Valid from: 25.5.2018
Updated: 10.05.2024
0. Preamble
The protection of your personal data is of particular concern to us. We therefore process your data exclusively on the basis of the statutory provisions (in particular the EU General Data Protection Regulation "GDPR"), the Austrian Data Protection Act "DSG" and the Telecommunications Act 2021 "TKG"). In this privacy policy, we inform you about the most important aspects of data processing by ÖKOBÜRUO - Alliance of the Environmental Movement (hereinafter referred to as "we" or "ÖKOBÜRO").
This ÖKOBÜRO privacy policy provides an overview of the processing of personal data carried out by us and your associated rights. Personal data is any information relating to identified or identifiable natural persons (Art. 4 (1) GDPR).
1. Responsible for data processing
ÖKOBÜRO - Alliance of the Environmental Movement
Neustiftgasse 36/3a
1070 Vienna
ZVR number: 873642346
+43 1 5249377
office@oekobuero.at
2. The data processing in detail
Depending on whether you visit our website, subscribe to our newsletter, apply for a job with us, establish a partnership with us, take part in an event or contact us for other reasons, we process your data in different ways on different legal bases. Below you will find the purpose and legal basis of the processing in detail.
2.1 Visiting our website
2.1.1 When you visit our website, your IP address and the time of access are recorded for the duration of this session. This is for technical reasons and therefore constitutes a legitimate interest within the meaning of Art. 6 (1) (f) GDPR. Unless otherwise specified below, we will not process this data any further. The storage period is 14 days.
2.2 Registration for the newsletter / event invitations
If you subscribe to our newsletter or our service for event invitations via web form, e-mail or signature list, your first and last name, address, telephone number and e-mail address will be processed for the purpose of processing the enquiry and sending it. The processing of your personal data is based on your consent (Art 6 (1) (a) GDPR). Your data will be stored until cancellation.
In order to achieve the purpose of data processing, it may be necessary for your data to be passed on to Mamara-IT GmbH & Co KG, based in Austria, and to Intuit Mailchimp, based in the USA. Intuit is certified according to the EU-U.S. Data Privacy Framework.
2.3 Contact by you
If you contact us by e-mail or telephone, your first and last name, your telephone number, your e-mail address and, if applicable, your address will be processed for the purpose of processing your enquiry. The processing of your personal data is based on your consent (Art. 6 (1) (a) GDPR) and on a legitimate interest (Art. 6 (1) (f) GDPR). Your data will be stored until cancellation.
In order to achieve the purpose of data processing, it may be necessary for your data to be passed on to Mamara-IT GmbH & Co KG, based in Austria, and to Microsoft Corporation, based in the USA. Microsoft Corporation is certified according to the EU-U.S. Data Privacy Framework.
2.4 Use of our legal services
If you make use of our legal service, your first and last name, your address, your telephone number and your e-mail address will be processed for the purpose of handling your enquiry. The processing of your personal data is based on your consent (Art 6 (1) (a) GDPR) and for the fulfilment of the contract (Art 6 (1) (b) GDPR). Your data will be deleted after seven years in accordance with the statutory retention obligation under the Federal Fiscal Code (Bundesabgabenordnung).
2.5 Participants in events
If you participate in or register for one of our events, we process your first and last name, the name of your organisation and your e-mail address for the purpose of processing and evaluating the event. The processing of your personal data is based on your consent (Art 6 (1) (a) GDPR). Your data will be deleted 90 days after closing your account on Eventbrite Inc or after cancellation.
In order to achieve the purpose of data processing, it is necessary for your data to be passed on to Eventbrite Inc, based in the USA. Eventbrite Inc is certified under the EU-U.S. Data Privacy Framework. In addition, your data may be passed on to funding organisations as proof of our activities.
2.6 Applicants
If you apply for a job with us, we will process your first and last name, your address, your telephone number, your e-mail address and your date of birth in particular for the purpose of processing your application. In addition, the documents sent by you (CV, letter of motivation) will be processed. We base the processing on the need to fulfil pre-contractual obligations (Art. 6 (1) (b) GDPR) and on your consent (Art. 6 (1) (a) GDPR). If no employment relationship is established, the data will be deleted after six months from the end of the application process. If you wish to be kept on record, the data will be deleted after two years. If an employment relationship is established, further processing will be based on a data protection declaration for employees yet to be submitted.
