Data Protection at VERBUND

It is important for VERBUND AG to protect your personal data.

Core business / services of VERBUND

It is important for VERBUND AG to protect your personal data and for us to explain to you how we handle them. We therefore comply with the applicable legal regulations for the protection, lawful handling and secrecy of personal data as well as data security, in particular the Data Protection Act as amended ("DSG"), the Telecommunications Act 2021 ("TKG 2021") and the General Data Protection Regulation ("GDPR").

1. Name and contact details of the data controller

The data controllers jointly responsible for processing your data within the scope of this data processing pursuant to Art. 26 GDPR are:

VERBUND AG, Am Hof 6a, 1010 Vienna and VERBUND Energy4Customers GmbH, Erdberger Lände 26A, 1030 Vienna ("VERBUND", "we" or "us"). VERBUND AG has concluded an agreement with Energy4Customers GmbH pursuant to Art. 26 GDPR ("Joint Controller Agreement"), which regulates the tasks and obligations under data protection law. You have the right to assert your claims to the data controller, regardless of the Joint Controller Agreement.

The contact details of the data protection officer: datenschutz@verbund.com.

2. Data processing by processors and other recipients

2.1.   Processor

Where service providers commissioned for subsequent data processing are involved ("processors" pursuant to Art. 4(8) GDPR, such as IT service providers, service providers for marketing services, payment service providers), they may also have access to personal data in accordance with our instructions. VERBUND works only with processors who provide sufficient guarantees that appropriate technical and organisational measures are implemented in such a way that processing is carried out in accordance with the requirements of the Austrian Data Protection Act ("DSG") and the General Data Processing Regulation ("GDPR") as amended. The processing performed by a processor is always done on the basis of a contract that binds the processor to the obligations under data protection law. VERBUND uses processors outside the European Union only if an adequacy decision has been taken by the European Commission for the third country concerned or if we have agreed on other appropriate guarantees pursuant to Art. 46 GDPR.

2.2.   Other recipients

For the following forms of data processing, personal data will only be forwarded to other recipients where required for the fulfilment of (pre-)contractual or statutory obligations, where justified for the maintenance of our legitimate interests or those of a third party, or where permitted within the scope of voluntarily granted consent. In addition to processors pursuant to point 2.1, the categories of recipients of personal data can include:

  • Sales partners: If the conclusion of your contract with VERBUND is brokered via one of our sales partners and/or a sales partner (jointly) supports your contract with VERBUND, the sales partner will collect the personal data necessary to conclude the contract and transmit these to VERBUND. We will also transmit your personal data to the sales partner to the extent necessary for any support you require from the sales partner.

  • VERBUND group company: We can forward individual data processing activities to specialist departments, divisions or companies within the VERBUND group and transmit the personal data necessary for this purpose. This is done primarily to be able to administer your data centrally and/or to be able to offer you a better service.

  • Market players in the gas or electricity market: In the course of initiating and processing the contract, it may be necessary for us to transmit your personal data to market players in the gas or electricity market (e.g. grid operators or energy suppliers) in order to fulfil (pre-)contractual and/or statutory obligations.

  • Authorities, courts and public bodies: Statutory obligations exist that VERBUND is only able to fulfil when we transmit your personal data in the necessary scope to authorities and public bodies (e.g. financial authorities, law enforcement agencies) as well as to courts.

  • Companies for credit and creditworthiness information: VERBUND may transmit your personal data to companies for credit and creditworthiness information (e.g. CRIF GmbH and Kreditschutzverband) within the scope of creditworthiness checks and to request information about your creditworthiness from them.

  • Other recipients: Within the scope of the contractual relationship and in particular in connection with our service obligations, it may be necessary, on a case by case basis, to transmit your personal data to other recipients (e.g. lawyers, notaries, insolvency administrators, debt collection agencies, experts, tax consultants, auditors, stakeholder representatives, banks, financial service providers, mail/courier services and logistics partners, installation partners, contract and cooperation partners for services linked to your contract).

3. Data processing in the context of "consulting and information for interested parties"

3.1.   Scope of the processing of personal data and their source

Parties with an interest in the products and services of VERBUND can use various channels to make contact with VERBUND (e.g. by phone or email). If you make use of one of these options, the following data provided by you – depending on the chosen manner of making contact – will be processed: information about your person such as gender, title, name, address, type of interest or information about your enquiry, information on how you can be reached (phone number and/or email address), information on energy consumption, grid operator and current energy supplier. The specific scope of the data collected from you will depend on the nature of your inquiry.

These data are provided by you on a voluntary basis; they are neither legally nor contractually prescribed, nor are they required in order to enter into a contract with us. However, if you do not provide these data, VERBUND will not be able to process your enquiry accordingly.

3.2.   What is our legal basis for processing personal data?

The legal basis for the processing of the data mentioned under point 3.1. is our legitimate interest in accordance with Art. 6(1)(f) GDPR, which consists of handling your enquiry as well as possible. If the reason for making contact is to conclude a contract, the fulfilment of (pre-)contractual measures pursuant to Art. 6(1)(b) GDPR is the legal basis.

3.3.   Purposes for which we process data

The personal data listed under point 3.1. will be processed by VERBUND for the purpose of handling your enquiry.

3.4.   Retention period

We will process your data in order to handle your enquiry and beyond that for a period of three months. A longer storage period will apply only to the extent this is required to fully process your concerns and beyond that only until the end of the relevant limitation periods, statutory retention periods or any legal disputes.

The option exists to render the data anonymous instead of erasing them. In this case, any personal reference will be irretrievably removed, which shall also remove any obligation to erase the data under data protection law.

3.5.   Data recipients

The data may be transmitted to commissioned service providers for order processing (order processor) or to other recipients pursuant to point 2.

4. Data processing in the context of "placing an order in the online shop"

4.1.   Scope of the processing of personal data and their source

In order to initiate the conclusion of a contract when placing your order in the online shop on our website, you will provide us with the following data, depending on the product selection/contract type: title, gender, first name, last name, address, date of birth, email address, phone number, billing address, customer number, ordered products, payment methods, bank details, billing data, data on your energy consumption as well as data about your facility (grid operator, meter point designation, meter number, meter reading), any name, address and customer number of an advertiser. Depending on the contract type, further data listed under point 5.1 may be collected from you when you place an order in the online shop.

If you also register for the VERBUND online services after placing your first order in the online shop, we will additionally ask you to enter a user name and password.

4.2.   What is our legal basis for processing personal data?

The legal basis for the processing of data pursuant to point 4.1. is Art. 6(1)(b) GDPR and therefore the processing for the fulfilment of a contract and for the implementation of pre-contractual measures.

The provision of data by you is voluntary; however, if you do not provide these data, VERBUND will not be able to process your order in the online shop for the contract conclusion accordingly or only to a limited extent.

4.3.   Purposes for which we process data

The personal data listed under point 4.1. will be processed by VERBUND for the purpose of processing the order and subsequently to fulfil the respective contractual obligations arising from placing the order in the online shop.

4.4.   Retention period

We will process your data for orders placed in the online shop for as long as necessary to handle the order and thereafter to the extent that statutory retention periods exist or warranty and limitation periods are still in force.

4.5.   Data recipients

The data may be transmitted to commissioned service providers for order processing (order processor) or to other recipients pursuant to point 2.

5. Data processing in the context of "processing energy contracts of VERBUND AG"

5.1.   Scope of the processing of personal data and their source

You can procure a range of different products and services from us. Depending on the product choice/contract type, personal data will be collected from you or from other sources for the purpose of processing energy contracts with you.

Collection of personal data from the data subject (Art. 13 GDPR):

If you conclude an energy supply contract for the supply of electricity or gas, the following personal data, which you provided us upon conclusion of the contract or were collected during ongoing contract fulfilment, will be processed:

  • Master data, such as title, gender, first name, last name, address, date of birth, email address, phone number, billing address, customer number;
  • Contractual data, such as contract type, products, tariff model, commitment period, delivery time, payment methods, bank details, billing data;
  • Facility data, such as grid operator, meter point designation, meter number;
  • Consumption data, such as the level of energy consumption, consumption period, meter readings;
  • Any other data, such as the name, address and customer number of an advertiser, upon registration for the VERBUND online account a user name and password or for customers who are also members of the jö Bonus Club the web ID, refresh token as well as the number of Ö points claimed/voucher.

If you also conclude a photovoltaic supply for electrical energy from photovoltaic systems, VERBUND will, in additional to the energy supply contract, process the following data provided by you at the time of concluding the contract: data of the photovoltaic system (output in kWpeak, feed-in in kWh, date of initial operation, current electricity consumer, reference number, certificate of recognition as a green electricity facility), any VAT Reg. No.

If you conclude a rental or purchase agreement for a photovoltaic system, wallbox or other moveable property, VERBUND will process the following personal data, which you provided us upon conclusion of the contract or were collected during ongoing contract fulfilment, will be processed:

  • Master data, such as title, gender, first name, last name, address, date of birth, email address, phone number, billing address, customer number;
  • Data on your property, such as owner, type of property, age of property, roof shape, roof slope, type of roof covering, number of floors, installation location, address, photos of the property (general view, roof, meter box);
  • Contractual data, such as contract type, products, commitment period, payment methods, bank details, billing data;
  • Facility data, such as grid operator, meter point designation, meter number;
  • Consumption data, such as the level of energy consumption, consumption period, meter readings;
  • Any other data, such as the name, address and customer number of an advertiser, upon registration for the VERBUND online account a user name and password.

If you procure a complete VERBUND-eCharging package from VERBUND, in addition to the purchase contract for a wallbox and to the electricity supply agreement within the scope of the VERBUND-eCharging service agreement, VERBUND will process the following personal data, which you provided us upon conclusion of the contract or were collected during ongoing contract fulfilment either from you or from a readout via the wallbox:
Data about your property, such as the installation location of the wallbox, power connection available, wall breakthroughs, cable run, photos of the property;
Data of the wallbox, such as designation of the wallbox, max. power output in kW, operating data of the wallbox, address, charging procedures (e.g. start date, time, duration, energy consumption data), session ID of the charging procedure, card number of the charging card.

Collection of personal data from other sources (Art. 14 GDPR):

Should it be necessary to verify your creditworthiness prior to the conclusion of a contract with us or during an ongoing contractual relationship, we will transmit the data required for this purpose and disclosed by you during contact initiation (title, gender, first name, last name, address, date of birth, any VAT and company register numbers) to the credit agency CRIF GmbH, Rothschildplatz 3/Top 3.06.B, 1020 Vienna, which processes the transmitted data as an independent data controller for its own purposes as a credit agency and address publisher, as described under https://www.crif.at/datenschutz/.

5.2.   What is our legal basis for processing personal data?

The legal basis for the processing of data under point 5.1. is Art. 6(1)(b) GDPR and therefore processing for the fulfilment of a contract and for the execution of precontractual measures as well as Art. 6(1)(c) GDPR for the fulfilment of legal obligations. Such obligations can arise in particular from: the Electricity Industry and Organisation Act (ElWOG), the Natural Gas Management Act (GWG), the Switching Ordinance, the Payments by Instalment Ordinance, the Industrial Code (GewO), the Green Electricity Act (ÖSG), the Renewable Energy Expansion Act (EAG), the Federal Energy Efficiency Act (EEffG), the Corporate Code (UGB), and the Federal Tax Code (BAO).

We will also process your data to protect the legitimate interests of us or third parties (Art. 6(1)(f) GDPR). VERBUND has a legitimate interest in learning more about your creditworthiness as required and thus preventing payment defaults. To this end, VERBUND can obtain creditworthiness information about your from companies that provide credit and creditworthiness information. In the interest of VERBUND or third parties, your data may also be processed for preparing statistics, analyses and reports, for business management and further development of processes, for developing new products and services, for customer support and marketing pursuant to point 6, for contract administration, for ensuring IT security and IT operation including tests, for compliance purposes and for internal audit measures as well as for optimising processing, delivery and communication processes. Our particular objective for doing so is also to continuously improve processes and services in order to be able to offer you excellent service quality.

The provision of data by you is voluntary; however, if you do not provide these data, VERBUND will not be able to process your application to conclude a contract accordingly or to render the contractual services during an ongoing contractual relationship accordingly or only with restriction.
A transmission of quarter-hourly values by smart meters of our grid operator and processing of these quarter-hourly values by VERBUND is done pursuant to Sec. 84a ElWOG only on the basis of voluntary consent (Art. 6(1)(a) GDPR) or for fulfilment of obligations arising from an energy supply contract that you have chosen and which is based on quarter-hourly values (Art. 6(1)(b) GDPR).

5.3.   Purposes for which we process data

The personal data listed under point 5.1. will be processed by VERBUND for the purpose of concluding, executing, modifying and terminating the contract with you as well as for settling payments to you. This also includes, in particular, the following activities:

  • Creditworthiness check on the customer as required
  • Carrying out a change of supplier pursuant to the Switching Ordinance in the case of an contract for the supply of electricity or gas.
  • Customer administration and billing (invoices are sent either by post or by email)
  • Optional use of the VERBUND online services via the VERBUND online account
  • Customer support and marketing for internal purposes (see point 6)

5.4.   Retention period

These data will be erased after the termination of the contractual relationship with the customer, unless the data have to be retained beyond the statutory retention obligation (e.g. those according to Art. 212 Corporate Code (UGB) or Art. 124 et seq. Federal Tax Code (BAO), or for as long as claims arising from the contractual relationship can be asserted.

5.5.   Data recipients

The data may be transmitted to commissioned service providers for order processing (order processor) or to other recipients pursuant to point 2.

6. Data processing in the context of "customer support and marketing for internal purposes"

6.1.   Scope of the processing of personal data and their source

Collection of personal data from the data subject (Art. 13 GDPR):

For this type of data processing, the data will be collected from you at the same time as the contract is concluded and data used that originates from the data processing in the context of "placing an order in the online shop" (point 4.1) and "processing of energy contracts of VERBUND AG" (point 5.1).

In addition, for example, the following documentation data will be collected by VERBUND from the transactions and service enquiries performed by you: date of enquiry/transaction, conversation notes, email correspondence.

Various data will also be collected directly from you via multiple sources, such as through voluntary customer surveys (point 9), data on your living situation, such as type of housing, household size, living space, heating system, which in themselves make no personal reference and produce personal data at VERBUND only when combined with other data and analyses, or, for example, through a power meter installed in your premises by VERBUND on the basis of a rental or purchase contract of a PV system incl. battery store or electric car charging station (point 8).

6.2.   What is our legal basis for processing personal data?

VERBUND processes your personal data for customer support and marketing purposes on the basis of the legitimate interest of VERBUND (Art. 6(1)(f) GDPR), in order achieve interested parties and customers as well as possible and to align the marketing strategies accordingly. You do not have to actively seek information on our special offers or new products and services; instead, this will be provided to you by us. The data processing carried out on the legal basis of our legitimate interest is done with minimal intervention: you will not be subjected either to automated decision-making pursuant to Art. 22 GDPR that has a legal effect on you or significantly affects you in a similar way, nor will you be subject to profile with increased intervention intensity. Essentially, only such data that clearly meet your areas of interest in terms of the content of purchases and enquiries will be collected, stored and used.

