Privacy Policy of VR Coach GmbH

1. Controller

The party responsible for the processing of personal data on this website within the meaning of the GDPR is:

VR Coach GmbH, Weng 242, 5453 Werfenweng, Austria info@vr-coach.at · tel. 0043-650-3505980

Personal data means all information relating to you as a person. This policy informs you which data we process, for what purposes and on what legal basis.

2. Security of transmission

Our website is secured with SSL/TLS encryption. You can recognise an active encryption by “https://” and the padlock symbol in your browser.

3. When visiting the website

Access data. If you use our website only for information purposes — i.e. without submitting data to us — we process the technically necessary access data that your browser automatically transmits: pages accessed, date and time, volume of data transferred, referrer, browser and system type, and the IP address. The purpose is the secure and stable operation of the website; the legal basis is our legitimate interest (Art. 6(1)(f) GDPR).

Hosting. Our website is hosted by Raidboxes GmbH on our behalf (processing on behalf under Art. 28 GDPR). The access data is generated on their servers.

Cookies and consent. We set technically necessary cookies on the basis of our legitimate interest (Art. 6(1)(f) GDPR). We only set cookies for statistics or marketing if you have consented via our cookie banner (Art. 6(1)(a) GDPR). You can change your choice at any time via the cookie settings. You can also generally restrict or delete cookies via your browser; the functionality of the website may be limited as a result.

4. When you contact us

If you contact us via a form (e.g. contact, showroom appointment, catalogue order) or by e-mail, we process the data you provide in order to handle your request. The legal basis is our legitimate interest in responding (Art. 6(1)(f) GDPR); if your request is aimed at concluding a contract, additionally Art. 6(1)(b) GDPR. We delete this data as soon as your request has been dealt with and no retention obligations prevent this.

5. Customer account and contract processing

For the use of certain services, you can set up a password-protected customer account. We process the data provided in this context and in the course of contract processing in order to perform the contract (Art. 6(1)(b) GDPR); the data required is apparent from the respective form. You can have your account deleted at any time by notifying us. After the contract has been processed or the account deleted, the data is stored in compliance with tax and commercial-law retention periods and then deleted.

6. Newsletter and mailing list

For the newsletter we use the double opt-in procedure: after registering, you receive a confirmation e-mail and are only added to the distribution list after your confirmation. We store your e-mail address as well as the time and IP address of registration and deregistration in order to be able to prove your consent. The legal basis is your consent (Art. 6(1)(a) GDPR), which you can withdraw at any time via the unsubscribe link or a message to us.

For sending, we use Newsletter2Go as a processor (Newsletter2Go GmbH, Köpenicker Str. 126, 10179 Berlin; “Brevo” platform). A data processing agreement under Art. 28 GDPR exists with the provider.

7. Audience measurement with Google Analytics

We use Google Analytics, a service of Google Ireland Limited, to statistically evaluate the use of our website and to improve our offering. Usage data is processed (including pages accessed, time of access, approximate location, device and browser information); this may involve a transfer to Google, including to the USA.

Google Analytics is loaded exclusively after your consent via our cookie banner (Art. 6(1)(a) GDPR). You can withdraw your consent at any time with effect for the future.

8. Use of our VR application on Meta VR headsets

8.1 Our therapy software runs on VR headsets from the manufacturer Meta. In order to operate such a headset at all, users need a Meta account and a Meta Horizon account. This account and usage relationship exists directly between the user and Meta Platforms Ireland Limited (4 Grand Canal Square, Dublin 2, Ireland); to that extent, Meta is responsible for the data processing. Further information can be found in Meta’s privacy policy.

8.2 In order for you to use our application, we send an invitation link to your Meta Horizon account. For this, we process the e-mail address linked to this account or your Horizon username, on the basis of contract performance (Art. 6(1)(b) GDPR).

8.3 When you use the application, we process exclusively application-related usage data.

8.4 We do not receive any information whatsoever about patients through the application; health-related data of treated persons is not processed by us in any form. Please note that Meta additionally carries out its own processing, over which we have no influence.

9. Recipients and processors

We only pass on data insofar as this is necessary and legally permissible, in particular to:

our hosting provider (see Section 3),
our newsletter provider (see Section 6),
a transport company, insofar as this is necessary for the delivery of ordered hardware (Art. 6(1)(b) GDPR),
Google in the context of audience measurement (Section 7, only after consent),
authorities, insofar as we are legally obliged to do so.

Contracts under Art. 28 GDPR exist with processors.

10. Storage period

We store personal data only for as long as is necessary for the respective purpose or as long as statutory retention periods exist. Data based on consent is stored until that consent is withdrawn; contract data until the expiry of the tax and commercial-law periods.

11. Your rights

You have the right to access (Art. 15), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18) and data portability (Art. 20), as well as the right to object to processing based on a legitimate interest (Art. 21 GDPR). You can object at any time to the processing of your data for direct marketing purposes. You can withdraw any consent given at any time with effect for the future (Art. 7(3) GDPR), without affecting the lawfulness of the processing carried out up to that point. A message to info@vr-coach.at is sufficient to exercise your rights.

12. Right to lodge a complaint

You have the right to lodge a complaint with a data protection supervisory authority. In Austria, the competent authority is the Austrian Data Protection Authority (Österreichische Datenschutzbehörde, www.dsb.gv.at).