Privacy information
It is important for us to protect your personal data.
We comply with the applicable legal regulations for the protection, lawful handling and secrecy of personal data as well as data security, in particular the Data Protection Act as amended ("DSG"), the Telecommunications Act ("TKG") and the General Regulation on Data Protection ("GDPR"). The following information describes how we are handling your data.
as of: September 2025
1. Name and address of the data controller
Responsible for the processing of your personal data in accordance with the data protection provisions in connection with the SAMMLUNG VERBUND is
VERBUND AG
Am Hof 6a
1010 Wien
(„VERBUND“, „we“, „us“).
Contact details of the data protection officer:
E-Mail: datenschutz@verbund.com
2. Processing in the context of the ‘website‘
2.1. What kind of personal data will we process?
During your visit to our website (sammlung.verbund.com) we will automatically collect the following personal data:
- Date and time of access to a page of our website
- Data about your device (device ID)
- IP address
- Name and version of your internet browser
- Session ID
We are not using cookies on our website.
2.2. What is our legal basis and purpose for processing personal data?
Where the data of your visit to our website are concerned, we justify the processing on the basis of our legitimate interest in accordance with Art. 6(1)(f) GDPR and § 165(3) TKG, which consists of giving our website a user-friendly design and protecting it against attacks.
We process your data relating to the visit to our website and online services for the following purposes:
- to make our website and online services, including their functions, available to you, and to improve and develop this website further;
- to create usage statistics;
- to detect, prevent and investigate attacks on our website and online services.
2.3. Retention period
We will generally store your data relating to the visit to our website for a period of three months. A longer retention period will apply only to the extent this is required to investigate identified attacks on our website and beyond that only until the end of the relevant limitation periods, statutory retention periods or any legal disputes.
2.4. Data recipients
In order to operate and administer the website, we regularly use IT service providers which, in accordance with our order and instructions, may under certain circumstances also have access to personal data in order to be able to render the commissioned IT services.
We will also transmit your personal data to the following recipients:
- to external third parties to the extent required by our legitimate interest (e.g. auditors, insurance companies in the event of an insured event, legal representatives as the occasion requires);
- to authorities and other public bodies to the extent required by law (e.g. financial authorities, courts).
Your data will not be passed to any other third parties for their own purposes without your consent.
3. Processing in the context of ‘Making contact / inquiries‘
3.1. What kind of personal data will we process?
When you contact us, personal details such as your title, name, contact details such as telephone number and/or email address, details about your company and your position, and potentially other information you voluntarily provide, as well as the content of your enquiry, will be processed for the purpose of handling your enquiry.
The provision of these data by you is voluntary. If you do not provide these data for the handling of your inquiry, we will not be able to process your inquiry accordingly.
3.2. What is our legal basis and purpose for processing personal data?
The legal basis for the processing of your personal data is our legitimate interest in accordance with Art. 6(1)(f) GDPR which consists of processing and handling your inquiry. If the enquiry is aimed at the conclusion of a contract, the legal basis for the processing is Art 6 para 1 lit b GDPR.
3.3. Retention period
We process your data in order to handle your enquiry and beyond that for a period of three months, so that we can respond appropriately to subsequent questions. A longer retention period will be applied only on the basis of statutory retention periods or for defence purposes in any legal disputes.
3.4. Data recipients
We regularly use service providers (e.g. IT service providers) who may also have access to personal data on our behalf and in accordance with our instructions in order to provide the commissioned services.
We may also transfer your personal data to the following recipients:
- on the basis of our legitimate interests to VERBUND Group companies as well as to external third parties such as legal representatives, insurance companies or auditors in the event of an incident;
- to authorities and other public bodies to the extent required by law (e.g. tax authorities, courts).
Your data will not be passed on to any other third parties for their own purposes without your consent.
4. Processing in the context of ‘Registration for events’
4.1. Scope of the processing of personal data
When you register for events organised by SAMMLUNG VERBUND or events held by SAMMLUNG VERBUND in collaboration with one or more other organisers, personal details such as your title, name, contact details such as telephone number and/or email address, potentially details of your company and position, and other event-related information will be processed.