2.7 Potential funding partners
As part of the acquisition of funding, the first name and surname, email address and, if applicable, the telephone number of the contact persons of the potential funding organisation are processed. The processing serves the purpose of establishing and handling a partnership. The processing of your personal data is based on a legitimate interest of ÖKOBÜRO (Art 6 (1) (f) GDPR). Your personal data will be deleted after the end of the cooperation.
2.8 Business partners (caterers, event location, suppliers, member organisations, etc.)
If you work with us (in particular) in the context of organising events, we process your first name and surname (company), your email address, your telephone number, bank details and the documents created in the course of the collaboration and the personal data contained therein (contracts, invoices, correspondence, etc.). The processing of your personal data is necessary for the fulfilment of the contract (Art 6 (1) (b) GDPR). Your data will be deleted within the scope of the statutory retention obligation under the Federal Fiscal Code (Bundesabgabenordnung) after seven years or, in the case of contracts under EU funding agreements, after ten years. We expressly reserve the right to store data beyond this in the event of legal disputes.
In order to achieve the purpose of data processing, it may be necessary for your data to be passed on to Mamara-IT GmbH & Co KG (database) based in Austria, to Microsoft Corporation (e-mail processing) based in the USA, to Erste Bank der Österreichischen Sparkassen (payment processing) based in Austria, to the respective tax consultant based in Austria and to authorities and projects of the Republic of Austria and the European Union. Microsoft Corporation is certified according to the EU-U.S. Data Privacy Framework.
3. Data protection officer
As the data processing carried out does not represent a core activity of the organisation and no extensive systematic monitoring of the data subjects is carried out, the appointment of a data protection officer is not necessary.
4. No disclosure to third parties
ÖKOBÜRO does not pass on the above-mentioned personal data to third parties. If, in exceptional cases, data should be passed on to third parties (= contract processors), this will be expressly indicated when the data is processed.
5. Storage of the data
ÖKOBÜRO takes appropriate technical and organisational measures to protect the above-mentioned personal data from loss, access and manipulation by unauthorised persons. This is done in particular through encryption, password protection, minimisation of employee access rights and physical protection of the server used by ÖKOBÜRO. The data is only processed for the time absolutely necessary to fulfil the purpose.
Data subjects can contact ÖKOBÜRO under office@oekobuero.at to exercise their rights.
1. Right to information - Art 15 GDPR
Data subjects have the right to obtain information about the data processed by ÖKOBÜRO with regard to the processing purposes, the categories of personal data and the planned storage period.
2. Right to rectification and completion - Art 16 GDPR
Data subjects may request ÖKOBÜRO to rectify incorrect data or complete incomplete data.
3. Erasure ("right to be forgotten") - Art 17 GDPR
Data subjects have the right to have their personal data stored by ÖKOBÜRO erased, unless the processing is necessary for exercising the right of freedom of expression and information, for compliance with a legal obligation, or for the establishment, exercise or defence of legal claims.
4. Right to data portability - Art 20 GDPR
Data subjects have the right to receive their data in a commonly used, structured, machine-readable form or to have it transmitted to a third party.
5. Revocation of consent to processing - Art 7 para 3 GDPR
Data subjects can revoke their consent to the processing of their data at any time and arrange for their data to be deleted.
6. Right to object - Art 21 para 3 GDPR
Data subjects can object to the processing of their data, which is carried out within the scope of the legitimate interest of ÖKOBÜRO (Art 6 para 1 lit f GDPR), at any time and request the deletion of their data.
7. Right to lodge a complaint with the supervisory authority - Art 77 GDPR
Data subjects have the right to lodge a complaint with a supervisory authority. To do so, they can contact the supervisory authority of their usual place of residence, place of work or the place of the suspected breach of the data protection provisions.
Austrian Data Protection Authority
Barichgasse 40-42
1030 Vienna
+43 1 52 152 - 0
dsb@dsb.gv.at
www.dsb.gv.at