Data Protection at VERBUND

VERBUND AG is committed to protecting your personal data and providing information on how we process your personal data. We therefore comply with the applicable legislation on the protection, lawful handling and confidentiality of personal data as well as data security, in particular the Austrian Data Protection Act as amended (Datenschutzgesetz, DSG), the Telecommunications Act 2021 (Telekommunikationsgesetz, TKG 2021) and the General Data Protection Regulation (GDPR).

1. Name and contact details of the controller

The controller responsible for processing your personal data in the context of the data processing operations indicated below is VERBUND Energy4Customers GmbH, Erdberger Lände 26A, 1030 Vienna, Austria (hereinafter referred to as “VERBUND”, “we” or “us”).

The contact details of the Data Protection Officer are as follows: datenschutz@verbund.com

2. Data processing by processors and other recipients

2.1.   Processors

Where service providers commissioned for subsequent data processing are involved (“processors” pursuant to Art. 4  (8) GDPR, such as IT service providers, marketing service providers, payment service providers), they may also have access to personal data on our behalf and in accordance with our instructions. VERBUND only works with processors who provide sufficient guarantees that appropriate technical and organisational measures are implemented in such a way that processing is carried out in accordance with the requirements of the DSG and GDPR as amended. The processing performed by a processor is always done on the basis of a contract that binds the processor to the obligations under data protection law. VERBUND uses processors outside the European Union only if an adequacy decision has been taken by the European Commission for the third country concerned or if we have agreed on other appropriate guarantees pursuant to Art. 46 GDPR.

2.2.  Other recipients

For the following forms of data processing, personal data will only be forwarded to other recipients where this is required for the fulfilment of (pre)contractual or legal obligations, where justified in order to protect our legitimate interests or those of a third party or where permitted within the scope of voluntary consent. In addition to the processors referred to in Section 2.1, the categories of recipients can include:

• Sales partners: If the conclusion of your contract with VERBUND is brokered through one of our sales partners and/or a sales partner is (jointly) managing your contract with VERBUND, the sales partner will collect the personal data required to conclude the contract and transfer these to VERBUND. We will also transfer your personal data to the sales partner to the extent necessary for any support you require from the sales partner.
  
  
  
  
• VERBUND Group companies: We may pass on individual data processing tasks to specialist departments, divisions or companies within the VERBUND Group and transfer the personal data necessary for this purpose. This is done primarily to enable us to manage your data centrally and/or offer you a better service.
  
  
  
  
• Market participants in the electricity or gas market: In the course of initiating and processing contracts, it may be necessary for us to transfer your personal data to market participants in the electricity or gas market (e.g. grid operators or energy suppliers) in order to fulfil (pre)contractual and/or legal obligations.
  
  
  
  
• Regulatory authorities, courts and public bodies: There are legal obligations that VERBUND is only able to fulfil if we transfer your personal data to regulatory authorities, public bodies (e.g. tax authorities, law enforcement agencies) and courts to the extent required.
  
  
  
  
• Credit reference and credit rating agencies: VERBUND may forward your personal data to credit reference and credit rating agencies (e.g. CRIF GmbH and Kreditschutzverband) for the purpose of credit checks and to request information about on your creditworthiness from these agencies.
  
  
  
  
• Other recipients: Within the scope of the contractual relationship and particularly in connection with our service obligations, it may be necessary, on a case by case basis, to forward your personal data to other recipients (e.g. lawyers, notaries, insolvency administrators, debt collection agencies, experts, tax consultants, auditors, interest groups, banks, financial service providers, mail/courier services and logistics partners, installation partners or contract and cooperation partners for services linked to your contract).

3. Data processing in the context of “consulting and information for interested parties”

3.1. Scope of the processing of personal data and their source

Parties with an interest in VERBUND products and services can use various channels to contact VERBUND (e.g. by phone or email). If you use one of these options, the following data provided by you will be processed, depending on the contact option selected: personal details such as gender, title, name, address, nature of interest or details of your enquiry, contact details, such as phone number and/or email address, information on energy consumption, grid operator and current energy supplier. The specific scope of the data collected from you will depend on the nature of your enquiry.

These data are provided by you on a voluntary basis; they are neither required by law or by contract nor are they required in order to enter into a contract. However, if you do not provide these data, VERBUND will not be able to process your enquiry.

3.2. Legal basis for processing personal data

The legal basis for processing the data referred to in Section 3.1. is our legitimate interest in accordance with Art. 6(1)(f) GDPR, which is to ensure that your enquiry is handled as efficiently as possible. If the reason for contacting us is to enter into a contract, steps prior to entering into the contract in accordance with Art. 6(1)(b) GDPR are the legal basis.

3.3. Purpose of data processing

The personal data indicated in Section 3.1 will be processed by VERBUND for the purpose of handling your enquiry/request.

3.4. Retention period

We will process your data in order to handle your enquiry and beyond that for a period of three months. Data will only be stored for a longer period if this is necessary in order to fully resolve your enquiry and, beyond that, only until the end of the relevant limitation periods, statutory retention periods or any legal disputes.

There is the option to anonymise rather than delete your data. In this case, any personal references will be irretrievably removed, which also eliminates the obligation to erase the data under data protection law.

3.5.   Data recipients

The data may be transferred to commissioned service providers for processing (processors) or to other recipients in accordance with Section 2.

4. Data processing in the context of “placing an order in the online shop”

4.1. Scope of the processing of personal data and their source

In order to initiate the conclusion of a contract when placing an order in the online shop on our website, you provide us with the following data, depending on the product selected/contract type: title, gender, first name, last name, address, date of birth, email address, phone number, billing address, customer number, products ordered, payment methods, bank details, billing information, data on your energy consumption as well as data about your facility (grid operator, metering point designation, meter number, meter reading), and, if applicable, the name, address and customer number of a recruiter. Depending on the type of contract, further data listed in Section 5.1 may also be collected from you when you place an order in the online shop.

If you also register for VERBUND online services after placing your first order in the online shop, we will also ask you to enter a user name and password.

4.2. Legal basis for processing personal data

The legal basis for processing the data referred to in Section 4.1 is Art. 6(1)(b) GDPR and therefore processing for the performance of a contract and taking steps prior to entering into a contract. The provision of data by you is voluntary; however, if you do not provide these data, VERBUND will not be able to process your order in the online shop for contract conclusion or will only be able to do so to a limited extent.

4.3. Purpose of data processing

The personal data indicated in Section 4.1 will be processed by VERBUND for the purpose of processing your order and subsequently to fulfil the respective contractual obligations arising from placing the order in the online shop.

4.4. Retention period

We will process your data for the purpose of processing an order placed in the online shop for as long as is necessary for order processing and, beyond that, to the extent that statutory retention periods exist or warranty and limitation periods are still in force.

4.5. Data recipients

The data may be transferred to commissioned service providers for processing (processors) or to other recipients in accordance with Section 2.

5. Data processing in the context of “processing energy contracts”

5.1. Scope of the processing of personal data and their source

You can purchase a range of products and services from us. Depending on the product selected/type of contract, personal data will be collected from you or from other sources for the purpose of processing energy contracts with you.

Collection of personal data from the data subject (Art.  13  GDPR):

If you enter into an energy supply contract with VERBUND for the supply of electricity or gas, the following personal data, which you provide to us when entering into the contract, or which will be collected from you subsequently during ongoing performance of the contract, will be processed:

• master data such as title, gender, first name, last name, address, date of birth, email address, phone number, billing address, customer number;
• contractual data such as contract type, products, tariff model, commitment period, delivery time, payment methods, bank details, billing information;
• facility data such as grid operator, metering point designation, meter number;
• consumption data, such as energy consumption level, consumption period, meter readings;
• any other data such as the name, address and customer number of a recruiter, user name and password when registering for a VERBUND online account, or in the case of customers who are also members of the jö Bonus Club, web ID, refresh token and the number of Ö points claimed/credited.

If you also enter into a photovoltaic purchase agreement with VERBUND for electricity from photovoltaic systems, VERBUND will, in addition to the energy supply contract, process the following data provided by you at the time of entering into the agreement: data relating to the photovoltaic system (output in kWpeak, feed-in in kWh, date of initial operation, previous offtaker, reference number of certification of recognition as green electricity system), VAT number if applicable.

If you enter into a lease or purchase agreement with VERBUND for a photovoltaic system, wallbox or other movable property, VERBUND will process the following personal data which you provide to us when entering into the agreement or which will be collected from you subsequently during ongoing performance of the agreement:

• master data such as title, gender, first name, last name, address, date of birth, email address, phone number, billing address, customer number;
• data relating to your property, such as owner, type of property, age of property, roof shape, roof slope, type of roof covering, number of floors, installation location, address, photos of the property (general view, roof, meter box);
• contractual data such as contract type, products, commitment period, payment methods, bank details, billing information;
• facility data such as grid operator, metering point designation, meter number;
• consumption data, such as energy consumption level, consumption period, meter readings;
• any other data, such as the name, address and customer number of a recruiter as well as user name and password when registering for a VERBUND online account.

If you purchase a completeVERBUND-eCharging packagefrom VERBUND, in addition to the purchase agreement for a wallbox and the electricity supply agreement under the VERBUND-eCharging service agreement, VERBUND will process the following personal data, which you provide to us when entering into the agreement or which will be collected from you subsequently during ongoing performance of the agreement or from a readout via the wallbox:

data relating to your property, such as the installation location of the wallbox, power connection available, wall breakthroughs, cable run, photos of the property;

data relating to the wallbox, such as the designation of the wallbox, max. power output in kW, operating data of the wallbox, address, charging procedures (e.g. start date, time, duration, energy consumption data), session ID of the charging procedure, card number of the charging card.

Collection of personal data from other sources (Art.  14 GDPR):

Should it be necessary to check your creditworthiness prior to entering into an agreement with us or during an ongoing contractual relationship, we will transfer the data required for this purpose and provided by you when initiating the agreement (title, gender, first name, last name, address, date of birth, any VAT and Company Register numbers) to the credit agency CRIF GmbH, Rothschildplatz 3/Top 3.06.B, 1020 Vienna, Austria, which processes the transferred data as an independent controller for its own purposes as a credit agency and address publisher, as described at https://crif.co.uk/privacy-policy/.

5.2. Legal basis for processing personal data

The legal basis for processing the data referred to in Section 5.1 is Art. 6(1)(b) GDPR and therefore processing for the performance of a contract and taking steps prior to entering into a contract, as well as Art. 6(1)(c) GDPR for compliance with legal obligations. Such obligations may arise in particular from: the Austrian Electricity Industry and Organisation Act (Elektrizitätswirtschafts- und –organisationsgesetz, ElWOG), the Austrian Gas Industry Act (Gaswirtschaftsgesetz, GWG), the Switching Ordinance (Wechselverordnung), the Payments by Instalment Ordinance (Ratenzahlungs-Verordnung), the Austrian Trade Regulation Act (Gewerbeordnung, GewO), the Green Electricity Act (Ökostromgesetz, ÖSG), the Renewable Energy Development Act (Erneuerbaren-Ausbau-Gesetz, EAG), the Federal Energy Efficiency Act (Bundes-Energieeffizienzgesetz, EEffG), the Austrian Commercial Code (Unternehmensgesetzbuch, UGB) and the Austrian Federal Tax Code (Bundesabgabenordnung, BAO).

We will also process your data in order to protect our legitimate interests or those of third parties (Art. 6(1)(f) GDPR). VERBUND has a legitimate interest in finding out more about your creditworthiness as required and thus preventing payment defaults. To this end, VERBUND may obtain credit information about you from credit reference and credit rating agencies. In the interest of VERBUND or third parties, your data may also be processed for preparing statistics, analyses and reports, for business management and further development of processes, for developing new products and services, for customer service and marketing in accordance with Section 6; for contract management, for ensuring IT security and IT operation, including tests, for compliance purposes and for internal audit measures as well as for optimising processing, delivery and communication processes. Our particular objective for doing so is also to continually improve our processes and services in order to be able to offer you excellent service quality.

These data are provided by you on a voluntary basis. However, if you do not provide these data, VERBUND will not be able to process your request to enter into a contract or to provide the contractual services during an ongoing contractual relationship or will only be able to do so to a limited extent. A transmission of quarter-hourly values by your grid operator’s smart meters and processing of these quarter-hourly values by VERBUND takes place pursuant to Section 84a ElWOG only on the basis of voluntary consent (Art. 6(1)(a) GDPR) or in order to fulfil the obligations under an energy supply agreement that you have chosen and which is based on quarter-hourly values (Art. 6(1)(b) GDPR).

5.3. Purpose of data processing

The personal data indicated in Section 5.1 will be processed by VERBUND for the purpose of concluding, executing, modifying and terminating the contract with you as well as for settling payments to you. This also includes the following activities:

• customer credit check as required;
• carrying out a change of supplier pursuant to the Switching Ordinance in the case of a contract for the supply of electricity or gas;
• customer management and billing (invoices are sent either by post or by email);
• optional use of VERBUND online services via the VERBUND online account;
• customer service and marketing (see Section 6).

5.4. Retention period

These data will be erased after the end of the contractual relationship with the customer, unless the data have to be retained in accordance with statutory retention obligations (e.g. obligations pursuant to Section 212 UGB or Sections 124 et seq. BAO) or for as long as claims arising from the contractual relationship can be asserted.

5.5. Data recipients

The data may be transferred to commissioned service providers for processing (processors) or to other recipients in accordance with Section 2.

6. Data processing in the context of “customer service and marketing”

6.1. Scope of the processing of personal data and their source

Collection of personal data from the data subject (Art. 13 GDPR):



For this type of data processing, the data will be collected from you at the time the contract is concluded and data used that originates from data processing in the context of “placing an order in the online shop” (Section 4.1) and “processing of energy contracts” (Section 5.1).

In addition, for example, the following documentation data will be collected by VERBUND from transactions and service enquiries made by you: enquiry/transaction date, meeting notes, email correspondence.

Furthermore, various data will be also collected directly from you from several sources, such as through voluntary customer surveys (Section 9), data on your living situation such as type of housing, household size, living space, heating system or other survey-specific data, which in themselves make no personal references, but which, when combined with other data and analyses, result in personal data being created by VERBUND, or via a power meter installed by VERBUND at your premises on the basis of a lease or purchase agreement for a PV system including battery storage or an electric car charging station (Section 8).

6.2. Legal basis for processing personal data

VERBUND processes your personal data for customer service and marketing purposes based on VERBUND’s legitimate interest (Art. 6(1)(f) GDPR), in order to best reach interested parties and customers and to align marketing strategies accordingly (see Section 6.3). You do not have to actively seek information on our special offers and new products and services. Instead, we will provide this to you. The data processing on the legal basis of our legitimate interest is carried out with minimal intervention: you will not be subject to automated decision-making pursuant to Art. 22 GDPR that produces a legal effect concerning you or significantly affects you in a similar way, nor will you be subject to profiling with increased intervention intensity. As a rule, only data that corresponds to your areas of interest based on the content of your orders, your enquiries or the information collected from you in customer surveys will be collected, stored and used.

