Privacy information

Responsible for the processing of your personal data in accordance with the data protection provisions in connection with the SAMMLUNG VERBUND is

VERBUND AG
Am Hof 6a
1010 Wien
(„VERBUND“, „we“, „us“).

Contact details of the data protection officer: 
E-Mail: datenschutz@verbund.com

2.1. What kind of personal data will we process?

During your visit to our website (sammlung.verbund.com) we will automatically collect the following personal data:

• Date and time of access to a page of our website
• Data about your device (device ID)
• IP address
• Name and version of your internet browser
• Session ID

We are not using cookies on our website.

2.2. What is our legal basis and purpose for processing personal data?

Where the data of your visit to our website are concerned, we justify the processing on the basis of our legitimate interest in accordance with Art. 6(1)(f) GDPR and § 165(3) TKG, which consists of giving our website a user-friendly design and protecting it against attacks.

We process your data relating to the visit to our website and online services for the following purposes:

• to make our website and online services, including their functions, available to you, and to improve and develop this website further;
• to create usage statistics;
• to detect, prevent and investigate attacks on our website and online services.

2.3. Retention period

We will generally store your data relating to the visit to our website for a period of three months. A longer retention period will apply only to the extent this is required to investigate identified attacks on our website and beyond that only until the end of the relevant limitation periods, statutory retention periods or any legal disputes.

2.4. Data recipients

In order to operate and administer the website, we regularly use IT service providers which, in accordance with our order and instructions, may under certain circumstances also have access to personal data in order to be able to render the commissioned IT services.

We will also transmit your personal data to the following recipients:

• to external third parties to the extent required by our legitimate interest (e.g. auditors, insurance companies in the event of an insured event, legal representatives as the occasion requires);
• to authorities and other public bodies to the extent required by law (e.g. financial authorities, courts).

Your data will not be passed to any other third parties for their own purposes without your consent.

3.1. What kind of personal data will we process?

If you contact us by e-mail or telephone, we will process the personal data you provide (e-mail, name, telephone number and the content of your inquiry or the associated documents) for the purpose of processing your inquiry and will reply to you accordingly.

The provision of these data by you is voluntary. If you do not provide these data for the handling of your inquiry, we will not be able to process your inquiry accordingly.

3.2. What is our legal basis and purpose for processing personal data?

The legal basis for the processing of your personal data is our legitimate interest in accordance with Art. 6(1)(f) GDPR which consists of processing and handling your inquiry. If the enquiry is aimed at the conclusion of a contract, the legal basis for the processing is Art 6 para 1 lit b GDPR. 

3.3. Retention period

We process your data in order to handle your enquiry and beyond that for a period of three months, so that we can respond appropriately to subsequent questions. A longer retention period will be applied only on the basis of statutory retention periods or for defence purposes in any legal disputes.

3.4. Data recipients

We regularly use service providers (e.g. IT service providers) who may also have access to personal data on our behalf and in accordance with our instructions in order to provide the commissioned services.

We may also transfer your personal data to the following recipients:

• on the basis of our legitimate interests to VERBUND Group companies as well as to external third parties such as legal representatives, insurance companies or auditors in the event of an incident;
• to authorities and other public bodies to the extent required by law (e.g. tax authorities, courts).

Your data will not be passed on to any other third parties for their own purposes without your consent.

4.1. Scope of the processing of personal data

When you register for SAMMLUNG VERBUND events, personal details such as gender, title, name, address, contact details such as telephone number and/or e-mail address, possibly details of your company and your position and other event-related details are processed.

The provision of data by you is voluntary; however, if you do not provide the data marked as mandatory, we will not be able to process your registration.

4.2. Legal basis and purpose of data processing

Legal basis for the processing of data is Art. 6 para. 1 lit. b GDPR and thus the fulfilment of a contract.

Personal data provided during registration will be processed for the purpose of managing the event, including the associated communication (e.g. sending confirmation of registration, seat reservation, answering questions, etc.).

4.3. Duration of storage

Your data will be stored for as long as is necessary for the fulfilment of the purpose, beyond that only as long as it must be processed within the framework of statutory retention obligations.

4.4. Recipients of data

The data will only be passed on to third parties if this is necessary to fulfil (pre-)contractual or legal obligations, is justified to protect our legitimate interests or is permitted within the scope of a given consent.

The data may be transferred to contracted service providers for order processing (responsible for the organisation and implementation of the event) or companies in accordance with the consent given. Our processors include, in particular, IT service providers and other providers of tools and software solutions that also support us in the provision of our services and act on our behalf (e.g. service providers for the purpose of event management).