When sending out direct marketing, VERBUND complies with the provisions under communication law in accordance with Art. 174 TKG 2021 (Telecommunications Act). The sending of direct advertising by electronic channels takes place solely on the basis of your voluntary consent.

VERBUND also uses your data on the basis of legitimate interests to allocate you to internal customer segments, in order to be able to offer you products and services with additional benefits for you that are tailored specifically for you and based on your consumption behaviour in the case of direct advertising measures, for the analysis of our marketing activities, in order to invite you to participate in competitions (see point 7), for customer relationship management as well as for customer satisfaction analyses and/or market and opinion surveys (see point 6.3).

The legal basis for the processing of the data for expanded, needs-based marketing is Art. 6(1)(a) GDPR. The processing of the data for this purpose therefore takes place only with your express consent, which you can voluntarily declare when placing an order in the online shop, when concluding the contract or via the VERBUND online services. Consent to process your data for this purpose is not required for concluding or executing a contract.

6.3.   Purposes for which we process data

The personal data pursuant to point 6.1 are processed on the legal basis of the legitimate interest of VERBUND (Art. 6(1)(f) GDPR) for the following purposes:

  • Direct advertising, in order to send interested parties, customers and former customers general information and offers in connection with the products and services of VERBUND and cooperation partners as well as future product innovations (such as, in particular, also in the areas of mobile wireless, internet, TV, etc.) by post and – if consent is available pursuant to Sec. 174 TKG as amended – by email or SMS or to share communicate it over the phone.
  • Customer relationship management, in order to contact you to send you greetings on special occasions, e.g. at Christmas or on your birthday.
  • Customer segmenting and statistical analyses, in order to categorise our customers into segments in a minimally invasive way with the goal of being able to offer you products and services with additional benefit specifically tailored to you and your consumption behaviour for measure of direct advertising and customer relationship management. For the purpose of customer segmentation, the data received from the data processing in the context of "placing an order in the online shop" and "processing energy contracts of VERBUND AG" (see points 4 and 5) will be analysed using various statistical methods and enriching them with aggregated socio-demographic data. Analysing means that various probability are calculated on the basis of the data merged in this way and with the help of automated analytical models, e.g. interest in gas products, which are used to select appropriate recommendations and offers for you. Moreover, these results are used to create personalised customer segments that are used to gain long-term findings about the needs and interests of our customers.
  • Processing together with data from commercially licensed credit agencies pursuant to Sec. 151 GewO. The personal data collected on you by VERBUND according to points 4.1 and 5.1 as well as the customer segments created on this basis of that personal data can also be linked with third-party data (e.g. address publishers and direct marketing companies), which can also be personal (e.g. socio-demographic information per customer) in order to improve the database and analysis of customer behaviour in a minimally invasive way. By linking such personal data, it is possible to include, for example, the current life phase of a customer, the community size and the purchasing power in the analysis.
  • Performing of customer satisfaction analyses as well as of market and opinion surveys.

Overall, VERBUND aims to use these measures to be able to provide you with a better offering by:

  • aligning the product range to your customer needs, so that we can send you offers individual tailored to you,
  • personalising the customer communication, so that you find offers which fit your wishes and allow you to receive altogether less advertising,
  • simplifying procedures such as concluding contracts or placing online orders, so that you get to your goal faster.
  • improving our service quality and improving or developing new, innovative products and services (e.g. services for optimising your energy consumption).

Expanded marketing measures with personalised (profiled) offers:

Only if you have granted VERBUND your voluntary consent (Art. 6(1)(a) GDPR) to process your data for additional marketing measures will processing of personal data pursuant to point 6.1 be carried out in order to be able to send you differentiated (profiled) product offers on the basis of the created customer profiles. This kind of data processing involves profiling pursuant to Art. 4(4) GDPR with increased intervention intensity. Target group selections are made from the created customer profiles in order to provide you with individualised and differentiated advertising and marketing measures as well as offers and in order to develop product optimisations via aggregated evaluations.

Consent to process your data for this purpose is not required for concluding or executing a contract. You may revoke your consent for this processing voluntarily and you can revoked your consent at any time with effect for the future, free of charge (see point 6.6). Even if you withdraw your consent, the lawfulness of processing operations carried out until you have withdrawn your consent shall not be affected.

6.4.   Retention period

VERBUND uses your personal data after the end of the business relationship for processing pursuant to point 6 for up to three years after your last contact with us, unless you object to the use of your data for this purpose beforehand or your granted consent is revoked. 

6.5.   Data recipients

The data may be transmitted to commissioned service providers for order processing (order processor) or to other recipients pursuant to point 2.

6.6.   Objection and revocation of consent

You may object at any time to the processing of these data for the purposes of undertaking customer support measures and for marketing purposes that we base on our legitimate interest (see point 11 below).

A customer may withdraw their voluntarily granted consent at any time without giving reason and with effect for the future by communicating to VERBUND by letter, email or telephone without further costs.

Postal address: VERBUND AG, Am Hof 6a, 1010 Vienna
Email address: datenschutz@verbund.com
Service line: 0800 210 210

7. Processing in the context of "participating in competitions"

7.1.   Scope of the processing of personal data and their source

When you participate in competitions of VERBUND AG, we will process the following data collected from you: information about your person such as gender, title, name, address as well as your contact details such as telephone number and/or email address as well as information related to the competition.

These data are provided by you on a voluntary basis; they are neither legally nor contractually prescribed. However, if you do not provide these data, you will not able to participate in the competition.

7.2.   What is our legal basis for processing personal data?

The legal basis for the processing of data pursuant to point 7.1. is Art. 6(1)(b) GDPR and therefore the processing for the fulfilment of a contract and for the implementation of pre-contractual measures. The storage and processing of the data is required in order to hold the competition and to inform you about any prizes.

Our legitimate interest pursuant to Art. 6(1)(f) GDPR consists of processing the competition for you to the best of our ability as well as aligning our marketing strategy with this.

Should your data be published in the event of a win, we will obtain your voluntary consent in this regard pursuant to Art. 6(1)(a) GDPR.

When sending out direct marketing, VERBUND complies with the provisions under communication law in accordance with Art. 174 TKG 2021 (Telecommunications Act). If you have given us your voluntary consent to send information regarding the competition to you by email (newsletter), the legal basis of the processing of data for this purpose is Art. 6(1)(a) GDPR.

7.3. Purpose of the data processing

The personal data listed under point 7.1. will be processed by VERBUND for the purpose of holding the competition. If you have given us your consent to the sending of information by email for the purposes of processing your data, then the data listed under point 7.1. will also be processed for this purpose (see point 9).

7.4. Retention period

We process your data for as long as is necessary for holding the competition and will delete them immediately after the end of the competition, unless the data also have to be processed in accordance with statutory retention obligations or you have given us your voluntary consent to the sending of information by email.

7.5. Data recipients

The data may be transmitted to commissioned service providers for order processing (order processor) or to other recipients pursuant to point 2.

8. Data processing in the context of "Energy data recording via the Power-Meter and the Power-Meter app"

8.1.   Scope of the processing of personal data and their source

Data collected from the data subject (information pursuant to Art. 13 GDPR):

The setup of a battery store and the installation of an electric car charging station ("wallbox") within the scope of a rental or purchase agreement for a photovoltaic system, incl. accessories and expansion components pursuant to point 5, also encompasses the installation of a power meter in your fuse/distribution box. With the installation of a power meter ("meter"), the following personal data are recorded directly by the meter when the energy data transmission feature of the meter is activated or when the VERBUND power meter app ("app") is used, and automatically read by us via a data connection and transferred to our systems:

  • Energy and power readings such as total power output, generated and stored energy per meter and activated data interface;
  • Metadata per meter and activated data interface such as device serial numbers, hardware version, firmware version, etc.;
  • Diagnostic data for operation and troubleshooting such as error codes;
  • VERBUND online services login data such as user name and password ("VERBUND ID");User-specific designations such as meter designation;
  • Date and time at which the app is accessed.

8.2.   What is our legal basis for processing personal data?

The legal basis for the processing of data pursuant to point 8.1. is Art. 6(1)(a) GDPR and therefore your voluntary consent to the meter transmitting energy data.

Where the data processing only concerns the data regarding your use of the app (date and time at which the app is accessed, device ID), we justify the processing on the basis of our legitimate interest in accordance with Art. 6(1)(f) GDPR, which consists of giving our app a user-friendly design, expanding existing features with the customer in mind and protecting our app against errors.

8.3.   Purposes for which we process data

The personal data recorded by the meter and listed under point 8.1. will be processed by VERBUND for the purpose of data analysis, visualisation, advice, notification, load control and load optimisation.

In the course of using the app, the energy and power readings of the meter will be accessed in order to be able to show these to the user in the app. The readings are temporarily stored locally in the app for faster presentation until the app is uninstalled. This is necessary in order to display the correct meter in the app or to visualise the correct data. The additional data on the meter are processed in the course of using the app for the correct presentation and for calculations in the app. To maintain the functionality of the app and for continuous improvement of the system, the following tools are used via third-party add-ins:

Firebase Crash Reporting

To receive feedback about errors in the app and the types of end device on which these errors occur, error data are analysed via Firebase Crash Reporting. This involves transmitting Instance IDs and crash traces to Google Inc. which do not reveal any information about the user. This third-party application can be deactivated in the settings at any time. The app also functions fully without your consent.

Google Analytics for Firebase

Google Analytics for Firebase is used to analyse use of the app. The data obtained will be used on the one hand to expand existing features with the customer in mind and on the other to develop new and meaningful functionalities. Google Analytics for Firebase is used solely on the basis of your voluntary consent.

Google is a third-party provider with registered office outside the EU or outside the EEA, namely in the USA. There is currently no adequacy decision for the USA in the sense of Art. 45 GDPR confirming an appropriate level of protection in third countries and no suitable guarantees pursuant to Art. 46 GDPR. Accordingly, data are transferred to the USA solely on the basis of your prior, express and voluntary consent pursuant to Art. 49(1)(a) GDPR in conjunction with Art. 6(1)(a) GDPR. Risks involved with the transmission of data are that US authorities, such as, example, US secret services, access your data for control and monitoring purposes and you are not informed about these activities. There is also a risk that you will not have any effective legal remedy against such access.

This third-party application can be deactivated in the settings at any time. The app also functions fully without this consent.

8.4.   Duration of the data processing

The data listed under point 8.1 will be processed until you revoke your consent to the transmission of energy data by the meter. The revocation of your consent does not affect the lawfulness of the processing performed to date. If the data processing concerns only the data regarding your use of the app and legitimate interest is based on the legal justification, this data processing will be performed for the duration of use of the app.

8.5.   Data recipients

The data may be transmitted to commissioned service providers for order processing (order processor) or to other recipients pursuant to point 2.

9. Processing in the context of "Customer survey for marketing purposes"

9.1.   Scope of the processing of personal data and their source

Should you, as a customer of VERBUND, participate in a voluntary survey for the purposes of market research, we will, depending on the type of customer survey, process key personal and communication data (gender, title, name, address, email address), key product and contract data (products purchased, energy consumption, plant number, customer number, length of the customer relationship, payment modalities), any reaction data to marketing campaigns (customer contact points, participation in promotions, Eco-Club participation, number of customer bonuses), and other survey-specific data.

9.2.   What is our legal basis for processing personal data?

The legal basis for the processing of data pursuant to point 9.1. is Art. 6(1)(a) GDPR and therefore your voluntary consent to participate in the customer survey.

9.3.   Purposes for which we process data

The personal data listed under point 9.1. will be processed by VERBUND for the purpose of holding the customer survey and carrying out market research.

9.4.   Retention period

We process your data for as long as is necessary for holding the customer survey and render it anonymous immediately after the end of the customer survey. In this case, any personal reference will be irretrievably removed, which shall also remove any obligation to erase the data under data protection law.

9.5.   Data recipients

The data may be transmitted to commissioned service providers for order processing (order processor) or to other recipients pursuant to point 2.

10. Processing in the context of "newsletter"

10.1.   Scope of the processing of personal data and their source

If you subscribe to a newsletter of VERBUND, we will process information about your person such as gender, title, name, address as well as your contact details such as telephone number and/or email address as well as your view and click rates.

The provision of these data by you is voluntary. However, if you do not provide the data, it will not be possible to send you any newsletters.

10.2.   What is our legal basis for processing personal data?

The legal basis for the processing of data pursuant to point 10.1. is Art. 6(1)(a) GDPR and therefore your voluntary consent to receive the newsletter. With your consent, we will also evaluate your use of our email newsletter in order to further optimise our email newsletter and our marketing in line with your interests and adapt it to better suit your needs. To this end, we will process whether you have opened our newsletter and which contents you clicked on in particular.

Your consent can be withdrawn at any time without giving reason and with effect for the future by, for example, clicking on the link in the email or by communicating with VERBUND by letter, email or telephone without further costs. This revocation will not affect the lawfulness of any processing done beforehand on the basis of the consent.

Postal address: VERBUND AG, Am Hof 6a, 1010 Vienna
Email address: datenschutz@verbund.com
Service line: 0800 210 210

10.3.   Purpose for which we process data

The personal data listed under point 10.1. will be processed by VERBUND for the purpose of sending information about products and services of VERBUND by email.

10.4.   Retention periods

Your data will be processed for as long as you continue to receive the newsletter and until you revoke your voluntary consent.

10.5.   Data recipients

The data may be transmitted to commissioned service providers for order processing (order processor) or to other recipients pursuant to point 2.

11. Processing in the context of "Application to the VERBUND hardship fund"

11.1. Scope of the processing of personal data and their source

When you apply for funds from the VERBUND hardship fund, we will process the master data we hold about you, such as gender, title, name and customer number as well as your indicated hardship reason and, in particular, all documents uploaded by you as evidence for the hardship reason. The specific scope of the data collected from you will depend on the hardship reason.

These data are provided by you on a voluntary basis; they are neither legally nor contractually prescribed. However, if you do not provide these data, VERBUND will not be able to process your application accordingly.

11.2. What is our legal basis for processing personal data?

The legal basis for the processing of data pursuant to point 11.1. (excluding special categories of personal data) is Art. 6(1)(b) GDPR and therefore processing for the fulfilment of a contract and for the implementation of pre-contractual measures (conclusion and processing of the funds) as well as our legitimate interest pursuant to Art. 6(1)(f) GDPR, which consists of checking your application and handling it in the best way possible.

The legal basis for the processing of any special categories of personal data pursuant to point 9 GDPR (e.g. health-related data) is Art. 6(1)(a) GDPR and therefore your explicit voluntary consent. You may withdraw your consent at any time with effect for the future. Even if you withdraw your consent, the lawfulness of processing operations carried out until you have withdrawn your consent shall not be affected. Please note that for certain hardship reasons, the processing of special categories of personal data can be a key prerequisite for the granting of funds from the VERBUND hardship fund and this could be rendered more difficult or impossible in the case of revocation.

