Data Protection at VERBUND

It is important for VERBUND AG to protect your personal data.

The protection of your personal data is of great importance to VERBUND AG. We therefore comply with all applicable laws relating to the protection, lawful handling and confidentiality of personal data, data security, in particular the Austrian Data Protection Act, as amended (Datenschutzgesetz - DSG) and the General Data Protection Regulation ("GDPR"). The following information describes which personal data we will process if necessary when you visit our VERBUND websites (“website”).

1. Name and address of the controller

The controller for the processing of your personal data according to the data protection laws is:

VERBUND AG
Am Hof 6a
1010 Vienna

The contact details of the Data Protection Officer are as follows:

Email: datenschutz@verbund.com

2. Processing in the context of the "website"

2.1. What kind of personal data will we process?

We automatically collect the following personal data when you visit our website:

  • date and time when you visit a page on our website
  • data of your terminal device (device-ID)
  • IP address
  • name and version of your browser
  • session ID.

Please see our cookie policy in section 3 for information about the cookies we use when you visit our website.

2.2. What is our legal basis for the processing of personal data?
We process data when you visit our website based on our legitimate interest according to Art. 6 (1) (f) GDPR, which consists of making our website user friendly and protecting it against attacks.

2.3. Purposes for which we process data

We process your data when you visit our website for the following purposes:

  • to make our website and its functionality available to you and to further improve and develop this website;
  • to create usage statistics;
  • to detect, prevent and investigate attacks on our website;
  • to display personalised products and pages.

2.4. Retention periods

We will basically retain your data we have collected when you visit the website for a period of three months. We store data longer only if this is necessary to investigate detected attacks on our website and, furthermore, until the expiry of relevant limitation periods, legal retention periods, or until disputes, if any, have been resolved.

2.5. Data recipients

In order to operate and administer the website, we regularly use IT service providers which, in accordance with our order and instructions, may under certain circumstances also have access to personal data in order to be able to render the commissioned IT services.

We will also transfer your personal data to the following recipients:

  • to external third parties to the extent required by our legitimate interest (e.g. auditors, insurance companies in the event of an insured event, legal representatives as the occasion requires, etc.);
  • to authorities and other public bodies to the extent required by law (e.g. financial authorities, courts, etc.).

Your data will not be passed to any other third parties for their own purposes without your consent.  

3. Rights of the data subject

3.1. Right to information

You have the right to obtain information from us on all your data processed by VERBUND. You have the right to obtain information as to whether your personal data will be transferred to a third state or to an international organisation. In this regard, you may request information on whether we have provided appropriate safeguards pursuant to Article 46 GDPR in connection with the transfer of your data.

3.2. Right to rectification and right to restriction of processing

You have the right to obtain the rectification of inaccurate data and the right to have incomplete data completed. Under certain circumstances, for example if the accuracy of data is contested, you have the right to obtain the restriction of processing; in this event, data may only be processed with your consent or for the establishment, exercise or defence of legal claims or for the protection of the rights of another natural or legal person or for reasons of important public interest.

3.3. Right to data portability

You have the right to request that VERBUND transmit to you or to a third party nominated by you, where technically feasible, a copy of your data in a structured, commonly used and machine readable format. Moreover, you have the right to transmit this data to another data controller without any obstruction from the data controller to whom the personal data has been given, if

(1) the processing is based on consent pursuant to Art. 6(1) (a) GDPR or Art. 9(2) (a) GDPR or on a contract pursuant to Art. 6(1) (b) GDPR, and
(2) the processing is carried out by automated means.

In exercising this right to data portability, you also have the right to have the personal data transmitted directly from one controller to another, where technically feasible. This right shall not adversely affect the rights and freedoms of others.

3.4. Right to erasure


You have the right to obtain erasure of data under certain circumstances, such as if the data have been unlawfully processed.

The so-called "right to be forgotten" does not apply because VERUND will never disclose your personal data.

If you have exercised the right to rectification, erasure or restriction of processing vis-à-vis VERBUND, we are obliged to communicate any rectification or erasure of data or restriction of processing to each recipient to whom the personal data have been disclosed, unless this proves impossible or involves disproportionate effort.

3.5. Right to object

You have the right to object at any time, on grounds relating to your particular situation, to the processing of your personal data which is based on point (e) or (f) of Art. 6(1) GDPR.

In this case, VERBUND will no longer process your personal data, unless we can demonstrate compelling legitimate grounds for the processing which override your interests, rights and freedoms or for the establishment, exercise or defence of legal claims.

3.6. Right to withdraw consent

You have the right to withdraw at any time your declaration of consent under data protection law. The revocation of consent shall not affect the lawfulness of the processing carried out on the basis of the consent until revocation.

3.7. Supervisory authority

Notwithstanding any other remedies, if you feel that your personal data were unlawfully processed, you may lodge a complaint with the national supervisory authority in your place of residence. In Austria, this supervisory authority is the Data Protection Authority.


As at: October 2021

The protection of your personal data and explaining to you how we handle them is of great importance to VERBUND AG.


1. Name and address of the controller

“Processor” pursuant to Art. 4 (8) GDPR, such as IT service providers, service providers for marketing services, payment service providers

 
VERBUND AG, am Hof 6a, 1010 Wien and VERBUND Energy4Customers GmbH, Erdberger Lände 26A, 1030 Wien (hereinafter “VERBUND”, “we” or “us”).

The contact details of the Data Protection Officer are:

Email:  datenschutz@verbund.com


2. Processing operations of processors and other recipients

2.1.   Processor

Where service providers commissioned for subsequent data processing are involved ("processors" such as IT service providers, service providers for marketing services, payment service providers, debt collections, commercially licensed credit agencies and address publishers), they may also have access to personal data in accordance with our instructions. VERBUND works only with processors who provide sufficient guarantees that appropriate technical and organisational measures are implemented in such a way that processing is carried out in accordance with the requirements of the Austrian Data Protection Act ("DSG") and the General Data Processing Regulation ("GDPR") as amended. The processing performed by a processor is always done on the basis of a contract that binds the processor to the obligations under data protection law. VERBUND uses processors outside the European Union only if an adequacy decision has been taken by the European Commission for the third country concerned or if we have agreed on appropriate guarantees or binding internal data protection regulations with the processor.

2.2.   Other recipients

For the following forms of data processing, personal data will only be forwarded to other recipients where required for the fulfilment of (pre-)contractual or statutory obligations, where justified for the maintenance of our legitimate interests or those of a third party, or where permitted within the scope of granted consent. In addition to processors pursuant to point 2.1, the categories of recipients of personal data can include:

  • Sales partners: If the conclusion of your contract with VERBUND is brokered via one of our sales partners and/or a sales partner (jointly) supports your contract with VERBUND, the sales partner will collect the personal data necessary to conclude the contract and transmit these to VERBUND. We will also transmit your personal data to the sales partner in the extent necessary for any support you require from the sales partner.
  • VERBUND group company: We can forward individual data processing activities to specialist departments, divisions or companies within the VERBUND group and transmit the personal data necessary for this purpose. This is done primarily to be able to administer your data centrally and/or to be able to offer you a better service.
  • Market players in the gas or electricity market: In the course of initiating and processing the contract, it may be necessary for us to transmit your personal data to market players in the gas or electricity market (e.g. grid operators or energy suppliers) in order to fulfil (pre-)contractual and/or statutory obligations.
  • Authorities, courts and public bodies: Statutory obligations exist that VERBUND is only able to fulfil when we transmit your personal data in the necessary scope to authorities and public bodies (e.g. financial authorities, law enforcement agencies) as well as to courts.
  • Companies for credit and creditworthiness information: VERBUND may transmit your personal data to companies for credit and creditworthiness information (e.g. CRIF GmbH and Kreditschutzverband) within the scope of creditworthiness checks and to request information about your creditworthiness from them.
  • Other recipients: Within the scope of the contractual relationship and in particular in connection with our service obligations, it may be necessary, on a case by case basis, to transmit your personal data to other recipients (e.g. lawyers, notaries, insolvency administrators, experts, tax consultants, auditors, stakeholder representatives, banks, financial service providers, mail/courier services and logistics partners, installation partners, contract and cooperation partners for services linked to your contract).

3. Processing in the context of "sending informational materials to prospects"

3.1. What kind of personal data will we process and what is their source?
Prospects can contact VERBUND in different ways (for example via phone or email). If you choose any of these options to contact us, we can process the following information you have provided, depending on the option chosen: personal details such as gender, title, name, address, the nature of your interest or information on your request, contact details such as phone number and/or email address, information on energy consumption, grid operator, and current supplier. The data actually collected from you will depend on the nature of the inquiry.

These data are provided by you on a voluntary basis; this is neither statutorily or contractually prescribed nor required for concluding a contract. However, if you do not provide these data, VERBUND may not be able to process your inquiry appropriately.

3.2. What is our legal basis for processing personal data?
We lawfully process the data referred to in Section 3.1. on the basis of our legitimate interest according to Art. 6 (1) (f) GDPR, which aims at processing your request to the best of our ability. 

If your reason for contacting us is to conclude a contract, pre-contractual measures will additionally be lawfully processed on the basis of Art. 6 (1) (b) GDPR.


3.3. Purposes for which we process data
VERBUND processes the personal data referred to in Section 3.1 in order to execute your request.


3.4. Retention periods
We process your data to execute your inquiry and retain them for three months. We store data longer only if this is necessary to complete your inquiry and, furthermore, until the expiry of relevant limitation periods, legal retention periods, or until disputes, if any, have been resolved.  

Instead of erasing data, we can also anonymise data. In this case, any reference to you as an individual is irretrievably deleted. If we do this, we no longer have to erase data according to data protection laws.

3.5. Data recipients
Data can be transferred to appointed service providers for processing operations according to Section 2.


4. Processing in the context of "placing an order in the webshop"

4.1. What kind of personal data will we process and what is their source?
When placing an order in the webshop on our website, you will provide us, depending on the chosen product, with the following data:
Title,  gender, first name, surname, address, date of birth, email address, phone number, invoice address, customer number, purchased products, payment modes, bank details, invoice details, data in respect of your energy consumption and data in respect of your facility (grid operator, meter point name, meter number, meter reading), any other data such as the name, address and customer name of a promoter. If you also register for VERBUND online services after placing your first order in the webshop, please also provide a user name and password.


4.2. What is our legal basis for processing personal data?
We lawfully process the data referred to in Section 4.1. according to Art. 6 (1) (b) GDPR for the performance of a contract.

These contact data are provided by you on a voluntary basis. However, if you do not provide these data, VERBUND may not be able to process your order in the webshop accordingly or only to a limited extent.

 
4.3. Purposes for which we process data
We process your data according to Section 4.1. for the purpose of order processing and thereafter for fulfilling the respective contractual obligations arising from placing the order in the webshop.

 

4.4. Retention periods

We process your data for orders placed in the online shop for as long as necessary to handle the order and thereafter to the extent that statutory retention periods exist or warranty and limitation periods are still in force.


Instead of erasing data, we can also anonymise data. In this case, any reference to you as an individual is irretrievably deleted. If we do this, we no longer have to erase data according to data protection laws.

4.5. Data recipients
To store and host personal data, we use an It service provider (service provider pursuant to Section 2), who may also have access to personal data, following our orders and instructions, in order to be able to render the commissioned IT services.


5. Processing in the context of “Processing of energy contracts of VERBUND AG”

5.1. What kind of personal data will we process and what is their source?

You can procure a range of different products and services from us. Depending on the product choice/contract type, personal data will be collected from you or from other sources for the purpose of processing energy contracts with you.

Data collected from the data subject (information according to Art. 13 GDPR):

If you enter into a contract with VERBUND for the supply of electricity or gas, we will process the following personal data which you provide to us when you enter into the contract, as well as data collected during the contract:

  • Master data such as title, gender, first name, surname, address, date of birth, email address, phone number, invoice address, customer number;
  • Contract data such as type of contract, products, tariff model, commitment period, lead time, payment terms, bank details, invoice data;
  • Facility data such as grid operator, metering point name, meter number;
  • Consumption data such as the level of energy consumption, consumption period, meter readings;
  • Any other data such as name, address and customer name of a promoter upon registration for the VERBUND online account, user name and password, or for customers that are also members of the jö Bonus Club, their web ID, refresh token as well as number of points Ös claim/credit note.

If you enter into a contract with VERBUND for the supply of electricity from photovoltaic systems, VERBUND will, in addition to the energy supply contract, also process the following data supplied by you at the time of concluding the contract: data of the photovoltaic system (performance in kWpeak, feed-in in kWh, commissioning date, previous current collector, case number of decree which recognises the system as green electricity system), VAT number, if any.

If you conclude a rental contract for a photovoltaic system, VERBUND will process the following personal data that you provided to us upon concluding the contract or are subsequently collected from you during performance on the current contract:

  • Master data such as title, gender, first name, surname, address, date of birth, email address, phone number, invoice address, customer number;
  • Data on your property: owner, type of property, age of the property, roof shape, roof incline, type of roof covering, number of floors, address, photos the property (general view, roof, meter boxes);
  • Contract data such as contract type, products, commitment period, terms of payment, bank details, invoice data;
  • Facility data such as grid operator, metering point name, meter number;
  • Consumption data such as the level of energy consumption, consumption period, meter readings;
  • Any other data such as name, address and customer name of a promoter upon registration to the VERBUND online account, user name and password.

