Privacy information
It is important for us to protect your personal data.
We comply with the applicable legal regulations for the protection, lawful handling and secrecy of personal data as well as data security, in particular the Data Protection Act as amended ("DSG"), the Telecommunications Act ("TKG") and the General Regulation on Data Protection ("GDPR"). The following information describes how we are handling your data.
as of: October 2024
1. Name and address of the data controller
Responsible for the processing of your personal data in accordance with the data protection provisions in connection with the SAMMLUNG VERBUND is
VERBUND AG
Am Hof 6a
1010 Wien
(„VERBUND“, „we“, „us“).
Contact details of the data protection officer:
E-Mail: datenschutz@verbund.com
2. Processing in the context of the ‘website‘
2.1. What kind of personal data will we process?
During your visit to our website (sammlung.verbund.com) we will automatically collect the following personal data:
- Date and time of access to a page of our website
- Data about your device (device ID)
- IP address
- Name and version of your internet browser
- Session ID
We are not using cookies on our website.
2.2. What is our legal basis and purpose for processing personal data?
Where the data of your visit to our website are concerned, we justify the processing on the basis of our legitimate interest in accordance with Art. 6(1)(f) GDPR and § 165(3) TKG, which consists of giving our website a user-friendly design and protecting it against attacks.
We process your data relating to the visit to our website and online services for the following purposes:
- to make our website and online services, including their functions, available to you, and to improve and develop this website further;
- to create usage statistics;
- to detect, prevent and investigate attacks on our website and online services.
2.3. Retention period
We will generally store your data relating to the visit to our website for a period of three months. A longer retention period will apply only to the extent this is required to investigate identified attacks on our website and beyond that only until the end of the relevant limitation periods, statutory retention periods or any legal disputes.
2.4. Data recipients
In order to operate and administer the website, we regularly use IT service providers which, in accordance with our order and instructions, may under certain circumstances also have access to personal data in order to be able to render the commissioned IT services.
We will also transmit your personal data to the following recipients:
- to external third parties to the extent required by our legitimate interest (e.g. auditors, insurance companies in the event of an insured event, legal representatives as the occasion requires);
- to authorities and other public bodies to the extent required by law (e.g. financial authorities, courts).
Your data will not be passed to any other third parties for their own purposes without your consent.
3. Processing in the context of ‘Making contact / inquiries‘
3.1. What kind of personal data will we process?
If you contact us by e-mail or telephone, we will process the personal data you provide (e-mail, name, telephone number and the content of your inquiry or the associated documents) for the purpose of processing your inquiry and will reply to you accordingly.
The provision of these data by you is voluntary. If you do not provide these data for the handling of your inquiry, we will not be able to process your inquiry accordingly.
3.2. What is our legal basis and purpose for processing personal data?
The legal basis for the processing of your personal data is our legitimate interest in accordance with Art. 6(1)(f) GDPR which consists of processing and handling your inquiry. If the enquiry is aimed at the conclusion of a contract, the legal basis for the processing is Art 6 para 1 lit b GDPR.
3.3. Retention period
We process your data in order to handle your enquiry and beyond that for a period of three months, so that we can respond appropriately to subsequent questions. A longer retention period will be applied only on the basis of statutory retention periods or for defence purposes in any legal disputes.
3.4. Data recipients
We regularly use service providers (e.g. IT service providers) who may also have access to personal data on our behalf and in accordance with our instructions in order to provide the commissioned services.
We may also transfer your personal data to the following recipients:
- on the basis of our legitimate interests to VERBUND Group companies as well as to external third parties such as legal representatives, insurance companies or auditors in the event of an incident;
- to authorities and other public bodies to the extent required by law (e.g. tax authorities, courts).
Your data will not be passed on to any other third parties for their own purposes without your consent.
4. Processing in the context of ‘Registration for events’
4.1. Scope of the processing of personal data
When you register for SAMMLUNG VERBUND events, personal details such as gender, title, name, address, contact details such as telephone number and/or e-mail address, possibly details of your company and your position and other event-related details are processed.
The provision of data by you is voluntary; however, if you do not provide the data marked as mandatory, we will not be able to process your registration.
4.2. Legal basis and purpose of data processing
Legal basis for the processing of data is Art. 6 para. 1 lit. b GDPR and thus the fulfilment of a contract.
Personal data provided during registration will be processed for the purpose of managing the event, including the associated communication (e.g. sending confirmation of registration, seat reservation, answering questions, etc.).
4.3. Duration of storage
Your data will be stored for as long as is necessary for the fulfilment of the purpose, beyond that only as long as it must be processed within the framework of statutory retention obligations.
4.4. Recipients of data
The data will only be passed on to third parties if this is necessary to fulfil (pre-)contractual or legal obligations, is justified to protect our legitimate interests or is permitted within the scope of a given consent.
The data may be transferred to contracted service providers for order processing (responsible for the organisation and implementation of the event) or companies in accordance with the consent given. Our processors include, in particular, IT service providers and other providers of tools and software solutions that also support us in the provision of our services and act on our behalf (e.g. service providers for the purpose of event management).
5. Processing in the context of ’Image recordings (photos/videos)’
5.1. Scope of the processing of personal data
If photographs are taken at events organised by SAMMLUNG VERBUND, these will be stored and used.
5.2. Legal basis and purpose of data processing
The legal basis is Article 6(1)(f) GDPR and thus the legitimate interest of VERBUND.
