Last Updated: 28 July 2023
The protection of personal data is very important to us, so we would like to list here all the information about the processing and storage of your data when you visit our website and in our companies in general.
To be able to use all the functions and services of our site, it is necessary to collect your personal data. However, the processing and storage is only carried out in accordance with the legal guidelines and requirements of the General Data Protection Regulation (GDPR) and the Austrian Telecommunications Act (TKG 2021).
Stift Klosterneuburg, Stiftsplatz 1, 3400 Klosterneuburg jointly responsible for processing within the meaning of Article 26 GDPR with
- Winery Stift Klosterneuburg GmbH, FN 124327i, Stiftsplatz 1, 3400 Klosterneuburg
- Stiftskellerei Klosterneuburg GmbH, FN 382298d, Stiftsplatz 1, 3400 Klosterneuburg
- “Hofkirchner” Weinvertriebs GmbH, FN 128655z, Rathausplatz 20, 3400 Klosterneuburg
- A home for street children Social project Stift Klosterneuburg, ZVR number149159583, Stiftsplatz 1,3400 Klosterneuburg
You can find more information in the imprint.
All companies can be reached at
Tel.: +43 2243 411 – 0
Within the meaning of Article 26 of the GDPR, the above-mentioned controllers jointly determine the purposes of and the means for processing personal data.
Stift Klosterneuburg, Stiftsplatz 1, 3400 Klosterneuburg, as the parent company, also fulfils all obligations under the GDPR for the above-mentioned subsidiaries, in particular with regard to the exercise of the rights of the data subject and complies with the information obligations under Articles 13 and 14.
Pursuant to Article 26(3) GDPR, regardless of the internal organization between the joint controllers, data subjects may exercise their rights under the GDPR with and against each of the controllers.
All employees are obliged to maintain confidentiality and to handle your data properly and to enter it correctly into our data processing systems.
DATA PROTECTION OFFICER
Data Protection Officer: Mag.a iur. Elisa Drescher
COLLECTION AND PROCESSING OF PERSONAL DATA ON THIS WEBSITE
Note: To protect your data as comprehensively as possible from unwanted access, we take so-called technical and organizational measures and use an encryption process on our website. Your data is transmitted over the Internet from your computer to our computer and vice versa using so-called TLS encryption. TLS means “Transport Layer Security” and is an encryption protocol for data transmission on the Internet. You can usually recognize “TLS” by the fact that the lock symbol in the status bar of your browser is closed and the address begins with https://.
1. COLLECTION OF ACCESS AND LOG DATA
This website automatically collects and stores server log file information that your browser sends to us.
- IP address of the user,
- Date and time of access,
- Type of request,
- Customer information such as type and version,
- Operating system of the user (device, OS version of the device),
- Referrer information (i.e. the source of the access)
The legal basis for this data processing is the legitimate interest according to Art. 6 para. 1 lit. f) GDPR. The legitimate interest is based on being able to identify indications of illegal use of our website (e.g. defense against hacker attacks) and to ensure a smooth connection.
We have concluded an order processing contract with the provider of this website, digimagical GmbH, based in Austria, in accordance with Art. 28 GDPR. This is a contract required by data protection law, which ensures that digimagical GmbH only processes the personal data of our website visitors in accordance with our instructions and in compliance with the GDPR. In addition, we have concluded an order processing contract with medani GmbH based in Austria in accordance with Art. 28 GDPR.
The collected data is stored in server log files, which your browser automatically transmits to us in encrypted form. We only save the server log files in the event of attacks on our server infrastructure or other legal violations. This longer storage period is based on our legitimate interest according to Art. 6 para. 1 lit. f) GDPR and only serves to preserve evidence.
2. ENQUIRIES VIA THE CONTACT FORM, E-MAIL, AND TELEPHONE
Any personal information that you provide to us on a voluntary basis will of course be treated confidentially. We use the personal data you provide exclusively to process and respond to your enquiry. The legal basis for data processing is our legitimate interest according to Art. 6 Para. 1 lit. f) GDPR. This results from our interest in answering enquiries from our customers, business partners and interested parties and in promoting or maintaining customer satisfaction. Another legal basis for natural persons is the initiation or fulfilment of a contract according to Art. 6 Para. 1 lit. b) GDPR.