 

If you procure a complete VERBUND-eCharging package from VERBUND, in addition to the purchase contract for a wallbox and to the electricity supply agreement within the scope of the VERBUND-eCharging service agreement, VERBUND will process the following personal data, which you provided us upon conclusion of the contract or were collected during ongoing contract fulfilment either from you or from a readout via the wallbox:

  • Data about your property, such as the installation location of the wallbox, power connection available, wall breakthroughs, cable run, photos of the property;
  • Data of the wallbox, such as designation of the wallbox, max. power output in kW, operating data of the wallbox, address, charging procedures (e.g. start date, time, duration, energy consumption data), session ID of the charging procedure, card number of the charging card.

Data collected from other sources (information according to Art. 14 GDPR):

Prior to the conclusion of an energy supply or photovoltaic supply contract and during an active contractual relationship VERBUND uses the information you have provided in the pre-contractual stage (first name, surname, date of birth) to obtain information on your credit rating from Wirtschaftsauskunftei CRIF GmbH, Diefenbachgasse 35, A-1150 Vienna.

Some of the information indicated under the data categories "Facility data" and "Consumption data" (such as meter readings, amount of energy consumption and consumption period) are also collected by VERBUND via your grid operator during the process of changing energy supplier.


5.2. What is our legal basis for processing personal data?
We lawfully process the data referred to in Section 5.1. according to Art. 6 (1) (b) GDPR for the performance of a contract and for the compliance with legal obligations according to Article 6 (1) (c) GDPR. These obligations may arise in particular from the Electricity Management and Organisation Act, the Gas Management Act, the Ordinance on Change of the Electricity Supplier, the Commercial Code, the Green Electricity Act, and the Federal Energy Efficiency Act.

We also process your data to protect the legitimate interests of us or third parties (Art. 6 (1) (f) GDPR). VERBUND has a legitimate interest in learning more about your creditworthiness prior to concluding a contract with you and in obtaining creditworthiness information about you from companies the provide credit and creditworthiness information. In the interest of VERBUND or third parties, your data may also be processed for preparing statistics, analyses and reports, for business management and further development of processes, for developing new products and services, for customer support and marketing pursuant to point 6, for contract administration, for ensuring IT security and IT operation including tests, for compliance purposes and for internal audit measures as well as for optimising processing, delivery and communication processes. Our particular objective for doing so is also to continuously improve processes and services in order to be able to offer you excellent service quality.

The provision of data by you is voluntary; however, if you do not provide these data, VERBUND will not be able to process your application to conclude a contract accordingly or to render the contractual services during an ongoing contractual relationship accordingly or only with restriction.
A transmission of quarterly hour values by smart meters of our grid operator and processing of these quarterly hour values by VERBUND is done pursuant to § 84a ElWOG only on the basis of consent (Art. 6 (1) (a) GDPR) or for fulfilment of obligations arising from an energy supply contract that you have chosen and which is based on quarterly hour values (Art. 6 (1) (b) GDPR).

 
5.3. Purposes for which we process data
We process your data according to Section 5.1. for the purpose of the conclusion, performance, amendment and termination of the contract with you, as well as for the purpose of billing. This also includes, in particular, the following activities:

  • Credit check before conclusion of a contract;
  • Carrying out a change of supplier in accordance with the Regulation on Changing Energy Supplier in the case of an energy supply contract;
  • Customer administration and invoicing (invoices are sent either by post or by email);
  • Optional use of the VERBUND online services via the VERBUND online account;
  • Customer support and marketing for our own benefit (see Section 6.)

5.4. Retention periods
These data will be erased after termination of the contract, unless we must keep data under tax laws (for example according to § 212 of the Commercial Code (UGB) or §§ 124 et seq of the Federal Tax Code (BAO)), or as long as claims can be asserted from the contractual relationship. 

Instead of erasing data, we can also anonymise data. In this case, any reference to you as an individual is irretrievably deleted. If we do this, we no longer have to erase data according to data protection laws.

 
5.5. Data recipients
We transfer data to third parties only where necessary for the compliance with (pre)contractual or legal obligations or for the safeguarding of our legitimate interests.


6. Processing in the context of "customer support and marketing for our own benefit"

6.1. What kind of personal data will we process and what is their source?

Data collected from the data subject (information according to Art. 13 GDPR):

We will collect the following data directly from the customer or take these from the processing operations carried out in the context of "placing an order in the webshop" (Section 4.1.) and "Processing of energy contracts of VERBUND AG" (see Section 5.1.).

In addition, we collect, for example, the following documentation data from transactions and service inquires made by you: date of inquiry/transaction, discussion notes, email correspondence.

Various data are also collected directly from you via multiple sources, such as through voluntary customer surveys (point 9), data on your living situation, such as type of housing, household size, living space, heating system, which in themselves make no personal reference and produce personal data at VERBUND only when combined with other data and analyses, or, for example, through a power meter installed in your premises by VERBUND on the basis of a rental or purchase contract of a PV system incl. battery store or electric car charging station (point 8).


Data collected from other sources (information according to  Art. 14 GDPR):

We also collect personal data on prospects via commercially licensed rating agencies. Based on mathematical-statistical models, VERBUND creates a customer profile which allows us to create personalised offers based on your interests (see Section 6.3.).


6.2. What is our legal basis for processing personal data?
VERBUND has a legitimate interest (Art. 6 (1) (f) GDPR) in sending direct marketing materials based on these personal data in order to reach its customers in the best way and to adjust its marketing strategies accordingly. You do not have to actively seek information about our special offers and new products and services; instead, we will provide this to you. The data processing on the legal basis of legitimate interest is carried out with minimal intensity of intervention: neither will automated decision-making take place according to Art. 22 GDPR, which has legal effect on you or similarly significantly affects you, nor will profiling take place with increased intensity of intervention. We collect, store and use only data that clearly match your preferences based on your purchases and inquiries.

VERBUND will send direct mail for marketing purposes in compliance with the requirements laid down in § 174 of the Telecommunications Act 2021 (TKG 2021). 

VERBUND also uses your data on the legal basis of legitimate interest to match them with internal customer segments, in order to be able to send you direct mail offering value added personalised and customised products and services tailored to your consumption pattern, to invite you to participate in contests (see Section 7.) and to analyse customer satisfaction (see Section 6.3.).

Data are lawfully processed for extended, demand-orientated marketing according to Art. 6 (1) (a) GDPR. Data are processed for this purpose only if you have given your consent, which you can provide voluntarily in the course of placing an order in the webshop, when concluding a contract or via the VERBUND online services. Consenting to the processing of your data for this purpose is not mandatory for concluding or performing a contract.


6.3. Purposes for which we process data

We use the personal data referred to in Section 6.1. on the basis of our legitimate interest (Art. 6 (1) (f) GDPR) for the following purposes:

  • For direct marketing to send you general information and offers in connection with the VERBUND products and services and product innovations (especially in the fields of mobile telephony, internet TV, etc.) by post and - if we have your consent according to § 174 Telecommunications Act 2021 (TKG 2021), as amended, - also via email or text message or by phone.
  • To classify customers into segments in a minimally invasive way in order to be able to offer you customised and personalised value-added products and services tailored to your consumption pattern based on direct marketing measures.
  • For the purpose of customer segmentation, we analyse data processed in the context of "placing orders in the webshop", "energy supply contracts (electricity and gas supply contracts, photovoltaic supply contracts, rental contract governing photovoltaic systems)" (see Sections 4. and 5.) using different statistical methods and by integrating aggregated socio-demographic data. Analysis means to calculate probabilities on the basis of the matched data with the aid of automated analysis models, e.g. your interest in gas products based on which we will select personalised recommendations and offers. Furthermore, these results are used to create personalised customer profiles to gain long-term knowledge about the needs and interests of customers. 
  • To process these data along with data obtained from commercially licensed rating agencies according to § 151 Commercial Code (GewO). Your personal data VERBUND has collected according to Sections 4.1 and 5.1. and the customer segments created on this basis will also be merged with data of third parties (e.g. address data base providers and direct marketing firms) that can also constitute personal data (e.g. socio-demographic data per customer) to improve the data base and to analyse customer behaviour. The merging of such personal data allows us to integrate into our analysis, for example, a customer’s current stage of life, the size of a community, as well as the purchasing power.
  • Customer satisfaction analyses.

As a whole, VERBUND is taking these measures to give you a better offer by focusing its product range on your needs,

  • so that we can send you personalised offers,
  • personalising communication with you, so that you can find those offers that fit your needs and get less advertising,
  • simplifying processes such as the conclusion of contracts or online orders, so that you get what you want more quickly.
  • Improving our service quality and improving or developing new, innovative products and services (e.g. services for optimising your energy consumption).

Extended marketing measures with personalised (profiled) offers:

If you have also given VERBUND your consent (Art. 6 (1) (a) GDPR) to additional marketing measures, we will process your data in accordance with Section 5.1. also in order to offer you differentiated (profiled) products on the basis of the customer profiles created. 
This type of data processing is profiling according to Art. 4 (4) GDPR with increased intervention intensity. Target group selections are made from the created customer profiles in order to provide you with individualised and differentiated advertising and marketing measures as well as offers and to develop product optimisations by means of aggregated analyses.

Your consent to this processing is voluntary and can withdraw it at any time and free of charge with effect for the future (see Section 6.6.). Even if you withdraw your consent, the lawfulness of processing operations carried out until you have withdrawn your consent shall not be affected.

6.4. Retention periods
After termination of our business relationship, VERBUND will use your personal data for up to 3 years after you last contacted us for the purpose of VERBUND’s own marketing measures and in order to send you advertising materials on VERBUND’s own activities and products and to solicit business in respect of VERBUND’s own product offer, unless you have previously objected to the use of your data for these purposes. We will erase your data 3 years after you last contacted VERBUND or earlier, if you have objected to such use. 

Instead of erasing data, we can also anonymise data. In this case, any reference to you as an individual is irretrievably deleted. If we do this, we no longer have to erase data according to data protection laws.

6.5. Data recipients

Data can be transferred to appointed service providers for processing operations according to Section 2 or to companies based on your consent.

6.6. Right to object and withdrawal of consent

You can object at any time to the processing of such data for the purposes of direct marketing, which we base on our legitimate interest (see Section 11.).

You can exercise your right to withdraw your consent at any time without giving reasons, with effect for the future, by sending a letter or email to the following contact details or by calling the phone number provided below. You will not incur any expenses if you exercise this right.
Postal address: VERBUND AG, Am Hof 6a, 1010 Vienna
Email: datenschutz@verbund.com
Service line: 0800 210 210


7. Processing in the context of "Participating in contests"

7.1. What kind of personal data will we process and what is their source?
We will process the following personal data which you provide to us when you participate in contests: information about your such as gender, title, name, address, phone number and/or email address and information related to the contest.

You provide these data on a voluntary basis; this is neither statutorily nor contractually required. However, if you do not provide these data, you will not be able to participate in the contest.


7.2. What is our legal basis for processing personal data?
We lawfully process the data referred to in Section 7.1. according to Art 6 (1) (b) GDPR and therefore for the performance of a contract or pre-contractual measures. The storage and processing of the data is required to process the contest and to inform you about any prizes.

Our legitimate interest according to Art. 6 (1) (f) GDPR consists of processing the contest for you as well as possible, contacting you about the contest and subsequently aligning our marketing strategy; this forms the additional legal basis for the processing of your data for contests.

If your data should be published in the event of a win, we will obtain your consent to do so in accordance with Art. 6 (1) (a) GDPR.

VERBUND will send direct mail for marketing purposes in compliance with the requirements laid down in § 174 of the Telecommunications Act 2021 (TKG 2021). If you have granted your consent for us to send information by email related to the contest (newsletter), the legal basis for the processing of the data for this purposes is Art. 6 (1) (a) GDPR.


7.3. Purposes for which we process data
We process your data according to Section 7.1. for the purpose of the conclusion and performance of the contract with you, as well as for the purpose of billing.  If you have granted us consent to send you information by email to process your data, then the data listed under Section 7.1. will also be processed for this purpose (see Section 9).

7.4. Retention periods
We will process your data for as long as this is necessary to process the contest, after which they will be immediately erased, unless the data have to be processed beyond the statutory retention period or you have given us your consent to send you information by email.
 
Instead of erasing data, we can also anonymise data. In this case, any reference to you as an individual is irretrievably deleted. If we do this, we no longer have to erase data according to data protection laws.


7.5. Data recipients
Data can be transferred to appointed service providers for processing according to Section 2 or to companies in accordance with the granted consent.


8.   Data processing "Energy data recording via the Power-Meter and the Power-Meter app"

 
8.1.   Scope of the processing of personal data and their source

Data collected from the data subject (information according to Art. 13 GDPR):

The setup of a battery store and the installation of an electric car charging station (“wallbox”) within the scope of a rental or purchase agreement for a photovoltaic system incl. accessories and expansion components pursuant to point 5 also encompasses the installation of a power meter in your fuse/distribution box. With the installation of a power meter (“meter”), the following personal data are recorded directly by the meter when the energy data transmission feature of the meter is activated or when the VERBUND power meter app (“app”) is used, and automatically read by us via a data connection and transferred to our systems:

  • Energy and power readings such as total power output, generated and stored energy per meter and activated data interface;
  • Metadata per meter and activated data interface such as device serial numbers, hardware version, firmware version, etc.;
  • Diagnostic data for operation and troubleshooting such as error codes;
  • VERBUND online services log-in data such as user name and password ("VERBUND ID");
  • User-specific designations such as meter designation;
  • Date and time at which the app is accessed.

8.2.  What is our legal basis for processing personal data?
The legal basis for the processing of data under Section 8.1. is Art. 6 (1) (a) GDPR and thus your consent to the voluntary participation in the customer survey. 