When sending direct marketing, VERBUND complies with the requirements under communication law in accordance with Art. 174 TKG 2021. Direct marketing is sent electronically solely on the basis of your voluntary consent.

VERBUND also uses your data on the basis of legitimate interests to assign you to internal customer segments, in order to be able to offer you products and services with additional benefits for you that are tailored specifically to you and based on your consumption behaviour in the case of direct marketing measures, for analysing our marketing activities in order to invite you to enter prize draws (see Section 7), for customer relationship management as well as for customer satisfaction analyses and/or market and opinion surveys (see Section 6.3).

The legal basis for processing the data for expanded, needs-based marketing is Art. 6(1)(a) GDPR. The data will therefore only be processed for this purpose with your express consent, which you can give voluntarily when placing an order in the online shop, when concluding the contract, via VERBUND online services or via other channels. Consent to process your data for this purpose is not required for concluding or executing a contract and is always voluntary.

6.3. Purpose of data processing

The personal data referred to in Section 6.1 are processed on the legal basis of VERBUND’s legitimate interest (Art. 6(1)(f) GDPR) for the following purposes:

• Direct marketing in order to send interested parties, customers and former customers general information and offers in connection with products and services of VERBUND and cooperation partners as well as future product innovations (such as mobile services, internet, TV, etc.) by post and, if consent has been given pursuant to Section 174 TKG as amended, by email, SMS or over the phone.
• Customer relationship management in order to send you greetings on special occasions such as Christmas or your birthday.
• Customer segmentation and statistical analyses in order to categorise our customers in a minimally invasive way with the aim of being able to offer you products and services with additional benefits that are tailored specifically to you and your consumption behaviour in direct marketing and customer relationship management measures. For the purpose of customer segmentation, the data obtained from data processing in the context of “placing an order in the online shop”, “processing energy contracts” and customer surveys (see Sections 4, 5 and 9) will be analysed using various statistical methods and enriched with aggregated sociodemographic data. Analysing means calculating different probabilities based on the data merged in this way and using automated analytical models, e.g. interest in gas products, which are used to select appropriate recommendations and offers for you. In addition, these results are used to create personalised customer segments, which are used to gain long-term insights into the needs and interests of our customers.
• Compilation of statistics and analyses to develop new tariffs/products/services, for customer service and risk minimisation. As a customer, you are interested in reliable and affordable products. To ensure this in the long term, we use the data we receive from you to better secure the supply of energy for all customers (e.g. to improve forecasting, prevent power outages or ensure grid stability).
• Processing together with data from commercially licenced credit agencies pursuant to Section  151 GewO. The personal data collected by VERBUND about you in accordance with Sections 4.1 and 5.1 as well as the customer segments created on the basis of these data can also be linked with third-party data (e.g. address publishers and direct marketing companies), which may also be personal (e.g. sociodemographic information per customer), in a minimally invasive way in order to improve the database and analyse customer behaviour. By linking such personal data, a customer’s current stage of life, community size and purchasing power can be included in the analysis.
• Conducting customer satisfaction analyses as well as market and opinion surveys.

Overall, VERBUND aims to use these measures to offer you a better service by

• aligning the product range with your customer needs so that we can send you individual offers that are tailored to you;
• personalising customer communication so that you find offers that suit your preferences and you receive less advertising overall;
• simplifying procedures, such as concluding contracts or placing online orders, so that you achieve what you set out to do more quickly;
• improving our quality of service and improving or developing new innovative products and services (e.g. services for optimising your energy consumption).

Enhanced marketing measures with personalised (profiled) offers:

Only if you have given VERBUND your voluntary consent (Art. 6(1)(a) GDPR) to process your data for additional marketing measures will personal data be processed pursuant to Section 6.1 in order to be able to send you differentiated (profiled) product offers based on the customer profiles created. This type of data processing involves profiling pursuant to Art. 4(4) GDPR and increased intensity of intervention. Target groups are selected from the customer profiles created in order to provide you with individualised and differentiated advertising and marketing measures as well as offers, and in order to develop product optimisations based on aggregated evaluations.

Consent to process your data for this purpose is not required for concluding or executing a contract. Your consent to this processing is voluntary and you can withdraw your consent at any time with future effect free of charge (see Section 6.6). Withdrawal of your consent will not affect the legality of processing that has been carried out on the basis of your consent until its withdrawal.

6.4. Retention period

VERBUND will use your personal data after the end of the business relationship for processing pursuant to Section 6 for up to three years after your last contact with us, unless you object to the use of your data for this purpose beforehand or withdraw your consent.

6.5. Data recipients

The data may be transferred to commissioned service providers for processing (processors) or to other recipients in accordance with Section 2.

6.6. Objection and withdrawal of consent

You can object at any time to the processing of these data for the purposes of undertaking customer support measures and for marketing purposes, which we base on our legitimate interest (see Section 11 below).

Freely given consent may be withdrawn by the customer at any time and at no further cost without stating the reasons and with future effect by letter, email or phone to VERBUND.

Postal address: VERBUND Energy4Customers GmbH, PO Box 8400, 1010

Vienna, Austria, email: datenschutz@verbund.com

Service line: 0800 210 210

7. Data processing in the context of “entering prize draws”

7.1. Scope of the processing of personal data and their source

When you enter VERBUND prize draws, we will process the following data collected from you: information about you such as gender, title, name, address, as well as your contact details, such as phone number and/or email address as well as information related to the prize draw.

These data are provided by you on a voluntary basis; they are neither required by law or by contract. However, if you do not provide these data, you will not be able to enter the prize draw.

7.2. Legal basis for processing personal data

The legal basis for processing the data referred to in Section 7.1 is Art. 6(1)(b) GDPR and therefore processing for the performance of a contract and taking steps prior to entering into a contract. The storage and processing of data is required in order to hold the prize draw and to inform you about any prizes you may have won.

Our legitimate interest pursuant to Art. 6(1)(f) GDPR is to conduct the prize draw for you in the best possible way and to align our marketing strategy accordingly.

If your data are to be published in the event of a win, we will obtain your consent pursuant to Art. 6(1)(a) GDPR.

When sending out direct marketing, VERBUND complies with the requirements under communication law in accordance with Section 174 TKG 2021. If you have given us your voluntary consent to send you information by email (newsletter) in the context of the prize draw, the legal basis for processing the data for this purpose is Art. 6(1)(a) GDPR.

7.3. Purpose of data processing

The personal data indicated in Section 7.1 will be processed by VERBUND for the purpose of holding the prize draw. If you have given us your consent to process your data for the purpose of sending information by email, the data indicated in Section 7.1 will also be processed for this purpose (see Section 9).

7.4. Retention period

We will process your data for as long as is necessary to conduct the prize draw and will delete your data after the prize draw has ended, unless the data have to be processed beyond this period in accordance with statutory retention obligations or you have given us your voluntary consent to send you information by email.

7.5. Data recipients

The data may be transferred to commissioned service providers for processing (processors) or to other recipients in accordance with Section 2.

8. Data processing in the context of “energy data collection via a power meter and power meter app”

8.1. Scope of the processing of personal data and their source

Data collected from the data subject (information pursuant to Art. 13 GDPR):



The set-up of battery storage and installation of an electric car charging station (“wallbox”) within the scope of a lease or purchase agreement for a photovoltaic system including fixtures and extension components pursuant to Section 5 also includes the installation of a power meter in your fuse/distribution box. When a power meter (“meter”) is installed, the following personal data are collected directly via the meter when the meter’s energy data transmission is activated or when using the VERBUND Power Meter app (“app”). These data are then automatically read by us via a data connection and transferred to our systems:

• energy and performance measurement data, such as total output, energy generated and stored per meter and enabled data interface;
• metadata per meter and enabled data interface, such as device serial numbers, hardware version, firmware version, etc.;
• diagnostic data for operation and troubleshooting, such as error codes;
• VERBUND online services login data such as user name and password (“VERBUND ID”);
• user-specific designations such as meter designation;
• date and time the app is accessed.

8.2. Legal basis for processing personal data

The legal basis for processing the data referred to in Section 8.1 is Art. 6(1)(a) GDPR and therefore your voluntary consent to the meter transmitting energy data.

Where data processing only concerns data relating to your use of the app (date and time of accessing the app, device ID), we also base our justification for processing on our legitimate interest pursuant to Art. 6(1)(f) GDPR, which is to make our app user-friendly, expand existing features in line with customer requirements and protect our app from errors.

8.3. Purpose of data processing

The personal data recorded by the meter as indicated in Section 8.1 will be processed by VERBUND for the purpose of data analysis, visualisation, advice, notification, load control and load optimisation.

When the app is being used, the meter’s energy and performance measurement data will be accessed so that the user can view them in the app. The measurement data are temporarily stored locally in the app for faster display until the app is uninstalled. This is necessary in order to display the correct meter in the app or to visualise the correct data. Additional information on the meter is processed during app use for correct display and for calculations in the app. The following tools are used via third-party integrations to maintain the functionality of the app and to constantly improve the system:

Firebase Crash Reporting

In order to identify errors in the app and the types of devices on which these errors occur, error data are analysed via Firebase Crash Reporting. This involves sending instance IDs and crash traces to Google Inc., which do not reveal any information about the user. This third-party application can be deactivated in the settings at any time. The app also functions fully without your consent.

Google Analytics for Firebase

Google Analytics for Firebase is used to analyse app use. The data obtained are used both to expand existing features with the customer in mind and to develop new and useful functionalities. Google Analytics for Firebase is only used on the basis of your voluntary consent.

Google is a third-party provider based outside the EU or outside the EEA, i.e. in the US. There is currently no adequacy decision for the US in accordance with Art. 45 GDPR confirming an adequate level of protection in the third country and no suitable guarantees pursuant to Art. 46 GDPR. Accordingly, data will be transferred to the US solely on the basis of your prior express and voluntary consent pursuant to Art. 49(1)(a) GDPR in conjunction with Art. 6(1)(a) GDPR. Risks associated with the transfer of data include the fact that US regulatory authorities, such as US intelligence agencies, access your data for control and monitoring purposes and that you are not notified of such access. There is also a risk that you will not have any effective legal remedy against such access.

This third-party application can be deactivated in the settings at any time. The app also functions fully without your consent.

8.4. Duration of data processing

The data indicated in Section 8.1 will be processed until you withdraw your consent to the transmission of energy data from the meter. Withdrawal of your consent will not affect the legality of processing that has been carried out to date. If data processing relates solely to the data regarding your use of the app and is based on a legitimate interest, this data processing will continue for the duration of your use of the app.

8.5. Data recipients

The data may be transferred to commissioned service providers for processing (processors) or to other recipients in accordance with Section 2.

9. Data processing in the context of “customer surveys”

9.1. Scope of the processing of personal data and their source

VERBUND customers may be invited to participate in customer surveys voluntarily via various channels. If you, as a customer of VERBUND, participate in a voluntary survey, depending on the type of customer survey, we will process personal and communication master data (gender, title, name, address, email address), product and contract master data (purchased products, energy consumption, facility number, customer number, length of customer relationship, payment methods), any response data relating to marketing campaigns (customer contact points, participation in promotions, Eco-Club participation, number of customer bonuses) as well as other survey-specific data.

9.2. Legal basis for processing personal data

The legal basis for processing the data indicated in Section 9.1 is our legitimate interest in accordance with Art. 6(1)(f) GDPR, provided that, as a result of balancing interests, the respective purposes indicated in Section 9.3 can be regarded as processing serving a legitimate interest. Our legitimate interest lies in particular in obtaining more information about our customers and their preferences through customer surveys in order to tailor our marketing strategies better, and to better secure the supply of energy for all customers (e.g. to improve forecasting, prevent power outages or ensure grid stability). Without a legitimate interest, we will only process your data referred to in Section 9.1 with your voluntary consent in accordance with Art. 6(1)(a) GDPR.

9.3. Purpose of data processing

The personal data indicated in Section 9.1 will be processed by VERBUND for the purpose of conducting the customer survey. The data collected from you in connection with your participation in the customer survey will also be processed for the purposes specified in Section 6.3 for data processing in the context of “customer service and marketing”.

9.4. Retention period

We will process your data for as long as is necessary to complete the respective customer survey. The personal data collected through a customer survey will be processed for up to three years after your last contact with us. Your data will only be processed for a longer period if required in individual cases or if the data have to be processed in accordance with statutory retention obligations.

9.5. Data recipients

The data may be transferred to commissioned service providers for processing (processors) or to other recipients in accordance with Section 2.

10. Data processing in the context of “newsletters”

10.1. Scope of the processing of personal data and their source

If you subscribe to a VERBUND newsletter, we will process information about you such as gender, title, name, address, your contact details, such as phone number and/or email address as well as your opening and click rates.

These data are provided by you on a voluntary basis. However, if you do not provide the data, you will not be able to receive a newsletter.

10.2. Legal basis for processing personal data

The legal basis for processing the data referred to in Section 10.1 is Art. 6(1)(a) GDPR and therefore your voluntary consent to receive the newsletter. With your consent, we will also analyse your use of our email newsletter in order to further optimise our email newsletter and our marketing in accordance with your interests and better adapt it to your needs. To this end, we process whether you have opened our newsletter and which particular content you have clicked.

You can withdraw your consent at any time without stating the reasons and with future effect, e.g. using the link in the email, by letter, email, or over the phone, at no further cost to VERBUND. Withdrawal of your consent will not affect the legality of processing that has been carried out on the basis of your consent until its withdrawal.

Postal address: VERBUND Energy4Customers GmbH, Erdberger Lände 26A, 1030 Vienna, Austria 

Email: datenschutz@verbund.com

Service line: 0800 210 210

10.3. Purpose of data processing

The personal data indicated in Section 10.1 will be processed by VERBUND for the purpose of sending information by email about VERBUND products and services.

10.4. Retention period

Your data will be processed for as long as you continue to receive the newsletter, unless you withdraw your voluntary consent.

10.5. Data recipients

The data may be transferred to commissioned service providers for processing (processors) or to other recipients in accordance with Section 2.

11. Data processing in the context of “applications for VERBUND hardship fund”

11.1. Scope of the processing of personal data and their source

If you apply for funds from the VERBUND hardship fund, we will process your personal data such as gender, title, name and customer number, as well as the reason for hardship you have provided and, in particular, all documents you have uploaded as evidence of your reason for hardship. The specific scope of the data collected from you will depend on the respective reason for hardship.

These data are provided by you on a voluntary basis; they are neither required by law or by contract. However, if you do not provide these data, VERBUND will not be able to process your application accordingly.

11.2. Legal basis for processing personal data

The legal basis for processing the data referred to in Section 11.1 (excluding special categories of personal data) is Art. 6(1)(b) GDPR and therefore processing for the performance of a contract and taking steps prior to entering into a contract (conclusion and processing of subsidies) as well as our legitimate interest in accordance with Art. 6(1)(f) GDPR, which involves reviewing your application and processing it as efficiently as possible.