All personal data that you transmit to us with your enquiry will be deleted or anonymized by us no later than 2 years after the final reply to you, unless a contract is concluded. The retention period of 2 years is because it may occasionally happen that you contact us again about the same matter after a reply and refer to the previous correspondence. Experience has shown that after 2 years no further queries follow our replies.
3. REGISTRATION FOR THE “WILLKOMMEN IM STIFT” AND “AUSSTICH” WINERY NEWSPAPERS
You can subscribe via our website either to our abbey newspaper “Willkommen im Stift” or to the newspaper of the winery “Ausstich”. The Chorherrenstift Klosterneuburg is responsible for sending out the monastery newspaper and the Weingut Stift Klosterneuburg GmbH is responsible for the newspaper “Ausstich”. Dispatch is free of charge. We have noted the successful registration in our customer database for verification purposes.
When registering, it is mandatory to provide your first and last name, your address (street, postcode, city, country). You can enter your e-mail address and telephone number voluntarily. Your data will only be passed on to the contracted printing company for dispatch. We have concluded a contract with the printing company in accordance with Art. 28 GDPR.
The legal basis for sending the newspapers is the legitimate interest according to Art. 6 para. 1 lit. f) GDPR. The legitimate interest is direct advertising.
You can object to the data processing at any time in accordance with Art. 21 GDPR.
4. SENDING NEWSLETTERS
On our website you can subscribe to various newsletters. The Chorherrenstift Klosterneuburg is responsible for sending the newsletter. If you select “Wine”, the Weingut Stift Klosterneuburg GmbH is the responsible party within the meaning of the GDPR. We send out a newsletter a maximum of once a month.
Our newsletters contain information about the monastery and its cultural offerings. The newsletter of Weingut Stift Klosterneuburg GmbH also contains information on offers or promotions. When you subscribe to the newsletter, we collect and store the data you enter in the input mask. You are only required to enter your e-mail address. All other details, such as title, first name, surname, are provided on a voluntary basis. After sending the registration form, you will receive an e-mail from us with a confirmation link. As soon as you click on the link contained therein, you give us your consent to receive our newsletter and have successfully registered for it. You will be informed of this by a further e-mail. You also give us your consent to process your e-mail address and, if applicable, your other data. This ensures that no third party or unauthorised person registers for our newsletter (compliance with the double opt-in procedure).
You can stop receiving the newsletter at any time by clicking on the “Unsubscribe” link at the end of each newsletter. If you revoke your consent, your data will be deleted immediately, and we will store the proof of revocation for a further three years so that we can fulfil our accountability obligation in accordance with Art. 5 para. 2) GDPR. This storage is based on our legitimate interest according to Art. 6 para. 1 lit. f) GDPR. The legal basis for the confirmation email is our legitimate interest according to Art. 6 para. 1 lit. f) GDPR, which is based on being able to prove that you have given your consent. The duty of proof for the responsible party is set out in Art. 5 para. 2) GDPR.
The legal basis for sending the newsletter is your consent in accordance with Art. 6 Para. 1 lit. a) GDPR and § 174 Para. 3 TKG 2021.
We exclude the transfer of data to third parties. The newsletter is sent by our processor CampaignMonitor by the company Iris Holdings L.P./Marigold based in the USA and agencylife innovative GmbH based in Vienna, Austria. An adequacy decision exists for the USA. The transfer of data to the USA is based on the standard contractual clauses.
5. VISITOR SURVEY
If you participate in our visitor survey, this is done on a purely voluntary basis. In these anonymous surveys, no information is stored that allows conclusions to be drawn about participants in the surveys. You can use free text fields to specify your information. When using the free text fields, please refrain from providing us with personal data about yourself or other persons. Any personal information you provide in surveys is considered voluntarily provided and will be stored in accordance with the GDPR.