11.3. Purpose of the data processing

The personal data listed under point 11.1. will be processed by VERBUND for the purpose of executing your application, especially for checking the indicated hardship reason and for the granting of funds from the VERBUND hardship fund.

11.4. Retention period

We process your data to execute your application, to check the indicated hardship reason and to grant funds from the VERBUND hardship fund for not longer than a period of six months from the date of application. A longer period of processing will take place only where this is required in individual instances to fully execute your application, as long as the data do not also have to be processed within the scope of statutory retention obligations.

11.5. Data recipients

The data may – where required for the purpose indicated under point 11.3 – be transmitted to commissioned service providers for order processing (order processor) or to other recipients pursuant to point 2.

12. Processing in the context of "VERBUND-charging assistant"

12.1. Scope of the processing of personal data and their sources

Collection of personal data from the data subject (Art. 13 GDPR):

When registering for and using the VERBUND-charging assistant and from the moment of connection of devices used by the customer (e.g. inverter, wallbox, etc.) and ongoing data transmission, the following information – depending on the respectively connected device – will be collected from the customer or read out directly via the VERBUND-charging assistant and transmitted to our systems:

  • Registration data of the customers such as email address, first and last name, device-specific data, user name, password;
  • Manufacturer-specific information needed to authorise the connection of the device to the VERBUND-charging assistant;
  • Metadata per device and activated data interface such as device serial numbers, hardware version, firmware version, etc.;
  • Energy and power readings such as total power output, generated and consumed energy;
  • Device status (connectivity of charging plug, plug-in and unplug time);
  • Information on charging procedures at wallboxes (start and end time of the charging sessions, charging power, energy quantities, number of used charging phases);
  • Charge and discharge capacity of a battery store and the current charge status;
  • User-specific designation of the device;
  • User-specific logs on the behaviour of the device;
  • Manufacturer-specific operating data of the device.

The data read from a device may vary depending on the manufacturer-specific interface of the device used. Changes and adjustments can also be made by the manufacturer at any time without the knowledge of VERBUND. You can usually find the current version of the manufacturer-specific data interface on the website of the respective device manufacturer.

12.2. What is our legal basis for processing personal data?
On the basis of your registration for and use of the VERBUND-charging assistant, the legal basis for the processing of data pursuant to point 12.1. is Art. 6(1)(b) GDPR and therefore the processing for the fulfilment of a contract and for the implementation of pre-contractual measures.

Where the data processing only concerns the user-friendly design of the app interface and new functions, we justify the processing on the basis of our legitimate interest in accordance with Art. 6(1)(f) GDPR, which consists of giving the VERBUND-charging assistant a user-friendly design, expanding existing features with the customer in mind and protecting the VERBUND-charging assistant against errors.

12.3. Purpose of the data processing
The data listed under point 12.1 and collected from the customer while registering for the VERBUND-charging assistant are processed by VERBUND for the purpose of checking suitability for using the VERBUND-charging assistant.

The personal data listed under point 12.1. ad collected during use of the VERBUND-charging assistant will be processed by VERBUND for the purpose of fulfilling the contract. The VERBUND-charging assistant is a service for customers, giving them the possibility to connect and administer certain devices (e.g. inverter, wallbox, etc.), in order to be able to control these devices, visualise energy flows or perform calculations of commands for controlling energy flows. Device-specific operating data are also processed for the purpose of error monitoring.

Data are also processed for the purpose of giving the interface of the VERBUND-charging assistant a user-friendly design, adapting functions and features to user behaviour or developing new functions with the greatest possible added value for users and protecting the VERBUND-charging assistant against errors.

12.4. Duration of the data processing
The data listed under point 12.1 and collected from the customer while registering for the VERBUND-charging assistant are processed by VERBUND for the purpose of checking suitability for using the VERBUND-charging assistant will be processed until it can be finally determined whether use and connection of the devices used by the customer is possible or entirely ruled out, subject to a maximum duration of two years from the date of registration.

The data listed under point 12.1 will be processed following successful registration until the end of use of the VERBUND-charging assistant, as long as the data do not also have to be processed within the scope of statutory retention obligations. A termination of use – whether on the basis of your cancellation or a block on our part – does not affect the lawfulness of the processing to date. By breaking the data link between the devices used by the customers or by closing the account, no further energy or other data can be collected via the devices used by the customers.

12.5. Data recipients
The data may be transmitted to commissioned service providers for order processing (order processor) or to other recipients pursuant to point 2.

13. Your rights
In principle, you have the right to information, correction, erasure, restriction, data portability, revocation of a granted consent and objection in respect of your data processed by VERBUND. To exercise these rights, please contact datenschutz@verbund.com. If you believe that the processing of your data violates data protection law or your data protection claims have otherwise been violated in any way, you can submit a complaint to the national supervisory authority where you live. In Austria, this supervisory authority is the Data Protection Authority.

You can find further details on your rights in the section "Data subjects' rights" at https://www.verbund.com/en-at/data-protection.

Version: September 2023

It is important for VERBUND Energy4Business GmbH and VERBUND Energy4Business Germany GmbH (hereinafter "VERBUND") to protect your personal data. We therefore comply with the applicable legal regulations for the protection, lawful handling and secrecy of personal data as well as data security, in particular the General Data Protection Regulation ("GDPR") and the respectively applicable data protection provisions. The following information describes which personal data we will process if necessary.

1. Name and address of the Data Controller

Responsible for the processing of your personal data in accordance with the data protection provisions for the initiation and processing of energy trading transactions or energy trading-related contracts (e.g. contracting) as well as for the newsletter / sending of information by email is:

VERBUND Energy4Business GmbH
Am Hof 6a
1010 Vienna

and for the initiation and processing of energy trading-related contracts (e.g. contracting) as well as for the newsletter / sending of information by email in Germany:

VERBUND Energy4Business Germany GmbH
Luise-Ulrich-Straße 20
80636 Munich, Germany

The contact details of the data protection officer: datenschutz@verbund.com.

2. Data processing in the context of "initiating and processing energy trading businesses or energy trading-related contracts"

2.1. What kind of personal data will we process?
The following personal data, which you have disclosed to us when concluding an energy trading business or an energy trading-related contract (e.g. contracting) and will subsequently be collected in the course of ongoing contractual fulfilment, will be processed, namely: company name (esp. sole traders), title, gender, first name, last name, address, email address, phone number, contact details and function designations of contact persons and employees, contents of phone calls, creditworthiness data, CDD data (incl. negative media reporting), sanction list information (as the case may be, date of birth, passport number, citizenship), payment methods, bank details, billing details, metering points of your facilities, company register number, EIC, shipper code, VAT Reg. No., ACER code and LEI.

Within the scope of initiating and processing a contracting contract (e.g. for PV systems, battery storage, charging points) and related contracts, the following personal data, in particular, are also processed: Data on your property or location (such as land registry number, property relationships on the site, plans, photos, etc.), facility data as well as other data that are necessary for performing the service (information pursuant to Art. 13 GDPR).

Prior to concluding a contract and during an ongoing contractual relationship, VERBUND will use the data disclosed by you and additionally collected by us to obtain information about your creditworthiness from the rating agency Moody's or the credit agencies KSV1870 and/or Creditreform as well as further information on you from Factiva (Dow Jones) and/or Bureau van Dijk (Compliance Catalyst) (information pursuant to Art. 14 GDPR).

2.2. What is our legal basis for processing personal data?
The legal basis for the processing of data pursuant to point 2.1. is Art. 6(1)(b) GDPR and therefore the necessity for the fulfilment of a contract and for the fulfilment of legal obligations pursuant to Art. 6(1)(c) GDPR. With regard to energy trading transactions, such obligations can arise in particular from: the Electricity Industry and Organisation Act, the Natural Gas Management Act, the Industrial Code, the Green Electricity Act, the Federal Energy Efficient Act, EU regulatory requirements like sanction lists, REMIR, EMIR, MAR and MiFID.
VERBUND also has a legitimate interest pursuant to Art. 6 (1)(f) GDPR to learn more about your creditworthiness and integrity as required before concluding a contract and during an existing contractual relationship with you, in order to prevent payment defaults in particular, but also to ensure compliance with the provisions on terms of compliance. VERBUND also has a legitimate interest in transmitting data to another group company for customer support and marketing for internal purposes (selection for the execution of advertising measures).
The provision of data by you is voluntary; however, if you do not provide these data, the prerequisites for concluding a contract or for contract processing on the part of VERBUND will not be satisfied.

2.3. Purpose of the data processing
We process your data under point 2.1. for the purposes of concluding, executing, modifying and terminating the contract with you as well as for billing you.

2.4. Retention period
These data will be erased after the termination of the contractual relationship with you, unless the data are needed beyond the statutory retention obligations (e.g. those according to Art. 212 Corporate Code (UGB) or Art. 124 et seq. Federal Tax Code (BAO) in Austria, Arts. 147 Federal Tax Code (AO) or 257 Commercial Code (HGB) in Germany) or for as long as claims arising from the contractual relationship can be asserted.

2.5. Data recipients
We will forward the data to third parties only where required for the fulfilment of (pre-)contractual or statutory obligations, or where justified for the maintenance of our legitimate interests. Your data may, for example, be passed to joint venture partners or group companies in order to be able to fulfil existing contractual obligations towards you. As required, we will transmit your personal data to external parties, e.g. auditors, insurers or legal representatives, to the extent necessary.

The data can be transmitted to commissioned service providers in their capacity as processor or, where legally necessary, to other market participants in the energy market (e.g. grid operators) as well as to authorities and public bodies (e.g. regulatory or financial authorities).

3. Data processing in the context of "newsletter / sending of information by email"

3.1. What kind of personal data will we process?
If you subscribe to a newsletter of VERBUND or request VERBUND to send information by email, we will process the following data: information about your person such as gender, title, name, email address as well as information about your company and position.
The provision of these data by you is voluntary. However, if you do not provide the data, it will not be possible to send any newsletters or information to you by email.

3.2. What is our legal basis and purpose for processing personal data?
The legal basis for the processing of data pursuant to point 3.1. is Art. 6(1)(a) GDPR and therefore your voluntary consent to receive the newsletter or information by email.
You have the right to withdraw your voluntary consent at any time without giving reason and with effect for the future by, for example, via the link contained in the email or in writing by email without incurring further costs to the respective data controller named in the declaration of consent and to datenschutz@verbund.com.
The personal data listed under point 3.1 will be processed by VERBUND for the respective purpose defined in the voluntary declaration of consent, such as, for example, the purpose to send information about activities, products, offers and services, competitions or events of VERBUND, to send invitations to events organised by VERBUND, and to send VERBUND publications and/or about other VERBUND-related topics, or about surveys on the satisfaction with services and offers of VERBUND.

3.3. Retention period
Your data will be processed for as long as you continue to receive the newsletter/information by email, and for as long as you have not revoked your voluntarily given consent for the purpose in question.

3.4. Data recipients

The data will be forwarded to third parties only where required for the fulfilment of (pre-)contractual or statutory obligations, or where permitted within the scope of your voluntarily granted consent. For example, as required, we will transfer your personal data to the external parties, e.g. auditors, insurers or legal representatives, to the extent necessary. Personal data will be rendered anonymous if possible.
Your personal data may be sent to commissioned service providers for order processing.

4. Rights of the data subject

In principle, you have the right to information, correction, erasure, restriction, data portability, revocation of a granted consent and objection in respect of your data processed by us. To exercise these rights, please write to us at datenschutz@verbund.com. If you believe that the processing of your data violates data protection law or your data protection claims have otherwise been violated in any way, you can submit a complaint to the national supervisory authority where you live. Responsible in Austria is the Data Protection Authority (Datenschutzbehörde (DSB, Barichgasse 40-42, 1030 Vienna, https://www.data-protection-authority.gv.at/) and in Bavaria the Data Protection Authority for the State of Bavaria (Bayerische Landesamt für Datenschutzaufsicht (BayLDA, Promenade 18, 91522 Ansbach, www.lda.bayern.de).

You can find further details on your rights in the section "Data subjects' rights" at www.verbund.com/en-at/data-protection.

As at: July 2023

It is important for VERBUND Tourismus GmbH to protect your personal data and to explain to you how we handle them. This privacy statement contains the main data processing activities of VERBUND Tourismus GmbH.

1. Name and address of the Data Controller

Responsible for processing your data is VERBUND Tourismus GmbH, Europaplatz 2, 1150 Vienna ("VERBUND", "we", "us"), reachable on tel: +43 (0)50 313-23 201, email: tourismus@verbund.com.

The contact details of the data protection officer: datenschutz@verbund.com.

2. Data processing in the context of "voucher ordering and processing"

2.1.   What kind of personal data will we process?

In the course of ordering and processing your voucher, the following data will be collected: first name, last name, address, email address, phone number, voucher code, issue date, voucher value, bank details.

2.2.   Legal basis and purpose of the data processing

The legal basis for the processing of data is Art. 6(1)(b) GDPR and therefore the processing for the fulfilment of a contract. The data will be processed by VERBUND for the purpose of ordering the voucher and for the further processing of the contract (conclusion of the contract, sending and redeeming the voucher, billing, etc.).

The provision of contact data by you is voluntary; however, if you do not provide these data, VERBUND will not be able to process your voucher order accordingly or send you a voucher.

2.3.   Retention period

We will process your data for as long as it is necessary to do so for processing the order and contract and beyond, and to the extent that statutory retention periods exist or warranty and limitation periods are still in force.

2.4.   Data recipients

In order to process the personal data, we use service providers (e.g. IT service providers) as processors; in accordance with our orders and instructions, these processors may, under certain circumstances, also have access to personal data in order to be able to render the commissioned services. Your data will not be passed to any third parties for their own purposes without your voluntary consent. As required, we will transmit your personal data to external parties, e.g. auditors, insurers or legal representatives, to the extent necessary. Personal data will be rendered anonymous if possible.

3.    Data processing in the context of "making contact/enquiries"

3.1.   What kind of personal data will we process?

When you make contact with VERBUND and request information or make enquiries, the following data provided by you, depending on the matter in question, will be processed (this depends on the chosen manner of making contact (online, email, phone) and the nature of your enquiry): information about your person such as qualification, title, name, address, contact information such as email address, phone number, type of interest or information about your enquiry, and any other data collected or indicated as necessary when making contact/inquiries, depending on the nature of your enquiry.

The provision of these data by you is voluntary. If you do not provide these data for the handling of your enquiry, VERBUND will not be able to process your enquiry accordingly.

3.2.   What is our legal basis and purpose for processing personal data?

The legal basis for the processing of your personal data is our legitimate interest in accordance with Art. 6(1)(f) GDPR. If the reason for the enquiry/making contact is to conclude a contract, the fulfilment of (pre-)contractual obligations pursuant to Art. 6(1)(b) GDPR is the legal basis. The personal data provided by you will be processed for the purpose of making contact and providing information or handling your inquiry.