Where the data processing only concerns the data regarding your use of the app (date and time at which the app is accessed, device ID), we justify the processing on the basis of our legitimate interest in accordance with Art. 6 (1) (f) GDPR, which consists of giving our app a user-friendly design, expanding existing features with the customer in mind and protecting our app against errors.

8.3.   Purposes for which we process data
The personal data recorded by the meter and listed under point 8.1. will be processed by VERBUND for the purpose of data analysis, visualisation, advice, notification, load control and load optimisation. 

In the course of using the app, the energy and power readings of the meter are accessed in order to be able to show these to the user in the app. The readings are temporarily stored locally in the app for faster presentation until the app is uninstalled. This is necessary in order to display the correct meter in the app or to visualise the correct data. The additional data on the meter are processed in the course of using the app for the correct presentation and for calculations in the app. To maintain the functionality of the app and for continuous improvement of the system, the following tools are used via third-party add-ins:

Firebase Crash Reporting

To receive feedback about errors in the app and the types of end device on which these errors occur, error data are analysed via Firebase Crash Reporting. This involves transmitting Instance IDs and crash traces to Google Inc. which do not reveal any information about the user. This third-party application can be deactivated in the settings at any time. The app also functions fully without your consent.

Google Analytics for Firebase

Google Analytics for Firebase is used to analyse use of the app. The data obtained are used on the one hand to expand existing features with the customer in mind and on the other to develop new and meaningful functionalities. The use of Google Analytics for Firebase takes place solely on the basis of your consent pursuant to point 8.2. This third-party application can be deactivated in the settings at any time. The app also functions fully without this consent.


8.4.  Retention periods
8.4.   Duration of the data processing
The data listed under point 8.1 are processed for the duration of your consent to the transmission of energy data by the meter. The withdrawal of consent does not affect the lawfulness of the processing to date. If the data processing concerns only the data regarding your use of the app and legitimate interest is based on the legal justification, this data processing is performed for the duration of use of the app.

The option exists to render the data anonymous instead of erasing them. In this case, any personal reference will be irretrievably removed, which shall also remove any obligation to erase the data under data protection law.

8.5.  Data recipients
Data can be transferred to appointed service providers for processing according to Section 2 or to companies based on your consent.

9. Processing in the context of "Customer survey for marketing purposes"

9.1.   Scope of the processing of personal data and their source

Should you, as a customer of VERBUND, participate in a voluntary survey for the purposes of market research, we will, depending on the type of customer survey, process key personal and communication data (gender, title, name, address, email address), key product and contract data (products purchased, energy consumption, plant number, customer number, length of the customer relationship, payment modalities), any reaction data to marketing campaigns (customer contact points, participation in promotions, Eco-Club participation, number of customer bonuses), and other survey-specific data.

9.2.   What is our legal basis for processing personal data?

The legal basis for the processing of data pursuant to point 8.1. is Art. 6 (1) (a) GDPR and therefore your consent for the voluntary participation in the customer survey.

9.3.   Purposes for which we process data

The personal data listed under point 8.1. will be processed by VERBUND for the purpose of holding the customer survey and carrying out market research.

9.4.   Retention period

We process your data for as long as is necessary for holding the customer survey and render it anonymous immediately after the end of the customer survey. In this case, any personal reference will be irretrievably removed, which shall also remove any obligation to erase the data under data protection law.

9.5.   Data recipients

The data may be transmitted to commissioned service providers for order processing (order processor) or to other recipients pursuant to point 2.


10.   Processing in the context of “newsletter”

10.1.  What kind of personal data will we process and what is their source?
If you subscribe to a newsletter of VERBUND, we will process information about your person such as gender, title, name, address as well as your contact details such as telephone number and/or email address.

The provision of these data by you is voluntary. However, if you do not provide the data, we will be unable to send you a newsletter.

10.2.  What is our legal basis for processing personal data?
The legal basis for the processing of data pursuant to point 9.1. is Art. 6(1) (a) GDPR and therefore your consent to receive the newsletter. With your consent, we will also evaluate your use of our email newsletter in order to further optimise our email newsletter and our marketing in line with your interests and adapt it to better suit your needs. To this end, we will process whether you have opened our newsletter and which contents you clicked on in particular.

Your consent may be withdrawn at any time without reason and with effect for the future by letter, email or phone without further costs to be paid to VERBUND:

Postal address: VERBUND AG, Am Hof 6a, 1010 Vienna
Email address: datenschutz@verbund.com
Serviceline: 0800 210 210


10.3. Purposes for which we process data
The personal data listed under Section 10.1. will be processed by VERBUND for the purpose of sending information about products and services of VERBUND.


10.4.  Retention periods
Your data will be processed for as long as you continue to receive the newsletter.

10.5.  Data recipients
The data may be sent to commissioned service providers for order processing pursuant to Section 2. or to companies pursuant to granted consent.

11.   Your rights

11.1.  Right to information
You have the right to obtain information from us on all your data processed by VERBUND. You have the right to obtain information as to whether your personal data will be transferred to a third state or to an international organisation. In this regard, you may request information on whether we have provided appropriate safeguards pursuant to Art. 46 GDPR in connection with the transfer of your data.

11.2.  Right to rectification and right to restriction of processing
You have the right to obtain the rectification of inaccurate data and the right to have incomplete data completed. Under certain circumstances, for example if the accuracy of data is contested, you have the right to obtain the restriction of processing; in this event, data may only be processed with your consent or for the establishment, exercise or defence of legal claims or for the protection of the rights of another natural or legal person or for reasons of important public interest.

11.3.  Right to data portability
You have the right to request that VERBUND transmit to you or to a third party nominated by you, where technically feasible, a copy of your data in a structured, commonly used and machine readable format. Furthermore, you have the right to transmit such data to another controller without hindrance from the controller to which the data have been provided, whereby
(1) the processing is based on consent pursuant to Art. 6 (1) (a) or Art. 9 (2) (a) or on a contract pursuant to Art. 6 (1) (b) GDPR; and
(2) the processing is carried out by automated means.

In exercising this right to data portability, you also have the right to have the personal data transmitted directly from one controller to another, where technically feasible. This right shall not adversely affect the rights and freedoms of others.

11.4.  Right to erasure

You have the right to obtain erasure of data under certain circumstances, such as if the data have been unlawfully processed.


If you have exercised the right to rectification, erasure or restriction of processing vis-à-vis VERBUND, we are obliged to communicate any rectification or erasure of data or restriction of processing to each recipient to whom the personal data have been disclosed, unless this proves impossible or involves disproportionate effort.

11.5.  Right to object
You have the right to object at any time, on grounds relating to your particular situation, to the processing of your personal data which is based on Art. 6 (1) (e) or (f) GDPR.

In this case, VERBUND will no longer process your personal data, unless we can demonstrate compelling legitimate grounds for the processing which override your interests, rights and freedoms or for the establishment, exercise or defence of legal claims.

11.6.  Right to withdraw consent
You have right to withdraw your consent at any time without giving reason and with effect for the future by letter, email or telephone, and without further costs to VERBUND.

Postal address: VERBUND AG, Am Hof 6a, 1010 Vienna
Email address: datenschutz@verbund.com
Service line: 0800 210 210

Even if you withdraw your consent, the lawfulness of processing operations carried out until you have withdrawn your consent shall not be affected.

11.7.  Right to complain to the supervisory authority
Notwithstanding any other remedies, if you feel that your personal data were unlawfully processed, you may lodge a complaint with the national supervisory authority in your place of residence. In Austria, this supervisory authority is the Data Protection Authority.


As at: 17/08/2022

The protection of your personal data is of great importance to VERBUND Energy4Business GmbH (hereinafter "VERBUND"). We therefore comply with all applicable laws relating to the protection, lawful handling and confidentiality of personal data, data security, in particular the Austrian Data Protection Act, as amended (Datenschutzgesetz - DSG) and the General Data Protection Regulation ("GDPR"). This document describes which personal data we will process when you visit our website at www.verbund.com ("website").

     

  1. Name and address of the controller
  2. The controller for the processing of your personal data according to data protection laws is:

    VERBUND Energy4Business GmbH
    Am Hof 6a
    1010 Vienna
    Phone: +43 (0)50313-0
    Email: business@verbund.com

    You can email the Data Protection Officer at datenschutz@verbund.com.

2.  Data processing "VISION-Website"

    2.1 Scope of processing of personal data

       

    We automatically collect the following personal data when you use our VISION website:
  • Date and time when you visit a page on our website
  • Data of your terminal device (device-ID)
  • IP address
  • Name and version of your browser
  • Session ID
  • Certain cookies (see Section 6. "Cookies").

       

      2.2. Lawfulness of processing of personal data

      We process data in connection with your use of our VISION website on the basis of the requirement to perform a contract according to Art. 6 (1) (b) GDPR and based on our legitimate interest according to Art. 6 (1) (f) GDPR, which consists in making our website user friendly and protecting our VISION website against attacks.

      2.3. Purposes for which we process data

       

    We process your data in connection with your visit of our VISION website for the following purposes:
  • to make our website and its functionality available to you and to further improve and develop this website;
  • to create usage statistics;
  • to detect, prevent, and investigate attacks on our website.

 

      2.4. Retention periods

      We will basically retain your data related to the use of the VISION website for the duration of the existing contractual relationship and also during the retention periods prescribed by law. We store data longer only if this is necessary to examine detected attacks on our website and, furthermore, until the end of relevant limitation periods, legal retention periods, or the termination of disputes, if any.

       

      2.5. Data recipients

      We regularly use IT service providers to operate and manage the VISION website. These providers may have access to personal data on our behalf and on our instruction in order to provide the commissioned IT services.

Your data will not be transferred to third parties for their own purposes without your consent.

 

    3. Processing to "solicit and perform energy trading transactions"

      3.1. Scope of processing of personal data

      We collect and process the following personal data which you disclose to us when you conclude an energy trading transaction or a similar contract and, furthermore, during the performance of the contract: company name (especially sole proprietor), academic degree, sex, first name, surname, address, email address, phone number, content of telephone conversations, IP address, credit worthiness data, CDD data (incl. negative media coverage), sanction lists data (when needed, date of birth, passport number, nationality), payment terms, bank details, invoice data, metering points of your facility, registry number, EIC, shipper code, VAT number, ACER code and LEI.

      Prior to the conclusion of a contract and during an active contractual relationship VERBUND uses the information you have provided and additional data we have collected to obtain information on your credit rating from Moody’s or the credit rating agencies KSV1870 and/or Creditreform, as well as further information about you from Factiva (Dow Jones) and/or Bureau van Dijk (Compliance Catalyst).

      3.2. Lawfulness of processing of personal data

      We lawfully process the data referred to in Section 3.1. according to Art. 6 (1) (b) GDPR for the performance of a contract and for the compliance with legal obligations according to Art. 6 (1) (c) GDPR. These obligations may arise in particular from the Electricity Management and Organisation Act, the Gas Management Act, the Commercial Code, the Green Electricity Act, the Federal Energy Efficiency Act, the EU regulations, such as sanctions lists, REMIT, EMIR, MAR, and MiFID.

      VERBUND has a legitimate interest according to Art. 6 (1) (f) GDPR to learn more about your credit standing and integrity prior to the conclusion of a contact and during the existing contractual relationship.

      You provide information on a voluntary basis; however, if you do not provide such data, you will not fulfil the requirements which are necessary for the conclusion and processing of a contract by VERBUND.

      3.3. Purposes for which we process data

      We process your data according to Section 3.1. for the purpose of the conclusion, performance, amendment and termination of the contract with you, as well as for billing purposes.

      3.4. Retention periods

      These data will be erased after termination of the contract, unless data are needed longer according to legal retention periods (such as those according to § 212 of the Commercial Code (UGB) or §§ 124 et seq of the Federal Tax Code (BAO)), or as long as claims can be asserted from the contractual relationship.

      3.5. Data recipients

       

               We transfer data to third parties only where necessary for the compliance with (pre)contractual or legal obligations or for the safeguarding of our legitimate interests.

    Data can be transferred to appointed service providers or, where legally necessary, to other participants of the energy market (e.g. grid operators), and to authorities and public agencies (e.g. regulatory authorities or fiscal authorities).

               

    4. Cookies

    The VISION website of VERBUND uses cookies. Cookies are tiny text files that are downloaded onto your terminal device (e.g. computer, smartphone or tablet computer) when you visit our website. Cookies help the website remember certain entries and settings (such as language or font size) for a certain period; it is therefore not necessary that you readjust these settings when you visit the website again. We use cookies to provide you with the best possible service on our website or to display content tailored to your needs. Cookies allow us to count the number of visits on our website and identify the pages visited.

    You may generally accept the use of cookies on our website and thereby benefit from the full functionality of the website. You can withdraw your general consent at any time by controlling and/or deleting cookies at your discretion. If you want to learn more on how to control cookies, please go to https://www.aboutcookies.com. You can delete all cookies stored on your computer and adjust the settings of most browsers to block cookies. You can also disable only some cookies. If you disable the use of all or even only some cookies (single opt-out), you may not be able to benefit from the full functionality of our website.

     

      4.1. Which cookies do we use?

      The VERBUND website uses first-party-cookies (especially all absolutely necessary cookies) as well as third-party-cookies (such as marketing cookies). Some of the cookies we use do not contain personal data, that is to say information relating to an identifiable or identified individual (e.g. name, IP address, address and location data). Other cookies or website technologies (such as plug-ins), however, process personal data. In this case, you may object to processing by single opt-out (see below). Furthermore, you can also adjust certain settings of a provider (e.g. Google) to block certain cookies (see below).