The legal basis for participation in surveys is your consent in accordance with Art. 6 Para. 1 lit. a) GDPR. If you have given further consent in the context of a survey, you have the option of revoking this consent at any time with effect for the future. In these cases, more details are regulated in the special data protection principles of the respective survey.
The results of our surveys are only used for internal evaluations. We do not pass on personal data to third parties unless you have expressly consented to this. We use the services of Kondeor GmbH, based in Eugendorf (Austria), to evaluate the anonymous survey data.
The storage period of any personal data collected in the context of customer surveys will be communicated in advance in the context of the specific customer survey.
6. ORGANISING COMPETIONS
You can participate in competitions on our website, via our newsletter or through other means. Unless otherwise stipulated in the respective competition or you have given us further express consent, the personal data you pass on to us as part of your participation in the competition will be used exclusively for the purpose of processing the competition (e.g. determining the winner, notifying the winner, sending the prize).
The legal basis for data processing in the context of sweepstakes is the fulfilment of the contract pursuant to Art. 6 para. 1) lit. b) GDPR. In the event of the submission of a declaration of consent in the context of a competition, Art. 6 para. 1) a) GDPR is the legal basis for the data processing based on the consent. If you have given your consent in the context of a competition, you have the option of revoking this consent at any time with effect for the future.
The information will only be passed on to third parties if this is necessary for the processing of the competition (e.g. sending the prize via a logistics company).
After the end of the competition and the announcement of the winners, the personal data of the participants will be deleted. If prizes in kind are offered, we store personal data of the winners for the duration of the respective statutory warranty period to arrange for rectification or replacement in the event of a defect.
7. USE OF WEB ANALYTICS TOOLS AND COOKIES
Cookies themselves do not contain any personal data about users, they only serve to uniquely identify what our customers find interesting and useful on our website. We also use “web beacons” (small graphic images, also known as “pixel tags” or “clear GIFs”) on our website. They are used together with cookies to track general user behavior on the website.
The legal basis for the processing of personal data using cookies and other technologies is your consent pursuant to Art. 6 para. 1) lit. a) GDPR, which you give us via the so-called “Consent Banner” as soon as you access our website for the first time.
- Technically necessary: These are cookies and similar methods without which you cannot use our services, for example to display our website correctly or to use functions you have requested.
- Comfort: These techniques allow us to consider your actual or presumed preferences for the comfortable use of our website. For example, we may display our website in a language that suits you based on your preferences.
- Statistics: These techniques allow us to compile anonymous statistics on the use of our services. This allows us to determine, for example, how we can better adapt our website to the habits of our users.
- Marketing: This enables us to show you advertising content tailored to you based on the analysis of your usage behavior. Your usage behavior can also be tracked across different websites, browsers or end devices using a user ID (unique identifier).
The data processed by necessary cookies are required for the purposes listed below to protect our legitimate interests and those of third parties in accordance with Art. 6 para. 1 lit. f) GDPR.
Link to the cookie settings: open cookie settings
Once cookies have been stored, you can delete them at any time via the settings of your web browser. You can also adjust the settings of your web browser so that no cookies are stored. In this case, not all functions of our website may be available.
Essential cookies enable basic functions and are necessary for the proper function of the website.
|Provider||Owner of this website|
|Purpose||Saves the visitors preferences selected in the Cookie Box of Borlabs Cookie.|
|Cookie Expiry||1 Year|
Google Tag Manager
|Name||Google Tag Manager|
|Provider||Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland|
|Purpose||Cookie by Google used to control advanced script and event handling.|
|Cookie Name||The tag manager doesn't set cookies|
Statistics cookies collect information anonymously. This information helps us to understand how our visitors use our website.
|Provider||Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland|
|Purpose||Cookie by Google used for website analytics. Generates statistical data on how the visitor uses the website.|
|Cookie Expiry||2 years|
Content from video platforms and social media platforms is blocked by default. If External Media cookies are accepted, access to those contents no longer requires manual consent.
|Provider||Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland|
|Purpose||Used to unblock YouTube content.|
|Cookie Expiry||6 Month|
|Provider||Audios Ventures Inc|
|Purpose||Used to embed podcasts via Simplecast|
|Cookie Expiry||6 months|
We may use specialized service providers, in particular from the online marketing sector, as part of data processing (using cookies and similar techniques to process usage data). These process your data on our behalf as processors, are carefully selected in each case and are contractually bound in accordance with Article 28 GDPR. All of the above providers act as processors for us.