3.3.   Retention period

We process your data in order to handle your enquiry and beyond that for a period of three months, so that we can respond appropriately to subsequent questions. A longer retention period will be applied only on the basis of statutory retention periods or for defence purposes in any legal disputes.

3.4.   Data recipients

The data will be forwarded to third parties only where required for the fulfilment of (pre-)contractual or statutory obligations, or where justified for the maintenance of our legitimate interests. For example, as required, we will transfer your personal data to the external parties, e.g. auditors, insurers or legal representatives, to the extent necessary. Personal data will be rendered anonymous if possible.

The data may be transmitted to commissioned service providers (e.g. IT service providers) for order processing.

4.   Data processing in the context of "conclusion and processing of contracts regarding services/offers of VERBUND"

4.1.   What kind of personal data will we process?

If you conclude a contract with VERBUND for specific services or offers (e.g. bookings of certain packages, group offers, seminar rooms, guided tours, bus reservations, etc.), we will in particular process the following personal data from you that you provided to us when concluding the respective contract or that are collected from you during the course of ongoing contract fulfilment: title, gender, first name, last name, address, email address, phone number, invoice address, invoice data, payment method, product or type of service, date or duration of utilisation of the service, and any other data provided, such as, for example, special requests or wishes. For company bookings, the following data in particular will additionally be processed: contact data of the person making the booking (name, phone number, email address), name and address of the company.

The provision of data by you is voluntary; however, if you do not provide these data, VERBUND will not be able to process your booking or the contract accordingly.

4.2.   What is our legal basis and purpose for processing personal data?

The legal basis for the processing of data pursuant to point 4.1. is Art. 6(1)(b) GDPR and therefore the processing for the fulfilment of a contract.

The data will be processed by VERBUND for the purpose of making bookings/concluding contracts and for the further processing of the contract/administration of the booking, customer service, communicating with you and for billing purposes.

4.3.   Retention period

We will process your data for as long as it is necessary to do so for processing the contract and beyond, and to the extent that statutory retention periods exist or warranty and limitation periods are still in force.

4.4.   Data recipients

In order to process the personal data, we use service providers (e.g. IT service providers) as order processors; in accordance with our orders and instructions, these may, under certain circumstances, also have access to personal data in order to be able to render the commissioned services. In fulfilment of statutory or (pre-)contractual obligations, we will also pass your data to recipients outside the company (e.g. authorities, municipalities, financial authorities, contractual and cooperation partners for the fulfilment of the contractual services, payment service providers, etc.). In addition, we will transmit your personal data to external parties, e.g. auditors, insurers or legal representatives, to the extent necessary. Personal data will be rendered anonymous if possible.

5. Data processing in the context of "Newsletter/information by email"

5.1.   What kind of personal data will we process?

If you subscribe to a newsletter of VERBUND or request information from VERBUND by email, we will process, in particular, the following data: information about your person such as gender, title, name, email address, as well as information about your company and position. The provision of these data by you is voluntary. However, if you do not provide the data, it will not be possible to send any newsletters or information to you by email.

5.2.   What is our legal basis and purpose for processing personal data?

The legal basis for the processing of data pursuant to point 5.1. is Art. 6(1)(a) GDPR and therefore your voluntary consent to receive the newsletter or information by email. You have the right to withdraw your voluntary consent at any time without giving reason and with effect for the future by clicking on the link contained in the email or by sending an email to tourismus@verbund.com.

Your data will be processed by VERBUND for the purpose defined in the voluntary declaration of consent, such as, for example, the purpose to send information about activities, offers and services, contests or events of VERBUND, and to send invitations to events organised by VERBUND.

5.3.   Retention period

Your personal data will be processed for as long as you continue to receive the newsletter/information by email, and for as long as you have not revoked your voluntarily given consent for the purpose in question.

5.4.   Data recipients

The data will be forwarded to third parties only where required for the fulfilment of (pre-)contractual or statutory obligations, or where permitted within the scope of your voluntarily granted consent. For example, as required, we will transfer your personal data to the external parties, e.g. auditors, insurers or legal representatives, to the extent necessary. Personal data will be rendered anonymous if possible.

Your personal data may be transmitted to commissioned service providers (e.g. IT service providers) for order processing.

6. Data processing in the context of "Webfotopoint and E-Card Sending"

6.1.   What kind of personal data will we process?

If you have taken a selfie (photo) at certain VERBUND excursion destinations using a photo system provided by VERBUND, this may subsequently be accessed on the VERBUND website www.verbund.com/tourismus, publicly viewed and sent by email (eCard).  The following data will be processed: photos, and the email address provided by you (for sending the eCard). These data are provided by you voluntarily. If you have also consented to the sending of a newsletter, the data provided by you in this regard (name and email address) will be processed for this purpose (see point 5).

6.2.   What is our legal basis and purpose for processing personal data?

The legal basis for the processing of your data is your voluntary consent pursuant to Art. 6(1)(a) GDPR. You may withdraw your voluntarily granted consent at any time with effect for the future and without giving reason by, for example, sending an email to tourismus@verbund.com.

6.3.   Retention period

The photos will be stored by us for a period of 12 months and then deleted, unless you have previously withdrawn your voluntary consent. Your email address will be used to send the eCard and then erased.

6.4.   Data recipients

In order to process the personal data, we use service providers (e.g. IT service providers) as processors; in accordance with our orders and instructions, these processors may, under certain circumstances, also have access to personal data in order to be able to render the commissioned services. In addition, we will transmit your personal data to external parties, e.g. auditors, insurers or legal representatives, to the extent necessary. Personal data will be rendered anonymous if possible.

7. Your rights

In principle, you have the right to information, correction, erasure, restriction, data portability, revocation of a granted consent and objection in respect of your data processed by VERBUND. To exercise these rights, please contact datenschutz@verbund.com. If you believe that the processing of your data violates data protection law or your data protection claims have otherwise been violated in any way, you can submit a complaint to the national supervisory authority where you live. In Austria, this supervisory authority is the Data Protection Authority.

You can find further details on your rights in the section "Data subjects' rights" at www.verbund.com/en-at/data-protection.


As at: March 2023

It is important for VERBUND to protect your personal data and for us to explain to you how we handle them.

We process the personal details of (i) persons or companies with which VERBUND enters into contact, manages contacts and/or contractual or business relationships, and of (ii) e.g. partners in companies, company bodies, managing directors or other employees of the contractual or business partners within the scope of existing or incipient contractual and business relationships.

In doing so, we always comply with the applicable legal regulations for the protection, lawful handling and secrecy of personal data as well as data security, in particular national data protection laws and the General Data Protection Regulation (GDPR).

1. Name and contact details of the data controller

Responsible for the processing of your data within the scope of data processing at VERBUND is the respective VERBUND group company indicated as the contract partner ("VERBUND", "we", "us"), namely:

VERBUND AG, Am Hof 6a, 1010 Vienna,
VERBUND Finanzierungsservice GmbH, Am Hof 6a, 1010 Vienna,
VERBUND Hydro Power GmbH, Europaplatz 2, 1150 Vienna,
VERBUND Innkraftwerke GmbH, Werkstraße 1, 84513 Töging am Inn,
VERBUND Energy4Business Germany GmbH, Luise-Ullrich-Straße 20, 80636 Munich 
VERBUND Energy4Future GmbH, Am Hof 6a, 1010 Vienna,
VERBUND Services GmbH, Am Hof 6a, 1010 Vienna,
VERBUND Green Power GmbH, Am Hof 6a, 1010 Vienna,
VERBUND Energy4Flex GmbH, Am Hof 6a, 1010 Vienna,
VERBUND Energy4Customers GmbH, Erdberger Lände 26A, 1030 Vienna,
VERBUND Thermal Power GmbH & Co KG, Kraftwerkstraße 1, 8410 Fernitz-Mellach,
VERBUND Tourismus GmbH, Europaplatz 2, 1150 Vienna,
VERBUND Energy4Business GmbH, Am Hof 6a, 1010 Vienna,
VERBUND Ventures GmbH, Am Hof 6a, 1010 Vienna,
VERBUND Wind Power Austria GmbH, Europaplatz 2, 1150 Vienna,
VERBUND Wind Power Romania S.R.L., Unimed Center, 8th Tudor Arghezi street, 7th floor, 2nd district, 020945, Bucharest
VERBUND Green Hydrogen GmbH, Am Hof 6a, 1010 Wien
VERBUND Green Hydrogen Sales GmbH, Am Hof 6a, 1010 Wien
Donaukraftwerk Jochenstein Aktiengesellschaft, Innstraße 121, 94036 Passau,
Grenzkraftwerke GmbH, Münchner Straße 48, 84359 Simbach am Inn,
Innwerk AG, Schulstraße 2, 84533 Stammham,
Lestin & Co. Tauch-, Bergungs- und Sprengunternehmen GmbH, Nikolsdorfer Gasse 3, 1050 Vienna,
Österreichisch-Bayrische Kraftwerke AG, Münchner Straße 48, 84359 Simbach am Inn,
VERBUND Green Power Deutschland GmbH, Energie-Allee 1, 55286 Wörrstadt,
VERBUND Green Power Deutschland Photovoltaik GmbH, Lennéstraße 3, 10785 Berlin,
Infrastruktur Bischheim GmbH & Co. KG, Energie-Allee, 55286 Wörrstadt,
Infrastruktur Oberheimbach I GmbH & Co. KG, Energie-Allee, 55286 Wörrstadt.
Parque Eolico Ayamonte S.L., Paseo del Club Deportivo 1, edificio 13, planta 1º izquierda, 28223 Pozuelo de Alarcón (Madrid),
Parque Eolico El Barroso S.L.U., Paseo del Club Deportivo 1, edificio 13, planta 1º izquierda, 28223 Pozuelo de Alarcón (Madrid),
Watt Development SPV 5, S.L.U., Paseo de la Castellana, 163. Planta 7ª. 28046, Madrid,
Watt Development SPV 6, S.L.U., Paseo de la Castellana, 163. Planta 7ª. 28046, Madrid
Watt Development SPV 7, S.L.U., Paseo de la Castellana, 163. Planta 7ª. 28046, Madrid

The contact details of the data protection officer: datenschutz@verbund.com.

2. How are data collected and which data are processed?

Data collected from the data subject (information pursuant to Art. 13 GDPR):
We process those personal data that we receive or collect from you or your contact person when making contact, managing contacts, initiating businesses or during a business relationship. 

Data collected from other sources (information according to Art. 14 GDPR):
We also process personal data that we lawfully receive as necessary from credit agencies or financial services institutes in the course of checking your creditworthiness or integrity from directory publishers and direct marketing companies, as well as from publicly accessible sources (e.g. websites, company register, commercial register, land register, business reports, media) or other third parties.

The following data are processed:
company name, address, company register number, tax number, VAT number, industry, title, gender, first name, last name, address, email address, phone number, as well as any function/position and date of birth, nature of the interest or details about your concerns, payment modalities, bank details, invoice details, if necessary the contract or customer number, contract or order data (e.g. contract term, sales data, volumes), documentation data (e.g. meeting notes, minutes/resolutions of meetings, correspondence such as emails), tape recordings of meetings (following granting of consent), any creditworthiness and integrity data, advertising data, as well as any other data voluntarily provided or collected when making contact or managing contacts and/or within the scope of a (contractual) relationship or data for the fulfilment of statutory requirements.

If communication or collaboration takes place online via audiovisual meeting or conference systems and/or other collaboration tools, the following data, in particular, on participating persons will also be processed: interaction data (start, end, releases, availability status), technical data (IP address, browser, operating system, hardware, LAN or WLAN), technical parameters for video and audio, (chat) messages, shared files, documents and screenshots, recordings of audio and video meetings (if you have granted your voluntary consent for this).
If, within the scope of a contractual relationship, you are listed in a confidentiality section of the insider directory of VERBUND, the start and end (date/time) of your belonging to and the reason for inclusion in the confidentiality section will also be processed. Should you, within the scope of your activity for VERBUND, gain access to insider information about VERBUND, you will be added to the relevant insider list in accordance with the provisions of the EU Market Abuse Regulation and will be legally required to also disclose to us your birth names and your private contact details (telephone number, residential address). This insider list must be sent by us to the Financial Market Authority on request.

3. For what purposes and on what legal basis will your data be processed?

We will process your personal data for the following purposes and on the basis of the following legal grounds:

3.1.   Art. 6(1)(b) GDPR

The processing of your data is required for the fulfilment of a contract entered into with you or for the performance of pre-contractual measures. The purposes of the data processing depend on the specific request/inquiry or on the contract entered into with you and mainly include the

  • Processing of your request/inquiry
  • Initiation of the contract
  • Processing and administration of the contract
  • Execution of the contract.

The data you provide are necessary to fulfil the contract or implement pre-contractual measures. Without these data, we cannot enter into the contract with you or process your request/inquiry.

3.2.   Art. 6(1)(a) GDPR

If you have given us your voluntary consent to process your personal data, this processing will only take place for the purposes set forth in the declaration of consent and to the extent indicated therein.

The voluntarily given consent can be revoked at any time with effect for the future, for example by sending an email to datenschutz@verbund.com. Even if you withdraw your consent, the lawfulness of processing operations carried out until you have withdrawn your consent shall not be affected.

3.3.   Art. 6(1)(f) GDPR

The processing is necessary for the protection of the legitimate interests of VERBUND or a third party. This is the case especially for the following purposes:

  • Creditworthiness or integrity check before entering into a contract as well as during an ongoing contractual relationship, in order to obtain information your creditworthiness and integrity in the case in question (e.g. open invoices, insolvency proceedings, avoidance of payment defaults; compliance with provisions in terms of compliance)
  • Contract partner suitability, auditing, evaluation before contract commencement, in order to establish whether they are best suited for the service to be provided
  • Performance evaluation and quality management during an ongoing contractual relationship with the goal of achieving the best performance for VERBUND
  • Inclusion in and managing databases on the basis of internal VERBUND regulations in the sense of financial market compliance and corruption prevention, occupational safety and/or other internal safety provision, in order to be able to take account of internal precautions/provisions.
  • Data administration incl. all related activities, in particular for the purpose of making contact and communicating
  • Provision and use of audio-visual conference systems and/or other communication and/or collaboration tools
  • Customer satisfaction analyses and stakeholder support
  • Public consultations as part of the planning approval process
  • Direct marketing, in order to be able to offer you information about products and services of VERBUND. You can refuse the data processing of direct marketing in accordance with Art. 21 GDPR. However, electronic communication for advertising purposes (e.g. sending of newsletters) takes place solely on the basis of your explicit and voluntary consent.