      The categories of cookies described below are first-party cookies, which will be sent and read exclusively by the VERBUND domain:                

      4.2. Cookies which are necessary to operate the website

      VERBUND uses cookies, which are necessary to run the website https://vision.verbund.com/ and to make available its services, applications and functions. This includes technologies that allow you to access the website, services, applications and functions and which are necessary to verify the website’s functionality, to prevent fraud, and to improve security. These cookies are essential for your use of the website’s services. The services cannot function properly without these cookies. These Cookies do not contain any personal data or personal information about you. Information we collect from cookies does not allow us to identify an individual. These cookies are only stored for as long as absolutely necessary for the services, thus regularly until the end of an online session or until you close your browser (session cookies).

       

      Cookie

      Description

      Retention period

      ASP.NET_SessionId

      Standard IIS session cookie to identify the user

      Session cookies that are deleted when you close your browser

      TempCookie

       

      Random GUID value: used for session identification between Sitecore and IdentityProvider Server

      verbund#country

       

      Country of the current user (https://sitecore.namics.com/2015/03/13/sitecore-cookies/, German only)

      verbund#lang

       

      Language of the current user (https://sitecore.namics.com/2015/03/13/sitecore-cookies/, German only)

      SID

       

      Session ID of the registered user in key accounts platform

      grosskunden#country

       

      Country of the current user

      grosskunden#lang

      Language of the current user

      idsrv.xsrf

      Antiforgery Token (https://en.wikipedia.org/wiki/Cross-site_request_forgery)

      idsrv.clients

      Saves the clients for which the user is registered

      SignInMessage.XXX

      The contextual information passed to the authorise endpoint. (https://identityserver.github.io/Documentation/docsv2/advanced/userService.html)

       

       

      4.3. Functional cookies

      VERBUND also uses functional cookies, which allow you to save and use stored searches and similar functions (e.g. selected language). These cookies are stored also after you close an internet session (permanent cookies) and are available again when you visit the website again to enhance your use of the website. Some of these cookies process your personal data to make available the functionalities to you. However, we do not use these data to identify you as an individual.

       

      Cookie

      Description

      Retention periods

       

      basketid

      Basket allocation

      1 year

      NSC_MCwtsw-xxx_wc-ofv-TTM

      Saves the IP address and the webserver port to which the client is transferred (see https://docs.citrix.com/en-us/netscaler/12/load-balancing/load-balancing-persistence/http-cookie-persistence.html)

      2 minutes

      idsrv

      If you have checked the "keep me logged in" functionality persistently. Otherwise, when you close your browser.

      idsrv.session

      If you have checked the "keep me logged in" functionality persistently. Otherwise, when you close your browser.

      idsrv.username

      Saves the last user name for pre-assignment in login

      1 year

       

       

      4.4. Performance cookies

      VERBUND currently does not use any analytic cookies to analyse the use or to monitor the performance of the VISION website.

      The following third-party cookies are transmitted and read out by domains of other service providers:

       

                     

      4.5. Web analytics cookies

      Google Analytics

      VERBUND uses Google Analytics, a web analytics service provided by Google Inc ("Google"). Google Analytics also uses cookies to analyse your use of the website. Information generated by the cookies on the use of this website is transmitted to and stored by a Google server in the United States. Please note that the code "gat._anonymizeIp();" was added to this website to guarantee the anonymisation of IP addresses. The IP addresses of users are therefore truncated on this website before they are stored on the Google servers (IP masking). The full IP address is therefore not transmitted to a Google server in the United States. Only in exceptional cases will the full IP address be transmitted to a Google server in the United States and truncated there. On behalf of VERBUND, Google will use this information for the purpose of evaluating your use of our website, for compiling synthesis reports on website activity for website operators, and for the purpose of providing other services relating to website activity and internet usage.

      You can adjust the settings of your browser to prevent the installation of cookies ("browser add-on"); please note, however, that if you do this, you might not be able to benefit from the full functionality of this website.

      Furthermore, you may download and install the browser plugin provided below to prevent the collection of data relating to your use of this website generated by the cookie (including your anonymised IP address) to Google and the processing of such data by Google. The current link is available at https://tools.google.com/dlpage/gaoptout?hl=en-GB.

      More information on Google’s terms of use and data privacy policy is available at http://www.google.com/analytics/terms/gb.html or under http://www.google.com/intl/en/analytics/privacyoverview.html (German only).

       

      4.6. Deactivation of cookies:

       

    You can also adjust the settings of your browser to generally block all cookies. If you want to learn more on how to control cookies, please go to https://www.aboutcookies.com.

    Please use the following links if you want to learn more on how to block cookies in all common browsers:


    • Mozilla Firefox:
    https://support.mozilla.org/en-US/kb/delete-cookies-remove-info-websites-stored

    • Internet Explorer: https://support.microsoft.com/en-us/topic/delete-and-manage-cookies-168dab11-0753-043d-7c16-ede5947fc64d

    • Google Chrome: https://support.google.com/accounts/answer/61416?hl=en

    • Safari: https://support.apple.com/kb/PH17191?locale=de_AT&viewlocale=en_US

     

    You can delete all cookies stored on your computer and adjust the settings of most browsers to block cookies. However, please note that if you do this, you may not be able to use the full functionality of this website. In this case, you might have to adjust some settings manually whenever you visit this website and accept that some functions might not work properly.

     

    5. Local storage

    We use Local Storage Technology (also called "Local Data" and "Local Storage") to adjust the VISION website to your personal needs and use. Data are stored locally in your browser’s cache and will remain there and can be read out even after you close the browser window or the program, unless you delete the cache.

    Local storage allows us to store your preferences in connection with the use of the VISION website on your computer, and you may use these without having to log in.

    Data stored in local storage cannot be accessed by third parties and are not transmitted to third parties or used for purposes of advertising.

    You can adjust the settings of your browser if you want to block the use of the local storage functions. These settings will also give you an overview of data saved in local storage. Browser extensions are available for more information (e.g. Firebug and Fire Storage Plus! for Firefox; Storage Area Explorer for Chrome).

    You can manage local storage content via the "History" or "Local Data" settings, depending on your browser.

     

    6. Rights of the data subject

    6.1. Right to information

      You have the right to obtain information from us on all your data processed by VERBUND. You have the right to obtain information as to whether your personal data will be transferred to a third state or to an international organisation. You may demand information in this context on whether we have provided appropriate safeguards according to Art. 46 GDPR in connection with the transfer of your data.

      6.2. Right to rectification and right to restriction of processing

      You have the right to obtain the rectification of inaccurate data and the right to have incomplete data completed. Under certain circumstances, for example if the accuracy of data is contested, you have the right to obtain the restriction of processing; in this event, data may only be processed with your consent or for the establishment, exercise or defence of legal claims or for the protection of the rights of another natural or legal person or for reasons of important public interest.

      6.3. Right to data portability

You have the right to request that VERBUND transmit to you or to a third party nominated by you, where technically feasible, a copy of your data in a structured, commonly used and machine-readable format. Furthermore, you have the right to transmit such data to another controller without hindrance from the controller to which the data have been provided, whereby        

    (1) the processing is based on consent pursuant to Art. 6 (1) (a) or Art. 9 (2) (a) or on a contract pursuant to Art. 6 (1) (b) GDPR; and
    (2) the processing is carried out by automated means.

In exercising this right to data portability, you also have the right to have the personal data transmitted directly from one controller to another, where technically feasible. This right shall not adversely affect the rights and freedoms of others.

 

6.4. Right to erasure

      You have the right to obtain erasure of data under certain circumstances, such as if the data have been unlawfully processed.

      The so-called "right to be forgotten" is not applicable, because VERBUND will not publish your personal data under any circumstances.

      If you have exercised the right to rectification, erasure or restriction of processing vis-à-vis VERBUND, we are obliged to communicate any rectification or erasure of data or restriction of processing to each recipient to whom the personal data have been disclosed, unless this proves impossible or involves disproportionate effort.

      6.5.  Right to object

      You have the right to object at any time, on grounds relating to your particular situation, to the processing of your personal data which is based on Art. 6 (1) (e) or (f) GDPR.

      In this case, VERBUND will no longer process your personal data, unless we can demonstrate compelling legitimate grounds for the processing which override your interests, rights and freedoms or for the establishment, exercise or defence of legal claims.

      6.6.  Right to withdraw consent

      You have right to withdraw your consent at any time. Even if you withdraw your consent, the lawfulness of processing operations carried out until you have withdrawn your consent shall not be affected.

      6.7.  Supervisory authority

      Notwithstanding any other remedies, if you feel that your personal data was unlawfully processed, you may lodge a complaint with the national supervisory authority in your place of residence. In Austria, this supervisory authority is the Data Protection Authority.
       
       

     

    As at: 25/5/2018

     

    It is important for VERBUND to protect your personal data and to explain to you how we handle them.

    You can submit your application for a position at VERBUND AG or one of the group companies via the application tool available on the website at www.verbund.com and input the application data directly via the web interface. VERBUND AG is familiar with the management of human resources for VERBUND companies and therefore organises the application process and the application tool centrally for these VERBUND companies.

    1. Name and contact details of the data controller

    The data controller responsible for processing your data within the scope of this data processing is VERBUND AG, Am Hof 6a, 1010 Vienna together with, in the sense Art. 26 GDPR, the respective VERBUND company, if you have applied to one of them in particular.

    The VERBUND companies include the following:

    VERBUND Hydro Power GmbH, Europaplatz 2, 1150 Vienna,
    VERBUND Energy4Business GmbH, Am Hof 6a, 1010 Vienna,
    VERBUND Energy4Business Germany GmbH, Luise-Ullrich-Straße 20, 80636 Munich
    VERBUND Energy4Customers GmbH, Erdberger Lände 26A 1030 Vienna,
    VERBUND Services GmbH, Am Hof 6a, 1010 Vienna,
    VERBUND Green Power GmbH, Am Hof 6a, 1010 Vienna,
    VERBUND Tourismus GmbH, Europaplatz 2, 1150 Vienna,
    VERBUND Thermal Power GmbH & Co KG, Kraftwerkstraße 1, 8410 Fernitz-Mellach,
    VERBUND Innkraftwerke GmbH, Werkstraße 1, 84513 Töging am Inn,
    Grenzkraftwerke GmbH, Münchner Straße 48, 84359 Simbach am Inn,
    Innwerk AG, Schulstraße 2, 84533 Stammham,
    smart Energy Personal GmbH, Dietrichgasse 27/3.OG, 1030 Vienna
    Email: office.hpr@verbund.com
    The contact details of the data protection officer are: Email: datenschutz@verbund.com

    2. What kind of personal data will we process?

    If you apply to VERBUND, we will process the following personal data (mandatory fields):

    • Information about your person, such as title, first name, last name, date of birth, citizenship
    • Information about how we can reach you, such as email, phone number
    • Information about your desired gross annual salary, earliest possible start date, information such as how you heard about the job
    • Curriculum vitae.

    Should you not provide the data in the fields marked as mandatory, we will not be able to process your application, as certain details about you are required in order to assess your suitability for the position.
    All other information that is not marked as mandatory, such as

    • address,
    • or other especially vulnerable data (e.g. religious belief),
    • and other documents voluntarily uploaded by you

    can be voluntarily filled out or disclosed by you. These data will also be handled by VERBUND and the VERBUND company you applied to for the same purpose as the mandatory fields.
    Please note that you are not required to share especially vulnerable data when submitting an application online. If you disclose such information voluntarily and without being asked to do so, you declare your consent that such data will be processed and used for the indicated purposes. 

    3. Legal basis and purpose of the data processing

    The legal basis for the processing of applicant data is Art. 6 (1) (b) GDPR and therefore the processing for the fulfilment of a contract or the performance of pre-contractual measures. By submitting an application, you are asking us to process your applicant data within the scope of the application, which requires the data processing described.

    If this concerns the processing of any voluntarily provided (including especially vulnerable) data, we will base the processing on your consent in the sense of Art. 6 (1) (a) in conjunction with Art. 9 (2) (a) GDPR.

    If you have given us consent to process your data, this processing will take place for the purposes set forth in the declaration of consent and to the extent agreed therein. You may revoke your consent with effect for the future at any time, free of charge.

    by letter (VERBUND AG, Am Hof 6a, 1010 Vienna),

    Email (office.hpr@verbund.at).

    Even if you withdraw your consent, the lawfulness of processing operations carried out until you have withdrawn your consent shall not be affected.

    4. Storage duration

    We will electronically store your personal data for the duration of the application process and thereafter for as long as claims arising from the application can be asserted. On the basis of the provisions of the Equalities Act, your data will in any case be stored for the duration of six months after completion of the application process.

    If you have granted your consent for the processing of certain data, your data may be erased earlier following the withdrawal of your consent. 

    5. Data recipients

    Your data may be forwarded to the following recipients:

    • commissioned service providers for order processing (“processor”)
    • (group) companies or other recipients within the scope of (pre-contractual) contract fulfilment or in accordance with granted consent
    • courts, authorities and public bodies

    VERBUND works only with processors who provide sufficient guarantees that appropriate technical and organisational measures are implemented in such a way that the processing is carried out in accordance with the requirements of the applicable national data protection laws and the General Data Processing Regulation ("GDPR") as amended. The processing performed by a processor is always done on the basis of a contract that binds the processor to the obligations under data protection law. VERBUND uses processors outside the European Union only if an adequacy decision has been taken by the European Commission for the third country concerned or if appropriate data protection guarantees are available (e.g. binding internal data protection regulations or EU standard contract clauses).