The provision of data by you is voluntary; however, if you do not provide the data marked as mandatory, we will not be able to process your registration.
4.2. Legal basis and purpose of data processing
The legal basis for processing the mandatory data is Article 6(1)(b) GDPR and thus the fulfillment of a contract. Insofar as the processing also concerns voluntarily provided, optional data, we base the processing on our legitimate interest pursuant to Article 6(1)(f) GDPR. This legitimate interest lies in particular in being able to address you and interact with you in accordance with the information you have voluntarily provided.
The personal data provided during registration will be processed for the purpose of handling and administering the event, including related communication (e.g. sending registration confirmation, reserving seats, answering questions, etc.). Insofar as the processing of your voluntarily provided particularly sensitive data (e.g. health data such as food intolerances) is concerned, we rely on your voluntary consent within the meaning of Article 6(a) GDPR in conjunction with Article 9(2)(a) GDPR. You can revoke your consent at any time with future effect free of charge by contacting the address specified in the declaration of consent. Revoking your consent does not affect the lawfulness of the processing carried out on the basis of your consent until revocation.
4.3. Duration of storage
Your data will be stored for as long as necessary to fulfill the purpose or until you object to the processing of your voluntarily provided data, and beyond that only for as long as it must be processed within the scope of statutory retention obligations. If you have given your consent to the processing of certain data, we will delete your data earlier if you revoke your consent.
4.4. Recipients of data
In the case of a joint event, the data will be shared between the parties responsible for organizing the event. The data will only be passed on to other third parties if this is necessary to fulfill (pre)contractual or legal obligations, if it is justified to protect our legitimate interests, or if it is permissible within the scope of consent that has been granted.
The data may be transferred to contracted service providers for order processing (responsible for the organisation and implementation of the event) or companies in accordance with the consent given. Our processors include, in particular, IT service providers and other providers of tools and software solutions that also support us in the provision of our services and act on our behalf (e.g. service providers for the purpose of event management).
5. Processing in the context of ’Image recordings (photos/videos)’
5.1. Scope of the processing of personal data
If photographs are taken at events organised by SAMMLUNG VERBUND, these will be stored and used by VERBUND.
5.2. Legal basis and purpose of data processing
The legal basis is Art. 6 (1) (f) GDPR and thus the legitimate interest of VERBUND and/or the joint organizer(s).
Images are processed for the purpose of documenting and presenting VERBUND events, activities and happenings and stored in the VERBUND archive. Furthermore, the images are processed for internal purposes and for VERBUND's public relations and press work and published in printed and electronic media, in particular on VERBUND's social media platforms (e.g. Facebook, Instagram, LinkedIn, YouTube). If we cannot base the use of images on legitimate interests, we will obtain separate consent from you for processing in accordance with Art 6 para 1 lit a GDPR. You can revoke your voluntarily given consent at any time with effect for the future, e.g. by e-mail to datenschutz@verbund.com.
5.3. Duration of storage
The image recordings are stored for as long as the documentation purpose is given and there is no objection to this processing. In addition, we store your data for as long as we are obliged to do so in accordance with statutory retention obligations. If the processing is based on your voluntary consent, we will store the data until you withdraw your consent.
5.4. Recipients of data
At a joint event, photos are taken in the common interest and used by all those jointly responsible for the event for the purposes described. The images will only be passed on to third parties if this is necessary to fulfill (pre)contractual or legal obligations, if it is justified to protect our legitimate interests, or if it is permitted within the scope of consent that has been granted.
The images may be transferred to commissioned service providers for order processing. Images may also be passed on to cooperation partners who participated in the event or on whose premises the event was held for publication (e.g., on their social media channels) for the purpose of public relations and press work.
5.5. Data processing after the end of the event
If an event is held by joint controllers, the data required for this purpose will be processed jointly as described above. Any data processing that takes place after the end of the event and is no longer related to the event (e.g., advertising mailings) is carried out under the sole responsibility of the respective organizer. Please refer to the relevant data protection information provided by VERBUND or the respective cooperation partner(s).