3.4.   Art. 6(1)(c) GDPR

The processing of personal data may be necessary in order to fulfil various statutory obligations. In particular, personal data will be processed for the fulfilment of the following legal obligations:

  • Preparation of the annual financial statements
  • Ongoing tax and tax-related obligations
  • Audits of accounts
  • in accordance with stock exchange legislation and the provisions of the Market Abuse Regulation in the sense of financial market compliance (this covers the personal data of persons who have access to insider information on an ad-hoc basis or in the context of projects and who are to be added to the insider list)
  • corporate guidelines
  • requirements in terms of occupation safety and other statutory provisions (such as, for example, in connection with epidemics/pandemics)

3.5.   Art. 6(1)(e) and Art. 9(2)(g) and (i) GDPR

Under certain circumstances, we will record your personal data (in particular name, email address, phone number, address, type and time and contact), in the event of contact with VERBUND employees for the purpose of contact person management (management of contact lists) in connection with an epidemic/pandemic (currently Covid-19). Such processing takes place on the basis of the applicable legal grounds, thus, amongst other things on the basis of the Epidemic Act (in Austria), special measures legislation and regulations (such as, for example, the COVID-19 Measures Act in Austria). By managing contact lists, we perform a task in the public interest. In particular, this means that we are able to contact you as quickly as possible in the event of an incident (suspected infection, confirmed infection) for your protection or that of another person. If you notify us of an illness, we will additionally process your health-related data. Your data will be retained for a period of 4 weeks and forwarded to the responsible offices/persons within VERBUND and to the corresponding legally responsible authorities only if the need arises.

4. How long will your data be stored?

The data will be processed for as long as it takes to complete the respective purpose and then erased, unless the data are needed beyond the statutory retention obligations (e.g. those according to Art. 212 Austrian Corporate Code (UGB) or Art. 124 et seq. Austrian Federal Tax Code (BAO) or other statutory requirements), or for as long as claims arising from the (contractual) relationship can be asserted or this can be justified to protect our legitimate interests. If the data processing is based on your voluntary consent, we will store your personal data until you revoke your consent at the latest.

5. To whom will your data be disclosed?

Your personal data will only be forwarded to third parties where required for the fulfilment of (pre-)contractual or statutory obligations, where justified for the maintenance of our legitimate interests, or where permitted within the scope of granted consent.

Your data will be disclosed to the following recipients:

  • (Group) companies within the scope of (pre-contractual) contract fulfilment, of the legitimate interest or in accordance with granted consent
  • Within the scope of the contractual relationship and in particular in connection with our service obligations, it may be necessary, on a case by case basis, to transmit your personal data to other recipients (e.g. lawyers, notaries, insolvency administrators, debt collection agencies, experts, tax consultants, auditors, stakeholder representatives, banks, financial service providers, mail/courier services and logistics partners, contract and cooperation partners for services linked to your contract).
  • Instructed service providers for order processing (e.g. service providers for payment processing, scanning and printing service providers, IT services)
  • Market participants in the electricity or gas market for the fulfilment of (pre-)contractual and/or statutory obligations
  • Courts, authorities and public bodies

In all cases in which we forward your data to recipients inside and outside of our company, we will always ensure that this is done only on the basis of legal grounds and in a way which ensures that your data will continue to be protected.

6. Your rights

In principle, you have the right to information, correction, erasure, restriction, data portability, revocation of a granted consent and objection in respect of your data processed by VERBUND. To exercise these rights, please contact datenschutz@verbund.com. If you believe that the processing of your data violates data protection law or your data protection claims have otherwise been violated in any way, you can submit a complaint to the national supervisory authority where you live. In Austria, this supervisory authority is the Data Protection Authority.

You can find further details on your rights in the section "Data subjects' rights" at www.verbund.com/en-at/data-protection.

Correct as of June 2023

Privacy statements in connection with the external image of VERBUND

It is important for VERBUND AG to protect your personal data. We therefore comply with the applicable legal regulations for the protection, lawful handling and secrecy of personal data as well as data security, in particular the Data Protection Act as amended ("DSG"), the Telecommunications Act ("TKG") and the General Regulation on Data Protection ("GDPR"). The following information describes which personal data we will process if necessary when you visit our VERBUND websites ("website").

1. Name and address of the data controller

Responsible for the processing of your personal data in accordance with the data protection provisions is:

VERBUND AG
Am Hof 6a
1010 Vienna

The contact details of the data protection officer: datenschutz@verbund.com.

2. Processing in the context of "website"

2.1. What kind of personal data will we process?

During your visit to our website and the VERBUND online services, we will automatically collect the following personal data:

  • Date and time of access to a page of our website
  • Date and time of your login to the VERBUND online services
  • Data about your device (device ID)
  • IP address
  • Name and version of your internet browser
  • Session ID

2.2. What is our legal basis for processing personal data?

Where the data of your visit to our website and online services are concerned, we justify the processing on the basis of our legitimate interest in accordance with Art. 6(1)(f) GDPR, which consists of giving our website a user-friendly design and protecting it against attacks. On the basis of your voluntary consent pursuant to Art. 6(1)(a) GDPR in conjunction with Section 165(3) TKG, we process your personal data to create usage statistics and to display personalised advertising. You can revoke your voluntarily given consent at any time.

2.3. Purpose of the data processing

We process your data relating to the visit to our website and online services for the following purposes:

  • to make our website and online services, including their functions, available to you, and to improve and develop this website further;
  • to detect, prevent and investigate attacks on our website and online services;
  • to create usage statistics;
  • to show personalised page suggestions.

2.4. Retention period

We will generally store your data relating to the visit to our website for a period of three months, and your data relating to the visit to the online services for the duration of the use of your online account as part of an energy supply contract with VERBUND. A longer retention period will apply only to the extent this is required to investigate identified attacks on our website and beyond that only until the end of the relevant limitation periods, statutory retention periods or any legal disputes.

2.5. Data recipients

In order to operate and administer the website, we regularly use IT service providers which, in accordance with our order and instructions, may under certain circumstances also have access to personal data in order to be able to render the commissioned IT services.

We will also transmit your personal data to the following recipients:

  • to external third parties to the extent required by our legitimate interest (e.g. auditors, insurance companies in the event of an insured event, legal representatives as the occasion requires, etc.);
  • to authorities and other public bodies to the extent required by law (e.g. financial authorities, courts, etc.).

Your data will not be passed to any other third parties for their own purposes without your consent.

3. Cookies

3.1. What are cookies?

Our website uses cookies. Cookies are small files that are placed on your device (e.g. computer, smartphone or tablet) when you visit our website. The purpose of cookies is to enable our website to function correctly, to expand the website's functionality and to optimise the website's functions. For example, the website can remember certain inputs and settings (e.g. language, font size) over a certain period of time, which means you do not have to perform repeat inputs and settings each time you visit the website.

There are cookies that require your consent before they can be used on your device and cookies that can be used without your consent because they are technically required for us to render our services ("essential cookies"). In the case of essential cookies, the data processing is required for the purpose of data security measures, to prevent abuse and to optimise the website and is therefore based on our legitimate interests pursuant to Art. 6(1) (f) GDPR in conjunction with Art. 96(3) TKG. We use all other cookies on our website via the cookie banner, solely on the basis of your prior express consent pursuant to Art. 6(1) (a) GDPR.

Our website also gives you the possibility to accept the use of cookies by clicking on the "Agree to cookies" button on our cookie banner, which automatically appears the first time you visit our website or when changes are made. By clicking on the "Reject cookies" button, you reject all non-essential cookies. After clicking on "Settings", you can allow or reject certain categories of cookies. If you do not select the checkbox and click on "Confirm selection", no cookie-based services requiring your consent will be loaded.

3.2. Which cookies are used?

We make use of operationally necessary cookies for our website, in order to offer you an optimal website experience. Additional cookies are only used if you provide your consent. We use these for statistical purposes or to show you information tailored to your requirements. You can decide which categories you would like to allow and can also change your cookie settings at any time. You can find further information on the cookies we use in our cookie banner. By clicking on "Agree to cookies", you consent to the use of all cookies. By clicking on the "Reject cookies" button, you reject all non-essential cookies. To change your cookie settings and allow only certain categories, go to "Settings", modify the relevant checkboxes and click on "Confirm selection". Please note that we also use services of providers located in the United States on our website. If you give your consent to the cookies necessary to use these services, this consent will also apply pursuant to Art. 49 (1) GDPR. It is therefore also possible that authorities located in the United States will be able to access your transmitted data and you will have no effective legal remedy against this.

3.3. How long are cookies stored?

With regard to the storage duration, a distinction must be made between "session cookies" and "persistent cookies".

Session cookies are automatically deleted when you leave our website. Persistent cookies, on the other hand, remain on your terminal device either until the cookies reach an expiry date set by us or you manually delete them from your browser. We use such persistent cookies to recognise you on your next visit to our website. You can find the precise storage duration in our cookie banner.

3.4. How can I deactivate cookies?

You can revoke your consent granted to us at any time with effect for the future by deleting the corresponding cookies and preventing the saving of cookies as described here. You can also decide at your discretion which categories of cookies you would like to allow and can also change your cookie settings in the cookie banner.
In addition, you can also make general changes to all cookie settings at any time via your browser. Most browsers accept cookies automatically. The use of certain cookies may also be required to open a website or to save the objection to the use of other cookies. You can delete all cookies that are already on your computer and you can set most browsers to prevent them from being placed or to require your explicit consent before saving a cookie. You can also separately activate "Block third-party cookies". As a rule, the Help function in the menu bar of your web browser shows you how to reject new cookies and how to deactivate cookies that have already been received. Learn how by visiting, for example: http://www.aboutcookies.org/. In the following you will additionally find a summary of links that provide detailed information on the deactivation of cookies in commonly used browsers.

However, please note that if you deactivate cookies, you may not be able to use all functions of this website to the fullest extent possible. In this case, you may have to manually make a number of settings each time you visit the website and accept that several functions may be impaired.

4. Tools

On the basis of the consent, you voluntarily granted (Art. 6(1) (a) GDPR), VERBUND uses different tools via the cookie banner.

4.1. Google Analytics

VERBUND uses Google Analytics, a web analysis service provided by Google Inc. ("Google"). Google Analytics also uses cookies, which enable analysis of how you use the website. The information generated by the cookies about your usage of this website will be transmitted to a Google server in the USA and stored there. Please note that Google Analytics has been extended on this website with the code "gat._anonymizeIp();", in order to assure the anonymised collection of IP addresses. The IP address of the users is therefore truncated on the website before it is saved on the Google servers (so-called IP masking). The full IP address will therefore not be transmitted to a server of Google in the USA. Only in exceptional circumstances will the full IP address be transmitted to a server of Google in the USA and truncated there. At the request of VERBUND, Google will use the information to analyse the use of the website, to compile reports on the website activities for the website operator, and to render further services associated with the use of the website and the use of the internet.

You can prevent the installation of cookies by making the relevant settings in your browser software (so-called "browser add-on"); however, please note that in this case you may not be able to use all functions of this website to the fullest extent possible.

Furthermore, you can prevent the data generated by the cookie and referring to your use of the website (incl. your previously anonymised IP address) being sent to Google as well as the processing of these data by Google by downloading and installing the relevant browser plugin. The current link is: http://tools.google.com/dlpage/gaoptout?hl=de.

You can find more information on the Terms of Use and Privacy Policy of Google at http://www.google.com/analytics/terms/de.html or http://www.google.com/intl/de/analytics/privacyoverview.html.

4.2. Google Adwords Conversion Tracking

This website uses the service Google Conversion Tracking of Google Ireland Limited. (Google Ireland Limited, Google Building Gordon House, 4 Barrow Street, Dublin D04 E5W5, Ireland). Google Adwords places a cookie on the visitor's computer if the visitor has reached our website via a Google ad. These cookies expire after 30 days and cannot be used to identify the user. If the user visits certain pages of the Adwords customer's website and the cookie has not yet expired, Google and the customer can see that the user clicked on the ad and was forwarded to this page. Each Adwords customer receives a different cookie. Cookies can therefore not be traced via the websites of Adwords customers. The information collected with the aid of the conversion cookie serves to create conversion statistics for Adwords customers who have opted for conversion tracking.

The Adwords customers learn about the total number of users who clicked on their ad and were forwarded to a page provided with a conversion tracking tag. However, they do not receive any information that could allow them to identify users in person. If visitors would prefer not to participate in the tracking method, they can also reject the placing of a cookie required for this – such as through a browser setting that generally deactivates the automatic placing of cookies. Visitors can also deactivate cookies for conversion tracking by setting their browser to block cookies from the domain „www.googleadservices.com“.

You can find more information on how Google uses data at https://www.google.com/intl/de/policies/privacy.

4.3. Google Tag Manager

This website uses Google Tag Manager of Google Ireland Limited (Google Ireland Limited, Google Building Gordon House, 4 Barrow Street, Dublin D04 E5W5, Ireland). Google Tag Manager is a solution that allows marketers to manage website tags through a single interface. The 'Tag Manager' tool itself, which implements the tags, is a cookie-less domain and does not collect any personal data. The tool provides for the triggering of other tags which in turn may collect data. Google Tag Manager does not access these data. If a deactivation has been performed at domain or cookie level, this remains in place for all tracking tags that are implemented with Google Tag Manager.

4.4. Google Signals

VERBUND has activated Google Signals, an additional service of Google Ireland Limited (Google Ireland Limited, Google Building Gordon House, 4 Barrow Street, Dublin D04 E5W5, Ireland). This feature sends aggregated (non-personal) data, such as interests or demographics of Google users who have activated personalised advertisements, to Google Analytics. The data are used by VERBUND for remarketing purposes. Cross-device user behaviour can also be measured. You can find more information about Google Signals at https://support.google.com/analytics/answer/7532985?hl=de.

4.5 Outbrain

This website uses technology from Outbrain (Outbrain UK Limited 5th Floor, The Place 175 High Holborn, London United Kingdom). Outbrain is a provider of native ads and works with publishers worldwide. The Outbrain pixel will not be displayed and the user's data will not be shared if no marketing consent has been given. Such data may consist of: which publisher/placement the click came from, from which device, browser, operating system, ad, time, country, region, interest categorised by the article, the ad that was clicked on. Everything anonymised on an anonymous user ID. The purpose of the Pixel is to facilitate retargeting in the Outbrain network and thereby display relevant ads to users.

5. Plugins

We use social media and other 3rd-party plugins on our website. To ensure optimal protection of your data, we use the service of Shariff for social media plugins. This program prevents the social media services from tracking your visit on our website, as long as you do not actively interact with the social media plugins. Therefore, no direct contact is established between you as a user of our website and the social media service. Only when you actively click the button or otherwise interact with the plugins is the respective social media service able to process your data. In detail:

5.1. Social media plugins used

Facebook: Facebook Inc. (Facebook Ireland Ltd., 4 Grand Canal Square, Grand Canal Harbour, Dublin 2, Ireland); more detailed information: http://www.facebook.com/policy.php

Twitter: Twitter Inc. (Twitter International Company, One Cumberland Place, Fenian Street, Dublin 2, D02 AX07, Ireland); more detailed information: http://twitter.com/privacy

5.2. Google Maps

On this website, map information is provided via the function "Google Maps" of Google Ireland Limited. (Google Ireland Limited, Google Building Gordon House, 4 Barrow Street, Dublin D04 E5W5, Ireland). In the course of using this function, Google also processes data on how this function is used by visitors to our website. You can find more information on how Google uses data at https://www.google.com/intl/de/policies/privacy.