    6. Your rights

    In principle, you have the right to information, correction, erasure, restriction, data portability, revocation of a granted consent and objection in respect of your data processed by VERBUND. To exercise these rights, please contact VERBUND at datenschutz@verbund.com. If you believe that the processing of your data violates data protection law or your data protection claims have otherwise been violated in any way, you can submit a complaint to the national supervisory authority where you live. In Austria, this supervisory authority is the Data Protection Authority.

    Last update: 6/9/2022

    VERBUND is committed to the protection of your personal data. We therefore comply with all applicable laws relating to the protection, lawful handling and the confidentiality of personal data, and the data security, including but not limited to the General Data Protection Regulation ("GDPR"). We would therefore like to inform you which personal data we will process when you visit an area which VERBUND monitors via video surveillance. The sign directly mentions the controller of the video-surveyed area.

    1. Name and address of the controller

    Depending on the video-surveyed area (location), the controller of your personal data according to data protection laws is:

     

    VERBUND AG

    Am Hof 6a

    A-1010 Vienna

    Phone: +43 (0)50313-0

    Email: information@verbund.com

     

    VERBUND Hydro Power GmbH

    Europaplatz 2

    A-1150 Vienna

    Phone: +43 (0)50313-0

    Email: information@verbund.com

     

    VERBUND Tourismus GmbH

    Europaplatz 2

    A-1150 Vienna

    Phone: +43 (0)50313-0

    Email: information@verbund.com

     

    Innwerk AG

    Schulstraße 2

    D-84533 Stammham

    Phone: +49 (0)8678 988922750

    Email: information@verbund.com

     

    Österreichisch-Bayrische Kraftwerke AG

    Münchner Straße 48

    D-84359 Simbach am Inn

    Phone: +49 (0) 8571 9140-00

    Email: information@verbund.com

     

    Donaukraftwerk Jochenstein AG

    Innstraße 121

    D-94036 Passau

    Phone: +49 (0) 8591 916-0

    Email: information@verbund.com

     

    VERBUND Thermal Power GmbH & Co KG

    Kraftwerkstraße 1

    A-8410 Fernitz-Mellach

    Phone: +43 (0)50313-0

    Email: information@verbund.com

     

    VERBUND Innkraftwerke GmbH

    Werkstraße 1

    D-84513 Töging am Inn

    Phone: +49 (0) 8631 39-0

    Email: information@verbund.com

     

    VERBUND Services GmbH

    Am Hof 6a

    A-1010 Wien

    Phone: +43 (0)50313-0

    Email: information@verbund.com

     

    Contact details of the Data Protection Officer: 

    Email: datenschutz@verbund.com

     

    2. "Video Surveillance" Processing Operations

    2.1. What kind of personal data will we process?

    We will process the following personal data in the context of video surveillance:

    • Image data of the data subject(s)
    • Place of video recording
    • Time of video recording
    • Identity of the data subject(s), if identifiable based on the recording
    • Role of the data subject(s) (e.g. offender, victim, witness), if identifiable based on the recording

    Please note that drones are used at the power plants for planning, controlling, security, maintenance or other documentary purposes (e.g. for condition inspections, preservation of evidence, creation of planning or permission documents). It cannot be ruled out that visitors to the power plants will be recorded by a drone. In order to minimise data, recordings of identifiable visitors will be pixelated where technically and organisationally possible, meaning that it will no longer be possible to identify individuals as a general rule.

    2.2. What is our legal basis for processing personal data?

    In order to justify processing on the basis of our legitimate interest, we refer to Art. 6(1) (f) GDPR, which consists of fulfilling the purposes mentioned in this privacy statement.

    2.3. Purposes for which we process data

    We process your data in the context of our video surveillance operations for the following purposes:

    • to protect our property and premises,
    • to fulfil our legal diligence obligations,
    • to prevent, curtail, and solve criminally relevant behaviour,
    • to meet requirements imposed by authorities in the context of the operations of facilities and power plants.

    2.4. Retention periods

    Except for live recordings, we keep your data for a maximum of 72 hours; we automatically erase data after that period has expired, unless proceedings are initiated that require longer retention periods. In such a case, we keep data throughout these proceedings and erase data subsequently.

    2.5. Data recipients

    In the event of proceedings, we will transfer your data to:

    • competent authorities and courts (to secure evidence in criminal cases), to policy authorities (for security purposes)
    • courts (to secure evidence in civil cases)
    • employees, victims, witnesses (in the context of the enforcement of claims)
    • insurance companies (only to settle insurance claims)
    • lawyers, courts, authorities, and other agencies for the enforcement of rights.

    We do not transfer data to recipients that use such data for their own purposes.

    3. Rights of the data subject

    The data subject has the right to obtain from the controller confirmation as to whether personal data relating to him or her will be processed; if this is the case, he or she shall have the right of access to such personal data and to the information specified in Art. 15 GDPR

    The data subject has the right to demand that the controller immediately correct any incorrect personal data concerning him or her and, if necessary, complete any incomplete personal data (Art. 16 GDPR).

    The data subject has the right to demand that the controller erase personal data relating to him or her immediately if one of the reasons specified in Art. 17 GDPR applies, e.g. if the data are no longer required for the purposes pursued (right to erasure).

    The data subject has the right to require the controller to restrict the processing if one of the conditions listed in Art. 18 GDPR is met, e.g. if the data subject has lodged an objection against the processing, for the duration of the controller’s examination.

    The data subject has the right to object at any time to the processing of personal data concerning him for reasons relating to his or her particular situation. The controller shall then no longer process the personal data unless he or she can prove compelling grounds for processing worthy of protection which outweigh the interests, rights and freedoms of the data subject, or the processing serves to assert, exercise or defend legal claims (Art. 21 GDPR).

    Without prejudice to any other administrative or judicial remedy, any data subject shall have the right to appeal to a supervisory authority if he or she considers that the processing of his or her personal data infringes the GDPR (Art. 77 GDPR). The data subject may exercise this right before a supervisory authority in the Member State of his or her place of residence, employment or presumed infringement. In Austria, the data protection authority has jurisdiction. In Bavaria, the Bavarian State Office is responsible for data protection supervision.

    It is important for VERBUND to protect your personal data and to explain to you how we handle them.

     1. Name and address of the Data Controller

    The Data Controller responsible for the processing of your data under this data processing agreement is VERBUND AG, Am Hof 6a, 1010 Vienna, tel.: +43 (0)50313-0, email: information@verbund.com or another VERBUND company (“VERBUND”) identified as the organiser, namely VERBUND Energy4Customers GmbH, Erdberger Lände 26A, 1030 Vienna, VERBUND Green Power GmbH, Am 6a, 1010 Wien, VERBUND Energy4Business GmbH, Am Hof 6a, 1010 Vienna, VERBUND Energy4Future GmbH, Am Hof 6a, 1010 Vienna, VERBUND Hydro Power GmbH, Europaplatz 2, 1150 Vienna, VERBUND Wind Power Austria GmbH, Europaplatz 2, 1150 Vienna, VERBUND Tourismus GmbH, Europaplatz 2, 1150 Vienna, VERBUND Thermal Power GmbH & Co KG, Kraftwerkstraße 1, 8410 Fernitz-Mellach, VERBUND Energy4Business Germany GmbH, Sonnenstraße 17, 80331 Munich, die VERBUND Green Power Deutschland GmbH, Energie-Allee 1, 55286 Wörrstadt, die VERBUND Green Power Deutschland Photovoltaik GmbH, mit Sitz in Schönefeld (Brandenburg) und der Geschäftsanschrift Sonnenstraße 17, 80331 Munich, Grenzkraftwerke GmbH, Münchner Straße 48, 84359 Simbach am Inn, Innwerk AG, Schulstraße 2, 84533 Stammham and VERBUND Innkraftwerke GmbH, Werkstraße 1, 84513 Töging am Inn.


    The contact details of the data protection officer are as follows: datenschutz@verbund.com.
     
    2. Data processing “Registration for events of VERBUND”

    2.1. What kind of personal data will we process
    If you register for events of VERBUND, we will process information about your person such as gender, academic degree, name, address as well as your contact details such as telephone number and/or email address, and under certain circumstances about your company and your position as well as further event-related information.

     
    You provide the data on a voluntary basis; however, if you do not provide the data in the fields identified as mandatory, we will not be able to process your registration.

     
    2.2. What is our legal basis for processing personal data?
    The legal basis for the processing of data pursuant to point 2.1. is Art. 6(1) (b) GDPR and therefore the fulfilment of a contract, as well the legitimate interest of VERBUND pursuant to Art. 6(1) (f) GDPR. The legitimate interest lies mainly in offering you a registration option (online, email or phone), to be able to get in contact and communicate with you, as well as to be able to perform an access check on site.

    The personal data disclosed as part of the registration will be processed for the purpose of processing the registration and administering the event, incl. the associated communication (e.g. sending out the registration confirmation, place reservation, answering questions, etc.).

     
    2.3. Retention period
    Your application data will be stored for as long as is necessary for fulfilment of the purpose, and in addition only for as long as they have to be processed within the scope of statutory retention obligations.

     
    2.4. Data recipients
    The data will only be forwarded to third parties where required for the fulfilment of (pre-)contractual or statutory obligations, where justified for the maintenance of our legitimate interests, or where permitted within the scope of granted consent.

     
    The data may be sent to commissioned service providers for order processing (responsible for the organisation and execution of the event) or to companies pursuant to granted consent.

     
    3. Data processing “Image recordings (photos/videos)”

      
    3.1. What kind of personal data will we process?
    If image recordings are made at events of VERBUND, these will be stored and used.


    3.2. What is our legal basis for processing personal data?
    The legal basis is Art. 6 (1) (f) GDPR and therefore the legitimate interest. 

    Image recordings are processed for the purpose of documenting and presenting events, activities and happenings related to the work or tasks of VERBUND, and stored in the VERBUND archive. Furthermore, the image recordings will be processed for internal purposes and for the purposes of the public relations and press work of VERBUND, made available to participants if necessary and published in printed and electronic media, in particular on social media platforms (Facebook, Twitter, YouTube, etc.).
     
    3.3. Retention period
    Your image recordings will be stored for as long as the purpose of documentation exists and no objections are made in respect of this processing.

     
    3.4. Data recipients
    The image data will only be forwarded to third parties where justified for the maintenance of our legitimate interests and moreover where permitted within the scope of the purpose of processing.

    The image recordings may be sent to commissioned service providers for order processing.

     
    4. Your rights

    In principle, you have the right to information, correction, erasure, restriction, data portability, revocation and objection in respect of your data processed by us. If you believe that the processing of your data violates data protection law or your data protection claims have otherwise been violated in any way, you can submit a complaint to us at datenschutz@verbund.com or to the national supervisory authority where you live. In Austria, this supervisory authority is the Data Protection Authority.


    As at: 23/05/2022

     

    It is extremely important for us VERBUND AG, Am Hof 6a, 1010 Vienna, ("VERBUND", "We", “us") to protect your personal data. We therefore comply with the applicable legal regulations for the protection, lawful handling and secrecy of personal data as well as data security, in particular the Data Protection Act as amended ("DSG"), the Telecommunications Act ("TKG") and the General Data Protection Regulation ("GDPR").

    We act as a responsible party within the meaning of the GDPR in the context of our social media profiles. This is why we inform you about the purposes for which and the legal basis on which we use various social media applications to contact you by means of the following privacy statement. The contact details of the data protection officer: datenschutz@verbund.com.

    We might need to update this privacy statement from time to time. It is therefore recommended that you check this page on a regular basis to ensure that you are viewing the most recent version.  

    Social Media Activities

    Contact us

    When you contact us via our social media pages

    • Facebook https://www.facebook.com/verbund,
    • Instagram https://www.instagram.com/verbund_ag/,
    • Twitter https://twitter.com/verbund,
    • LinkedIn https://at.linkedin.com/company/verbund,
    • Xing https://www.xing.com/pages/verbund, or  
    • YouTube https://www.youtube.com/user/verbundcom

    we process the data you provide (e.g. customer number, counter point number, full name, address, description of the system or problem, communication with us) for the purpose of answering your enquiry, implementing pre-contractual measures in accordance with Art 6 Para 1 lit b GDPR or in the context of our legitimate interests in processing your enquiry (customer support) in accordance with Art 6 Para 1 lit f GDPR. We will save this data for a maximum of three months after your enquiry has been handled, insofar as other statutory retention periods do not apply.  

    In this context, we receive your personal data from the respective operator of the social media platform and also transmit your personal data to them. To the extent that this involves a transfer to countries without an adequacy decision in accordance with Article 45 para 3 of the GDPR and without suitable guarantees in accordance with Article 46 of the GDPR, such as the USA in particular, we would like to point out that there is a risk that your data transmitted in this way may be accessed by authorities in these third countries for control and monitoring purposes and that no effective legal remedies are available.

    Social Media Interaction

    You can also interact with us on our social media profiles by clicking various buttons (e.g. "Like", "Share", "Subscribe", "Invite Friends", "Love", "Dislike", "Share", "Subscribe", "Like" etc.) or commenting on content. In this case, we will process your interaction as well as your ("User") name, profile photo and IP address, and any invited or tagged third party personal data.

    We use this information in accordance with Art 6 Para 1 lit a and f GDPR to respond to your questions and comments, to comment on your opinion/feedback, to provide you with the opportunity to express your opinion or to advertise VERBUND AG and our product range on the platform. We store the data you have provided yourself until you withdraw your interaction or as long as our content (images, videos, etc.) is online.

    Tracking / marketing campaigns

    We automatically process personal data on our social media profiles via the page insight tools of Facebook, Instagram and LinkedIn, in each case together with the platform operator, which provide information about the interaction of visitors and users and serve to optimise your experience on the website or to optimise marketing activities ("tracking data").