The legal basis for processing any special categories of personal data pursuant to Art. 9 GDPR (e.g. data concerning health) is Art. 6(1)(a) GDPR and therefore your express voluntary consent. You can withdraw this consent at any time with future effect. Withdrawal of your consent will not affect the legality of processing that has been carried out on the basis of your consent until its withdrawal. Please note that for certain hardship cases, the processing of special categories of personal data may be an essential prerequisite for the award of funds from the VERBUND hardship fund, and this could be rendered more difficult or impossible in the event of withdrawal.

11.3. Purpose of data processing

The personal data indicated in Section 11.1 will be processed by VERBUND for the purpose of handling your application, in particular for checking the reason given for hardship and awarding funds from the VERBUND hardship fund.

11.4. Retention period

We will process your data for the purpose of handling your application, checking the reason given for hardship and awarding funds from the VERBUND hardship fund for a maximum period of six months from the date of application. Your data will only be processed for a longer period if required in individual cases in order to handle your application, unless the data have to be processed beyond this in accordance with statutory retention obligations.

11.5. Data recipients

Where necessary for the purpose specified in Section 11.3, data may be transferred to commissioned service providers for processing (processors) or to other recipients in accordance with Section 2.

12. Data processing in the context of “VERBUND charging assistant”

12.1. Scope of the processing of personal data and their source

Collection of personal data from the data subject (Art.  13  GDPR):

When registering for and using the VERBUND charging assistant and once the devices used by the customer have been connected (e.g. inverter, wallbox, etc.) and data transmission is established, the following information is collected from the customer and/or commissioned processor, depending on the respective connected device, or read directly via the VERBUND charging assistant and transferred to our systems:

• customer login details, such as email address, first and last name, device-specific data, user name, password;
• manufacturer-specific information needed to authorise the connection of the device to the VERBUND charging assistant;
• metadata for each device and enabled data interface such as device serial numbers, hardware version, firmware version, etc.;
• energy and performance measurement data, such as total output, energy generated and consumed;
• device status (connectivity, charging plug, plug in and unplug time);
• information on charging procedures at wallboxes (start and end time of charging sessions, charging output, energy volume, number of charging phases used);
• charging and discharging capacity of battery storage and current charge status;
• user-specific designation of the device;
• user-specific logs of device’s behaviour;
• manufacturer-specific device operating data.

The data read from a device can vary depending on the manufacturer-specific interface of the device used. Changes and adjustments can also be made by the manufacturer at any time without VERBUND’s knowledge. The current version of the manufacturer-specific data interface can usually be found on the respective device manufacturer’s website.

12.2. Legal basis for processing personal data

The legal basis for processing the data referred to in Section 12.1 based on your registration for and use of the VERBUND charging assistant is Art.  6  (1)  (b) GDPR and therefore processing for the performance of a contract and taking steps prior to entering into a contract.

Where data processing only concerns the user-friendly design of the interface and new functions, we justify processing on the basis of our legitimate interest in accordance with Art.  6  (1)  (f) GDPR, which involves making the VERBUND charging assistant user-friendly, extending existing functions with the user in mind and protecting the VERBUND charging assistant against errors.

12.3. Purpose of data processing

The data indicated in Section 12.1 and collected from the customer during registration for the VERBUND charging assistant will be processed by VERBUND for the purpose of checking suitability for using the VERBUND charging assistant.

The personal data indicated in Section 12.1 and collected when using the VERBUND charging assistant will be processed by VERBUND for the purpose of contract performance. The VERBUND charging assistant is a service for customers giving them the ability to connect and manage specific devices (e.g. inverter, wallbox, etc.) in order to be able to control these devices, visualise energy flows or perform calculations of commands for controlling energy flows. Device-specific operating data are also processed for the purpose of error monitoring.

Data are also processed for the purpose of giving the interface of the VERBUND charging assistant a user-friendly design, adapting functions and features to user behaviour or developing new functions with maximum added value for users and protecting the VERBUND charging assistant against errors.

12.4. Duration of data processing

The data indicated in Section 12.1 and collected during registration for the VERBUND charging assistant will be processed by VERBUND for the purpose of checking suitability for using the VERBUND charging assistant until it can be finally determined whether use and connection of the devices used by the customer is possible or ruled out entirely, for a maximum period of two years from the date of registration.

The data indicated in Section 12.1 will be processed following successful registration until the end of use of the VERBUND charging assistant, unless the data also have to be processed in accordance with statutory retention obligations. Termination of use, whether due to your deregistration or a block on our part, will not affect the legality of processing that has been carried out to date. Disconnecting the data connection between devices used by customers or closing the account prevents the collection of any further energy or other data via the devices used by customers.

12.5. Data recipients

The data may be transferred to commissioned service providers for processing (processors) or to other recipients in accordance with Section 2.

13. Data processing in the context of “Flood Relief Assistance 2024”

13.1. Scope of the processing of personal data and their source

If you claim Flood Relief Assistance 2024 from VERBUND, we will process your personal data such as gender, title, name and customer number as well as your confirmed application for stopgap assistance from the emergency assistance or disaster relief fund.



The data in the application form are provided by you on a voluntary basis; they are not required by law or by contract. However, if you do not provide these data, VERBUND will not be able to provide you with Flood Relief Assistance 2024.

13.2. Legal basis for processing personal data

The legal basis for processing the data referred to in Section 13.1. is Art. 6(1)(b) GDPR and therefore processing for the performance of a contract and taking steps prior to entering into a contract (conclusion and processing of Flood Relief Assistance 2024) as well as our legitimate interest in accordance with Art. 6(1)(f) GDPR, which involves reviewing your application for Flood Relief Assistance 2024 and processing it as efficiently as possible.

13.3. Purpose of data processing

The personal data indicated in Section 13.1 will be processed by VERBUND for the purpose of handling your application, in particular to check the requirements for Flood Relief Assistance 2024 and award it.

13.4. Retention period

We will process your data for the purpose of handling your application, checking the requirements and awarding Flood Relief Assistance 2024, at the latest until processing and disbursement of Flood Relief Assistance 2024 have been completed in full. Your data will only be processed for a longer period if required in individual cases in order to complete the processing of Flood Relief Assistance 2024, unless the data have to be processed beyond this in accordance with statutory retention obligations.

13.5. Data recipients

Where necessary for the purpose specified in Section 13.3, data may be transferred to commissioned service providers for processing (processors) or to other recipients in accordance with Section 2.

14. Your rights

In principle, you have the right to information, rectification, erasure, restriction of processing, data portability, revocation of a granted consent  and objection with regard to your data processed by VERBUND. To enforce these rights, please contact VERBUND by sending an email to datenschutz@verbund.com. If you believe that the processing of your data violates data protection law or that your rights under data protection law have otherwise been violated in any way, you can lodge a complaint with the supervisory authority in your place of residence. In Austria, this supervisory authority is the Data Protection Authority.

You can find further details on your rights in the section “Data subjects’ rights” at www.verbund.com/en-at/data-protection.

Last updated: July 2025

VERBUND Energy4Business GmbH, VERBUND Energy4Business Germany GmbH and VERBUND Energy4Future GmbH (hereinafter referred to as “VERBUND”) are committed to protecting your personal data. We therefore comply with the applicable legislation on the protection, lawful handling and confidentiality of personal data as well as data security, in particular the General Data Protection Regulation (GDPR) and applicable national data protection regulations. The following information describes which personal data we may process if necessary.

1. Name and address of the controller

The controller responsible for processing your personal data in accordance with data protection regulations for the initiation and processing of energy trading transactions or energy trading-related contracts and for newsletters/sending of information by email is:

VERBUND Energy4Business GmbH

Am Hof 6a

1010 Vienna, Austria

The controller responsible for initiating and processing energy trading transactions (with electricity tax settlement), energy trading-related contracts and for newsletters/sending information by email in Germany is:

VERBUND Energy4Business Germany GmbH

Luise-Ulrich-Straße 20

80636 Munich, Germany

The controller responsible for initiating and processing energy trading transactions and energy products from purely renewable energy sources and for newsletters/sending information by email is:

VERBUND Energy4Future GmbH

Am Hof 6a

1010 Vienna, Austria

VERBUND Energy4Business GmbH, VERBUND Energy4Business Germany GmbH and VERBUND Energy4Future GmbH are each referred to in the following as “VERBUND”, “we” or “us”.

The contact details of the Data Protection Officer are as follows: datenschutz@verbund.com.

2. Data processing in the context of “initiating and processing energy trading transactions or energy trading-related contracts”

2.1. Scope of the processing of personal data

The following personal data, which you provide to us when entering into an energy trading transaction or a energy trading-related contract or which are collected subsequently in the course of ongoing contract performance, will be processed: company name (in particular, sole traders), where applicable, customer number, title, first name, last name, address, email address, phone number, contact details (name, email address) and job titles of contact persons or authorised users, including assignments of roles and rights (for software solutions provided), contents of phone conversations and other communication data (emails), credit rating data, CDD data (including negative media reports), sanctions list information (date of birth, passport number, nationality), payment methods, bank details, billing information, metering points of your facilities (metering point number, meter ID), location of facilities, location ID, company register number, EIC, shipper code, VAT number, ACER code and LEI.

If you conclude a contract with VERBUND regarding an EPS (Energy Performance System), the following data will be also processed in connection with the software solution(s) provided: login details, user ID and usage data such as login time and session information (including technically necessary cookies).

In the context of initiating and processing a contract (e.g. for PV systems, battery storage, charging stations) and related agreements, the following personal data, in particular, are also processed: data relating to your property or the location (such as land registry number, ownership of the land, plans, photos, etc.), facility data, as well as other data that are necessary for the provision of services (information pursuant to Art. 13 GDPR).

Before entering into a contract and during an ongoing contractual relationship, VERBUND will use the data you have provided and the additional data we have collected in order to obtain information on your creditworthiness and integrity from rating agency Moody’s or the credit agencies KSV1870 and/or Creditreform as well as further information about you from Factiva (Dow Jones) and/or Bureau van Dijk (Compliance Catalyst) (information pursuant to Art. 14 GDPR).

2.2. Legal basis and purpose for processing personal data

We process your data for the purpose of concluding, executing, amending and terminating the contract with you, as well as for billing purposes. The legal basis for the processing of mandatory data is Art. 6(1)(b) GDPR and therefore the necessity for performance of a contract and for compliance with legal obligations in accordance with Art. 6(1)(c) GDPR. Such obligations may arise with respect to energy trading transactions, in particular from the Austrian Electricity Industry and Organisation Act (Elektrizitätswirtschafts- und -organisationsgesetz, EIWOG), the Austrian Gas Industry Act (Gaswirtschaftsgesetz, GWG), the Austrian Trade Regulation Act (Gewerbeordnung, GewO), the Green Electricity Act (Ökostromgesetz, ÖSG), the Federal Energy Efficiency Act (Bundes-Energieeffizienzgesetz, EEffG), EU regulatory provisions such as sanctions lists, REMIT, EMIR, MAR and MiFID. As far as the processing of optional data, which you have provided voluntarily, is concerned, we base the processing on our legitimate interest pursuant to Art. 6 (1)(f) GDPR, which primarily lies in being able to interact with you in accordance with your voluntary disclosures or to be able to respond to enquiries. In connection with the use of the software solution(s) provided in the EPS, your data will be further processed in order to provide you with all of its/their functions, but also to improve and develop it/them and to be able to detect, prevent and investigate attacks.

VERBUND also has a legitimate interest in accordance with Art. 6(1)(f) GDPR in learning more about your creditworthiness and integrity prior to entering into a contract and during the ongoing contractual relationship with you, in order to prevent payment defaults in particular, but also to ensure compliance with compliance-related provisions.

These data are provided by you on a voluntary basis; however, if you do not provide these data, VERBUND will not be able to fulfil the conditions for entering into or executing a contract.

2.3. Retention period

The data will be erased after the end of the contractual relationship with you, unless the data are required beyond that in accordance with statutory retention obligations (e.g. those pursuant to Section 212 of the Austrian Commercial Code (UGB) or Sections 124 et seq. of the Federal Tax Code (BAO) in Austria, Section 147 of the German Tax Code (AO) or Section 257 of the German Commercial Code (HGB)) or while claims arising from the contractual relationship can still be asserted. The data collected in connection with the use of the software solution(s) provided in the EPS (including technical cookies) will only be stored for the duration of the respective session.

2.4. Data recipients

We only forward the data to third parties where this is required for the fulfilment of (pre)contractual or legal obligations or where it is justified in order to protect our legitimate interests. For example, your data may be shared with other contract and cooperation partners for services linked to your contract or with Group companies in order that we can fulfil our contractual obligations to you. Where necessary, we will transfer your personal data to external third parties to the extent required, e.g. to auditors, insurance companies, legal representatives or credit agencies/companies providing information on creditworthiness and integrity.

The data may be transferred to commissioned service providers as processors or, where legally necessary, to other market participants in the energy market (e.g. grid operators) as well as to authorities and public bodies (e.g. regulatory or tax authorities).

3. Data processing in the context of “newsletters/sending information by email”

3.1. Scope of the processing of personal data

If you subscribe to a VERBUND newsletter or request information from VERBUND by email, we will process the following data: personal information such as title, name, email address and possibly information about your company and position. The above data are provided by you on a voluntary basis. However, if you do not provide the data, you will not be able to receive a newsletter or receive information by email.

3.2. Legal basis and purpose for processing personal data

The legal basis for processing the data referred to in Section 3.1. is Art. 6(1)(a) GDPR and therefore your voluntary consent to receive the newsletter or information by email.

Your consent can be withdrawn at any time without stating the reasons and with future effect by, for example, clicking on the link in the email or by communicating in writing by email without incurring further costs to the respective controller named in the declaration of consent, as well as by sending an email to datenschutz@verbund.com.

VERBUND will process the personal data indicated in Section 3.1. for the purpose defined in the voluntary declaration of consent, for example, for the purpose of sending information on VERBUND activities, products, offers and services, prize draws or events, sending invitations to events organised by VERBUND and sending VERBUND publications and/or information on other VERBUND-related topics or about surveys on satisfaction with services and offers provided by VERBUND.

3.3. Retention period

Your data will be processed for as long as you continue to receive the newsletter/information by email, and for as long as you have not withdrawn your voluntarily granted consent for the purpose in question.

3.4. Data recipients

The data will only be forwarded to third parties where this is required for the fulfilment of (pre)contractual or legal obligations or where permitted within the scope of your voluntary consent. For example, we may transfer your personal data to external third parties such as auditors, insurers or legal representatives to the extent necessary. In this case, personal data will be anonymised where possible.

Your personal data may be transferred to commissioned service providers for processing.

4. Data subject rights

In principle, you have the right to information, rectification, erasure, restriction of processing, data portability, revocation of a granted consent and objection with regard to your data processed by VERBUND. To exercise these rights, contact us at datenschutz@verbund.com.