6. Rights of the data subject

In principle, you have the right to information, correction, erasure, restriction, data portability, revocation of a granted consent and objection in respect of your data processed by us. To exercise these rights, please write to us at datenschutz@verbund.com. If you believe that the processing of your data violates data protection law or your data protection claims have otherwise been violated in any way, you can submit a complaint to the national supervisory authority where you live. In Austria, this supervisory authority is the Data Protection Authority. 

You can find further details on your rights in the section "Data subjects' rights" at www.verbund.com/en-at/data-protection.

updated November 2023

It is extremely important for us VERBUND AG, Am Hof 6a, 1010 Vienna, ("VERBUND", "we", "us") to protect your personal data. We therefore comply with the applicable legal regulations for the protection, lawful handling and secrecy of personal data as well as data security, in particular the Data Protection Act as amended ("DSG"), the Telecommunications Act ("TKG") and the General Data Protection Regulation ("GDPR").

1. Name and contact details of the data controller

We act as a responsible party within the meaning of the GDPR in the context of our social media profiles. This is why we inform you about the purposes for which and the legal basis on which we use various social media applications to contact you by means of the following privacy statement.

The contact details of the data protection officer: datenschutz@verbund.com.

We update this privacy statement from time to time, if necessary. It is therefore recommended that you check this page on a regular basis to ensure that you are viewing the most recent version.

2. Social media activities

2.1 Contacting us

When you contact us via our social media pages

  • Facebook https://www.facebook.com/verbundag,
  • Instagram https://www.instagram.com/verbundag,
  • Twitter https://twitter.com/verbundag,
  • LinkedIn https://at.linkedin.com/company/verbundag,
  • Xing https://www.xing.com/pages/verbund or
  • Youtube https://www.youtube.com/@verbundag

we process the data you provide (e.g. customer number, counter point number, full name, address, description of the system or problem, communication with us) for the purpose of answering your enquiry and therefore for implementing pre-contractual measures in accordance with Art. 6(1)(b) GDPR or in the context of our legitimate interests in processing your enquiry (customer support) in accordance with Art. 6(1)(f) GDPR. We will store these data for a maximum of three months after your enquiry has been handled, insofar as other statutory retention periods do not apply.

In this context, we receive your personal data from the respective operator of the social media platform and also transmit your personal data to them. If this results in the transmission of your personal data to countries without an adequacy decision pursuant to Art. 45(3) GDPR, we have put in place suitable guarantees pursuant to Art. 46 GDPR, in order to ensure an appropriate level of data protection for your personal data in the third country. Where such suitable guarantees are unavailable, we will transmit your personal data only on the basis of your express consent. In this case, please note that there is a risk that your data transmitted in this way may be accessed by authorities in these third countries for control and monitoring purposes and that no effective legal remedies are available.

2.2 Social media interaction

You can also interact with us on our social media profiles by clicking various buttons (e.g. "Like", "Share", "Subscribe", "Invite Friends", "Love", "Dislike" etc.) or commenting on content. In this case, we will process your interaction as well as your ("User") name, profile photo and IP address, and, if necessary, any personal data of invited or tagged third parties.

We use this information in accordance with Art. 6(1)(a) and (f) GDPR to respond to your questions and comments, to comment on your opinion/feedback, to provide you with the opportunity to express your opinion or to advertise VERBUND AG and our product range on the platform. We will store the data you have provided yourself until you withdraw your interaction or as long as our content (images, videos, etc.) is online.

2.3 Tracking / marketing campaigns

We automatically process personal data on our social media profiles via the page insight tools of Facebook, Instagram and LinkedIn, in each case together with the platform operator, which provide information about the interaction of visitors and users and serve to optimise your experience on the website or to optimise marketing activities ("tracking data").

Facebook and Instagram

We have entered into the following shared responsibility agreement with Meta Platforms Ireland Ltd, 4 Grand Canal Square, Grand Canal Harbour, Dublin 2, Ireland for our Facebook and Instagram profiles: https://www.facebook.com/legal/controller_addendum

Please refer to the section "How is this information shared?" under the subheading "Partners who use our analytics services" in Facebook's privacy policy at https://www.facebook.com/policy.php to find out which personal data we process together. We use this information in accordance with Art. 6(1)(f) GDPR both to create aggregated analyses of how our social media presence is used and to optimise our marketing activities. These data are stored by Meta in accordance with the time limits outlined at https://www.facebook.com/policy.php (subitem: "Data storage, deactivation and deletion of accounts").

LinkedIn

We have entered into the following joint responsibility agreement with LinkedIn Ireland Unlimited Company, Wilton Place, Dublin 2, Ireland for our LinkedIn profile: https://legal.linkedin.com/pages-joint-controller-addendum

Please refer to LinkedIn's data protection notices to find out which personal data we process together at https://de.linkedin.com/legal/privacy-policy. We use this information in accordance with Art. 6(1)(f) GDPR both to create aggregated analyses of how our social media presence is used and to optimise our marketing activities. These data are stored by LinkedIn in accordance with https://de.linkedin.com/legal/privacy-policy.

3. Data recipients

We also transfer your personal data to external vicarious agents or service providers (commissioned processors) to the extent necessary:

  • to IT service providers and/or providers of data hosting or data processing or similar services;
  • to other service providers, providers of tools and software solutions who also support us in rendering our services and operate on our behalf (incl. providers of marketing tools, marketing agencies, communication service providers and call centres)

All our commissioned processors handle your data only on our behalf and on the basis of our instructions to allow us to provide you with our online service.

We will also transfer your personal data to the following recipients (responsible bodies) to the extent necessary:

  • to VERBUND Group companies to the extent necessary to fulfil our obligations to you
  • to any third parties involved in the fulfilment of our obligations to you (e.g. banks);
  • to other external third parties to the extent required (e.g. auditors, insurance companies in the event of an insured event, legal representatives as the occasion requires, etc.);
  • to authorities and other public bodies to the extent required by law (e.g. financial authorities, etc.).

To the extent that we process your data in a third country outside the European Union (EU) or the European Economic Area (EEA) or we do so within the scope of using third-party services, this will only be carried out if it is necessary for the fulfilment of our (pre-)contractual obligations, on the basis of your explicit and voluntary consent, due to a legal obligation or based on our legitimate interests. We have implemented suitable and proportionate safeguards to ensure that any transfer of your data to the respective third country is in compliance with data protection law. We will provide you with a copy of these suitable safeguards at your request insofar as we process or have your data processed in third countries.

4. Retention period

We store your data for three months in order to process enquiries (and in the event of follow-up questions) through our website or social media pages. In individual cases (such as complaints), the personal data will be retained for the period in which claims can be asserted against us (statutory limitation period of 3 or up to 30 years).

We will store the personal data voluntarily provided on our company websites (e.g. name, comments, interactions, etc.) for as long as you have not removed the corresponding information (e.g. a "Like") or deleted the comment or these have been lawfully deleted by the platform operator within the scope of the terms of use (e.g. in cases of abuse).

5. Data security

We adopt appropriate technical and organisational security measures in order to protect your personal data against accidental or unauthorised destruction, modification or against loss, theft and unauthorised inspection, disclosure, reproduction, use, alteration or access. Moreover, both we and our employees are obliged to adhere to data secrecy and non-disclosure. Our vicarious agents and authorised representatives who are required to have access to your personal data for the performance of their professional duties will also have access and be subject to the same obligations to comply with data secrecy and non-disclosure.

6. Your rights

In principle, you have the right to information, correction, erasure, restriction, data portability, revocation of a granted consent and objection in respect of your data processed by VERBUND. To exercise these rights, please contact VERBUND at datenschutz@verbund.com. If you believe that the processing of your data violates data protection law or your data protection claims have otherwise been violated in any way, you can submit a complaint to the national supervisory authority where you live. In Austria, this supervisory authority is the Data Protection Authority.

You can find further details on your rights in the section "Data subjects' rights" at www.verbund.com/en-at/data-protection.

Correct as of December 2022

It is important for VERBUND to protect your personal data and for us to explain to you how we handle them.

1. Name and contact details of the data controller

Responsible for the processing of your data within the scope of the following data processing is the respective indicated VERBUND group company ("VERBUND", "we", "us"), namely:

VERBUND AG, Am Hof 6a, 1010 Vienna,
VERBUND Hydro Power GmbH, Europaplatz 2, 1150 Vienna,
VERBUND Energy4Business GmbH, Am Hof 6a, 1010 Vienna,
VERBUND Energy4Future GmbH, Am Hof 6a, 1010 Vienna,
VERBUND Energy4Flex GmbH, Am Hof 6a, 1010 Vienna,
VERBUND Services GmbH, Am Hof 6a, 1010 Vienna,
VERBUND Green Power GmbH, Am Hof 6a, 1010 Vienna,
VERBUND Tourismus GmbH, Europaplatz 2, 1150 Vienna,
VERBUND Thermal Power GmbH & Co KG, Kraftwerkstraße 1, 8410 Fernitz-Mellach,
VERBUND Wind Power Austria GmbH, Europaplatz 2, 1150 Vienna,
VERBUND Energy4Business Germany GmbH, Luise-Ullrich-Straße 20, 80636 Munich
VERBUND Innkraftwerke GmbH, Werkstraße 1, 84513 Töging am Inn,
VERBUND Green Hydrogen GmbH, Am Hof 6a, 1010 Wien,
VERBUND Green Hydrogen Sales GmbH, Am Hof 6a, 1010 Wien,
Grenzkraftwerke GmbH, Münchner Straße 48, 84359 Simbach am Inn,
Donaukraftwerk Jochenstein Aktiengesellschaft, Innstraße 121, 94036 Passau,
Österreichisch-Bayrische Kraftwerke AG, Münchner Straße 48, 84359 Simbach am Inn,
Innwerk AG, Schulstraße 2, 84533 Stammham,
VERBUND Green Power Deutschland GmbH, Energie-Allee 1, 55286 Wörrstadt,
VERBUND Green Power Deutschland Photovoltaik GmbH, Lennéstraße 3, 10785 Berlin,
Infrastruktur Bischheim GmbH & Co. KG, Energie-Allee, 55286 Wörrstadt,
Infrastruktur Oberheimbach I GmbH & Co. KG, Energie-Allee, 55286 Wörrstadt.

The contact details of the data protection officer: datenschutz@verbund.com.

2. Processing in the context of "newsletter/information sent by email"

2.1. What kind of personal data will we process?
If you subscribe to a newsletter of VERBUND or request VERBUND to send information by email, we will process the following data: information about your person such as gender, title, name, email address, as well as information about your company and position and, if necessary, other data specific to the enquiry. The provision of these data by you is voluntary. However, if you do not provide the data, it will not be possible to send any newsletters or information to you by email.

2.2. What is our legal basis and purpose for processing personal data?
The legal basis for the processing of data pursuant to point 2.1. is Art. 6(1)(a) GDPR and therefore your voluntary consent to receive the newsletter or information by email. You have the right to withdraw your voluntary consent at any time without giving reason and with effect for the future by, for example, via the link contained in the email or in writing by email without incurring further costs to the respective data controller named in the declaration of consent and to datenschutz@verbund.com.

The personal data listed under point 2.1 will be processed by VERBUND for the respective purpose defined in the voluntary declaration of consent, such as, for example, the purpose to send information about activities, products, offers and services, competitions or events of VERBUND, to send invitations to events organised by VERBUND, and to send VERBUND publications and/or about other VERBUND-related topics, or about surveys on the satisfaction with services and offers of VERBUND.

2.3. Retention period
Your data will be processed for as long as you continue to receive the newsletter/information by email, and for as long as you have not revoked your voluntarily given consent for the purpose in question.

2.4. Data recipients
The data will be forwarded to third parties only where required for the fulfilment of (pre-)contractual or statutory obligations, or where permitted within the scope of your voluntarily granted consent. For example, as required, we will transfer your personal data to the external parties, e.g. auditors, insurers or legal representatives, to the extent necessary. Personal data will be rendered anonymous if possible.

Your personal data may be sent to commissioned service providers for order processing.

3. Processing in the context of "participating in surveys"

3.1. What kind of personal data will we process?
If you participate voluntarily in a survey of VERBUND (online, verbal or in writing), we will process, in particular, the following data: information about your person such as gender, title, name, email address, as well as information about your company and position, IP address (online), and other data or answers/comments voluntarily provided by you within the context of the survey. The provision of these data by you is voluntary. However, if you do not provide these data you will not be able to participate in the survey.

3.2. What is our legal basis and purpose for processing personal data?
The legal basis for the processing of data pursuant to point 3.1. is Art. 6(1)(a) GDPR and therefore your voluntary consent. You have the right to withdraw your voluntary consent at any time without giving reason and with effect for the future by, for example, sending an email without incurring further costs to the data controller named in the declaration of consent or to datenschutz@verbund.com. The personal data listed under point 3.1. will be processed by VERBUND for the purpose of implementing and analysing the information received within the scope of the respective survey.

3.3. Retention period
Your data will be stored for the duration of implementing the survey and beyond that for a period of six months, in order to subsequently process the information provided. If you have given your consent to participate in another survey, your data will be stored until you withdraw your consent.

3.4. Data recipients
The data will be passed to third parties only if you have given us your consent to do so. As required, we will also transmit your personal data to other external parties, e.g. auditors, insurers or legal representatives, to the extent necessary. Personal data will be rendered anonymous if possible. Your personal data may be sent to commissioned service providers (e.g. IT service providers) for order processing.

4. Processing in the context of "competitions"

4.1.   What kind of personal data will we process?
We process the following data for the participation in competitions: information about your person such as gender, title, name, address, as well as your contact details such as telephone number and/or email address, as well as, if necessary, information related to the competition. The provision of these data by you is voluntary. If you do not provide these data, you will not able to participate in the competition.

4.2.   What is our legal basis and purpose for processing personal data?
The legal basis for the processing of these data is Art. 6(1)(b) GDPR and therefore the processing for the fulfilment of a contract or pre-contractual measures. The storage and processing of the data is required in order to hold the competition and to inform you about any prizes. In addition, we will use your personal data for internal marketing purposes, in order to align our marketing strategy. The legal basis for this are our legitimate interests pursuant to Art. 6(1)(f) GDPR. Should your data be published in the event of a win, we will obtain your consent in this regard pursuant to Art. 6(1)(a) GDPR.

4.3.   Retention period
We process your personal data for as long as is necessary for holding the competition and will delete them immediately after the end of the competition, unless these data also have to be stored in accordance with statutory retention obligations.