5.1. Scope of the processing of personal data

If photographs are taken at events organised by SAMMLUNG VERBUND, these will be stored and used.

5.2. Legal basis and purpose of data processing

The legal basis is Article 6(1)(f) GDPR and thus the legitimate interest of VERBUND.

Images are processed for the purpose of documenting and presenting VERBUND events, activities and happenings and stored in the VERBUND archive. Furthermore, the images are processed for internal purposes and for VERBUND's public relations and press work and published in printed and electronic media, in particular on VERBUND's social media platforms (e.g. Facebook, Instagram, LinkedIn, YouTube). If we cannot base the use of images on legitimate interests, we will obtain separate consent from you for processing in accordance with Art 6 para 1 lit a GDPR. You can revoke your voluntarily given consent at any time with effect for the future, e.g. by e-mail to datenschutz@verbund.com.

5.3. Duration of storage

The image recordings are stored for as long as the documentation purpose is given and there is no objection to this processing. In addition, we store your data for as long as we are obliged to do so in accordance with statutory retention obligations. If the processing is based on your voluntary consent, we will store the data until you withdraw your consent.

5.4. Recipients of data

The image recordings will only be passed on to third parties if this is necessary to fulfil (pre)contractual or legal obligations, is justified to protect our legitimate interests or is permitted within the scope of a given consent.

The image recordings may be transmitted to contracted service providers for order processing. Image recordings may also be passed on to cooperation partners who participated in the event or in whose premises the event was held, for publication on their social media channels for the purpose of public relations and press work.

6.1. Scope of the processing of personal data

When you register for a SAMMLUNG VERBUND newsletter, we process your personal data such as gender, title, name and e-mail address.

The provision of this data by you is voluntary. However, if you do not provide the data, we will not be able to send you a newsletter.

6.2. Legal basis and purpose of data processing

The legal basis for the processing of the data is Art 6 para 1 lit a GDPR and thus your voluntary consent to receive the newsletter about the SAMMLUNG VERBUND. This newsletter reports on  our activities, mainly events/exhibitions and cooperation partners. You will also be invited to events organised by the SAMMLUNG VERBUND.

Your voluntary consent can be revoked at any time without giving reasons and with effect for the future without further cost, for example via the link contained in the e-mail to VERBUND AG, SAMMLUNG VERBUND, Am Hof 6a, 1010 Vienna and at datenschutz@verbund.com.

6.3. Duration of storage

Your data will be processed for the duration of your subscription to the newsletter as long as you have not revoked your voluntary consent.

6.4. Recipients of data

Data will only be passed on to third parties if this is necessary to fulfil (pre-)contractual or legal obligations, is justified to protect our legitimate interests or is permitted within the scope of your voluntarily granted consent. For example, we transfer your personal data to the extent necessary to external third parties, e.g. auditors, insurers or legal representatives. Your personal data may be transferred to contracted service providers (e.g. IT service providers) for order processing.

7.1. Scope of the processing of personal data

When you contact us on our SAMMLUNG VERBUND social media profiles, we process the data you provide (e.g. name, concerns, communication with us).

You can react to our posts by clicking on various buttons (such as ‘Like’, ‘Share’, ‘Invite friends’) or comment on content or send it to other users. In this case, your interaction as well as your (‘user’) name, profile photo and IP address as well as any personal data of invited or tagged third parties will be processed.

Your data may also be processed by the platform operators in this context. In this case, we and the respective platform operator are joint controllers pursuant to Art. 26 GDPR. For our Facebook and Instagram profiles, we have concluded the following joint controllership agreement with Meta Platforms Ireland Ltd, Serpentine Avenue, Dublin 4, Ireland: https://www.facebook.com/legal/controller_addendum. You can find more information about the processing of your data at

Facebook: https://de-de.facebook.com/privacy/policy/
Instagram: https://de-de.facebook.com/help/instagram/155833707900388

7.2. Legal basis and purpose of data processing

We process your personal data to answer your enquiry and thus to carry out (pre-)contractual measures in accordance with Art. 6 para. 1 lit. b GDPR or within the scope of our legitimate interests in processing your enquiry in accordance with Art. 6 para. 1 lit. f GDPR. With regard to social media interaction, we use your voluntarily disclosed data on the basis of your consent in accordance with Art 6 para 1 lit a or f GDPR to answer your questions and comments, to comment on your opinion/feedback, to give you the opportunity to express your opinion or to present and advertise the SAMMLUNG VERBUND and its activities.