Consent Management via Borlabs
We use the cookie consent technology of Borlabs Cookies to obtain your consent under data protection law for the storage of certain cookies on your end device or for the use of certain technologies and to document this in accordance with data protection law. The provider of this technology is Borlabs – Benjamin A. Bornschein (“Borlabs”) with its registered office in Germany.
Borlabs sets a technically necessary cookie to store your data protection consents. The following information is stored in the Borlabs cookie:
- Cookie Runtime
- Cookie version
- Domain and path of the website
- UID (randomly generated ID, which according to Borlabs is not personally identifiable)
No data is transferred to Borlabs.
Use of Google Analytics
This website uses Google Analytics if you give your consent within the meaning of Art. 6 para. 1) a) and Art. 49 para. 1) a) GDPR. This is a service provided by Google Ireland Limited (“Google”), a company incorporated and operated under the laws of Ireland (registration number: 368047) with its registered office at Gordon House, Barrow Street, Dublin 4, Ireland and Google LLC (USA) (“Google”).
Google Analytics uses so-called “cookies”. These are text files that are stored on your computer and enable an analysis of the use of the website by the user. The information acquired through the cookies about your usage behavior of this website is usually transferred to a Google server in the USA and stored there. The data processing is also essentially carried out by Google. An adequacy decision exists for the USA, so that the data transfer can take place without further measures. You can view Google’s certification here.
We have made the setting that your IP address is anonymized. The IP addresses are anonymized by Google, but within member states of the European Union or in other contracting states to the Agreement on the European Economic Area. Only in exceptional cases will the full IP address be transferred to a Google server in the USA and shortened there.
On behalf of the operator of this website, Google will use this information for the purpose of evaluating your use of the website, compiling reports on website activity, and providing other services relating to website activity and internet usage to the website operator.
The anonymized IP address transmitted by your browser as part of Google Analytics is linked to other data about you, such as search history, personal accounts, usage data from other devices and any other data Google may have about you.
You can view the cookies that are set in connection with Google Analytics in the list above.
You can revoke your consent at any time by making the appropriate settings directly via our banner. The user and event data will be deleted after 14 months. The “Reset user data on new activity” function is enabled. This means that if you visit again before the retention period expires, your data will not be deleted.
This website uses the “Google Signals” function to add a cross-device analysis of visitor flows to the statistical reports generated by Google Analytics.
When are Google Signals collected?
Google Signals are only applied to users who are logged into a Google Account during sessions and have enabled the Personalized Advertising feature in their Google Account.
What information do we receive through Google Signals?
Google Signals does not provide us with any deep insights about specific individuals or ways to uniquely identify you or the device you are using. We only receive general demographic information (gender, age group) and possible interests from Google.
How can I deactivate Google Signals?
If you want to disable this feature for yourself, you will need to do so proactively via the setting in your Google account. The link will take you to the change options in your Google Account: https://support.google.com/ads/answer/2662856.
You can find more information about Google Signals directly on Google’s information page at https://support.google.com/analytics/answer/7532985?hl=de.
We use Google Ads with your consent in accordance with Art. 6 para. 1)lit. a) GDPR in order to be able to show you advertisements on websites of Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland (“Google”) and other third-party providers.
You can find more information about cookies in the cookie list above.
For more information on the privacy of Google services, please visit: https://policies.google.com/privacy?hl=de
Google Tag Manager
We use the Google Tag Manager of the provider Google Ireland Limited, Google Building Gordon House, Barrow St, Dublin 4, Ireland.