4.4.   Data recipients
The data will be forwarded to third parties only where required for the fulfilment of (pre-)contractual or statutory obligations, where justified for the maintenance of our legitimate interests, or where permitted within the scope of your voluntarily granted consent. For example, as required, we will transfer your personal data to the external parties, e.g. auditors, insurers or legal representatives, to the extent necessary. Personal data will be rendered anonymous if possible.

The data may be sent to commissioned service providers (e.g. IT service providers and other service providers for processing the competition) for order processing.

5. Data processing in the context of "Making contact/enquiries"

5.1.   What kind of personal data will we process?
When you make contact with VERBUND and request information or make enquiries, the following data provided by you, depending on the matter in question, will be processed (this depends on the chosen manner of making contact (online, email, phone) and the nature of your enquiry): information about your person such as qualification, title, name, address, contact information such as email address, phone number, type of interest or information about your enquiry, and any other data collected or indicated as necessary when making contact/inquiries, depending on the nature of your enquiry. The provision of these data by you is voluntary. If you do not provide these data for the handling of your enquiry, VERBUND will not be able to process your enquiry accordingly.

5.2.   What is our legal basis and purpose for processing personal data?
The legal basis for the processing of your personal data mentioned under point 5.1. is our legitimate interest in accordance with Art. 6(1)(f) GDPR. If the reason for the enquiry/making contact is to conclude a contract, the legal basis for the processing is Art. 6(1)(b) GDPR. The personal data listed under point 5.1. will be processed for the purpose of making contact and providing information or handling your inquiry.

5.3.   Retention period
We process your data in order to handle your enquiry and beyond that for a period of three months, so that we can respond appropriately to subsequent questions. A longer retention period will be applied only on the basis of statutory retention periods or for defence purposes in any legal disputes.

5.4.   Data recipients
The data will be forwarded to third parties only where required for the fulfilment of (pre-)contractual or statutory obligations, or where justified for the maintenance of our legitimate interests. For example, as required, we will transfer your personal data to the external parties, e.g. auditors, insurers or legal representatives, to the extent necessary. Personal data will be rendered anonymous if possible. Your personal data may be sent to commissioned service providers (e.g. IT service providers) for order processing.

6. Your rights

In principle, you have the right to information, correction, erasure, restriction, data portability, revocation of a granted consent and objection in respect of your data processed by us. To exercise these rights, please write to us at datenschutz@verbund.com. If you believe that the processing of your data violates data protection law or your data protection claims have otherwise been violated in any way, you can submit a complaint to the national supervisory authority where you live. In Austria, this supervisory authority is the Data Protection Authority.

You can find further details on your rights in the section "Data subjects' rights" at www.verbund.com/en-at/data-protection.

Correct as of June 2023

It is important for VERBUND to protect your personal data and to explain to you how we handle them.

1. Name and contact details of the data controller

Responsible for the processing of your data under this data processing agreement is VERBUND AG, Am Hof 6a, 1010 Vienna, tel.: +43 (0)50313-0, email: information@verbund.com or another VERBUND company ("VERBUND", "we", "us") identified as the organiser, namely VERBUND Energy4Customers GmbH, Erdberger Lände 26A, 1030 Vienna, VERBUND Green Power GmbH, Am Hof 6a, 1010 Vienna, VERBUND Energy4Business GmbH, Am Hof 6a, 1010 Vienna, VERBUND Energy4Future, Am Hof 6a, 1010 Vienna, VERBUND Hydro Power GmbH, Europaplatz 2, 1150 Vienna, VERBUND Wind Power Austria GmbH, Europaplatz 2, 1150 Vienna, VERBUND Tourismus GmbH, Europaplatz 2, 1150 Vienna, VERBUND Thermal Power GmbH & Co KG, Kraftwerkstraße 1, 8410 Fernitz-Mellach, VERBUND Energy4Business Germany GmbH, Luise-Ullrich-Straße 20, 80636 Munich, VERBUND Green Power Deutschland GmbH, Energie-Allee 1, 55286 Wörrstadt, VERBUND Green Power Deutschland Photovoltaik GmbH, Lennéstraße 3, 10785 Berlin, Grenzkraftwerke GmbH, Münchner Straße 48, 84359 Simbach am Inn, Innwerk AG, Schulstraße 2, 84533 Stammham and VERBUND Innkraftwerke GmbH, Werkstraße 1, 84513 Töging am Inn.

The contact details of the data protection officer: datenschutz@verbund.com.

2. Data processing in the context of "registration for events of VERBUND"

2.1. What kind of personal data will we process?
When you register for events of VERBUND, we will process information about your person such as gender, title, name, address as well as your contact details such as telephone number and/or email address, and under certain circumstances about your company and your position as well as further event-related information. You provide the data on a voluntary basis; however, if you do not provide the data in the fields identified as mandatory, we will not be able to process your registration.

2.2. What is our legal basis and purpose for processing personal data?
The legal basis for the processing of data pursuant to point 2.1. is Art. 6(1)(b) GDPR and thus the fulfilment of a contract. The personal data disclosed as part of the registration will be processed for the purpose of processing the registration and administering the event, incl. the associated communication (e.g. sending out the registration confirmation, place reservation, answering questions, etc.).

2.3. Retention period
Your data will be stored for as long as is necessary for fulfilment of the purpose, and in addition only for as long as they have to be processed within the scope of statutory retention obligations.

2.4. Data recipients
The data will be forwarded to third parties only where required for the fulfilment of (pre-)contractual or statutory obligations, where justified for the maintenance of our legitimate interests, or where permitted within the scope of granted consent. The data may be sent to commissioned service providers for order processing (responsible for the organisation and execution of the event) or to companies pursuant to granted consent. Our service providers include, in particular, providers of IT services and other providers of tools and software solutions, who also support us in rendering our services and operate on our behalf (e.g. service providers for the purposes of event management).

3. Data processing in the context of "Image recordings (photos/videos)"

3.1. What kind of personal data will we process?
If image recordings are made at events of VERBUND, these will be stored and used.

3.2. What is our legal basis and purpose for processing personal data?
The legal basis is Art. 6(1)(f) GDPR and therefore the legitimate interest of VERBUND. Image recordings are processed for the purpose of documenting and presenting events, activities and happenings related to the work or tasks of VERBUND, and stored in the VERBUND archive. Furthermore, the image recordings will be processed for internal purposes and for the purposes of the public relations and press work of VERBUND, made available to participants if necessary and published in printed and electronic media, in particular on social media platforms (Facebook, Twitter, YouTube, etc.). If we are unable to base use of the images on our legitimate interests, we will obtain separate consent for the processing from you pursuant to Art. 6(1)(a) GDPR. You can revoke your voluntarily given consent at any time with effect for the future by sending an email to datenschutz@verbund.com.

3.3. Retention period
The image recordings will be stored for as long as the purpose of documentation exists and no objections are made in respect of this processing. We will also store your personal data for as long as the statutory retention obligations require us to do so. If the processing is based on your voluntary consent, we will store the data until you revoke your consent.

3.4. Data recipients
The image data will only be forwarded to third parties where justified for the maintenance of our legitimate interests and moreover where permitted within the scope of the purpose of processing. The image recordings may be sent to commissioned service providers for order processing.

4. Your rights

In principle, you have the right to information, correction, erasure, restriction, data portability, revocation and objection in respect of your data processed by us. If you believe that the processing of your data violates data protection law or your data protection claims have otherwise been violated in any way, you can submit a complaint to us at datenschutz@verbund.com or to the national supervisory authority where you live. In Austria, this supervisory authority is the Data Protection Authority.

You can find further details on your rights in the section "Data subjects' rights" at www.verbund.com/en-at/data-protection.

Correct as of June 2023

Other privacy statements

It is important for VERBUND to protect your personal data and to explain to you how we handle them.
You can submit your application for a position at VERBUND AG or one of the group companies via the application tool available on the website at www.verbund.com and input the application data directly via the web interface. VERBUND AG is familiar with the management of human resources for VERBUND companies and therefore organises the application process and the application tool centrally for these VERBUND companies.

1. Name and contact details of the data controller

The data controller responsible for processing your data within the scope of this data processing is VERBUND AG, Am Hof 6a, 1010 Vienna together with, in the sense Art. 26 GDPR, the respective VERBUND company, if you have applied to one of them in particular. VERBUND AG has concluded an agreement with the respective data controller pursuant to Art. 26 GDPR ("Joint Controller Agreement"), which regulates the distribution of tasks and obligations under data protection law. You have the right to assert your claims to the data controller, regardless of the Joint Controller Agreement.

The VERBUND companies include the following:
VERBUND Hydro Power GmbH, Europaplatz 2, 1150 Vienna,
VERBUND Energy4Business GmbH, Am Hof 6a, 1010 Vienna,
VERBUND Energy4Business Germany GmbH, Luise-Ullrich-Straße 20, 80636 Munich
VERBUND Energy4Customers GmbH, Erdberger Lände 26A, 1030 Vienna,
VERBUND Services GmbH, Am Hof 6a, 1010 Vienna,
VERBUND Green Power GmbH, Am Hof 6a, 1010 Vienna,
VERBUND Tourismus GmbH, Europaplatz 2, 1150 Vienna,
VERBUND Thermal Power GmbH & Co KG, Kraftwerkstraße 1, 8410 Fernitz-Mellach,
VERBUND Innkraftwerke GmbH, Werkstraße 1, 84513 Töging am Inn,
VERBUND Green Hydrogen GmbH, Am Hof 6a, 1010 Wien,
VERBUND Green Hydrogen Sales GmbH, Am Hof 6a, 1010 Wien,
Grenzkraftwerke GmbH, Münchner Straße 48, 84359 Simbach am Inn,
Innwerk AG, Schulstraße 2, 84533 Stammham,
smart Energy Personal GmbH, Dietrichgasse 27/3.OG, 1030 Vienna
Email: office.hpr@verbund.com

The contact details of the data protection officer: datenschutz@verbund.com.

2. What kind of personal data will we process?

If you apply to VERBUND, we will process the following personal data (mandatory fields):

  • Information about your person, such as title, first name, last name, date of birth, citizenship
  • Information about how we can reach you, such as email, phone number
  • Information about your desired gross annual salary, earliest possible start date, information such as how you heard about the job
  • Curriculum vitae

Should you not provide the data in the fields marked as mandatory, we will not be able to process your application, as certain details about you are required in order to assess your suitability for the position.

All other information that is not marked as mandatory, such as

  • address,
  • or other especially vulnerable data (e.g. religious belief),
  • and other documents voluntarily uploaded by you

can be voluntarily filled out or disclosed by you. These data will also be handled by VERBUND and the VERBUND company you applied to for the same purpose as the mandatory fields.
Please note that you are not required to share especially vulnerable data when submitting an application online. If you disclose such information voluntarily and without being asked to do so, you declare your consent that such data will be processed and used for the indicated purposes. You can revoke your voluntarily given consent at any time with effect for the future.

3. Legal basis and purpose of the data processing

The legal basis for the processing of applicant data is Art. 6(1)(b) GDPR and therefore the processing for the fulfilment of a contract or the performance of pre-contractual measures. By submitting an application, you are asking us to process your applicant data within the scope of the application, which requires the data processing described.
If this concerns the processing of any voluntarily provided (including especially vulnerable) data, we will base the processing on your consent in the sense of Art. 6(1)(a) in conjunction with Art. 9(2)(a) GDPR.
If you have given us consent to process your data, this processing will take place for the purposes set forth in the declaration of consent and to the extent agreed therein. You may revoke your consent with effect for the future at any time, free of charge, e.g.:

  • by letter (VERBUND AG, Am Hof 6a, 1010 Vienna),
  • Email (office.hpr@verbund.at).

Even if you withdraw your consent, the lawfulness of processing operations carried out until you have withdrawn your consent shall not be affected.

4. Retention period

We will electronically store your personal data for the duration of the application process and thereafter for as long as claims arising from the application can be asserted. Your data will in any case be stored for the duration of six months after completion of the application process. Should an employment relationship come into existence, we will store you data for the duration of employment and erase them following the termination of your appointment upon expiry of the statutory retention obligations.
If you have granted your consent for the processing of certain data, your data may be erased earlier following the withdrawal of your consent.

5. Data recipients

Your data may be forwarded to the following recipients:

  • commissioned service providers for order processing ("processor")
  • (group) companies as joint data controllers (within the scope of (pre-contractual) contract fulfilment) or in accordance with granted consent
  • to external third parties to the extent required by our legitimate interest (e.g. legal representatives as the occasion requires)
  • courts, authorities and public bodies.

VERBUND works only with processors who provide sufficient guarantees that appropriate technical and organisational measures are implemented in such a way that the processing is carried out in accordance with the requirements of the applicable national data protection laws and the General Data Protection Regulation ("GDPR") as amended. The processing performed by a processor is always done on the basis of a contract that binds the processor to the obligations under data protection law. VERBUND uses processors outside the European Union only if an adequacy decision has been taken by the European Commission for the third country concerned or if appropriate data protection guarantees are available (e.g. binding internal data protection regulations or EU standard contract clauses).

6. Your rights

In principle, you have the right to information, correction, erasure, restriction, data portability, revocation of a granted consent and objection in respect of your data processed by VERBUND. To exercise these rights, please contact VERBUND at datenschutz@verbund.com. If you believe that the processing of your data violates data protection law or your data protection claims have otherwise been violated in any way, you can submit a complaint to the national supervisory authority where you live. In Austria, this supervisory authority is the Data Protection Authority.

You can find further details on your rights in the section "Data subjects' rights" at www.verbund.com/en-at/data-protection.

Correct as of December 2022

It is important for VERBUND to protect your personal data. We therefore comply with the applicable legal regulations for the protection, lawful handling and secrecy of personal data as well as data security, in particular the General Data Protection Regulation ("GDPR"). The following information describes which personal data we will process if necessary when you visit an area under video surveillance by VERBUND. The data controller for the respective area under video surveillance is directly named on the information board.

1. Name and address of the Data Controller

Responsible for processing your personal data in accordance with the data protection provisions is, depending on the area (location) under video surveillance:
 
VERBUND AG
Am Hof 6a
A-1010 Vienna

VERBUND Hydro Power GmbH
Europaplatz 2
A-1150 Vienna

VERBUND Tourismus GmbH
Europaplatz 2
A-1150 Vienna

Innwerk AG
Schulstraße 2
D-84533 Stammham

Österreichisch-Bayrische Kraftwerke AG
Münchner Straße 48
D-84359 Simbach am Inn

Donaukraftwerk Jochenstein AG
Innstraße 121
D-94036 Passau

VERBUND Thermal Power GmbH & Co KG  
Kraftwerkstraße 1
A-8410 Fernitz-Mellach

VERBUND Innkraftwerke GmbH
Werkstraße 1
D-84513 Töging am Inn

VERBUND Services GmbH
Am Hof 6a
A-1010 Vienna

VERBUND Energy4Business Germany GmbH
Luise-Ullrich-Straße 20
D-80836 München

The contact details of the data protection officer: datenschutz@verbund.com.