Images are processed for the purpose of documenting and presenting VERBUND events, activities and happenings and stored in the VERBUND archive. Furthermore, the images are processed for internal purposes and for VERBUND's public relations and press work and published in printed and electronic media, in particular on VERBUND's social media platforms (e.g. Facebook, Instagram, LinkedIn, YouTube). If we cannot base the use of images on legitimate interests, we will obtain separate consent from you for processing in accordance with Art 6 para 1 lit a GDPR. You can revoke your voluntarily given consent at any time with effect for the future, e.g. by e-mail to datenschutz@verbund.com.
5.3. Duration of storage
The image recordings are stored for as long as the documentation purpose is given and there is no objection to this processing. In addition, we store your data for as long as we are obliged to do so in accordance with statutory retention obligations. If the processing is based on your voluntary consent, we will store the data until you withdraw your consent.
5.4. Recipients of data
The image recordings will only be passed on to third parties if this is necessary to fulfil (pre)contractual or legal obligations, is justified to protect our legitimate interests or is permitted within the scope of a given consent.
The image recordings may be transmitted to contracted service providers for order processing. Image recordings may also be passed on to cooperation partners who participated in the event or in whose premises the event was held, for publication on their social media channels for the purpose of public relations and press work.
8. Processing in the context of ‘Initiation and conclusion of contracts’
8.1. Scope of the processing of personal data
We process personal data of persons or companies with whom VERBUND enters into contractual and business relationships, as well as of shareholders, executive bodies, managing directors or other employees of contractual or business partners in the context of prospective or existing contractual and business relationships.
In addition, we process personal data that we may have lawfully received from credit agencies or financial services institutions in the course of checking creditworthiness or integrity, as well as from publicly accessible sources (e.g. websites, company register, commercial register, annual reports, media) or other third parties.
The processed data includes in particular Company name, address, company register number, tax number, VAT number, title, gender, first name, surname, address, email address, telephone number and, if applicable, function/position, bank details, invoice data, contract data if applicable (e.g. contract duration), documentation data (e.g. conversation notes, correspondence such as email correspondence), creditworthiness and integrity data if applicable, as well as any other data voluntarily provided or collected as part of the (pre-)contractual relationship or data to fulfil legal requirements.
If communication or collaboration takes place online via audiovisual meeting or conference systems and/or other collaboration tools, the following data in particular is also processed about participating persons: Interaction data (start, end, approvals, availability status), technical data (IP address, browser, operating system, hardware, LAN or WLAN), technical parameters for video and audio, (chat) messages, shared files, documents and screen content, recordings of audio and video meetings (provided you have given your voluntary consent for this).
8.2. Legal basis and purpose of data processing
The legal basis for the processing of data is Article 6(1)(b) GDPR and therefore the processing for the fulfilment of a contract and for the implementation of pre-contractual measures. The data is processed by VERBUND for the purpose of initiating or concluding the contract and for further contract processing and communication with you. The provision of data by you is voluntary; however, if you do not provide this data, VERBUND will not be able to conclude a contract with you.
Furthermore, the data is processed to fulfil legal obligations in accordance with Article 6(1)(c) GDPR, e.g. to comply with tax and duty law or other legal obligations.
In addition, the processing is justified to safeguard the legitimate interests of VERBUND pursuant to Art. 6 para. 1 lit. f GDPR. This is particularly the case for
a creditworthiness or integrity check prior to the conclusion of a contract in order to obtain information about your creditworthiness or integrity,
Inclusion and management in databases due to VERBUND's internal regulations in terms of financial market compliance and corruption prevention in order to be able to take account of our own precautions/regulations,
Data management, including all related activities, in particular for the purpose of establishing contact and communication,
Provision and use of audiovisual conference systems and/or other communication and/or collaboration tools.
8.3. Duration of storage
Your data will be processed for as long as it is necessary for the respective purpose and will then be deleted, unless the data is required beyond this within the scope of the statutory retention obligations (e.g. those pursuant to Section 212 UGB or Sections 124 ff BAO or other legal requirements), or as long as claims can still be asserted from the (contractual) relationship or it is justified to safeguard our legitimate interests.
8.4. Recipients of data
Personal data will only be passed on to third parties if this is necessary to fulfil (pre)contractual or legal obligations, is justified to protect our legitimate interests or is permitted within the scope of a given consent.
Your data will be passed on to the following recipients in particular:
- on the basis of our legitimate interests to external third parties such as legal representatives, insurance companies or auditors in the event of an incident;
- to authorities and other public bodies to the extent required by law (e.g. tax authorities, courts)
Your personal data may be transferred to contracted service providers (e.g. IT service providers) for order processing.
9. Your rights
In principle, you have the right to information, correction, deletion, restriction, data portability, revocation and objection with regard to your data processed by us. If you believe that the processing of your data violates data protection law or your data protection claims have otherwise been violated in any way, you can complain to us at datenschutz@verbund.com or to the national supervisory authority of your place of residence. In Austria this responsibility lies with the Austrian Data Protection Authority, Barichgasse 40-42, 1030 Vienna, e-mail: dsb@dsb.gv.at, Tel: +43 1 52 152-0.
10. Updates of the data privacy information
We reserve the right to make changes to this privacy information at any time. The privacy information will be updated regularly and all changes will be published on this website.