    Facebook and Instagram

    We have entered into the following shared responsibility agreement with Facebook Ireland Ltd, 4 Grand Canal Square, Grand Canal Harbour, Dublin 2, Ireland for our Facebook and Instagram profiles: https://www.facebook.com/legal/controller_addendum

    Please refer to the section "How is this information shared?" under the subheading "Partners who use our analytics services" in Facebook's privacy policy at https://www.facebook.com/policy.php to find out which personal data we process together.

    We use this information in accordance with Art 6 para 1 lit f GDPR both to create aggregated analyses of how our social media presence is used and to optimise our marketing activities.

    This data is stored by Facebook in accordance with the time limits outlined at https://www.facebook.com/policy.php (subitem: "Data storage, deactivation and deletion of accounts").

    LinkedIn

    We have entered into the following joint responsibility agreement with LinkedIn Ireland Unlimited Company, Wilton Place, Dublin 2, Ireland for our LinkedIn profile: https://legal.linkedin.com/pages-joint-controller-addendum

    Please refer to LinkedIn's data protection notices to find out which personal data we process together at https://de.linkedin.com/legal/privacy-policy.
    We use this information in accordance with Art 6 para 1 lit f GDPR both to create aggregated analyses of how our social media presence is used and to optimise our marketing activities.

    This data is stored by LinkedIn in accordance with https://de.linkedin.com/legal/privacy-policy.

    Transfer to third parties

    We also transfer your personal data to external vicarious agents or service providers (commissioned processors) to the extent necessary:

    • to IT service providers and/or providers of data hosting or data processing or similar services;
    • to other service providers, providers of tools and software solutions who also support us in rendering our services and operate on our behalf (incl. providers of marketing tools, marketing agencies, communication service providers and call centres)

    All our commissioned processors handle your data only on our behalf and on the basis of our instructions to allow us to provide you with our online service.

    We will also transfer your personal data to the following recipients (responsible bodies) to the extent necessary:

    • to VERBUND Group companies to the extent necessary to fulfil obligations to you
    • to any third parties involved in the fulfilment of our obligations to you (e.g. banks);
    • to other external third parties to the extent required (e.g. auditors, insurance companies in the event of an insured event, legal representatives as the occasion requires, etc.);
    • to authorities and other public bodies to the extent required by law (e.g. financial authorities, etc.).

    To the extent that we process your data in a third country outside the European Union (EU) or the European Economic Area (EEA) or we do so within the scope of using third-party services, this will only be carried out if it is necessary for the fulfilment of our (pre-)contractual obligations, on the basis of your consent, due to a legal obligation or based on our legitimate interests. We have implemented suitable and proportionate safeguards to ensure that any transfer of your data to the respective third country is in compliance with data protection law. We will provide you with a copy of these suitable safeguards at your request insofar as we process or have your data processed in third countries.

    Storage duration

    We store your data for three months in order to process enquiries (and in the event of follow-up questions) through our website or social media pages. In individual cases (such as complaints), the personal data is retained for the period in which claims can be asserted against us (statutory limitation period of 3 or up to 30 years).

    Data security

    We adopt appropriate technical and organisational security measures in order to protect your personal data against accidental or unauthorised destruction, modification or against loss, theft and unauthorised inspection, disclosure, reproduction, use, alteration or access. Moreover, both we and our employees are obliged to adhere to data secrecy and non-disclosure. Our vicarious agents and authorised representatives who are required to have access to your personal data for the performance of their professional duties will also have access and be subject to the same obligations of data secrecy and non-disclosure.

    Your rights

    You may request information about your stored personal data at any time. You can also request the correction or deletion of your data under certain conditions. In addition, you may be entitled to the right to restrict the processing of your data and to obtain the return of the data you have provided in a structured, conventional and machine-readable format. You also have the right to withdraw your consent at any time with effect for the future.

    Moreover, you have the right to object to the processing of your data for reasons relating to your particular situation (Art 21 GDPR). You have the possibility to lodge a complaint with the data protection authority.

    Kindly submit your request by clearly identifying yourself and briefly describing the scope of how you intend to exercise your rights as listed above, so that we can process your request relating to your above-mentioned rights and to ensure that personal data is not disclosed to unauthorised third parties.

    Correct as of 23/05/2022

    Privacy statement for taking minutes of meeting of VERBUND Hydro Power GmbH

    It is important for VERBUND Hydro Power GmbH to protect your personal data and to explain to you how we handle them.

    1. Name and address of the Data Controller

    Responsible for processing your data is VERBUND Hydro Power GmbH, Europaplatz 2, 1150 Vienna ("VERBUND", "we", "us").

    The contact details of the data protection officer are as follows: datenschutz@verbund.com.

    2. Processing in the context of “taking minutes of meeting”

    2.1.   What kind of personal data will we process?

    During communication via certain, clearly defined telephone numbers at VERBUND, the following personal data are processed: name, telephone number, contents of telephone calls.

    2.2.   What is our legal basis and purpose for processing personal data?

    The legal basis for the processing of the data and recording the meeting mentioned under point 2.1. is (i) Art. 6 (1) (b) GDPR provided that we have a contractual relationship with you and have declared this to be part of the contract or have agreed to perform the contract by telephone or (ii) our legitimate interest pursuant to Art. 6 (1) (f) GDPR. The recording of telephone calls relating to disaster control, disruptions, contract processing and service, which is in our interest, serves not only to preserve evidence (especially in the case of disaster reports) but in particular also to ensure the quality of sensitive processes and the necessary communication chains (cf. in particular the standard required by DIN EN 50518-2 or ÖVE/ÖNORM EN 50518-2). In this way, we can better understand (i) when we received which notification, (ii) what information we received, (iii) which steps we took on this basis and in which timeframe, and (iv) what was agreed. In this way, we can ensure for the long term that we ask you the right questions and provide you with sufficient support and information – whether in an emergency, in the professional handling of joint contractual relationships, or in service.

    2.3.   Retention period

    Your personal data will (i), if they represent contractual content, and depending on the legal situation, be stored for seven years (Austria: Art. 132 Federal Tax Code (BAO) and Art. 212 Corporate Code (UGB)) or ten years (Germany: Art. 238 in conjunction with Art. 257 (1) (4) Commercial Code (HGB) and Art. 14b VAT Act (UStG)), or (ii) in all other cases for a maximum of three years as evidence in the event of claims for damages (see Art. 1489 General Civil Code (ABGB) and Arts. 195 et seq. Civil Code (BGB)). If necessary, your data will be stored only for as long as court or administrative proceedings are pending, which may require a longer storage period. In such an event, the data will be stored for the duration of the proceedings and then deleted.

    2.4.   Data recipients 

    The data will never be passed to third parties. If courts or authorities demand disclosure in pending proceedings, the data will be disclosed only if they can provide proof of a sufficient legal basis.

    3. Your rights

    In principle, you have the right to information, correction, erasure, restriction, data portability, revocation of a granted consent and objection in respect of your data processed by us. To exercise these rights, please write to us at datenschutz@verbund.com. If you believe that the processing of your data violates data protection law or your data protection claims have otherwise been violated in any way, you can submit a complaint to the national supervisory authority where you live. 

    As at 2019/05/15
    It is important for VERBUND Innkraftwerke GmbH to protect your personal data and to explain to you how we handle them.

    1. Name and address of the Data Controller

    Responsible for processing your data is VERBUND Innkraftwerke GmbH, D-84513 Töging am Inn, Werkstraße 1, ("VERBUND", "we", "us").

    The contact details of the data protection officer are as follows: datenschutz@verbund.com.

    2. Processing in the context of “taking minutes of meeting”

    2.1.   What kind of personal data will we process?

    During communication via certain, clearly defined telephone numbers at VERBUND, the following personal data are processed: name, telephone number, contents of telephone calls.

    2.2.   What is our legal basis and purpose for processing personal data?

    The legal basis for the processing of the data and recording the meeting mentioned under point 2.1. is (i) Art. 6 (1) (b) GDPR provided that we have a contractual relationship with you and have declared this to be part of the contract or have agreed to perform the contract by telephone or (ii) our legitimate interest pursuant to Art. 6 (1) (f) GDPR. The recording of telephone calls relating to disaster control, disruptions, contract processing and service, which is in our interest, serves not only to preserve evidence (especially in the case of disaster reports) but in particular also to ensure the quality of sensitive processes and the necessary communication chains (cf. in particular the standard required by DIN EN 50518-2 or ÖVE/ÖNORM EN 50518-2). In this way, we can better understand (i) when we received which notification, (ii) what information we received, (iii) which steps we took on this basis and in which timeframe, and (iv) what was agreed. In this way, we can ensure for the long term that we ask you the right questions and provide you with sufficient support and information – whether in an emergency, in the professional handling of joint contractual relationships, or in service.

    2.3.   Retention period

    Your personal data will (i), if they represent contractual content, and depending on the legal situation, be stored for seven years (Austria: Art. 132 Federal Tax Code (BAO) and Art. 212 Corporate Code (UGB)) or ten years (Germany: Art. 238 in conjunction with Art. 257 (1) (4) Commercial Code (HGB) and Art. 14b VAT Act (UStG)), or (ii) in all other cases for a maximum of three years as evidence in the event of claims for damages (see Art. 1489 General Civil Code (ABGB) and Arts. 195 et seq. Civil Code (BGB)). If necessary, your data will be stored only for as long as court or administrative proceedings are pending, which may require a longer storage period. In such an event, the data will be stored for the duration of the proceedings and then deleted.

    2.4.   Data recipients 

    The data will never be passed to third parties. If courts or authorities demand disclosure in pending proceedings, the data will be disclosed only if they can provide proof of a sufficient legal basis.

    3. Your rights

    In principle, you have the right to information, correction, erasure, restriction, data portability, revocation of a granted consent and objection in respect of your data processed by us. To exercise these rights, please write to us at datenschutz@verbund.com. If you believe that the processing of your data violates data protection law or your data protection claims have otherwise been violated in any way, you can submit a complaint to the national supervisory authority where you live. 

    As at 2019/05/15

    It is important for Grenzkraftwerke GmbH to protect your personal data and to explain to you how we handle them.

    1. Name and address of the Data Controller

    Responsible for processing your data is Grenzkraftwerke GmbH, D-84359 Simbach am Inn, Münchner Strasse 48, ("VERBUND", "we", "us").

    The contact details of the data protection officer are as follows: datenschutz@verbund.com..

    2. Processing in the context of “taking minutes of meeting”

    2.1.   What kind of personal data will we process?

    During communication via certain, clearly defined telephone numbers at VERBUND, the following personal data are processed: name, telephone number, contents of telephone calls.

    2.2.   What is our legal basis and purpose for processing personal data?

    The legal basis for the processing of the data and recording the meeting mentioned under point 2.1. is (i) Art. 6 (1) (b) GDPR provided that we have a contractual relationship with you and have declared this to be part of the contract or have agreed to perform the contract by telephone or (ii) our legitimate interest pursuant to Art. 6 (1) (f) GDPR. The recording of telephone calls relating to disaster control, disruptions, contract processing and service, which is in our interest, serves not only to preserve evidence (especially in the case of disaster reports) but in particular also to ensure the quality of sensitive processes and the necessary communication chains (cf. in particular the standard required by DIN EN 50518-2 or ÖVE/ÖNORM EN 50518-2). In this way, we can better understand (i) when we received which notification, (ii) what information we received, (iii) which steps we took on this basis and in which timeframe, and (iv) what was agreed. In this way, we can ensure for the long term that we ask you the right questions and provide you with sufficient support and information – whether in an emergency, in the professional handling of joint contractual relationships, or in service.

    2.3.   Retention period

    Your personal data will (i), if they represent contractual content, and depending on the legal situation, be stored for seven years (Austria: Art. 132 Federal Tax Code (BAO) and Art. 212 Corporate Code (UGB)) or ten years (Germany: Art. 238 in conjunction with Art. 257 (1) (4) Commercial Code (HGB) and Art. 14b VAT Act (UStG)), or (ii) in all other cases for a maximum of three years as evidence in the event of claims for damages (see Art. 1489 General Civil Code (ABGB) and Arts. 195 et seq. Civil Code (BGB)). If necessary, your data will be stored only for as long as court or administrative proceedings are pending, which may require a longer storage period. In such an event, the data will be stored for the duration of the proceedings and then deleted.

    2.4.   Data recipients 

    The data will never be passed to third parties. If courts or authorities demand disclosure in pending proceedings, the data will be disclosed only if they can provide proof of a sufficient legal basis.

    3. Your rights

    In principle, you have the right to information, correction, erasure, restriction, data portability, revocation of a granted consent and objection in respect of your data processed by us. To exercise these rights, please write to us at datenschutz@verbund.com. If you believe that the processing of your data violates data protection law or your data protection claims have otherwise been violated in any way, you can submit a complaint to the national supervisory authority where you live. 

    As at 2019/05/15

     

    General privacy statement for contractual and business partners and other third parties

    It is important for VERBUND to protect your personal data and for us to explain to you how we handle them.

    We process the personal details of (i) persons or companies with which VERBUND enters into contact, manages contacts and/or contractual or business relationships, and of (ii) e.g. partners in companies, company bodies, managing directors or other employees of the contractual or business partners within the scope of existing or incipient contractual and business relationships.

    In doing so, we always comply with the applicable legal regulations for the protection, lawful handling and secrecy of personal data as well as data security.