Through Google Tag Manager, website tags are managed through one interface. This allows us as marketers to manage website tags through one interface. Tags are small sections of code that, for example, record (track) your activities on our website. The Google Tag Manager itself does not set cookies, but ensures that other tags are activated, which in turn may collect data, such as Google Analytics. Google Analytics itself sets cookies. You can find more information on this in the chapter “Web tracking measures”.
By implementing the Google Tag Manager, your IP address is transferred anonymously to Google. This may also result in data being transferred to Google servers in the USA. We have concluded an order processing contract with Google in accordance with Art. 28 GDPR. An adequacy decision exists for the USA, so that the data transfer can take place without further measures. You can view Google’s certification here.
In the Tag Manager account settings, we have not allowed Google to receive anonymized data from us.
The storage period of the integrated tracking tools, such as Google Analytics, depends on the respective tool used, which is loaded via the Google Tag Manager.
Integration of YouTube Videos and Map Services
On our websites, we embed videos and map services that are not stored on our servers. To ensure that calling up our websites with embedded videos and maps does not automatically lead to content from the third-party provider being reloaded, we only display locally stored preview images of the maps in a first step. This does not provide the third-party provider with any information.
Only after clicking on the preview image or granting consent via the cookie consent banner will content from the third-party provider be reloaded. This provides the third-party provider with the information that you have accessed our site as well as the usage data technically required in this context. We have no influence on the further data processing by the third-party provider. By clicking on the preview image, you give us your consent to reload content from the third-party provider. The embedding is based on your consent pursuant to Art. 6 para. 1 lit. a) GDPR, provided that you have previously given your consent by clicking on the preview image. An adequacy decision exists for the USA, so that the data transfer can take place without further measures. You can view Google’s certification here.
Video service provider:
Google Ireland Limited/Google LLC (USA) (“YouTube” and “Google Maps”)
Revocation of consent
If you have clicked on a preview image, the content of the third-party provider will be reloaded immediately. If you do not want such reloading on other pages, please stop clicking on the thumbnails or revoke your consent for reloading via the cookie consent banner.
8. EMBEDDING FONTS – GOOGLE FONTS LOCAL
Our website uses Google Fonts for uniform display, which we have stored locally on our server. This means that no data is transmitted to Google Inc. servers in the USA.
9. ONLINE SHOP
Weingut Stift Klosterneuburg GmbH is responsible for the online shop.
To place orders via the online shop, you can either create a customer account or place an order as a guest.
Registration and creation of a user account: For the registration and creation of your user account, we collect your e-mail address, title, first name and surname as well as your birthday. You will receive a link to create a new password by e-mail. The legal basis for this data processing is Art. 6 para. 1 lit. b) GDPR. Your data is therefore processed for the purpose of fulfilling contractual obligations. The legal basis for requesting the date of birth is the fulfilment of legal obligations to be able to carry out age verification within the framework of the laws for the protection of minors. We process your date of birth exclusively for age verification purposes.
Ordering as a “guest”: When ordering as a guest, we only collect the data required to carry out the delivery. The legal basis for this data processing is Art. 6 para. 1 lit. b) GDPR, you provide this data as part of your contractual relationship.
Commissioned consignment of goods: If the delivery address differs from the billing address, personal data of persons who do not order directly in our shop may also be processed. Experience has shown that these orders often serve as gifts. We have received your address from a person who gives you our products as a gift. Your address data therefore does not come from publicly accessible sources (Art. 14 para. 2 lit. f) GDPR). The legal basis for this data processing is the fulfilment of the contract according to Art. 6 para. 1 lit. b) GDPR.
Processing your order: Before checkout (payment), you have the option of entering “Notes on the order” in a free text field. We request that you do not enter any personal data here. We collect your data for invoicing and for processing the shipment. The legal basis for this data processing is the fulfilment of the contract according to Art. 6 para. 1 lit. b) GDPR.
Payment options: You can pay by credit card (VISA, MasterCard), EPS or SOFORT banking (Klarna). You will be redirected to the website of the selected payment service provider. You can enter your payment details there and finally process the order. For this purpose, the specific payment amount is transmitted to the service provider used. You can find further information on the data processing carried out in the information texts on the input mask/website of the service providers. You will also find further contact information there. Payment processing takes place directly via the selected payment service provider.