8. Processing in the context of ‘Initiation and conclusion of contracts’
8.1. Scope of the processing of personal data
We process personal data of persons or companies with whom VERBUND enters into contractual and business relationships, as well as of shareholders, executive bodies, managing directors or other employees of contractual or business partners in the context of prospective or existing contractual and business relationships.
In addition, we process personal data that we may have lawfully received from credit agencies or financial services institutions in the course of checking creditworthiness or integrity, as well as from publicly accessible sources (e.g. websites, company register, commercial register, annual reports, media) or other third parties.
The processed data includes in particular Company name, address, company register number, tax number, VAT number, title, first name, surname, address, email address, telephone number and, if applicable, function/position, bank details, invoice data, contract data if applicable (e.g. contract duration), documentation data (e.g. conversation notes, correspondence such as email correspondence), creditworthiness and integrity data if applicable, as well as any other data voluntarily provided or collected as part of the (pre-)contractual relationship or data to fulfil legal requirements.
If communication or collaboration takes place online via audiovisual meeting or conference systems and/or other collaboration tools, the following data in particular is also processed about participating persons: Interaction data (start, end, approvals, availability status), technical data (IP address, browser, operating system, hardware, LAN or WLAN), technical parameters for video and audio, (chat) messages, shared files, documents and screen content, recordings of audio and video meetings (provided you have given your voluntary consent for this).
8.2. Legal basis and purpose of data processing
The legal basis for processing the mandatory data is Article 6(1)(b) GDPR and therefore processing for the fulfillmente of a contract and for the implementation of pre-contractual measures. The data is processed by VERBUND for the purpose of initiating or concluding the contract and for further contract processing and communication with you. The provision of data by you is voluntary; however, if you do not provide this data, VERBUND will not be able to conclude a contract with you.
Furthermore, the data is processed to fulfil legal obligations in accordance with Article 6(1)(c) GDPR, e.g. to comply with tax and duty law or other legal obligations.
In addition, the processing is justified to safeguard the legitimate interests of VERBUND pursuant to Art. 6 para. 1 lit. f GDPR. This is particularly the case for
- optional data that you voluntarily provide, in particular so that we can address you or interact with you in accordance with this information or handle your request accordingly.
- a creditworthiness or integrity check prior to the conclusion of a contract in order to obtain information about your creditworthiness or integrity,
- Inclusion and management in databases due to VERBUND's internal regulations in terms of financial market compliance and corruption prevention in order to be able to take account of our own precautions/regulations,
- Data management, including all related activities, in particular for the purpose of establishing contact and communication,
- Provision and use of audiovisual conference systems and/or other communication and/or collaboration tools.
8.3. Duration of storage
Your data will be processed for as long as it is necessary for the respective purpose and will then be deleted, unless the data is required beyond this within the scope of the statutory retention obligations (e.g. those pursuant to Section 212 UGB or Sections 124 ff BAO or other legal requirements), or as long as claims can still be asserted from the (contractual) relationship or it is justified to safeguard our legitimate interests.
8.4. Recipients of data
Personal data will only be passed on to third parties if this is necessary to fulfil (pre)contractual or legal obligations, is justified to protect our legitimate interests or is permitted within the scope of a given consent.
Your data will be passed on to the following recipients in particular:
- on the basis of our legitimate interests to external third parties such as legal representatives, insurance companies or auditors in the event of an incident;
- to authorities and other public bodies to the extent required by law (e.g. tax authorities, courts)
Your personal data may be transferred to contracted service providers (e.g. IT service providers) for order processing.
9. Your rights
In principle, you have the right to information, correction, deletion, restriction, data portability, revocation and objection with regard to your data processed by us. If you believe that the processing of your data violates data protection law or your data protection claims have otherwise been violated in any way, you can complain to us at datenschutz@verbund.com or to the national supervisory authority of your place of residence. In Austria this responsibility lies with the Austrian Data Protection Authority, Barichgasse 40-42, 1030 Vienna, e-mail: dsb@dsb.gv.at, Tel: +43 1 52 152-0.
10. Updates of the data privacy information
We reserve the right to make changes to this privacy information at any time. The privacy information will be updated regularly and all changes will be published on this website.