If you believe that the processing of your data violates data protection law or that your rights under data protection law have otherwise been violated in any way, you can lodge a complaint with the supervisory authority in your place of residence. In Austria, this supervisory authority is the Data Protection Authority (DSB, Barichgasse 40–42, 1030 Vienna, Austria, www.dsb.gv.at) and in Bavaria, the Bayerische Landesamt für Datenschutzaufsicht (BayLDA, Promenade 18, 91522 Ansbach, Germany, www.lda.bayern.de).

You can find further details on your rights in the section “Data subjects’ rights” at www.verbund.com/en-at/data-protection.

Last updated: November 2025

VERBUND is committed to protecting your personal data and providing information on how we process your personal data. This privacy statement contains information on the main data processing operations relating to VERBUND’s tourism activities.

1. Name and address of the controller

The controller responsible for processing your data in accordance with Sections 2 to 6 below is VERBUND Tourismus GmbH, Europaplatz 2, 1150 Vienna, Austria, which can be contacted by phone on +43 (0) 50 313 – 23 201 and by email at tourismus@verbund.com.

If you are interested in a guided tour of a power plant or similar and register for this directly with VERBUND, the controller responsible for processing your data in accordance with Sections 3 and 4 is the respective VERBUND company, namely VERBUND Hydro Power GmbH, Europaplatz 2, 1150 Vienna, Austria.

Each VERBUND company listed is subsequently referred to as “VERBUND”, “we” or “us”. The contact



details of the Data Protection Officer are as follows: datenschutz@verbund.com

2. Data processing in the context of “voucher ordering and processing”

2.1. Scope of the processing of personal data

The following data will be collected in the course of ordering and processing your voucher: first name, last name, address, email address, phone number, voucher code, date of issue, voucher value, bank details.

2.2. Legal basis and purpose of data processing

The legal basis for processing the data is Art. 6(1)(b) GDPR and therefore processing for performance of a contract. The data will be processed by VERBUND for the purpose of ordering the voucher and for the further processing of the contract (conclusion of the contract, sending and redemption of the voucher, billing, etc.).

Contact details are provided by you on a voluntary basis; however, if you do not provide these details, VERBUND will not be able to process your voucher order or send you a voucher.

2.3. Retention period

We will process your data for as long as is necessary in order to process orders and execute contracts and, beyond that, to the extent that statutory retention periods exist or warranty and limitation periods are still in force.

2.4. Data recipients

We use service providers (e.g. IT service providers) as processors to process personal data. These service providers may also have access to personal data on our behalf and in accordance with our instructions in order to provide the commissioned services. As a rule, your data will not be forwarded to third parties for their own purposes without your voluntary consent. We may transfer your personal data to external third parties, e.g. auditors, insurance companies or legal representatives to the required extent when necessary. In this case, personal data will be anonymised where possible.

3. Data processing in the context of “contacting us/enquiries”

3.1. Scope of the processing of personal data

When you contact VERBUND and request information or make enquiries, the following data will be processed, depending on the contact option selected (online, email, phone) and the nature of your enquiry: personal details such as salutation, title, name, address, contact details such as email address, phone number, nature of interest or details of your enquiry, as well as any other data collected or indicated as necessary when you contact us/send an enquiry, depending on the nature of your enquiry.

These data are provided by you on a voluntary basis. If you do not provide the data required to deal with your request/enquiry, VERBUND will not be able to process your request/enquiry accordingly.

3.2. Legal basis and purpose for processing personal data

The legal basis for the processing of your personal data is our legitimate interest in accordance with Art. 6(1)(f) GDPR. If the reason for your enquiry/contacting us is to conclude a contract, the legal basis for the processing is taking steps prior to entering into a contract in accordance with Art. 6(1)(b) GDPR. The personal data provided by you will be processed for the purpose of getting in touch and providing information or handling your enquiry.

3.3. Retention period

We process your data in order to handle your enquiry and beyond that for a period of three months to enable us to adequately respond to any follow-up questions. The data will only be stored for a longer period on the basis of statutory retention periods or to defend ourselves in the event of legal disputes.

3.4. Data recipients

Your data will only be forwarded to third parties where this is required for the fulfilment of (pre)contractual or legal obligations or to protect our legitimate interests. For example, we may transfer your personal data to external third parties such as auditors, insurers or legal representatives to the required extent when necessary. In this case, personal data will be anonymised where possible.

Your personal data may be transferred to commissioned service providers (e.g. IT service providers) for processing.

4. Data processing in the context of “concluding and processing contracts relating to services/offers from VERBUND”

4.1. Scope of the processing of personal data

If you enter into a contract with VERBUND for certain services or offers (e.g. bookings of certain packages, group offers, seminar rooms, guided tours, bus reservations, etc.), the following personal data in particular, which you provide to us when entering into the respective contract or which are collected subsequently in the course of ongoing contract performance, will be processed: title, gender, first name, last name, address, email address, phone number, billing address, billing information, payment method, product or type of service, date or duration of use of the service, as well as other data provided in individual cases, such as special requests or preferences. In the case of company or group bookings, the following data are also processed: contact details of the party making the booking (name, phone number, email address), names of the people participating, as well as the name and address of the company.

These data are provided by you on a voluntary basis; however, if you do not provide these data, VERBUND will not be able to process your booking or fulfil the contract.

4.2. Legal basis and purpose for processing personal data

The legal basis for processing the data referred to in Section 4.1. is Art. 6(1)(b) GDPR and therefore processing for the performance of a contract.

VERBUND will process the data for the purpose of making bookings/concluding contracts and for the further processing of the contract/managing the booking, customer service, communicating with you and for billing purposes.



If you take part in a power station or dam tour – even without having registered–, please provide your name during access control or at the safety briefing. The legal basis for this is Art. 6(1)(f) GDPR (legitimate interest). The legitimate interest lies in processing your data for the purpose of documenting your acknowledgement of the safety guidelines as well as for the purpose of access control, in particular for the purpose of protecting property and personal protection.

4.3. Retention period

We will process your data for as long as is necessary in order to process the contract and, beyond that, to the extent that statutory retention periods exist or warranty and limitation periods are still in force.

The data will be stored for three months in the context of the access control and safety briefing.

4.4. Data recipients

We use service providers (e.g. IT service providers) as processors to process personal data. These service providers may also have access to personal data on our behalf and in accordance with our instructions in order to provide the commissioned services. In fulfilment of legal or (pre)contractual obligations, we also pass on your data to recipients outside the company (e.g. regulatory authorities, municipalities, tax authorities, contract and cooperation partners to fulfil contractual services, payment service providers, etc.). Furthermore, we will transfer your personal data to external third parties, e.g. to auditors, insurers or legal representatives, to the required extent when necessary. In this case, personal data will be anonymised where possible.

5. Data processing in the context of “newsletter/information by email”

5.1. Scope of the processing of personal data

If you subscribe to a VERBUND newsletter or request information from VERBUND by email, we will process the following data: personal information such as gender, title, name, email address and possibly information about your company and position. The above data are provided by you on a voluntary basis. However, if you do not provide the data, you will not be able to receive a newsletter or receive information by email.

5.2. Legal basis and purpose for processing personal data

The legal basis for the processing of data pursuant to Section 5.1. is Art. 6(1)(a) GDPR and therefore your voluntary consent to receive the newsletter or information by email. Your consent can be withdrawn at any time without stating the reasons and with future effect by, for example, clicking on the link in the email or by sending an email to datenschutz@verbund.com.

VERBUND will process your data for the purpose stipulated in the voluntary declaration of consent, for example, for the purpose of sending information on VERBUND activities, offers and services, prize draws or events, as well as for sending invitations to events organised by VERBUND.

5.3. Retention period

Your data will be processed for as long as you continue to receive the newsletter/information by email, unless you have withdrawn your consent for the purpose in question.

5.4. Data recipients

Your data will only be forwarded to third parties where this is required for the fulfilment of (pre)contractual or legal obligations or where permitted within the scope of your voluntary consent. For example, we may transfer your personal data to external third parties such as auditors, insurers or legal representatives to the required extent when necessary. In this case, personal data will be anonymised where possible.

Your personal data may be transferred to commissioned service providers (e.g. IT service providers) for processing.

6. Data processing in the context of “web photo point and sending e-cards”

6.1. Scope of the processing of personal data

If you have taken a picture (photo) at certain VERBUND excursion destinations using a photo system with a self-timer provided by VERBUND, the photo can be accessed subsequently on the VERBUND website at https://visit.verbund.com/en and sent by email (e-card). The following data will be processed in this context: images (photos) as well as the email address provided by you (for sending an e-card). These data are provided by you on a voluntary basis. If you have also agreed to receive a newsletter, the data you provide (name and email address) will be processed for this purpose (see Section 5).

6.2. Legal basis and purpose for processing personal data

The legal basis for the processing of your data is your voluntary consent pursuant to Art. 6(1)(a) GDPR. You can withdraw your consent at any time with future effect and without stating the reasons by sending an email to tourismus@verbund.com.

6.3. Retention period

We will store the photos for a period of twelve months and then delete them unless you withdraw your voluntary consent. Your email address will be used to send the e-card and will then be deleted.

6.4. Data recipients

We use service providers (e.g. IT service providers) as processors to process personal data. These service providers may also have access to personal data on our behalf and in accordance with our instructions in order to provide the commissioned services. Furthermore, we will transfer your personal data to external third parties, e.g. to auditors, insurance companies or legal representatives to the required extent when necessary. In this case, personal data will be anonymised where possible.

7. Your rights

In principle, you have the right to information, rectification, erasure, restriction of processing, data portability, revocation of a granted consent and objection with regard to your data processed by VERBUND. To enforce these rights, contact us at datenschutz@verbund.com. If you believe that the processing of your data violates data protection law or that your rights under data protection law have otherwise been violated in any way, you can lodge a complaint with the supervisory authority in your place of residence. In Austria, this supervisory authority is the Data Protection Authority.

You can find further details on your rights in the section “Data subjects’ rights” atwww.verbund.com/en-at/data-protection.

Last updated: August 2025

VERBUND is committed to protecting your personal data and providing information on how we process your personal data.

We process personal data of (i) individuals or companies with which VERBUND enters into contact, maintains contact, and/or enters into contractual or business relationships, as well as of (ii) e.g. shareholders, boards, managing directors or other employees of the contractual or business partners within the scope of existing or incipient contractual and business relationships.

In doing so, we always comply with the applicable legislation on the protection, lawful handling and confidentiality of personal data and data security, in particular national data protection laws  and the General Data Protection Regulation (GDPR).

1. Name and contact details of the controller

The controller responsible for processing your data in the context of data processing at VERBUND is the VERBUND Group company designated as contract partner in each case (“VERBUND”, “we”, “us”), namely

VERBUND AG, Am Hof 6a, 1010 Vienna, Austria,

VERBUND Finanzierungsservice GmbH, Am Hof 6a, 1010 Vienna, Austria,

VERBUND Hydro Power GmbH, Europaplatz 2, 1150 Vienna, Austria,

VERBUND Innkraftwerke GmbH, Werkstraße 1, 84513 Töging am Inn, Germany,

VERBUND Energy4Business Germany GmbH, Luise-Ullrich-Straße 20, 80636 Munich, Germany, 

VERBUND Energy4Future GmbH, Am Hof 6a, 1010 Vienna, Austria,

VERBUND Digital Power GmbH, Am Hof 6a, 1010 Vienna, Austria,

VERBUND Business Solutions GmbH, Am Hof 6a, 1010 Vienna, Austria,

VERBUND Green Power GmbH, Am Hof 6a, 1010 Vienna, Austria,

VERBUND Green Power Österreich GmbH, Am Hof 6a, 1010 Vienna, Austria,

VERBUND Green Power Iberia, S.L.U., Paseo de la Castellana 163 Planta 7^a, 28046 Madrid, Spain,

VERBUND Energy4Flex GmbH, Am Hof 6a, 1010 Vienna, Austria,

VERBUND Energy4Customers GmbH, Erdberger Lände 26A, 1030 Vienna, Austria,

VERBUND Thermal Power GmbH & Co KG, Kraftwerkstraße 1, 8410 Fernitz-Mellach, Austria,

VERBUND Tourismus GmbH, Europaplatz 2, 1150 Vienna, Austria,

VERBUND Energy4Business GmbH, Am Hof 6a, 1010 Vienna, Austria,

VERBUND Ventures GmbH, Am Hof 6a, 1010 Vienna, Austria,

VERBUND Wind Power Austria GmbH, Europaplatz 2, 1150 Vienna, Austria,

VERBUND Wind Power Romania S.R.L., Unimed Center, 8th Tudor Arghezi street, 7th floor, 2nd district, 020945, Bucharest, Romania,

VERBUND Green Hydrogen GmbH, Am Hof 6a, 1010 Vienna, Austria,

VERBUND Green Hydrogen Sales GmbH, Am Hof 6a, 1010 Vienna, Austria,

Donaukraftwerk Jochstein Aktiengesellschaft, Innstraße 121, 94036 Passau, Germany,

Grenzkraftwerke GmbH, Münchner Straße 48, 84359 Simbach am Inn, Germany,

Innwerk AG, Schulstraße 2, 84533 Stammham, Germany,

Lestin & Co. Tauch- und Bergungsunternehmen GmbH, Nikolsdorfer Gasse 3, 1050 Vienna, Austria

Österreichisch-Bayrische Kraftwerke AG, Münchner Straße 48, 84359 Simbach am Inn, Germany,

VERBUND Green Power Deutschland GmbH, Energie-Allee 1, 55286 Wörrstadt, Germany,

VERBUND Green Power Deutschland Photovoltaik GmbH, Lennéstraße 3, 10785 Berlin, Germany,

Infrastruktur Bischheim GmbH & Co. KG, Energie-Allee, 55286 Wörrstadt, Germany

The contact details of the Data Protection Officer are as follows: datenschutz@verbund.com

2. How are data collected and which data are processed?

Data collected from the data subject (information pursuant to Art. 13 GDPR):

We process the personal data that we receive or collect from you or your contact person in the course of establishing contact, maintaining contact or initiating business or a business relationship. 

Data collected from other sources (information pursuant to Art. 14 GDPR):

We also process personal data that we lawfully receive as necessary from credit agencies or financial service institutions in the course of checking your creditworthiness or integrity, from address publishers and direct marketing companies as well as from publicly accessible sources (e.g. websites, company register, commercial register, land register, annual reports, media) or other third parties.

The following data will be processed:

company name, address, company register number, tax number, VAT number, industry, title, gender, first name, last name, address, email address, phone number as well as job title/position and date of birth if applicable, nature of interest or details of your request, payment methods, bank details, billing information, where appropriate, contract or customer number, contract or order data (e.g. duration of contract, sales data, volume), documentation data (e.g. meeting notes, minutes/resolutions of meetings, correspondence such as email correspondence), recordings of meetings (after consent has been given), where applicable, creditworthiness and integrity data, advertising data, as well as any other data provided voluntarily or collected in the context of establishing or maintaining contact and/or (contractual) relationship in order to meet legal requirements.