The legal basis for this is Article 6 para. 1) lit. b) GDPR, i.e. you provide us with the data on the basis of the contractual relationship between you and us.
Storage period: We store your data until your user account is deleted. This does not affect the fulfilment of retention obligations such as under the Federal Tax Code.
10. REGISTRATION FOR EVENTS
If you register for events via our website, we require the information marked as mandatory in the booking mask. This is regularly your name so that we can enter you on the guest list. If you come to our events with an accompanying person, we also collect the name of the accompanying person. Please make sure that you are authorized to enter the name.
The information you provide for the booking will be processed by us exclusively for the purpose of implementing the events. The legal basis for this data processing is the fulfilment of the contract according to Art. 6 para. 1 lit b) GDPR.
Your registration data will not be passed on to third parties. We store the data of participants of events, as far as necessary, for the duration of the legal storage obligations. After that and in all other cases, the data will be deleted.
11. INTEGRATION OF THE PODCAST
12. PROCESSING OPERATIONS IN CONNECTION WITH THE EXERCISE OF DATA PROTECTION RIGHTS
Insofar as your data has been provided on the basis of consent pursuant to Art. 6 para. 1) a), Art. 9 para. 2)lit. a) or Art. 49 para. 1) lit. a) GDPR, we will process your data exclusively for the intended purpose and after separate information to be able to prove, within the scope of the accountability incumbent upon us pursuant to Art. 5 (2) GDPR, that you have consented to the data processing in question. If you withdraw your consent, your data will be deleted within the legally prescribed period – please note, however, that data that fall under the tax law or other retention obligations must be stored for at least seven years and, if necessary, extended by the duration of proceedings by the (tax) authority. The legal basis for data processing is Art. 6 para. 1 lit. c) GDPR.
Insofar as you assert data subject rights against us pursuant to Art. 15 to 21 of the GDPR, we also process and store your data in order to be able to prove within the scope of accountability pursuant to Art. 5 (2) of the GDPR that we have complied with the GDPR when processing your request. The legal basis for this processing is Article 6 (1) (c) of the GDPR in conjunction with the asserted data subject right(s).
DATA PROCESSING IN THE CONTEXT OF APPLICATION PROCEDURES
In order to receive and manage the application and thus for the purpose of (possibly) establishing an employment relationship, you can send us your application documents by e-mail. The legal basis for this data processing is Art. 6 para. 1 lit. b) GDPR. Within the scope of the application process, we only collect the data from you that is required to establish the employment relationship with us.
Within our company, only those people who are involved in the decision-making process will have access to your personal data.
In the event of a successful application, your personal data will be stored for the duration of your employment relationship. In addition, after its termination, your tax-relevant data will be archived within the framework of the statutory retention periods. In the event of an unsuccessful application, your personal data will be deleted 7 months after the rejection.
OPERATING SOCIAL MEDIA PRESENCES
Klosterneuburg Abbey maintains the following social media presences:
Weingut Stift Klosterneuburg GmbH maintains the following social media presences:
Instagram and Facebook are products of Meta Platforms Inc (formerly Facebook Inc): facebook.com/help/1561485474074139/? helpref=related
DATA PROCESSING BY US
a. Maintenance of the above-mentioned social media pages and placement of ads
The personal data entered on social media sites, such as comments, videos, pictures, likes, public messages, etc. are published by the respective social media platform. We reserve the right to delete content should this be necessary. Where appropriate, we share content on our site and contact you via the social media platform, for example via the messengers offered. In addition, we regularly place advertisements (“ads”) via our social media pages. The legal basis for this data processing is the legitimate interest according to Art. 6 para. 1 lit. f) GDPR, which is in the interest of our public relations and communication.
b. Page Insights
The social media platforms provide anonymised statistics and insights that help us gain knowledge about the types of actions people take on our site (called “page insights”). These page insights are created based on certain information about people who have visited our site.