    1. Name and contact details of the data controller

    Responsible for the processing of your data within the scope of data processing at VERBUND is the respective VERBUND group company indicated as the contractual partner (“VERBUND”, “we”, “us”), namely:

    VERBUND AG, Am Hof 6a, 1010 Vienna,

    VERBUND Finanzierungsservice GmbH, Am Hof 6a, 1010 Vienna,

    VERBUND Hydro Power GmbH, Europaplatz 2, 1150 Vienna,

    VERBUND Innkraftwerke GmbH, Werkstraße 1, 84513 Töging am Inn,

    VERBUND Energy4Business Germany GmbH, Sonnenstraße 17, 80331 Munich,

    VERBUND Services GmbH, Am Hof 6a, 1010 Vienna,

    VERBUND Green Power GmbH, Am Hof 6a, 1010 Wien,

    VERBUND Energy4Flex GmbH, Am Hof 6a, 1010 Wien,

    VERBUND Energy4Customers GmbH, Erdberger Lände 26A, 1030 Wien,

    VERBUND Thermal Power GmbH & Co KG, Kraftwerkstraße 1, 8410 Fernitz-Mellach,

    VERBUND Tourismus GmbH, Europaplatz 2, 1150 Vienna,

    VERBUND Energy4Business GmbH, Am Hof 6a, 1010 Vienna,

    VERBUND Ventures GmbH, Am Hof 6a, 1010 Wien,

    VERBUND Trading Romania S.R.L., Unimed Center, 8th Tudor Arghezi street, 7th floor, 2nd district, 020945, Bucharest

    VERBUND Wind Power Austria GmbH, Europaplatz 2, 1150 Vienna,

    VERBUND Wind Power Romania S.R.L., Unimed Center, 8th Tudor Arghezi street, 7th floor, 2nd district, 020945, Bucharest

    Donaukraftwerk Jochenstein Aktiengesellschaft, Innstraße 121, 94036 Passau,

    Grenzkraftwerke GmbH, Münchner Straße 48, 84359 Simbach am Inn,

    Innwerk AG, Schulstraße 2, 84533 Stammham,

    Lestin & Co. Tauch-, Bergungs- und Sprengunternehmen GmbH, Nikolsdorfer Gasse 3, 1050 Vienna,

    Österreichisch-Bayrische Kraftwerke AG, Münchner Straße 48, 84359 Simbach am Inn,

    VERBUND Green Power Deutschland GmbH, Energie-Allee 1, 55286 Wörrstadt,

    VERBUND Green Power Deutschland Photovoltaik GmbH, mit Sitz in Schönefeld (Brandenburg) und der Geschäftsanschrift Sonnenstraße 17, 80331 München,

    Infrastruktur Bischheim GmbH & Co. KG, Energie-Allee, 55286 Wörrstadt,

    Infrastruktur Oberheimbach I GmbH & Co. KG, Energie-Allee, 55286 Wörrstadt.

    The contact details of the data protection officer are as follows: datenschutz@verbund.com.

    2. How are data collected and which data are processed?

    Data collected from the data subject (information according to Art. 13 GDPR):
    We process those personal details that we receive or collect from you or your contact person when making contact, managing contacts, initiating businesses or during a business relationship. 

    Data collected from other sources (information according to Art. 14 GDPR):
    We also process data that we lawfully receive as necessary from credit agencies or financial services institutes in the course of checking your creditworthiness or integrity from directory publishers and direct marketing companies, as well as from publicly accessible sources (e.g. websites, company register, commercial register, land register, business reports, media). 

    The following data are processed:
    In particular, the processed personal data may, depending on the nature of your business or contractual relationship with VERBUND, include: company name, address, company register number, tax number, VAT number, industry, title, gender, first name, last name, address, email address, phone number, as well as any function/position and date of birth, nature of the interest or details about your concerns, payment modalities, bank details, invoice details, if necessary the contract or customer number, contract or order data (e.g. contract term, sales data, volumes), documentation data (e.g. meeting notes, correspondence such as emails), any creditworthiness and integrity data, advertising data, as well as any other data voluntarily provided or collected when making contact or managing contacts and/or within the scope of a (contractual) relationship or data for the fulfilment of statutory requirements.

    If, within the scope of a contractual relationship, you are listed in a confidentiality section of the insider directory of VERBUND, the start and end (date/time) of your belonging to and the reason for inclusion in the confidentiality section will also be processed. Should you, within the scope of your activity for VERBUND, gain access to insider information about VERBUND, you will be added to the relevant insider list in accordance with the provisions of the EU Market Abuse Regulation and will be legally required to also disclose to us your birth names and your private contact details (telephone number, residential address). This insider list must be sent by us to the Financial Market Authority on request. 

    3. For what purposes and on what legal basis will your data be processed?

    We will process your personal data for the following purposes and on the basis of the following legal grounds:

    3.1.   Art. 6 (1) (b) GDPR

     The processing of your data is required for the fulfilment of a contract entered into with you or for the performance of pre-contractual measures. The purposes of the data processing depend on the specific request/inquiry or on the contract entered into with you and mainly include the

    • Processing of your request/inquiry
    • Initiation of the contract
    • Processing and administration of the contract
    • Execution of the contract.

    The data you provide are necessary to fulfil the contract or implement pre-contractual measures. Without these data, we cannot enter into the contract with you or process your request/inquiry.


    3.2.   Art. 6 (1) (a) GDPR

    If you have given us consent to process your personal data, this processing will only take place for the purposes set forth in the declaration of consent and to the extent indicated therein.

    Your granted consent may be revoked free of charge at any time with effect for the future. Even if you withdraw your consent, the lawfulness of processing operations carried out until you have withdrawn your consent shall not be affected.

    3.3.   Art. 6 (1) (f) GDPR

    The processing is necessary for the protection of the legitimate interests of VERBUND or a third party. This is the case especially for the following purposes:

    • Creditworthiness or integrity check before entering into a contract as well as during an ongoing contractual relationship, in order to obtain information your creditworthiness and integrity
    • Contractual partner suitability, auditing, assessment before contract commencement, in order to establish whether they are best suited for the service to be provided
    • Performance valuation and quality management during an ongoing contractual relationship with the goal of achieving the best performance for VERBUND
    • Inclusion in and managing databases on the basis of internal VERBUND regulations in the sense of financial market compliance and corruption prevention, occupational safety and/or other internal safety provision, in order to be able to take account of internal precautions/provisions.
    • Data administration incl. all related activities, in particular for the purpose of making contact and communicating
    • Customer satisfaction analyses and stakeholder support
    • Direct marketing, in order to be able to offer you information about products and services of VERBUND. You can refuse the data processing of direct marketing under the provisions of Art. 21 GDPR.  
    • Provision and use of audio-visual conference systems and/or other communication and/or collaboration tools
    • Customer satisfaction analyses and stakeholder support
    • Direct marketing, in order to be able to offer you information about products and services of VERBUND. You can refuse the data processing of direct marketing under the provisions of Art. 21 GDPR.  

    3.4.   Art. 6 (1) (c) GDPR

    The processing of personal data may be necessary in order to fulfil various statutory obligations.

    In particular, personal data will be processed for the fulfilment of the following legal obligations:

    • Preparation of the annual financial statements
    • Ongoing tax and tax-related obligations
    • Audits of accounts
    • in accordance with stock exchange legislation and the provisions of the Market Abuse Regulation in the sense of financial market compliance (this covers the personal data of persons who have access to insider information on an ad-hoc basis or in the context of projects and who are to be added to the insider list)
    • corporate guidelines
    • Specifications in terms of occupational safety, etc

    3.5.   Art. 6(1) (e) and Art. 9(2) (i) GDPR 

    Your data (in particular name, email address, phone number, address, type and time and contact) will, in the event of a visit or contact with use or with VERBUND employees, be processed for the purpose of contact person management (management of contact lists) in connection with an epidemic/pandemic (currently Covid-19). By managing contact lists, we perform a task in the public interest, which in particular means that we are able to contact you as quickly as possible in the event of an incident (suspected infection, confirmed infection) for your protection or that of another person. If you notify us of an illness, we will additionally process your health-related data. Your data will be retained for a period of 4 weeks and forwarded to the responsible offices/persons within VERBUND and to the corresponding legally responsible authorities only if the need arises.

    4. How long will your data be stored?

    The data will be processed for as long as it takes to complete the respective purpose and then erased, unless the data are needed beyond the statutory storage obligations (e.g. those according to Art. 212 Corporate Code (UGB) or Art. 124 et seq. Federal Tax Code (BAO) or other statutory provisions), or for as long as claims arising from the (contractual) relationship can be asserted or this can be justified to protect our legitimate interests. The option exists to render the data anonymous instead of erasing them. In this case, any personal reference will be irretrievably removed.


    5. To whom will your data be disclosed?

    Your personal data will only be forwarded to third parties where required for the fulfilment of (pre-)contractual or statutory obligations, where justified for the maintenance of our legitimate interests, or where permitted within the scope of granted consent.

    Your data will be disclosed to the following recipients: 

    • Companies or other third parties within the scope of (pre-contractual) contract fulfilment, of the legitimate interest or in accordance with granted consent
    • Instructed service providers for order processing (e.g. service providers for payment processing, scanning and printing service providers, IT services)
    • Courts, authorities and public bodies

    In all cases in which we forward your data to recipients inside and outside of our company, we will always ensure that this is done only on the basis of legal grounds and in a way which ensures that your data will continue to be protected. 


    6. Your rights

    In principle, you have the right to information, correction, erasure, restriction, data portability, revocation of a granted consent and objection in respect of your data processed by VERBUND. To exercise these rights, please contact datenschutz@verbund.com. If you believe that the processing of your data violates data protection law or your data protection claims have otherwise been violated in any way, you can submit a complaint to the national supervisory authority where you live. In Austria, this supervisory authority is the Data Protection Authority.

     
    Last update: 23/05/2022

     
    It is important for VERBUND to protect your personal data and for us to explain to you how we handle them.

    1. Name and contact details of the data controller

    Responsible for the processing of your data within the scope of the following data processing is the respective indicated VERBUND group company (“VERBUND”, “we”, “us”), namely:
    VERBUND AG, Am Hof 6a, 1010 Wien,
    VERBUND Hydro Power GmbH, Europaplatz 2, 1150 Wien,
    VERBUND Energy4Business GmbH, Am Hof 6a, 1010 Wien,
    VERBUND Energy4Future GmbH, Am Hof 6a, 1010 Wien,
    VERBUND Energy4Flex GmbH, Am Hof 6a, 1010 Wien,
    VERBUND Services GmbH, Am Hof 6a, 1010 Wien,
    VERBUND Green Power GmbH, Am Hof 6a, 1010 Wien,
    VERBUND Tourismus GmbH, Europaplatz 2, 1150 Wien,
    VERBUND Thermal Power GmbH & Co KG, Kraftwerkstraße 1, 8410 Fernitz-Mellach,
    VERBUND Wind Power Austria GmbH, Europaplatz 2, 1150 Wien,
    VERBUND Energy4Business Germany GmbH, Sonnenstraße 17, 80331 München,
    VERBUND Innkraftwerke GmbH, Werkstraße 1, 84513 Töging am Inn,
    Grenzkraftwerke GmbH, Münchner Straße 48, 84359 Simbach am Inn,
    Donaukraftwerk Jochenstein Aktiengesellschaft, Innstraße 121, 94036 Passau,
    Österreichisch-Bayrische Kraftwerke AG, Münchner Straße 48, 84359 Simbach am Inn,
    Innwerk AG, Schulstraße 2, 84533 Stammham,
    VERBUND Green Power Deutschland GmbH, Energie-Allee 1, 55286 Wörrstadt,
    VERBUND Green Power Deutschland Photovoltaik GmbH, Brandenburg Airport Center, Willy Brandt Platz 2, 12529 Schönefeld,
    Infrastruktur Bischheim GmbH & Co. KG, Energie-Allee, 55286 Wörrstadt,
    Infrastruktur Oberheimbach I GmbH & Co. KG, Energie-Allee, 55286 Wörrstadt.


    The contact details of the data protection officer are: Email: datenschutz@verbund.com

    2. Processing in the context of “newsletter/information by email”

    2.1.   What kind of personal data will we process?
    If you subscribe to a newsletter of VERBUND or request VERBUND to send information by email, we will process the following data: information about your person such as gender, title, name, email address, as well as information about your company and position and, if necessary, other data specific to the enquiry.
    The provision of these data by you is voluntary. However, if you do not provide the data, it will not be possible to send any newsletters or information to you by email.

    2.2.   What is our legal basis and purpose for processing personal data?
    The legal basis for the processing of data pursuant to point 2.1. is Art. 6 (1) (a) GDPR and therefore your consent to receive the newsletter or information by email.

    You have the right to withdraw your consent at any time without giving reason and with effect for the future by sending an email without incurring further costs to the data controller named in the declaration of consent and to datenschutz@verbund.com.

    The personal data listed under point 2.1 will be processed by VERBUND for the respective purpose defined in the declaration of consent, such as, for example, the purpose to send information about activities, products, offers and services, competitions or events of VERBUND, to send invitations to events organised by VERBUND, and to send VERBUND publications and/or about other VERBUND-related topics, or about surveys on the satisfaction with services and offers of VERBUND. 

    2.3.   Retention period
    Your data will be processed for as long as you continue to receive the newsletter/information by email, and for as long as you have granted us your consent for the purpose in question.
    The option exists to render the data anonymous instead of erasing them. In this case, any personal reference will be irretrievably removed, which shall also remove any obligation to erase the data under data protection law.

    2.4.   Data recipients
    The data will be forwarded to third parties only where required for the fulfilment of (pre-)contractual or statutory obligations, or where permitted within the scope of your granted consent.

    The data may be sent to commissioned service providers for order processing.