Where communication or collaboration takes place online via audiovisual meeting or conference systems and/or other collaboration tools, the following data on participating individuals will also be processed: interaction data (start, end, approvals, availability status), technical data (IP address, browser, operating system, hardware, LAN or WLAN), technical parameters for video and audio,  (chat) messages, shared files, documents and screenshots, recordings of audio and video meetings (if you have given your voluntary consent for this).

If, in the context of a contractual relationship, you are listed in a confidentiality section of the VERBUND insider directory, the start and end (date/time) of your affiliation and the reason for your inclusion in the confidentiality section will also be processed. Should you gain access to inside information on VERBUND within the scope of your work for VERBUND, you will be added to the relevant list of insiders in accordance with the provisions of the EU Market Abuse Regulation and will be legally required to inform us of your birth name and your personal contact details (phone number, home address). We are required to send this list of insiders to the Financial Market Supervisory Authority on request.

3. For what purposes and on which legal basis will your data be processed?

We process your personal data for the following purposes and based on the following legal bases:

3.1.   Art. 6(1)(b) GDPR

The processing of your data is required for the performance of a contract concluded with you or for taking steps prior to entering into a contract. The purpose of the data processing will depend on the specific request or enquiry or the contract concluded with you, and will include in particular

• handling your request/enquiry;
• initiating the contract;
• processing and administering the contract;
• performance of the contract.

The data you provide are required for performance of the contract or for taking steps prior to entering into a contract. Without these data, we are unable to conclude the contract with you or process your request/enquiry.

3.2.   Art. 6(1)(a) GDPR

If you have given us your voluntary consent to process your personal data, the data will only be processed for the purposes set out in the declaration of consent and to the extent specified there.

You can withdraw your consent at any time with future effect without stating the reasons, e.g. by sending an email to datenschutz@verbund.com. Withdrawal of your consent will not affect the legality of processing that has been carried out on the basis of your consent until its withdrawal.

3.3.   Art. 6(1)(f) GDPR

The processing is justified in order to protect the legitimate interests of VERBUND or a third party. This is the case particularly for the following purposes:

• credit or integrity checks prior to entering into a contract as well as during an ongoing contractual relationship, in order to obtain information about your creditworthiness and integrity in a specific case (e.g. outstanding invoices, insolvency proceedings, avoidance of payment defaults, compliance with compliance-related provisions);
• contract partner suitability, auditing and assessment prior to the start of a contract to determine whether they are best suited for the service to be provided;
• service evaluation and quality management during an ongoing contractual relationship with the aim of achieving the best service for VERBUND;
• recording and maintaining data in databases in accordance with VERBUND internal regulations for the purpose of financial market compliance and prevention of corruption, occupational safety and/or other internal safety regulations in order to comply with own precautions/regulations;
• data management including all related activities, in particular for the purpose of making contact and communicating;
• provision and use of audiovisual conference systems and/or other communication and/or collaboration tools;
• customer satisfaction analyses and stakeholder support;
• public consultations as part of planning approval processes;
• direct marketing to provide you with information on VERBUND’s products and services. You can object to the processing of data for marketing purposes pursuant to Art.  21 GDPR. However, electronic communication for marketing purposes (e.g. sending newsletters) will only take place solely with your express and voluntary consent.

3.4.   Art. 6(1)(c) GDPR

The processing of personal data may be necessary in order to fulfil various legal obligations. In particular, personal data will be processed for the fulfilment of the following legal obligations:

• preparation of annual financial statements;
• ongoing tax and tax-related obligations;
• audits by the Austrian Court of Audit;
• in accordance with stock exchange legislation and the requirements of the Market Abuse Regulation for the purpose of financial market compliance (this includes the personal data of individuals who have access to inside information on an ad hoc basis or in connection with projects and who are to be added to the insider list);
• corporate law requirements;
• requirements in terms of occupational safety and other statutory provisions (e.g. for epidemics/pandemics).

3.5.   Art. 6(1)(e) and Art. 9(2)(g) and  (i) GDPR

We may collect your personal data (in particular name, email address, phone number, address, type and time of contact) when contacting VERBUND employees for the purpose of contact management (maintaining contact lists) in connection with an epidemic/pandemic (currently Covid-19). Such processing is carried out on the basis of the applicable legal provisions, including the Epidemic Act (Epidemiegesetz, in Austria), special measures legislation and regulations (such as the Covid-19 Measures Act in Austria). By maintaining contact lists, we perform a task that is in the public interest. This allows us to contact you as quickly as possible in order to protect you or another person, particularly in the event of a suspected or confirmed case. If you report a medical condition to us, we will also process your health data. Your data will be stored for a period of four weeks and will only be forwarded to the relevant internal departments/persons at VERBUND and to the relevant legally competent authorities in specific cases.

4. How long will your data be stored?

The data will be processed for as long as is necessary for the respective purpose and will then be deleted unless the data are required beyond that in accordance with statutory retention obligations (e.g. pursuant to Section 212 of the Austrian Commercial Code (UGB) or Sections 124 et seq. of the Austrian Federal Tax Code (BAO) or other statutory requirements) or for as long as claims arising from the (contractual) relationship can be asserted or this can be justified in order to protect our legitimate interests. If the data processing is based on your voluntary consent, we will store your personal data until you withdraw your consent at the latest.

5. Who will your data be passed on to?

Your personal data will only be passed on to third parties where this is necessary for the fulfilment of (pre)contractual or legal obligations, is justified in order to protect our legitimate interests or is permitted within the scope of consent that has been given.

Your data will be passed on to the following recipients in particular:

• (Group) companies in the context of (precontractual) contract performance, legitimate interest or in accordance with consent that has been given;
• within the scope of the contractual relationship and in particular in connection with our performance obligation, to e.g. solicitors, notaries, insolvency administrators, debt collection agencies, experts, tax consultants, auditors, interest groups, banks, financial service providers, mail/courier services and logistics partners or contract and cooperation partners for services linked to your contract;
• commissioned service providers for processing (e.g. payment processing service providers, scanning and printing service providers, IT services);
• market participants in the electricity or gas market for the fulfilment of (pre)contractual and/or legal obligations;
• courts, regulatory authorities and public bodies.

In all cases where we pass on your data to recipients within and outside our company, we always ensure that this is only done on a legal basis and that the protection of your data is guaranteed.

6. Your rights

In principle, you have the right to information, rectification, erasure, restriction of processing, data portability, revocation of a granted consent and objection with regard to your data processed by VERBUND. To enforce these rights, contact us at datenschutz@verbund.com. If you believe that the processing of your data violates data protection law or that your rights under data protection law have otherwise been violated in any way, you can lodge a complaint with the supervisory authority in your place of residence. In Austria, this supervisory authority is the Data Protection Authority.

You can find further details on your rights in the section “Data subjects’ rights” at www.verbund.com/en-at/data-protection.

Last updated: February 2025

It is important for VERBUND AG to protect your personal data. We therefore comply with the applicable legal regulations for the protection, lawful handling and confidentiality of personal data as well as data security, in particular the Data Protection Act as amended ("DSG"), the Telecommunications Act ("TKG") and the General Data Protection Regulation ("GDPR"). The following information describes which personal data we may process when you visit our VERBUND websites (‘Website’) and for which purposes we use which cookies and similar technologies on our VERBUND websites (‘Website’) and we offer you the opportunity to make settings to consent to this use and to revoke your consent at any time.

1. Name and address of the data controller

The controller responsible for processing your personal data in accordance with data protection regulations is:

VERBUND AG
Am Hof 6a
1010 Vienna

Contact details of the data protection officer: datenschutz@verbund.com.

2. Processing in the context of the "website"

2.1. Scope of the processing of personal data

When you visit our website and the VERBUND online services, we will automatically collect the following personal data about you:

• Date and time of accessing a page on our website
• Date and time of your login to the VERBUND online services
• Data about your end device (device ID)
• IP address
• Name and version of your web browser
• Session ID

2.2. Legal basis for the processing of personal data

As far as the data of your visit to our website and online services is concerned, we base the justification for the processing on our legitimate interest in accordance with Art. 6 (1) (f) GDPR, which consists of making our website user-friendly and protecting it from attacks. Based on your voluntary consent in accordance with Art. 6 (1) (a) GDPR in conjunction with Section 165 (3) TKG, we process your personal data to compile usage statistics and to display personalised advertising. You can revoke your voluntary consent at any time.

2.3. Purpose of the data processing

We process your data in connection with your visit to our website and online services for the following purposes

• to provide you with our website and online services, including their functions, and to further improve and develop this website;
• to recognise, prevent and investigate attacks on our website and online services
• to compile usage statistics;
• to display personalised product and page suggestions.

2.4. Duration of storage

We will generally store your data for visiting the website for a period of three months, and your data for visiting the online services for the duration of the use of your online account as part of an energy supply contract with VERBUND. Data will only be stored for longer if this is necessary to investigate any attacks on our website and only until the end of any applicable limitation periods, statutory retention periods or any legal disputes.

2.5. Data recipients

We regularly use IT service providers to operate and manage the website, who may also have access to personal data on our behalf and in accordance with our instructions in order to provide the commissioned IT services.

We also transfer your personal data to the following recipients:

• to external third parties to the extent necessary on the basis of our legitimate interests (e.g. auditors, insurance companies in the event of an insurance claim, legal representatives in the event of an incident, etc);
• to authorities and other public bodies to the extent required by law (e.g. tax authorities, courts, etc).

Your data will not be passed on to any other third parties for their own purposes without your consent.

3. Processing in the context of the "website"

3.1 Scope of the processing of personal data

In the course of using our chatbot, we will automatically process the following personal data about you

• Date and time of accessing the chatbot
• Conversation history and actions taken
• Date and time of each interaction with the chatbot

3.2 Legal basis for the processing of personal data

As far as the data of your use of the chatbot is concerned, we rely on our legitimate interest according to Art 6 (1) (f) GDPR to justify the processing, which consists of making the chatbot user-friendly and protecting it from attacks. Only on the basis of your voluntary consent in accordance with Art. 6 (1) (a) GDPR do we also process your personal data to create usage statistics and to analyse the course of the conversation and the actions taken. You can revoke your voluntarily granted consent at any time. If the use of the chatbot is necessary for the fulfilment of a contract or for the implementation of pre-contractual measures (e.g. in the context of processing a service request), we rely on Art 6 (1) (b) GDPR to justify the processing.

3.3 Purpose of the data processing

We process your data in connection with the use of our chatbot for the following purposes

• to provide you with our chatbot, including its functions, and to further improve and develop this chatbot;
• to recognise, prevent and investigate attacks on our chatbot
• to be able to compile usage statistics;
• to be able to process your service request.

3.4 Duration of storage

If the data processing is based on your voluntary consent, your data for the use of our chatbot will generally be stored for a period of 30 days. Data will only be stored for longer if this is necessary for legitimate interests in order to investigate detected attacks on our chatbot and beyond that only until the end of relevant limitation periods, statutory retention periods or any legal disputes. The chatbot can also be used without consent. In this case, data will only be processed for as long as it is technically necessary for the use of the chatbot.

3.5 Recipients of data

We regularly use IT service providers to operate and manage the chatbot, who may also have access to personal data on our behalf and in accordance with our instructions in order to provide the commissioned IT services.

We also transfer your personal data to the following recipients:

• to external third parties to the extent necessary on the basis of our legitimate interests (e.g. auditors, insurance companies in the event of an insurance claim, legal representatives in the event of an incident, etc);
• to authorities and other public bodies to the extent required by law (e.g. tax authorities, courts, etc).

Your data will not be passed on to any other third parties for their own purposes without your consent.

4. Cookies

4.1. Cookies and how they work

Cookies and similar web storage technologies, such as scripts, web beacons, tracking URLs, pixels or tags (hereinafter referred to as ‘cookies’) are used on our website. Cookies are small files that are stored on your end device (e.g. PC, smartphone or tablet) when you visit our website. Each time you visit our website, the cookie and the website ‘communicate’ with each other so that your device can be recognised. This is useful for both you and us: cookies serve the purpose of enabling our website to work correctly, expanding the range of functions and optimising the website experience. This enables the website to remember certain entries and settings (e.g. language, font size) over a certain period of time so that you do not have to enter them again each time you visit the website.

We use first-party and third-party cookies. First-party cookies come directly from our website and only send information to us. However, our website may also contain technologies from other providers (third parties) which we integrate into our website for advertising purposes and which may set their own cookies on your end device.
In most cases, the information in a cookie is pseudonymised or anonymised, as cookies generally do not identify you as a person, but your device. In some cases, it is possible to link certain cookies to personal data. There are therefore cookies that require your consent before they can be used on your end device and cookies that can be used without your consent because they are technically necessary for us to provide our services (‘necessary cookies’). In the case of necessary cookies, the data processing is necessary for the purpose of data security measures, to prevent misuse and to optimise the website and is therefore based on our legitimate interests in accordance with Art. 6 (1) (f) GDPR in conjunction with Section 165 (3) TKG. We use all other cookies on our website exclusively on the basis of your prior express consent in accordance with Art. 6 (1) (a) GDPR in conjunction with Section 165 (3) TKG via the cookie banner.

Insofar as the settings you have made or the voluntary consent you have given also includes providers who transfer data to countries without an adequacy decision pursuant to Art 45 (3) GDPR and without suitable guarantees pursuant to Art 46 GDPR (such as the USA in particular), your consent pursuant to Art 49 GDPR also applies here. There is a risk that your data transmitted in this way may be subject to access by authorities in these third countries for control and monitoring purposes and that no effective legal remedies are available against this.

4.2. Cookie categories

We use cookies on our website to provide you with an optimised website experience. The cookies that are technically necessary for the provision of the service are automatically activated with every visit based on our legitimate interests. Additional cookies are only used if you consent to them in advance. We use these for statistical purposes or to show you personalised information. You can decide which categories you want to allow and can also change your cookie settings at any time. You can find more information about the cookies we use in our cookie banner. By clicking on ‘Accept cookies’, you consent to the use of all cookies. By clicking on the ‘Reject cookies’ button, you reject all unnecessary cookies. To customise your cookie settings and only allow certain categories, select ‘Settings’ and then the desired checkboxes and click on ‘Confirm selection’.

4.3. Storage duration

With regard to the storage period, a distinction is made between ‘session cookies’ and ‘persistent cookies’:

Session cookies are deleted when the browser is closed. Persistent cookies, on the other hand, remain on your end device until the cookies either reach an expiry date specified by us or are manually deleted by you in your browser. We use such persistent cookies to recognise you the next time you visit our website. You can find the exact storage period in our cookie banner. To do this, click on the ‘Settings’ button and on the information icon for each category.

3.4. Deactivating cookies

You can revoke the consent you have given us at any time with effect for the future by deleting the relevant cookies and preventing the storage of cookies as described here. You can also decide at your own discretion which categories of cookies you wish to allow and can change your cookie settings in the cookie banner.

In addition, you can change all cookie settings in general at any time via your browser. Most browsers accept cookies automatically. It may be necessary to use certain cookies in order to open a website or to save your objection to the use of other cookies. You can delete all cookies stored on your computer and set most browsers so that the storage of cookies is prevented or explicit consent is required before a cookie is stored. You can also separately activate ‘Block third-party cookies’. As a rule, the help function in the menu bar of your web browser will show you how to reject new cookies and switch off cookies you have already received. You can find out how here, for example: http://www.aboutcookies.org/.

