil the purposes for which it was collected.

Personal data submitted through an enquiry form will generally be retained for as long as reasonably necessary to process and follow up on the enquiry.

If an enquiry results in a business relationship or contract, the relevant personal data may be retained for the duration of the business relationship and thereafter for as long as necessary to comply with statutory retention obligations or to establish, exercise or defend legal claims.

Where statutory retention periods apply, the relevant data will be retained for the legally prescribed period.

After the applicable purpose and retention periods have expired, personal data will be deleted or anonymised unless there is another lawful basis for continued retention.

  1. Data Security

We implement appropriate technical and organisational measures designed to protect personal data against accidental or unlawful destruction, loss, alteration, unauthorised disclosure or unauthorised access.

However, no method of transmission over the internet or electronic storage can be guaranteed to be completely secure.

  1. Your Rights

Subject to the applicable legal requirements, you have the following rights under the GDPR:

Right of access

You have the right to obtain confirmation as to whether we process personal data concerning you and, where applicable, to obtain access to that personal data and further information pursuant to Article 15 GDPR.

Right to rectification

You have the right to request the correction of inaccurate personal data and the completion of incomplete personal data pursuant to Article 16 GDPR.

Right to erasure

You have the right to request the deletion of your personal data under the conditions set out in Article 17 GDPR.

Right to restriction of processing

You have the right to request restriction of processing under the conditions set out in Article 18 GDPR.

Right to data portability

Where the applicable legal requirements are met, you have the right to receive personal data concerning you in a structured, commonly used and machine-readable format and to transmit that data to another controller pursuant to Article 20 GDPR.

Right to object

Where processing is based on Article 6(1)(e) or Article 6(1)(f) GDPR, you have the right to object to such processing on grounds relating to your particular situation, subject to the conditions set out in Article 21 GDPR.

You may object to direct marketing at any time where applicable.

Right to withdraw consent

Where processing is based on your consent, you have the right to withdraw that consent at any time.

The withdrawal of consent does not affect the lawfulness of processing carried out before the withdrawal.

Right regarding automated decision-making

You have the right, subject to the conditions of Article 22 GDPR, not to be subject to a decision based solely on automated processing, including profiling, which produces legal effects concerning you or similarly significantly affects you.

We do not currently use solely automated decision-making that produces such effects through this website.

  1. Exercising Your Rights

To exercise any of your rights or to ask questions about the processing of your personal data, please contact us:

Exotrade GmbH
An der Zwerchwiese 6
1190 Vienna
Austria

Email: office@exotrade.at
Phone: +43 676 33 11 458

We will generally respond to requests concerning your data protection rights within one month of receiving the request. Where permitted by Article 12 GDPR, this period may be extended by a further two months, taking into account the complexity and number of requests.

Where we have reasonable doubts concerning the identity of the person making a request, we may request additional information necessary to confirm the identity of the requesting person.

  1. Right to Lodge a Complaint

If you believe that the processing of your personal data violates applicable data protection law, you have the right to lodge a complaint with a competent supervisory authority.

In Austria, the competent supervisory authority is:

Austrian Data Protection Authority (Österreichische Datenschutzbehörde)
Barichgasse 40–42
1030 Vienna
Austria

Phone: +43 1 52 152-0
Email: dsb@dsb.gv.at
Website: www.dsb.gv.at

You may also lodge a complaint with another supervisory authority where permitted under the GDPR.

  1. Personal Data Obtained from Third Parties

Where we receive personal data about you from a person or organisation other than yourself, we will process that data in accordance with the applicable provisions of the GDPR.

Where Article 14 GDPR applies, we will provide the information required by law, subject to the exceptions provided for in Article 14 GDPR.

  1. Changes to this Privacy Policy

We may update this Privacy Policy from time to time to reflect changes to our website, services, data processing activities or applicable legal requirements.

The current version published on this website applies.

Last updated: October 2026

 

← Back to homepage