7.3 Duration of storage

We store the data you provide (e.g. name, comments, interactions) until your interaction is cancelled or until it is lawfully deleted by the platform operator in accordance with the terms of use (e.g. in the event of misuse) or as long as our content (images, videos, etc.) is online.

7.4. Recipients of the data

The published data is generally available on the respective social media platform and is made available to all other users as part of the functionalities of the respective social media platform. Furthermore, data will only be passed on to third parties if this is necessary for the fulfilment of (pre-)contractual or legal obligations or is permitted within the scope of your voluntarily granted consent. For example, we transfer your personal data to the extent necessary to external third parties, e.g. auditors, insurers or legal representatives. Your personal data may be transferred to contracted service providers (e.g. IT service providers) for order processing.

8.1. Scope of the processing of personal data

We process personal data of persons or companies with whom VERBUND enters into contractual and business relationships, as well as of shareholders, executive bodies, managing directors or other employees of contractual or business partners in the context of prospective or existing contractual and business relationships.

In addition, we process personal data that we may have lawfully received from credit agencies or financial services institutions in the course of checking creditworthiness or integrity, as well as from publicly accessible sources (e.g. websites, company register, commercial register, annual reports, media) or other third parties.

The processed data includes in particular Company name, address, company register number, tax number, VAT number, title, gender, first name, surname, address, email address, telephone number and, if applicable, function/position, bank details, invoice data, contract data if applicable (e.g. contract duration), documentation data (e.g. conversation notes, correspondence such as email correspondence), creditworthiness and integrity data if applicable, as well as any other data voluntarily provided or collected as part of the (pre-)contractual relationship or data to fulfil legal requirements.

If communication or collaboration takes place online via audiovisual meeting or conference systems and/or other collaboration tools, the following data in particular is also processed about participating persons: Interaction data (start, end, approvals, availability status), technical data (IP address, browser, operating system, hardware, LAN or WLAN), technical parameters for video and audio, (chat) messages, shared files, documents and screen content, recordings of audio and video meetings (provided you have given your voluntary consent for this).

8.2. Legal basis and purpose of data processing

The legal basis for the processing of data is Article 6(1)(b) GDPR and therefore the processing for the fulfilment of a contract and for the implementation of pre-contractual measures. The data is processed by VERBUND for the purpose of initiating or concluding the contract and for further contract processing and communication with you. The provision of data by you is voluntary; however, if you do not provide this data, VERBUND will not be able to conclude a contract with you.

Furthermore, the data is processed to fulfil legal obligations in accordance with Article 6(1)(c) GDPR, e.g. to comply with tax and duty law or other legal obligations.

In addition, the processing is justified to safeguard the legitimate interests of VERBUND pursuant to Art. 6 para. 1 lit. f GDPR. This is particularly the case for

a creditworthiness or integrity check prior to the conclusion of a contract in order to obtain information about your creditworthiness or integrity,

Inclusion and management in databases due to VERBUND's internal regulations in terms of financial market compliance and corruption prevention in order to be able to take account of our own precautions/regulations,

Data management, including all related activities, in particular for the purpose of establishing contact and communication,

Provision and use of audiovisual conference systems and/or other communication and/or collaboration tools.

8.3. Duration of storage

Your data will be processed for as long as it is necessary for the respective purpose and will then be deleted, unless the data is required beyond this within the scope of the statutory retention obligations (e.g. those pursuant to Section 212 UGB or Sections 124 ff BAO or other legal requirements), or as long as claims can still be asserted from the (contractual) relationship or it is justified to safeguard our legitimate interests.

8.4. Recipients of data

Personal data will only be passed on to third parties if this is necessary to fulfil (pre)contractual or legal obligations, is justified to protect our legitimate interests or is permitted within the scope of a given consent.

Your data will be passed on to the following recipients in particular:

• on the basis of our legitimate interests to external third parties such as legal representatives, insurance companies or auditors in the event of an incident;
• to authorities and other public bodies to the extent required by law (e.g. tax authorities, courts)

Your personal data may be transferred to contracted service providers (e.g. IT service providers) for order processing.

In principle, you have the right to information, correction, deletion, restriction, data portability, revocation and objection with regard to your data processed by us. If you believe that the processing of your data violates data protection law or your data protection claims have otherwise been violated in any way, you can complain to us at datenschutz@verbund.com or to the national supervisory authority of your place of residence. In Austria this responsibility lies with the Austrian Data Protection Authority, Barichgasse 40-42, 1030 Vienna, e-mail: dsb@dsb.gv.at, Tel: +43 1 52 152-0.

We reserve the right to make changes to this privacy information at any time. The privacy information will be updated regularly and all changes will be published on this website.