Below we have also compiled links where you can find detailed information on deactivating cookies in common browsers:

• Mozilla Firefox: https://support.mozilla.org/de/kb/cookies-loeschen-daten-von-websites-entfernen
• Microsoft Edge: https://support.microsoft.com/de-de/microsoft-edge/cookies-in-microsoft-edge-l%C3%B6schen-63947406-40ac-c3b8-57b9-2a946a29ae09
• Google Chrome: https://support.google.com/accounts/answer/61416?hl=de
• Safari: https://support.apple.com/kb/PH17191?locale=de_AT&viewlocale=de_DE

However, we would like to point out that if you deactivate cookies, you may not be able to use all the functions of this website to their full extent. You may then have to make some settings manually each time you visit the website and accept the impairment of some functions.

5. Tools

5.1. Google Analytics 4

VERBUND uses Google Analytics 4, a service provided by Google Ireland Limited, Gordon House, 4 Barrow St, Dublin, D04 E5W5, Ireland (‘Google’), with which the use of websites can be analysed.

When using Google Analytics 4, the IP addreass transmitted by your end device when you use the website is always collected and processed in anonymised form by default and automatically, so that the information collected cannot be directly linked to a person. This automatic anonymisation takes place by Google truncating the IP address transmitted by your device within member states of the European Union (EU) or other signatory states to the Agreement on the European Economic Area (EEA).

Google uses this and other information on behalf of VERBUND to evaluate your use of the website, to compile reports on your website activities and usage behaviour and to provide us with other services related to your website and internet usage. The abbreviated IP address transmitted by your device as part of Google Analytics 4 will not be merged with other Google data.

Google Analytics 4 also enables the creation of statistics with statements about the age, gender and interests of website users on the basis of an evaluation of interest-based advertising and with the help of third-party information via a special function, the so-called ‘demographic characteristics’. This makes it possible to determine and differentiate between user groups of the website for the purpose of target group-optimised marketing measures. However, data collected via the ‘demographic characteristics’ cannot be assigned to a specific person and therefore cannot be assigned to you personally.

All processing described above, in particular the setting of Google Analytics cookies for the storage and reading of information on the end device used by you for the use of the website, will only take place if you have given us your express consent to do so in accordance with Art. 6 (1) (a) GDPR. Without your consent, Google Analytics 4 will not be used during your use of the website. You can revoke your consent at any time with effect for the future. To exercise your cancellation, adjust the desired change in the cookie banner by clicking on ‘Reject cookies’.

We have concluded a so-called order processing contract with Google for our use of Google Analytics 4, which obliges Google to protect the data of our website users and not to pass it on to third parties.

To ensure compliance with the European level of data protection, including in the event of any transfer of data from the EU or the EEA to the USA and possible further processing there, Google relies on the so-called new standard contractual clauses of the European Commission, which Google applies.

Further legal information on Google Analytics 4 can be found at https://policies.google.com/privacy?hl=de&gl=de and at https://policies.google.com/technologies/partner-sites.

Google Analytics in consent mode (Consent Mode): Depending on your consent, Google Analytics will process your personal data in so-called consent mode (or ‘Consent Mode’). You can choose whether or not to consent to Google Analytics cookies. This collected data is mainly used to measure user behaviour on the website, to display targeted advertising and to provide us with web analytics reports. You can consent to data processing by Google via the cookie banner. If you do not give your consent, no personal data will be forwarded to Google.

5.2. Google Adwords Conversion Tracking

VERBUND uses the Google Conversion Tracking service of Google Ireland Limited. (Google Ireland Limited, Google Building Gordon House, 4 Barrow Street, Dublin D04 E5W5, Ireland). Google Adwords places a cookie on the visitor's computer if they have reached our website via a Google advert. These cookies lose their validity after 30 days and are not used for personal identification. If the user visits certain pages of the Adwords customer's website and the cookie has not yet expired, Google and the customer can recognise that the user clicked on the ad and was redirected to this page. Each Adwords customer receives a different cookie. Cookies can therefore not be tracked via the websites of Adwords customers. The information collected using the conversion cookie is used to generate conversion statistics for Adwords customers who have opted for conversion tracking. In this way, we can improve the performance of our Ads adverts in Google search results and target returning visitors more effectively. Adwords customers are told the total number of users who clicked on their advert and were redirected to a page with a conversion tracking tag. However, they do not receive any information that can be used to personally identify users.

If the visitor does not wish to participate in the tracking process, they can also reject the setting of a cookie required for this - for example, by changing their browser settings to generally deactivate the automatic setting of cookies. The visitor can also deactivate cookies for conversion tracking by setting their browser to block cookies from the domain ‘www.googleadservices.com’. Further information on the use of data by Google can be found at https://www.google.com/intl/de/policies/privacy.

VERBUND has also activated the Google Enhanced Conversion function in order to be able to identify, record and evaluate conversions via the website (e.g. the conclusion of an electricity supply contract) more precisely. The function is used to improve the accuracy of conversion tracking and to protect the privacy of the visitor by converting the email address transmitted when the contract is concluded into a hashed/pseudonymized character string. The hash standard “SHA 256” is used for this. Based on this personal information (email address), the visitor's interaction can be assigned to the corresponding Google account if the visitor was logged into their Google account when they interacted with a VERBUND ad in the Google network. The Google Enhanced Conversion function is only used if the visitor has consented to the marketing cookies before visiting the website. The visitor can revoke this consent at any time for the future and change it via the cookie settings.

5.3. Google Ads Remarketing

VERBUND uses the functions of Google Ads Remarketing. The provider is Google Ireland Limited (‘Google’), Gordon House, Barrow Street, Dublin 4, Ireland.

With Google Ads Remarketing, we can assign people who interact with our online offering to specific target groups in order to subsequently display interest-based advertising in the Google advertising network (remarketing or retargeting).

Furthermore, the advertising target groups created with Google Ads Remarketing can be linked to Google's cross-device functions. In this way, interest-based, personalised advertising messages that have been adapted to you depending on your previous usage and surfing behaviour on one end device (e.g. mobile phone) can also be displayed on another of your end devices (e.g. tablet or PC).

If you have a Google account, you can object to personalised advertising by clicking on the following link: https://adssettings.google.com/anonymous?hl=de.

The use of this service is based on your consent in accordance with Art. 6 (1) (a) GDPR and can be revoked at any time. Further information and the data protection provisions can be found in Google's privacy policy at: https://policies.google.com/technologies/ads?hl=de.

5.4. Google Tage Manager

VERBUND uses Google Tag Manager from Google Ireland Limited (Google Ireland Limited, Google Building Gordon House, 4 Barrow Street, Dublin D04 E5W5, Ireland). Google Tag Manager is a solution that allows marketers to manage website tags via an interface. The Tag Manager tool implements the tags and does not collect any personal data itself. The tool only triggers other tags such as Google Analytics or LinkedIn Insight and controls when they are triggered. Google Tag Manager itself does not access this data. If deactivation has been carried out at domain or cookie level, this remains in place for all tracking tags that are implemented with Google Tag Manager.

5.5. Google Signals

VERBUND has activated Google Signals, an add-on service to Google Analytics from Google Ireland Limited (Google Ireland Limited, Google Building Gordon House, 4 Barrow Street, Dublin D04 E5W5, Ireland). This feature sends aggregated (non-personal) data such as interests or demographics of Google users who have activated personalised ads to Google Analytics. The data is used for remarketing purposes by VERBUND. In addition, cross-device user behaviour can be measured. Further information on Google Signals can be found at https://support.google.com/analytics/answer/7532985?hl=de.

5.6. Floodlight activities

DoubleClick Floodlight is a Google conversion tracking service - a service provided by Google Ireland Limited, Google Building Gordon House, 4 Barrow Street, Dublin D04 E5W5, Ireland, to measure the effectiveness of our advertising campaigns and limit the frequency with which you are shown a particular advert. The aim is to ensure that you only receive adverts that are relevant to you and your interests. In particular, information is collected and stored that shows the time of your visit, your advertising interest through clicks made and your user behaviour on third-party websites. This information is not passed on to third parties, but is only used for campaign management and campaign control. In addition, user profiles are created which are used for our own market research purposes - in particular on the basis of the interests identified. You can revoke the storage of cookies at any time by making the appropriate setting in the cookie banner. Further information about this Google service can be found at https://www.google.com/policies/privacy/ads/ or at https://www.google.com/settings/u/0/ads/authenticated

5.7 LinkeIn Insight Tag

Our website uses the ‘LinkedIn Insight Tag’ conversion tool from LinkedIn Ireland Unlimited Company, Wilton Place, Dublin 2, Ireland. This tool creates a cookie in your web browser that enables the collection of the following data, among others: IP address, device and browser characteristics and page events (e.g. page views). This data is encrypted, anonymised within seven days and the anonymised data is deleted within 90 days. LinkedIn does not share any personal data with us, but offers anonymised summarised reports on the website target group and display performance. LinkedIn also offers the possibility of retargeting via the Insight Tag. We can use this data to display targeted advertising outside our website without identifying you as a website visitor. You can find more information on data protection at LinkedIn at https://www.linkedin.com/legal/privacy/eu. The processing is based on your express consent, Art 6 (1) (a) GDPR. LinkedIn members can control the use of their personal data for advertising purposes in their account settings. You can deactivate the Insight tag on our website in the cookie banner.

5.8. Spoteffects

This website uses the web analysis service ‘spoteffects’ from XAD spoteffects GmbH (Saarstr. 7, 80797 Munich) to record the effectiveness of our TV and CTV advertising campaigns. Cookies are used to statistically analyse visitor access and return visits as well as order completions. If you have not consented to the marketing cookies, this analysis will not be carried out. The IP addresses of browsers are hashed so that no conclusions can be drawn about households or individual persons.

5.9. Microsoft Universal Event Tracking

The VERBUND website uses the Microsoft Universal Event Tracking service provided by Microsoft Ireland Operations Limited, One Microsoft Place, South County Business Park, Dublin D18 P521, Ireland (‘Microsoft’). Microsoft places a cookie on the visitor's computer if they have accessed our website via a Microsoft advertisement. If the user visits certain pages of the website and the cookie has not yet expired, Microsoft and VERBUND can recognise that the user clicked on the advertisement and was redirected to this page. The information collected using the conversion cookie is used to compile conversion statistics. This enables us to improve the performance of our ads in Microsoft search results and to better target returning visitors. VERBUND receives the total number of users who clicked on its ad and were redirected to a page with a conversion tracking tag. However, we do not receive any information that can be used to personally identify users. If visitors do not wish to participate in the tracking process, they can also refuse the necessary cookies by, for example, using browser settings that generally disable the automatic setting of cookies or via the cookie banner on our website. In addition to revoking your consent, you also have the option of disabling personalised ads in the ad settings in your Microsoft account: https://account.microsoft.com/privacy/ad-settings/signedout.

5.10. Visual Website Optimizer (VWO)

VERBUND uses the web analysis service Visual Website Optimizer (VWO), a service provided by Wingify Software Pvt. Ltd. (703, 7th floor, KLJ North Tower, Netaji Subhash Place, Pitampura, Delhi-110034, India), which can be used to analyse the use of the VERBUND website.

We use VWO to carry out occasional A/B tests and personalisation during your visit to our website in order to optimise and further develop our website. For this purpose, we process pseudonymised data such as the number of visitors, their click behaviour and the average active time spent on our website.

VWO uses cookies, which serve, among other things, to recognise the visitor's browser and enable more accurate collection of statistical data. The user's IP address is pseudonymised immediately after collection and before storage to prevent any personal references.

Processing is based on your express consent in the cookie banner, Art. 6 para. 1 lit. a GDPR. You can withdraw this consent at any time if you object to the future collection and storage of your pseudonymised visitor data. Alternatively, you can obtain an opt-out cookie from VWO at https://vwo.com/opt-out/, which ensures that no visitor data from your browser will be collected and stored by VWO in the future. For more information on data protection at VWO, please visit: vwo.com/privacy-policy.

6. Rights of the data subject

With regard to your data processed by us, you have the rights to information, rectification, erasure, restriction, data portability, withdrawal of consent and objection. To exercise these rights, please contact us at datenschutz@verbund.com. If you believe that the processing of your data violates data protection law or that your data protection rights have been violated in any other way, you can lodge a complaint with the national supervisory authority of your place of residence. In Austria, the data protection authority is responsible.

You can find more details about your rights in the ‘Data subject rights’ section at www.verbund.com/datenschutz.

as of July 2025

It is extremely important for us VERBUND AG, Am Hof 6a, 1010 Vienna, ("VERBUND", "we", "us") to protect your personal data. We therefore comply with the applicable legal regulations for the protection, lawful handling and secrecy of personal data as well as data security, in particular the Data Protection Act as amended ("DSG"), the Telecommunications Act ("TKG") and the General Data Protection Regulation ("GDPR").

1. Name and contact details of the data controller

We act as a responsible party within the meaning of the GDPR in the context of our social media profiles. This is why we inform you about the purposes for which and the legal basis on which we use various social media applications to contact you by means of the following privacy statement.

The contact details of the data protection officer: datenschutz@verbund.com.

We update this privacy statement from time to time, if necessary. It is therefore recommended that you check this page on a regular basis to ensure that you are viewing the most recent version.

2. Social media activities

Your data may also be processed by the platform operators in connection with our social media activities. In this case, we and the respective platform operator are joint controllers pursuant to Art. 26 GDPR. We have therefore entered into agreements on joint responsibility.

2.1 Contacting us

When you contact us via our social media pages

• Facebook https://www.facebook.com/verbundag,
• Instagram https://www.instagram.com/verbundag,
• Bluesky https://bsky.app/profile/verbundag.bsky.social,
• LinkedIn https://at.linkedin.com/company/verbundag,
• Kununu https://www.kununu.com/at/verbund
• Xing https://www.xing.com/pages/verbund oder
• Youtube https://www.youtube.com/@verbundag

we process the data you provide (e.g. customer number, counter point number, full name, address, description of the system or problem, communication with us) for the purpose of answering your enquiry and therefore for implementing pre-contractual measures in accordance with Art. 6(1)(b) GDPR or in the context of our legitimate interests in processing your enquiry (customer support) in accordance with Art. 6(1)(f) GDPR. We will store these data for a maximum of three months after your enquiry has been handled, insofar as other statutory retention periods do not apply. In this context, we receive your personal data from the respective operator of the social media platform and also transmit your personal data to them.

2.2 Social media interaction

You can also interact with us on our social media profiles by clicking various buttons (e.g. "Like", "Share", "Subscribe", "Invite Friends", "Love", "Dislike" etc.) or commenting on content. In this case, we will process your interaction as well as your ("User") name, profile photo and IP address, and, if necessary, any personal data of invited or tagged third parties.