    3. Processing in the context of “participating in surveys”

    3.1.   What kind of personal data will we process?
    If you participate in a survey of VERBUND (online, verbal or in writing), we will process, in particular, the following data: information about your person such as gender, title, name, email address, as well as information about your company and position, IP address (online), and other data or answers/comments voluntarily provided by you within the context of the survey. 

    The provision of these data by you is voluntary. However, if you do not provide these data you will not be able to participate in the survey.

    3.2.   What is our legal basis and purpose for processing personal data?
    The legal basis for the processing of data pursuant to point 3.1. is Art. 6 (1) (a) GDPR and therefore your consent.

    You have the right to withdraw your consent at any time without giving reason and with effect for the future by sending an email without incurring further costs to the data controller named in the declaration of consent and to datenschutz@verbund.com.

    The personal data listed under point 3.1. are processed by VERBUND depending on the purpose of the survey stipulated in the respective declaration of consent. 

    3.3. Retention period
    Your data will be stored for the duration of the survey and beyond that for a period of six months. If you have given your consent to participate in another survey, your data will be stored until you withdraw your consent.

    The option exists to render the data anonymous instead of erasing them. In this case, any personal reference will be irretrievably removed, which shall also remove any obligation to erase the data under data protection law.

    3.4.   Data recipients
    The data will be passed to third parties only if you have given us your consent to do so.

    The data may be sent to commissioned service providers for order processing.

    4.   Processing in the context of “competitions”

    4.1.   What kind of personal data will we process?
    We process the following data for the participation in competitions: information about your person such as gender, title, name, address, as well as your contact details such as telephone number and/or email address, as well as, if necessary, information related to the competition.

    The provision of these data by you is voluntary. If you do not provide these data, you will not able to participate in the competition.

    4.2.   What is our legal basis and purpose for processing personal data?
    The legal basis for the processing of these data is Art. 6 (1) (b) GDPR and therefore the processing for the fulfilment of a contract or pre-contractual measures. The storage and processing of the data is required in order to hold the competition and to inform you about any prizes. 

    The further legal basis for the processing of your data for competitions is our legitimate interest pursuant to Art. 6 (1) (f) GDPR, which consists of processing the competition for you in the best way possible, making contact with you about the competition and basing our marketing strategy on this.

    Should your data be published in the event of a win, we will obtain your consent in this regard pursuant to Art. 6 (1) (a) GDPR.
    The personal data listed under point 4.1. will be processed by VERBUND for the purpose of holding the competition and providing information about any prizes. 

    4.3.   Retention period
    We process your data for as long as is necessary for holding the competition and will delete them immediately after the end of the competition, unless the data also have to be processed in accordance with statutory retention obligations.
    The option exists to render the data anonymous instead of erasing them. In this case, any personal reference will be irretrievably removed, which shall also remove any obligation to erase the data under data protection law.

    4.4.   Data recipients
    The data will be forwarded to third parties only where required for the fulfilment of (pre-)contractual or statutory obligations, where justified for the maintenance of our legitimate interests, or where permitted within the scope of granted consent.
    The data may be sent to commissioned service providers for order processing.

    5. Data processing in the context of “making contact/enquiries”

    5.1.   What kind of personal data will we process?
    When you make contact with VERBUND and request information or make enquiries, the following data provided by you, depending on the matter in question, will be processed (this depends on the chosen manner of making contact (online, email, phone) and the nature of your enquiry): information about your person such as qualification, title, name, address, contact information such as email address, phone number, type of interest or information about your enquiry, and any other data collected or indicated as necessary when making contact/inquiries, depending on the nature of your enquiry. 

    The provision of these data by you is voluntary. If you do not provide these data for the handling of your enquiry, VERBUND will not be able to process your enquiry accordingly.

    5.2.   What is our legal basis and purpose for processing personal data?
    The legal basis for the processing of the data mentioned under point 5.1. is our legitimate interest in accordance with Art. 6 (1) (f) GDPR. If the reason for the enquiry/making contact is to conclude a contract, the additional legal basis for the processing is Art. 6 (1) (b) GDPR.
    The personal data listed under point 5.1. will be processed for the purpose of making contact and providing information or handling your inquiry. 

    5.3.   Retention period
    We retain your data in order to handle your enquiry and beyond that for a period of three months. A longer storage period will apply only to the extent this is required to fully process your concerns and beyond that only until the end of the relevant limitation periods, statutory retention periods or any legal disputes.
    The option exists to render the data anonymous instead of erasing them. In this case, any personal reference will be irretrievably removed, which shall also remove any obligation to erase the data under data protection law.
     
    5.4.   Data recipients
    The data will be forwarded to third parties only where required for the fulfilment of (pre-)contractual or statutory obligations, or where justified for the maintenance of our legitimate interests.

    The data may be sent to commissioned service providers for order processing.

    6. Your rights

    In principle, you have the right to information, correction, erasure, restriction, data portability, revocation of a granted consent and objection in respect of your data processed by us. To exercise these rights, please write to us at datenschutz@verbund.com. If you believe that the processing of your data violates data protection law or your data protection claims have otherwise been violated in any way, you can submit a complaint to the national supervisory authority where you live. In Austria, this supervisory authority is the Data Protection Authority.


    Last update: 23/05/2022

    It is important for VERBUND Tourismus GmbH to protect your personal data and to explain to you how we handle them. This privacy statement contains the main data processing activities of VERBUND Tourismus GmbH.

    1. Name and address of the Data Controller

    Responsible for processing your data is VERBUND Tourismus GmbH, Europaplatz 2, 1150 Vienna (“VERBUND”, “we”, “us”), reachable on tel: +43 (0)50 313-23 201, email: tourismus@verbund.com.

    The contact details of the data protection officer are as follows: email: datenschutz@verbund.com.

    2. Data processing “Voucher ordering and processing”

    2.1.   What kind of personal data will we process?

    In the course of ordering and processing your voucher, the following data will be collected: first name, last name, address, email address, phone number, voucher code, issue date, voucher value, bank details.

    2.2.   Legal basis and purpose of the data processing

    The legal basis for the processing of data is Art. 6 (1) (b) GDPR and therefore the processing for the fulfilment of a contract. The data are processed by VERBUND for the purpose of ordering the voucher and for the further processing of the contract (conclusion of the contract, sending and redeeming the voucher, billing, etc.).

    The provision of contact data by you is voluntary; however, if you do not provide these data, VERBUND will not be able to process your voucher order accordingly or send you a voucher.

    2.3.   Retention period

    We process your data for as long as it is necessary to do so for processing the order and contract and beyond, and to the extent that statutory retention periods exist or warranty and limitation periods are still in force. 

    2.4.   Data recipients

    In order to process the personal data, we use service providers (e.g. IT service providers) which, in accordance with our orders and instructions, may under certain circumstances also have access to personal data in order to be able to render the commissioned services.
    Your data will not be passed to any third parties for their own purposes without your consent.

    3.    Data processing in the context of “making contact/enquiries”

    3.1.   What kind of personal data will we process?

    When you make contact with VERBUND and request information or make inquiries, the following data provided by you, depending on the matter in question, will be processed (this depends on the chosen manner of making contact (online, email, phone) and the nature of your enquiry): information about your person such as qualification, title, name, address, contact information such as email address, phone number, type of interest or information about your enquiry, and any other data collected or indicated as necessary when making contact/inquiries, depending on the nature of your enquiry. 

    The provision of these data by you is voluntary. If you do not provide these data for the handling of your enquiry, VERBUND will not be able to process your enquiry accordingly.

    3.2.   What is our legal basis and purpose for processing personal data?

    The legal basis for the processing of these data is our legitimate interest pursuant to Art. 6 (1) (f) GDPR. If the reason for the enquiry/making contact is aimed at the conclusion of a contract, the additional legal basis for the processing is Art. 6 (1) (b) GDPR. 

    The personal data provided by you will be processed for the purpose of making contact and providing information or handling your inquiry. 

    3.3.   Retention period

    We retain your data in order to handle your enquiry and beyond that for a period of three months. A longer retention period will apply only to the extent this is required to fully process your concerns and beyond that only until the end of the relevant limitation periods, statutory retention periods or any legal disputes.

    The option exists to render the data anonymous instead of erasing them. In this case, any personal reference will be irretrievably removed, which shall also remove any obligation to erase the data under data protection law.

    3.4.   Data recipients

    The data will be forwarded to third parties only where required for the fulfilment of (pre-)contractual or statutory obligations, or where justified for the maintenance of our legitimate interests.

    The data may be sent to commissioned service providers for order processing.

    4.Data processing “Conclusion and processing of contracts regarding services/offers of VERBUND”

    4.1.   What kind of personal data will we process?

    If you conclude a contract with VERBUND for specific services or offers (e.g. bookings of certain packages, group offers, seminar rooms, etc.), we will process in particular the following personal data from you that you provided to us when concluding the respective contract or that are collected from you during the course of ongoing contract fulfilment: title, gender, first name, last name, address, email address, phone number, invoice address, invoice data, payment method, product or type of service, date or duration of utilisation of the service, and any other data provided, such as, for example, special requests or wishes. For company bookings, the following data in particular will additionally be processed: contact data of the person making the booking (name, phone number, email address), name and address of the company.

    The provision of data by you is voluntary; however, if you do not provide these data, VERBUND will not be able to process your booking or the contract accordingly.

    4.2.   What is our legal basis and purpose for processing personal data?

    The legal basis for the processing of data pursuant to point 4.1. is Art. 6 (1) (b) GDPR and therefore the processing for the fulfilment of a contract.

    The data are processed by VERBUND for the purpose of making bookings/concluding contracts and for the further processing of the contract/administration of the booking, customer service, communicating with you and for billing purposes.

    4.3.   Retention period

    We process your data for as long as it is necessary to do so for processing the contract and beyond, and to the extent that statutory storage periods exist or warranty and limitation periods are still in force. 

    The option exists to render the data anonymous instead of erasing them. In this case, any personal reference will be irretrievably removed, which shall also remove any obligation to erase the data under data protection law.

    4.4.   Data recipients

    In order to process the personal data, we use service providers (e.g. IT service providers) which, in accordance with our orders and instructions, may under certain circumstances also have access to personal data in order to be able to render the commissioned services. In fulfilment of statutory obligations, we also pass your data to recipients outside the company (e.g. authorities, municipalities, financial authorities, etc.). 

    5.   Data processing “Newsletter/information by email”

    5.1.   What kind of personal data will we process?

    If you subscribe to a newsletter of VERBUND or request information from VERBUND by email, we will process, in particular, the following data: information about your person such as gender, title, name, email address, as well as information about your company and position and, if necessary, other data specific to the inquiry.

    The provision of these data by you is voluntary. However, if you do not provide the data, it will not be possible to send any newsletters or information to you by email.

    5.2.   What is our legal basis and purpose for processing personal data?

    The legal basis for the processing of data pursuant to point 5.1. is Art. 6 (1) (a) GDPR and therefore your consent to receive the newsletter or information by email.

    You have the right to withdraw your consent at any time without giving reason and with effect for the future by sending an email to tourismus@verbund.com.

    Your data will be processed by VERBUND for the purpose defined in the declaration of consent, such as, for example, the purpose to send information about activities, offers and services, contests or events of VERBUND, and to send invitations to events organised by VERBUND. 

    5.3.   Retention period

    Your data will be processed for as long as you continue to receive the newsletter/information by email, and for as long as you have granted us your consent for the purpose in question.

    The option exists to render the data anonymous instead of erasing them. In this case, any personal reference will be irretrievably removed, which shall also remove any obligation to erase the data under data protection law.

    5.4.   Data recipients

    The data will only be forwarded to third parties where required for the fulfilment of (pre-)contractual or statutory obligations, or where permitted within the scope of your granted consent.

    The data may be sent to commissioned service providers for order processing.

    6.   Data processing “Webfotopoint and E-Card Sending”

    6.1.   What kind of personal data will we process?

    If you have taken a selfie (photo) at certain VERBUND excursion destinations using a photo system provided by VERBUND, this may subsequently be accessed on the VERBUND website www.verbund.com/tourismus, publicly viewed and sent by email (eCard). 
    The following data will be processed: photos, and the email address provided by you (for sending the eCard). These data are provided by you voluntarily.

    If you have also consented to the sending of a newsletter, the data provided by you in this regard (name and email address) will be processed for this purpose (see point 5).

    6.2.   What is our legal basis and purpose for processing personal data?

    The legal basis for the processing of your data is your consent pursuant to Art. 6 (1) (a) GDPR. 

    You may withdraw your consent at any time with effect for the future and without giving reason by sending an email to tourismus@verbund.com.

    6.3.   Retention period

    The photos will be stored by us for a period of 12 months and then deleted, unless you have previously withdrawn your consent. Your email address will be used to send the eCard and then deleted. 

    The option exists to render the data anonymous instead of erasing them. In this case, any personal reference will be irretrievably removed, which shall also remove any obligation to erase the data under data protection law.

    6.4.   Data recipients

    In order to process the personal data, we use service providers (e.g. IT service providers) which, in accordance with our orders and instructions, may under certain circumstances also have access to personal data in order to be able to render the commissioned services. 

    7. Your rights

    In principle, you have the right to information, correction, erasure, restriction, data portability, revocation of a granted consent and objection in respect of your data processed by VERBUND. To exercise these rights, please contact datenschutz@verbund.com. If you believe that the processing of your data violates data protection law or your data protection claims have otherwise been violated in any way, you can submit a complaint to the national supervisory authority where you live. In Austria, this supervisory authority is the Data Protection Authority.


    Last update: 2020/06/16