The legal basis for this data processing is our legitimate interest according to Art. 6 para. 1 lit. f) GDPR, which is based on obtaining information about the actions as well as visitors to our pages.
This processing of personal data is carried out by the social media platform and us as so-called joint controllers according to Art. 26 GDPR. In the event of joint responsibility, a separate agreement must be concluded.
Instagram and Facebook: https://www.facebook.com/legal/terms/page_controller_addendum
If you wish to object to certain data processing over which we have control (e.g. deletion of comments), please contact us using the contact details above.
Note: The provision of your data is neither legally nor contractually required or necessary for the conclusion of a contract. You are not obliged to provide your personal data. The consequence of not providing it is that you will not be able to communicate or interact with us via our social media pages or participate in the competition. To contact us, please use the above-mentioned e-mail address.
DATA PROCESSING BY THE OPERATOR OF THE SOCIAL MEDIA PLATFORM:
In addition to us, there is also the operator of the social media platforms themselves. From a data protection point of view, this operator is also considered to be another responsible party that carries out its own data processing. This means that the operator is also a separate responsible entity according to the GDPR. However, we have only limited influence on the data processing by the operator. At the points where we can exert influence (e.g. through parameterisation), we work towards data protection-compliant handling by the operator of the social media platform within the scope of our possibilities. In many places, however, we cannot influence the data processing by the operator of the social media platform and also do not know exactly what data they process. The respective operator will inform you about the processing of personal data in its own data protection declaration:
In the context of platform use, your personal data is usually also processed by the respective platform operator on servers in third countries, in particular in the USA. Certain third countries are granted a so-called adequacy decision by the European Commission. This means that the legal situation for the protection of privacy in these countries is comparable with that in the EU or the EEA. More information about the current countries with adequacy decision can be found here. Meta Platforms Inc (Facebook, Instagram) and Google (YouTube) are certified in accordance with the adequacy decision for the USA, the Data Privacy Framework. In all other cases, we conclude so-called standard contractual clauses with the platform operators for the transfer of personal data to third countries.
Note: The operator of the social media platform uses web tracking methods. The web tracking can also take place regardless of whether you are logged in or registered with the social media platform. As already explained, we can unfortunately hardly influence the web tracking methods of the social media platform. For example, we cannot switch this off. Please be aware of this: It cannot be ruled out that the provider of the social media platform uses your profile and behavioural data, for example, to evaluate your habits or personal relationships and preferences, etc. We have no influence on the processing of your data by the provider of the social media platform.
DATA SUBJECTS’ RIGHTS
YOUR RIGHTS AS A DATA SUBJECT
In accordance with Art. 15 (1) GDPR, you have the right to request information free of charge about the personal data stored about you. Furthermore, if the legal requirements are met, you have the right to rectification (Art. 16 of the GDPR), deletion (Art. 17 of the GDPR) and restriction of processing (Art. 18 of the GDPR) of your personal data. If you have provided the processed data yourself, you have a right to data transfer according to Art. 20 GDPR.
If the data processing is based on Art. 6 para. 1) lit. e) or f) GDPR, you have the right to object pursuant to Art. 21 GDPR. If you object to data processing, this will not take place in the future unless the controller can demonstrate compelling legitimate grounds for further processing that outweigh the interest of the data subject in objecting.
You also have the right to lodge a complaint with a data protection supervisory authority. In particular, the complaint may be lodged with a supervisory authority in the EU Member State of your place of residence, place of work or place of the alleged infringement.
Contact details of the competent data protection authority: Wickenburggasse 8, 1080 Vienna, email@example.com
NO AUTOMATED DECISION MAKING
We do not carry out automatic decision-making or profiling.
Unless otherwise stated in the previous chapters, the provision of personal data is neither legally nor contractually required or necessary for the conclusion of a contract. Failure to provide your personal data may mean that we are unable to respond to your enquiries, for example.
This data protection notice was created in cooperation with the consulting firm SCALELINE. The legal texts are subject to copyright.