We use this information in accordance with Art. 6(1)(f) GDPR to respond to your questions and comments, to comment on your opinion/feedback, to provide you with the opportunity to express your opinion or to advertise VERBUND AG and our product range on the platform. We will store the data you have provided yourself until you withdraw your interaction or as long as our content (images, videos, etc.) is online.

2.3 Tracking / marketing campaigns

We automatically process personal data on our social media profiles via the page insight tools of Facebook, Instagram and LinkedIn, in each case together with the platform operator, which provide information about the interaction of visitors and users and serve to optimise your experience on the website or to optimise marketing activities ("tracking data").

3. Data recipients

We also transfer your personal data to external vicarious agents or service providers (commissioned processors) to the extent necessary:

• to IT service providers and/or providers of data hosting or data processing or similar services;
• to other service providers, providers of tools and software solutions who also support us in rendering our services and operate on our behalf (incl. providers of marketing tools, marketing agencies, communication service providers and call centres)

All our commissioned processors handle your data only on our behalf and on the basis of our instructions to allow us to provide you with our online service.

We will also transfer your personal data to the following recipients (responsible bodies) to the extent necessary:

• to VERBUND Group companies to the extent necessary to fulfil our obligations to you
• to any third parties involved in the fulfilment of our obligations to you (e.g. banks);
• to other external third parties to the extent required (e.g. auditors, insurance companies in the event of an insured event, legal representatives as the occasion requires, etc.);
• to authorities and other public bodies to the extent required by law (e.g. financial authorities, etc.).

To the extent that we process your data in a third country outside the European Union (EU) or the European Economic Area (EEA) or we do so within the scope of using third-party services, this will only be carried out if it is necessary for the fulfilment of our (pre-)contractual obligations, on the basis of your explicit and voluntary consent, due to a legal obligation or based on our legitimate interests. We have implemented suitable and proportionate safeguards to ensure that any transfer of your data to the respective third country is in compliance with data protection law. We will provide you with a copy of these suitable safeguards at your request insofar as we process or have your data processed in third countries.

4. Retention period

We store your data for three months in order to process enquiries (and in the event of follow-up questions) through our website or social media pages. In individual cases (such as complaints), the personal data will be retained for the period in which claims can be asserted against us (statutory limitation period of 3 or up to 30 years).

We will store the personal data voluntarily provided on our company websites (e.g. name, comments, interactions, etc.) for as long as you have not removed the corresponding information (e.g. a "Like") or deleted the comment or these have been lawfully deleted by the platform operator within the scope of the terms of use (e.g. in cases of abuse).

5. Your rights

In principle, you have the right to information, correction, erasure, restriction, data portability, revocation of a granted consent and objection in respect of your data processed by VERBUND. To exercise these rights, please contact VERBUND at datenschutz@verbund.com. If you believe that the processing of your data violates data protection law or your data protection claims have otherwise been violated in any way, you can submit a complaint to the national supervisory authority where you live. In Austria, this supervisory authority is the Data Protection Authority.

You can find further details on your rights in the section "Data subjects' rights" at www.verbund.com/en-at/data-protection.

as of July 2025

VERBUND AG is committed to protecting your personal data and providing information on how we process your personal data. We therefore comply with the applicable legal provisions on the protection, lawful handling, and secrecy of personal data as well as data security, in particular the Data Protection Act as amended (“DSG”), the Telecommunications Act 2021 (“TKG 2021”) and the General Data Protection Regulation (“GDPR”).

1. Name and contact details of the controller

The controller responsible for processing your personal data in connection with the data processing listed under point 2 is VERBUND Energy4Customers GmbH, Erdberger Lände 26A, 1030 Vienna (hereinafter referred to as “VERBUND”, “we” or “us”).

The contact details of the Data Protection Officer are as follows: datenschutz@verbund.com

2. Data processing in relation to the VERBUND app

In the following privacy statement, we provide information on which data and information we may collect, process and use when you use the VERBUND app.

2.1. Scope of the processing of personal data

When you use the VERBUND app, we automatically process the following personal data about you:

• date and time the app was launched;
• login data: selected username, password, system nickname;
• date and time you logged in to the VERBUND app;
• data about your end device (device ID);
• actions taken in the app and data to record the action;
• date and time of each interaction.

In order to provide you with the services available in the VERBUND app, we store individual data records received when you sign up for the My VERBUND online account. These may include supplementary master data or information on the status of your contract.

2.2. Legal basis for the processing of personal data

The legal basis for data processing in connection with the use of the VERBUND app is Art. 6(1)(b) GDPR. The provision of your data is required and mandatory for using the VERBUND app. If you do not provide your data, you will not be able to sign up or use the VERBUND app. As far as the data relating to your actions and interactions in the VERBUND app is concerned, we justify our processing on our legitimate interest under Art. 6(1)(f) GDPR, which lies in making the app user-friendly and protecting it from attacks.

2.3. Purpose of the data processing

We process your data in connection with the use of our VERBUND app for the following purposes:

• to provide you with our VERBUND app, including its functions, and to further improve and develop the VERBUND app;
• to detect, prevent, and investigate attacks on our VERBUND app;
• to compile usage statistics;
• to address your service queries.

2.4. Retention period

We process your data required for the use of the VERBUND app as long as the user agreement with you remains in force or for as long as it is technically required for the use of the VERBUND app. Once the contractual relationship with you has ended, your data from the use of the VERBUND app will be deleted, unless the data must continue to be stored in accordance with statutory retention obligations (e.g. obligations pursuant to Section 212 of the Austrian Commercial Code (UGB) or Section 124 et seq. Austrian Federal Tax Code (BAO)), or for as long as claims from the contractual relationship can still be asserted. Data will only be stored for longer if this is necessary in order to investigate identified attacks on the VERBUND app based on our legitimate interests.

2.5. Data recipients

We regularly use IT service providers to operate and manage the VERBUND app, who may also have access to personal data on our behalf and in accordance with our instructions in order to provide the commissioned IT services. VERBUND works only with processors who provide sufficient guarantees that appropriate technical and organisational measures are implemented in such a way that processing is carried out in accordance with the requirements of the DSG and the GDPR as amended. The processing performed by a processor is always done on the basis of a contract that binds the processor to the obligations under data protection law. VERBUND uses processors outside the European Union only if an adequacy decision has been taken by the European Commission for the third country concerned or if we have agreed on other appropriate guarantees pursuant to Art. 46 GDPR.

We may also transfer your personal data to the following recipients:

• to external third parties to the extent necessary on the basis of our legitimate interests (e.g. auditors, legal representatives in the event of an incident, etc);
• to regulatory authorities and other public bodies to the extent required by law (e.g. tax authorities, courts, etc.).

Your data will not be disclosed to any other third parties for their own purposes without your consent.

3. Data subject rights

In principle, you have the right to information, rectification, erasure, restriction of processing, data portability, revocation of a granted consent and objection. To exercise these rights, contact us at datenschutz@verbund.com. If you believe that the processing of your data violates data protection law or that your rights under data protection law have otherwise been violated in any way, you can submit a complaint to the national supervisory authority where you live. In Austria, this supervisory authority is the Data Protection Authority.

You can find more information on your rights in the section “Data subjects’ rights” at www.verbund.com/en-at/data-protection.

Last updated: November 2025

It is important for VERBUND to protect your personal data and for us to explain to you how we handle them.

1. Name and contact details of the data controller

Responsible for the processing of your data within the scope of the following data processing is the respective indicated VERBUND group company ("VERBUND", "we", "us"), namely:

VERBUND AG, Am Hof 6a, 1010 Vienna,
VERBUND Hydro Power GmbH, Europaplatz 2, 1150 Vienna,
VERBUND Energy4Business GmbH, Am Hof 6a, 1010 Vienna,
VERBUND Energy4Future GmbH, Am Hof 6a, 1010 Vienna,
VERBUND Energy4Flex GmbH, Am Hof 6a, 1010 Vienna,
VERBUND Digital Power GmbH, Am Hof 6a, 1010 Vienna,
VERBUND Business Solutions GmbH, Am Hof 6a, 1010 Vienna,
VERBUND Green Power GmbH, Am Hof 6a, 1010 Vienna,
VERBUND Green Power Österreich GmbH, Am Hof 6a, 1010 Wien,
VERBUND Tourismus GmbH, Europaplatz 2, 1150 Vienna,
VERBUND Thermal Power GmbH & Co KG, Kraftwerkstraße 1, 8410 Fernitz-Mellach,
VERBUND Wind Power Austria GmbH, Europaplatz 2, 1150 Vienna,
VERBUND Energy4Business Germany GmbH, Luise-Ullrich-Straße 20, 80636 Munich
VERBUND Innkraftwerke GmbH, Werkstraße 1, 84513 Töging am Inn,
VERBUND Green Hydrogen GmbH, Am Hof 6a, 1010 Wien,
VERBUND Green Hydrogen Sales GmbH, Am Hof 6a, 1010 Wien,
VERBUND Ventures GmbH, Am Hof 6a, 1010 Wien,
Grenzkraftwerke GmbH, Münchner Straße 48, 84359 Simbach am Inn,
Donaukraftwerk Jochenstein Aktiengesellschaft, Innstraße 121, 94036 Passau,
Österreichisch-Bayrische Kraftwerke AG, Münchner Straße 48, 84359 Simbach am Inn,
Innwerk AG, Schulstraße 2, 84533 Stammham,
VERBUND Green Power Deutschland GmbH, Energie-Allee 1, 55286 Wörrstadt,
VERBUND Green Power Deutschland Photovoltaik GmbH, Lennéstraße 3, 10785 Berlin,
Infrastruktur Bischheim GmbH & Co. KG, Energie-Allee, 55286 Wörrstadt,
Infrastruktur Oberheimbach I GmbH & Co. KG, Energie-Allee, 55286 Wörrstadt.

The contact details of the data protection officer: datenschutz@verbund.com.

2. Processing in the context of "newsletter/information sent by email"

2.1. What kind of personal data will we process?

If you subscribe to a newsletter of VERBUND or request VERBUND to send information by email, we will process the following data: information about your person such as title, name, email address, as well as information about your company and position and potential additional information provided voluntarily. The provision of these data by you is voluntary. However, if you do not provide the data, it will not be possible to send any newsletters or information to you by email.

2.2. What is our legal basis and purpose for processing personal data?

The legal basis for the processing of data pursuant to point 2.1. is Art. 6(1)(a) GDPR and therefore your voluntary consent to receive the newsletter or information by email. You have the right to withdraw your voluntary consent at any time without giving reason and with effect for the future by, for example, via the link contained in the email or in writing by email without incurring further costs to the respective data controller named in the declaration of consent and to datenschutz@verbund.com.

The personal data listed under point 2.1 will be processed by VERBUND for the respective purpose defined in the voluntary declaration of consent, such as, for example, the purpose to send information about activities, products, offers and services, competitions or events of VERBUND, to send invitations to events organised by VERBUND, and to send VERBUND publications and/or about other VERBUND-related topics, or about surveys on the satisfaction with services and offers of VERBUND.

2.3. Retention period

Your data will be processed for as long as you continue to receive the newsletter/information by email, and for as long as you have not revoked your voluntarily given consent for the purpose in question.

2.4. Data recipients

The data will be forwarded to third parties only where required for the fulfilment of (pre-)contractual or statutory obligations, or where permitted within the scope of your voluntarily granted consent. For example, as required, we will transfer your personal data to the external parties, e.g. auditors, insurers or legal representatives, to the extent necessary. Personal data will be rendered anonymous if possible.

Your personal data may be sent to commissioned service providers for order processing.

3. Processing in the context of "participating in surveys"

3.1. What kind of personal data will we process?

If you participate voluntarily in a survey of VERBUND (online, verbal or in writing), we will process, in particular, the following data: information about your person such as title, name, email address, as well as information about your company and position, IP address (online), and other data or answers/comments voluntarily provided by you within the context of the survey. The provision of these data by you is voluntary. However, if you do not provide these data you will not be able to participate in the survey.

3.2. What is our legal basis and purpose for processing personal data?

The legal basis for the processing of data pursuant to point 3.1. is Art. 6(1)(a) GDPR and therefore your voluntary consent. You have the right to withdraw your voluntary consent at any time without giving reason and with effect for the future by, for example, sending an email without incurring further costs to the data controller named in the declaration of consent or to datenschutz@verbund.com. The personal data listed under point 3.1. will be processed by VERBUND for the purpose of implementing and analysing the information received within the scope of the respective survey.

3.3. Retention period

Your data will be stored for the duration of implementing the survey and beyond that for a period of six months, in order to subsequently process the information provided. If you have given your consent to participate in another survey, your data will be stored until you withdraw your consent.

3.4. Data recipients

The data will be passed to third parties only if you have given us your consent to do so. As required, we will also transmit your personal data to other external parties, e.g. auditors, insurers or legal representatives, to the extent necessary. Personal data will be rendered anonymous if possible. Your personal data may be sent to commissioned service providers (e.g. IT service providers) for order processing.

4. Processing in the context of "competitions"

4.1. Scope of processing personal data

When you take part in competitions, we process the following data: personal details such as your title, name, address and contact details such as your telephone number and/or email address, as well as any other information required for the competition (e.g. photos for social media competitions). The provision of this data by you is voluntary. If you do not provide the mandatory data, participation in the competition is not possible.

4.2. Legal basis and purpose for the processing of personal data

The legal basis for the processing of the mandatory data is Art. 6 (1) lit. b GDPR and therefore the processing for the performance of a contract or pre-contractual measures. The storage and processing of the data is necessary to conduct the competition and to inform you of any winnings.

In addition, we use your personal data for internal marketing purposes to align our marketing strategy. The legal basis for this is our legitimate interests pursuant to Art. 6 (1) lit. f GDPR. The legitimate interest is also the legal basis with regard to the data that is not mandatory and lies in being able to address you in accordance with the information you have provided. If your data is to be published in the event of a win, we will obtain your consent in advance in accordance with Art. 6 (1) lit. a GDPR, unless you have already made the data publicly available yourself (e.g. in a post as part of a social media competition).

4.3. Retention period

We process your personal data for as long as is necessary for holding the competition and will delete them immediately after the end of the competition, unless these data also have to be stored in accordance with statutory retention obligations.

4.4. Data recipients

The data will be forwarded to third parties only where required for the fulfilment of (pre-)contractual or statutory obligations, where justified for the maintenance of our legitimate interests, or where permitted within the scope of your voluntarily granted consent. For example, as required, we will transfer your personal data to the external parties, e.g. auditors, insurers or legal representatives, to the extent necessary. Personal data will be rendered anonymous if possible.

The data may be sent to commissioned service providers (e.g. IT service providers and other service providers for processing the competition) for order processing.

5. Data processing in the context of "Making contact/enquiries"

5.1. What kind of personal data will we process?

When you make contact with VERBUND and request information or make enquiries, the following data provided by you, depending on the matter in question, will be processed (this depends on the chosen manner of making contact (online, email, phone) and the nature of your enquiry): information about your person such as qualification, title, name, address, contact information such as email address, phone number, type of interest or information about your enquiry, and any other data collected or indicated as necessary when making contact/inquiries, depending on the nature of your enquiry. The provision of these data by you is voluntary. If you do not provide these data for the handling of your enquiry, VERBUND will not be able to process your enquiry accordingly.