2. Processing in the context of "video surveillance"

2.1. What kind of personal data will we process?
As part of the video surveillance activities, we process the following personal data:

  • Image data of the from the data subject(s),
  • Place in which the image was taken,
  • Time at which the image was taken,
  • Identity of the data subject(s), where recognisable from the recording,
  • Role of the data subject(s) (e.g. perpetrator, victim, witness), where recognisable from the recording.

Please note that drones are used at the power plants for planning, controlling, security, maintenance or other documentary purposes (e.g. for condition inspections, preservation of evidence, creation of planning or permission documents). It cannot be ruled out that visitors to the power plants will be recorded by a drone. In order to minimise data, recordings of identifiable visitors will be pixelated where technically and organisationally possible, meaning that it will no longer be possible to identify individuals as a general rule.

2.2. What is our legal basis for processing personal data?
We process our personal data on the basis of our legitimate interests pursuant to Art. 6(1)(f) GDPR for the protection of property, to increase the safety of staff, visitors and customers as well as to prevent, limit and clear up criminal offences (e.g. property damage, vandalism, break-in, etc.) as well as to protect domiciliary rights and to fulfil statutory due diligence including the preservation of evidence.

2.3. Purpose of the data processing
We process your personal data in connection with the video surveillance for the following purposes:

  • to protect property and buildings,
  • to fulfil our statutory due diligence obligations,
  • to prevent, limit and clear up criminal conduct,
  • to fulfil conditions imposed by the authorities for operating facilities and power plants.

2.4. Retention period
To the extent they do not involve live transmissions, our your data will be stored for a maximum of 72 hours and then automatically erased, unless proceedings are initiated that necessitate a longer retention period. In such an event, the data will be stored for the duration of the proceedings and then erased.

2.5. Data recipients
A small number of employees of the respective data controller have access to the video surveillance recordings; this access is to be documented. Access takes place solely for the purpose of clearing up criminal offences.
If there is suspicion of a crime, your personal data may, in the event of the initiation of proceedings, be forwarded to:

  • responsible authorities or courts (for the preservation of evidence in criminal cases), security agencies (for security agency purposes)
  • courts (for the preservation of evidence in civil cases)
  • employees, witnesses, victims (within the scope of claim enforcement)
  • insurance companies (exclusively for the processing of insurance claims)
  • lawyers, courts, authorities and other bodies for the purposes of law enforcement

Beyond that, your personal data will not be forwarded to recipients who intend to pursue their own purposes with these data.

3. Rights of the data subject

In principle, you have the right to information, correction, erasure, restriction, data portability, revocation of a granted consent and objection in respect of your data processed by us. To exercise these rights, please write to us at datenschutz@verbund.com. If you believe that the processing of your data violates data protection law or your data protection claims have otherwise been violated in any way, you can submit a complaint to the national supervisory authority where you live. In Austria, this supervisory authority is the Data Protection Authority.

You can find further details on your rights in the section "Data subjects' rights" at www.verbund.com/en-at/data-protection.

Correct as of December 2022

It is important for VERBUND Hydro Power GmbH to protect your personal data and to explain to you how we handle them.

1. Name and address of the data controller

Responsible for processing your data is VERBUND Hydro Power GmbH, Europaplatz 2, 1150 Vienna, ("VERBUND", "we", "us").

The contact details of the data protection officer: datenschutz@verbund.com.

2. Processing in the context of "taking minutes of meeting"

2.1. Scope of the processing of personal data
During communication via certain, clearly defined telephone numbers at VERBUND, the following personal data are processed: name, telephone number, contents of telephone calls.

2.2. What is our legal basis and purpose for processing personal data?
The legal basis for the processing of the data and recording the meeting mentioned under point 2.1. is (i) Art. 6(1)(b) GDPR provided that we have a contractual relationship with you and have declared this to be part of the contract or have agreed to perform the contract by telephone or (ii) our legitimate interest pursuant to Art. 6(1)(f) GDPR. The recording of telephone calls relating to disaster control, disruptions, contract processing and service, which is in our interest, serves not only to preserve evidence (especially in the case of disaster reports) but in particular also to ensure the quality of sensitive processes and the necessary communication chains (cf. in particular the standard required by DIN EN 50518-2 or ÖVE/ÖNORM EN 50518-2). In this way, we can better understand (i) when we received which notification, (ii) what information we received, (iii) which steps we took on this basis and in which timeframe, and (iv) what was agreed. In this way, we can ensure for the long term that we ask you the right questions and provide you with sufficient support and information – whether in an emergency, in the professional handling of joint contractual relationships, or in service.

2.3. Retention period
Your personal data will (i), if they represent contractual content, and depending on the legal situation, be stored for seven years (Austria: Art. 132 Federal Tax Code (BAO) and Art. 212 Corporate Code (UGB)) or ten years (Germany: Art. 238 in conjunction with Art. 257 (1) (4) Commercial Code (HGB) and Art. 14b VAT Act (UStG)), or (ii) in all other cases for a maximum of three years as evidence in the event of claims for damages (see Art. 1489 General Civil Code (ABGB) and Arts. 195 et seq. Civil Code (BGB)). If necessary, your data will be stored only for as long as court or administrative proceedings are pending, which may require a longer retention period. In such an event, the data will be stored for the duration of the proceedings and then erased.

2.4. Data recipients
The data will never be passed to third parties. If courts or authorities demand disclosure in pending proceedings, the data will be disclosed only if they can provide proof of a sufficient legal basis.

3. Your rights

In principle, you have the right to information, correction, erasure, restriction, data portability, revocation of a granted consent and objection in respect of your data processed by us. To exercise these rights, please write to us at datenschutz@verbund.com. If you believe that the processing of your data violates data protection law or your data protection claims have otherwise been violated in any way, you can submit a complaint to the national supervisory authority where you live.

You can find further details on your rights in the section "Data subjects' rights" at www.verbund.com/en-at/data-protection.

Correct as of May 2019

It is important for VERBUND Innkraftwerke GmbH to protect your personal data and to explain to you how we handle them.

1. Name and address of the data controller

Responsible for processing your data is VERBUND Innkraftwerke GmbH, D-84513 Töging am Inn, Werkstraße 1, ("VERBUND", "we", "us").

The contact details of the data protection officer: datenschutz@verbund.com.

2. Processing in the context of "taking minutes of meeting"

2.1. What kind of personal data will we process?
During communication via certain, clearly defined telephone numbers at VERBUND, the following personal data are processed: name, telephone number, contents of telephone calls.

2.2. What is our legal basis and purpose for processing personal data?
The legal basis for the processing of the data and recording the meeting mentioned under point 2.1. is (i) Art. 6(1)(b) GDPR provided that we have a contractual relationship with you and have declared this to be part of the contract or have agreed to perform the contract by telephone or (ii) our legitimate interest pursuant to Art. 6(1)(f) GDPR. The recording of telephone calls relating to disaster control, disruptions, contract processing and service, which is in our interest, serves not only to preserve evidence (especially in the case of disaster reports) but in particular also to ensure the quality of sensitive processes and the necessary communication chains (cf. in particular the standard required by DIN EN 50518-2 or ÖVE/ÖNORM EN 50518-2). In this way, we can better understand (i) when we received which notification, (ii) what information we received, (iii) which steps we took on this basis and in which timeframe, and (iv) what was agreed. In this way, we can ensure for the long term that we ask you the right questions and provide you with sufficient support and information – whether in an emergency, in the professional handling of joint contractual relationships, or in service.

2.3. Retention period
Your personal data will (i), if they represent contractual content, and depending on the legal situation, be stored for seven years (Austria: Art. 132 Federal Tax Code (BAO) and Art. 212 Corporate Code (UGB)) or ten years (Germany: Art. 238 in conjunction with Art. 257 (1) (4) Commercial Code (HGB) and Art. 14b VAT Act (UStG)), or (ii) in all other cases for a maximum of three years as evidence in the event of claims for damages (see Art. 1489 General Civil Code (ABGB) and Arts. 195 et seq. Civil Code (BGB)). If necessary, your data will be stored only for as long as court or administrative proceedings are pending, which may require a longer retention period. In such an event, the data will be stored for the duration of the proceedings and then erased.

2.4. Data recipients
The data will never be passed to third parties. If courts or authorities demand disclosure in pending proceedings, the data will be disclosed only if they can provide proof of a sufficient legal basis.

3. Your rights

In principle, you have the right to information, correction, erasure, restriction, data portability, revocation of a granted consent and objection in respect of your data processed by us. To exercise these rights, please write to us at datenschutz@verbund.com. If you believe that the processing of your data violates data protection law or your data protection claims have otherwise been violated in any way, you can submit a complaint to the national supervisory authority where you live. 

You can find further details on your rights in the section "Data subjects' rights" at www.verbund.com/en-at/data-protection.

Correct as of May 2019

It is important for Grenzkraftwerke GmbH to protect your personal data and to explain to you how we handle them.

1. Name and address of the data controller

Responsible for processing your data is Grenzkraftwerke GmbH, D-84359 Simbach am Inn, Münchner Strasse 48, ("VERBUND", "we", "us").

The contact details of the data protection officer: datenschutz@verbund.com.

2. Processing in the context of "taking minutes of meeting"

2.1. What kind of personal data will we process?
During communication via certain, clearly defined telephone numbers at VERBUND, the following personal data are processed: name, telephone number, contents of telephone calls.

2.2. What is our legal basis and purpose for processing personal data?
The legal basis for the processing of the data and recording the meeting mentioned under point 2.1. is (i) Art. 6(1)(b) GDPR provided that we have a contractual relationship with you and have declared this to be part of the contract or have agreed to perform the contract by telephone or (ii) our legitimate interest pursuant to Art. 6(1)(f) GDPR. The recording of telephone calls relating to disaster control, disruptions, contract processing and service, which is in our interest, serves not only to preserve evidence (especially in the case of disaster reports) but in particular also to ensure the quality of sensitive processes and the necessary communication chains (cf. in particular the standard required by DIN EN 50518-2 or ÖVE/ÖNORM EN 50518-2). In this way, we can better understand (i) when we received which notification, (ii) what information we received, (iii) which steps we took on this basis and in which timeframe, and (iv) what was agreed. In this way, we can ensure for the long term that we ask you the right questions and provide you with sufficient support and information – whether in an emergency, in the professional handling of joint contractual relationships, or in service.

2.3. Retention period
Your personal data will (i), if they represent contractual content, and depending on the legal situation, be stored for seven years (Austria: Art. 132 Federal Tax Code (BAO) and Art. 212 Corporate Code (UGB)) or ten years (Germany: Art. 238 in conjunction with Art. 257 (1) (4) Commercial Code (HGB) and Art. 14b VAT Act (UStG)), or (ii) in all other cases for a maximum of three years as evidence in the event of claims for damages (see Art. 1489 General Civil Code (ABGB) and Arts. 195 et seq. Civil Code (BGB)). If necessary, your data will be stored only for as long as court or administrative proceedings are pending, which may require a longer retention period. In such an event, the data will be stored for the duration of the proceedings and then erased.

2.4. Data recipients
The data will never be passed to third parties. If courts or authorities demand disclosure in pending proceedings, the data will be disclosed only if they can provide proof of a sufficient legal basis.

3. Your rights

In principle, you have the right to information, correction, erasure, restriction, data portability, revocation of a granted consent and objection in respect of your data processed by us. To exercise these rights, please write to us at datenschutz@verbund.com. If you believe that the processing of your data violates data protection law or your data protection claims have otherwise been violated in any way, you can submit a complaint to the national supervisory authority where you live.

You can find further details on your rights in the section "Data subjects' rights" at www.verbund.com/en-at/data-protection.

Correct as of May 2019

Data subjects' rights

VERBUND is the respective VERBUND group company indicated as the data controller ("VERBUND", "we", "us").

1.   Right to information

You have the right to obtain information from VERBUND on all your data processed by VERBUND. You have the right to obtain information as to whether your personal data will be transferred to a third state or to an international organisation. In this regard, you may request information on whether we have provided appropriate safeguards pursuant to Article 46 GDPR in connection with the transfer of your data.

2.   Right to rectification and right to restriction of processing

You have the right to obtain the rectification of inaccurate data and the right to have incomplete data completed. Under certain circumstances, for example if the accuracy of data is contested, you have the right to obtain the restriction of processing; in this event, data may only be processed with your consent or for the establishment, exercise or defence of legal claims or for the protection of the rights of another natural or legal person or for reasons of important public interest.

3.   Right to data portability

You have the right to request that VERBUND transmit to you or to a third party nominated by you, where technically feasible, a copy of your data in a structured, commonly used and machine readable format. Moreover, you have the right to transmit this data to another data controller without any obstruction from the data controller to whom the personal data have been given, if
(1) the processing is based on consent pursuant to Article 6(1)(a) or Article 9(2)(a) or on a contract pursuant to Article 6(1)(b) GDPR; and
(2) the processing is carried out by automated means.

In exercising this right to data portability, you also have the right to have the personal data transmitted directly from one controller to another, where technically feasible. This action must not affect the freedoms and rights of other persons.

4.   Right to erasure

You have the right to obtain erasure of data under certain circumstances, such as if the data have not been processed in accordance with data protection requirements. 
If you have exercised the right to rectification, erasure or restriction of processing vis-à-vis VERBUND, we are obliged to communicate any rectification or erasure of data or restriction of processing to each recipient to whom the personal data have been disclosed, unless this proves impossible or involves disproportionate effort.

5.   Right to object

You have the right to object at any time, on grounds relating to your particular situation, to the processing of your personal data, which is based on Art. 6(1)(e) or (f) GDPR.

In this case, VERBUND will no longer process your personal data, unless we can demonstrate compelling legitimate grounds for the processing which override your interests, rights and freedoms or for the establishment, exercise or defence of legal claims.

6.   Right to withdraw consent

You have right to withdraw your consent at any time without giving reason and with effect for the future by, for example, letter, email or telephone to the VERBUND company indicated as the data controller and without further costs.

The contact details of the data protection officer: datenschutz@verbund.com.

Even if you withdraw your consent, the lawfulness of processing operations carried out until you have withdrawn your consent shall not be affected.

7.   Right to lodge a complaint with the supervisory authority

Notwithstanding any other remedies, if you feel that your personal data were unlawfully processed, you may lodge a complaint with the national supervisory authority in your place of residence. Responsible in Austria, the Data Protection Authority (Datenschutzbehörde (DSB, Barichgasse 40-42, 1030 Vienna [www.dsb.gv.at]) and in Bavaria the Data Protection Authority for the State of Bavaria (Bayerische Landesamt für Datenschutzaufsicht (BayLDA, Promenade 18, 91522 Ansbach [www.lda.bayern.de]).

8.    Identification of the individual

Kindly submit your request by clearly identifying yourself and briefly describing the scope of how you intend to exercise your data subjects' rights as listed above, so that we can process your request relating to your above-mentioned rights and to ensure that personal data is not disclosed to unauthorised third parties.

November 2022