5.2. What is our legal basis and purpose for processing personal data?

The legal basis for the processing of your personal data mentioned under point 5.1. is our legitimate interest in accordance with Art. 6(1)(f) GDPR. If the reason for the enquiry/making contact is to conclude a contract, the legal basis for the processing is Art. 6(1)(b) GDPR. The personal data listed under point 5.1. will be processed for the purpose of making contact and providing information or handling your inquiry.

5.3. Retention period

We process your data in order to handle your enquiry and beyond that for a period of three months, so that we can respond appropriately to subsequent questions. A longer retention period will be applied only on the basis of statutory retention periods or for defence purposes in any legal disputes.

5.4. Data recipients

The data will be forwarded to third parties only where required for the fulfilment of (pre-)contractual or statutory obligations, or where justified for the maintenance of our legitimate interests. For example, as required, we will transfer your personal data to the external parties, e.g. auditors, insurers or legal representatives, to the extent necessary. Personal data will be rendered anonymous if possible. Your personal data may be sent to commissioned service providers (e.g. IT service providers) for order processing.

6. Data processing “Information transmission (newsletter) and inquiries via VERBUND's WhatsApp info channel”

6.1. Scope of personal data processing

If you use WhatsApp, you also have the option of registering for VERBUND's WhatsApp info channel in order to receive certain information selected by you from VERBUND on a regular basis (newsletter) or to send us inquiries. When you use our WhatsApp information channel, we process your telephone number and profile name as well as any other data specific to your enquiry and the content of your communication. The provision of this data by you is voluntary. However, if you do not provide the data, we will not be able to send you any newsletters or information via our WhatsApp information channel or respond to your enquiry.

6.2. Legal basis and purpose for the processing of personal data

The legal basis for the processing of your personal data under point 6.1. is the voluntary consent pursuant to Art. 6 (1) lit. a GDPR in conjunction with § 174 TKG, which you give by sending the confirmation message in WhatsApp. The personal data listed in section 6.1 will be processed for the purpose of providing information for the purpose specified in the declaration of consent and, if necessary, for processing your request via the VEBRUND WhatsApp information channel. Your voluntary consent can be revoked at any time without giving reasons and with effect for the future by sending the word “STOP” via the WhatsApp information channel. This will unsubscribe you from the WhatsApp information channel and you will no longer receive any further information from us.

6.3. Duration of storage

Your data will be processed for as long as you receive the newsletter via our WhatsApp information channel and will be deleted if you revoke your consent by sending “STOP.” Your inquiries will generally be stored for 24 hours and then automatically deleted. Your data will only be stored for longer if this is necessary to process your request or within the scope of statutory retention periods or to protect our legitimate interests, in particular to defend ourselves in any legal disputes.

6.4. Recipients of data

The data will only be passed on to third parties if this is necessary to fulfill (pre)contractual or legal obligations or if it is justified to protect our legitimate interests. For example, we may transfer your personal data to external third parties, such as auditors, insurers, or legal representatives, to the extent necessary. In such cases, personal data will be anonymized wherever possible. Your personal data may be transferred to contracted service providers (e.g., IT service providers) for order processing.

In addition to WhatsApp Ireland Limited, Merrion Road, Dublin 4, D04 X2K5, Ireland we use the service provider Infobip Ltd., 5th floor 35-38 New Bridge Street, EC4V 6BW London, United Kingdom, for the use of our WhatsApp information channel. This provider provides us with an interface solution (API) that enables us to communicate with you via the WhatsApp information channel. In addition, the service provider is responsible for cloud hosting (meta cloud) of the associated data.

7. Your rights

You have the right to access, correct, delete, restrict, transfer, revoke and object to the data we process about you.

If you believe that the processing of your data violates data protection law or that your data protection rights have been violated in any other way, you can complain to us at datenschutz@verbund.com or to the national supervisory authority of your place of residence. In Austria, the Austrian Data Protection Authority, Barichgasse 40-42, 1030 Vienna, email: dsb.@dsb.gv.at, Tel: +43 1 52 152-0.

Further details on your rights can be found in the ‘Data subject rights’ section at www.verbund.com/datenschutz.

as of July 2025

It is important for VERBUND to protect your personal data and to explain to you how we handle them.

1. Name and contact details of the data controller

Responsible for the processing of your data under this data processing agreement is VERBUND AG, Am Hof 6a, 1010 Vienna, tel.: +43 (0)50313-0, email: information@verbund.com or another VERBUND company ("VERBUND", "we", "us") identified as the organiser, namely

• VERBUND Energy4Customers GmbH, Erdberger Lände 26A, 1030 Wien,
• VERBUND Green Power GmbH, Am Hof 6a, 1010 Wien,
• VERBUND Green Power Österreich GmbH, Am Hof 6a, 1010 Wien,
• VERBUND Energy4Business GmbH, Am Hof 6a, 1010 Wien,
• VERBUND Energy4Future GmbH, Am Hof 6a, 1010 Wien,
• VERBUND Digital Power GmbH, Am Hof 6a, 1010 Wien,
• VERBUND Business Solutions GmbH, Am Hof 6a, 1010 Wien,
• VERBUND Hydro Power GmbH, Europaplatz 2, 1150 Wien,
• VERBUND Wind Power Austria GmbH, Europaplatz 2, 1150 Wien,
• VERBUND Tourismus GmbH, Europaplatz 2, 1150 Wien,
• VERBUND Thermal Power GmbH & Co KG, Kraftwerkstraße 1, 8410 Fernitz-Mellach,
• VERBUND Energy4Business Germany GmbH, Luise-Ullrich-Straße 20, 80636 München,
• VERBUND Green Power Deutschland GmbH, Energie-Allee 1, 55286 Wörrstadt,
• VERBUND Green Power Deutschland Photovoltaik GmbH, Lennéstraße 3, 10785 Berlin,
• VERBUND Ventures GmbH, Am Hof 6a, 1010 Wien,
• VERBUND Green Hydrogen GmbH, Am Hof 6a, 1010 Wien,
• VERBUND Green Hydrogen Sales GmbH, Am Hof 6a, 1010 Wien,
• Grenzkraftwerke GmbH, Münchner Straße 48, 84359 Simbach am Inn,
• Innwerk AG, Schulstraße 2, 84533 Stammham
• and VERBUND Innkraftwerke GmbH, Werkstraße 1, 84513 Töging am Inn.

VERBUND may also hold an event together with another VERBUND company or one or more cooperation partners. In such a case, the organisers listed in the invitation are joint controllers and have concluded a corresponding agreement in accordance with Art. 26 GDPR (‘Joint Controller Agreement’). You have the right to assert your claims against each controller independently of the Joint Controller Agreement.

The contact details of the data protection officer: datenschutz@verbund.com.

2. Data processing in the context of "registration for events"

2.1. What kind of personal data will we process?

If you register for VERBUND events or events held by VERBUND together with one or more organisers, your personal data such as title, name, address, contact details such as telephone number and/or email address, possibly information about your company and your position and other event-related information will be processed. You provide the data on a voluntary basis; however, if you do not provide the data in the fields identified as mandatory, we will not be able to process your registration.

2.2. What is our legal basis and purpose for processing personal data?

The legal basis for processing the mandatory data specified in section 2.1 is Art. 6 (1) (b) GDPR and thus the fulfillment of a contract. The personal data provided during registration will be processed for the purpose of handling and administering the event, including related communication (e.g., sending registration confirmation, reserving seats, answering questions, etc.).

As far as the processing of your voluntarily provided optional data is concerned, we base the processing on our legitimate interest pursuant to Art. 6 (1) (f) GDPR, which primarily lies in being able to interact with you in accordance with your voluntary information. Insofar as the processing of your voluntarily provided sensitive data (e.g., health data such as food intolerances) is concerned, we base this on your voluntary consent within the meaning of Art. 6 lit. a GDPR in conjunction with Art. 9 (2) lit. a GDPR. You can revoke your consent at any time with future effect free of charge by contacting the address specified in the declaration of consent. Revoking your consent does not affect the lawfulness of the processing carried out on the basis of your consent until revocation.

2.3. Retention period

Your data will be stored for as long as is necessary for fulfilment of the purpose, and in addition only for as long as they have to be processed within the scope of statutory retention obligations. If you have given your consent to the processing of certain data, we will delete your data earlier if you revoke your consent.

2.4. Data recipients

At a joint event, the data is shared between the joint controllers who hold the event. The data is only passed on to other third parties if this is necessary to fulfil (pre)contractual or legal obligations, is justified to protect our legitimate interests or is permitted within the scope of a granted consent (e.g. to the controller of an external event location). The data may be transferred to contracted service providers for order processing (responsible for organising and running the event). Our contract processors include, in particular, IT service providers and other providers of tools and software solutions that also support us in providing our services and work on our behalf (e.g. service providers for the purpose of event management).

3. Data processing in the context of "Image recordings (photos/videos)"

3.1. What kind of personal data will we process?

If images are taken at events, these will be stored and used for subsequent reporting (e.g. social media, website of the person(s) responsible, etc.).

3.2. What is our legal basis and purpose for processing personal data?

The legal basis is Art. 6(1)(f) GDPR and thus the legitimate interest of VERBUND and also of the joint organiser(s). Image recordings are processed and stored in the VERBUND archive for the purpose of documenting and presenting events, activities and occurrences that are related to the work and/or the tasks of VERBUND. Furthermore, the image recordings are processed for internal purposes and for the purpose of VERBUND's public and press relations work, and may be made available to participants and to all joint controllers for the above-mentioned purposes and published in printed and electronic media, in particular on social media platforms (Facebook, YouTube, etc.). If we are unable to base the use of the images on legitimate interests, we will obtain separate consent from you for the processing in accordance with Article 6(1)(a) of the GDPR. You can revoke your voluntarily granted consent at any time with effect for the future, e.g. by sending an e-mail to datenschutz@verbund.com.

3.3. Retention period

The images will be stored for as long as the documentation purpose exists and no objection to this processing is made. In addition, we store your data for as long as we are obliged to do so under the statutory retention requirements. If the processing is based on your voluntary consent, we store the data until you revoke it.

3.4. Data recipients

At a joint event, photos are taken in the common interest and used by all joint controllers for the purposes described, who hold the event. The images will only be passed on to third parties if this is justified in order to protect our legitimate interests and is also permissible within the scope of the processing purpose. The images may be transmitted to contracted service providers for order processing.

4. Data processing after the end of the event

If an event is held by joint controllers, the processing of the data required for this is carried out as described above in joint responsibility. Any data processing that takes place after the end of the event and is no longer related to the event (e.g. advertising mailings or similar) is carried out in the sole responsibility of the respective company. In this regard, please note the corresponding data protection information from VERBUND or the respective cooperation partner.

5. Data processing “Podcasts”

5.1. Scope of personal data processing

If you have agreed to VERBUND recording a podcast on a specific topic, the conversations conducted with you as an interview partner together with VERBUND or a third party commissioned by VERBUND will be recorded as audio and/or video podcasts, edited, and, after your approval, stored as files on the Podigee hosting platform so that they can subsequently be played or published on various electronic media or platforms (e.g., YouTube, Spotify, etc.).

If you are a user of such media and access a VERBUND podcast, we refer you to the data protection information applicable to you for these media with regard to data processing.

5.2. Legal basis and purpose for the processing of personal data

The legal basis for the processing is Art. 6 (1) lit. f GDPR and thus the legitimate interest of VERBUND, which lies in communicating or presenting a topic relating to VERBUND to the outside world (VERBUND product, project, event, etc.). The podcast is published internally, but also in external electronic media (Spotify, YouTube, etc.), primarily for the purpose of public relations and marketing.

5.3. Duration of storage

The podcast will be stored and published for as long as the public purpose exists and no objection to this processing is raised.

5.4. Recipients of data

If service providers are used for this processing, corresponding data processing agreements will be concluded with them. Our data processors include, in particular, IT service providers, production companies, and other service providers who also support us in providing our services and act on our behalf and according to our instructions. Podcasts will only be passed on to third parties if this is justified to protect our legitimate interests and is also permissible within the scope of the processing purpose (see 5.1. and 5.2.).

6. Your rights

You have the right to information, correction, deletion, restriction, data portability, revocation and objection with regard to your data processed by us. If you believe that the processing of your data violates data protection law or your data protection rights have otherwise been violated in any way, you can complain to us at datenschutz@verbund.com or to the national supervisory authority at your place of residence. In Austria, the data protection authority is responsible.

You can find more details about your rights in the section ‘Data subjects' Rights’ at www.verbund.com/datenschutz.

You can assert your rights against any of the controllers at an event held by several controllers.

as of September 2025

It is important for VERBUND to protect your personal data and to explain to you how we handle them.
You can submit your application for a position at VERBUND AG or one of the group companies via the application tool available on the website at www.verbund.com and input the application data directly via the web interface. VERBUND AG is familiar with the management of human resources for VERBUND companies and therefore organises the application process and the application tool centrally for these VERBUND companies.

1. Name and contact details of the data controller

The data controller responsible for processing your data within the scope of this data processing is VERBUND AG, Am Hof 6a, 1010 Vienna together with, in the sense Art. 26 GDPR, the respective VERBUND company, if you have applied to one of them in particular. VERBUND AG has concluded an agreement with the respective data controller pursuant to Art. 26 GDPR ("Joint Controller Agreement"), which regulates the distribution of tasks and obligations under data protection law. You have the right to assert your claims to the data controller, regardless of the Joint Controller Agreement.

The VERBUND companies include the following:
Electriply GmbH, Gewerbepark 19, 4101 Feldkirchen an der Donau
Grenzkraftwerke GmbH, Münchner Straße 48, 84359 Simbach am Inn
Innwerk AG, Schulstraße 2, 84533 Stammham
LESTIN Tauch- und Bergungsunternehmen GmbH, Nikolsdorfer Gasse 31 ,1050 Wien
smart Energy Personal GmbH, Dietrichgasse 27/3.OG, 1030 Wien
VERBUND Business Solutions GmbH, Am Hof 6a, 1010 Wien
VERBUND Digital Power GmbH, Am Hof 6a, 1010 Wien
VERBUND Energy4Business GmbH, Am Hof 6a, 1010 Wien
VERBUND Energy4Business Germany GmbH, Luise-Ullrich-Straße 20, 80636 München
VERBUND Energy4Customers GmbH, Erdberger Lände 26A 1030 Wien
VERBUND Engineers4Energy GmbH, Gewerbepark 19, 4101 Feldkirchen an der Donau
VERBUND Green Hydrogen GmbH, Am Hof 6a, 1010 Wien
VERBUND Green Power GmbH, Am Hof 6a, 1010 Wien
VERBUND Green Power Deutschland GmbH, Energie-Allee 1, 55286 Wörrstadt
VERBUND Green Power Deutschland Photovoltaik GmbH, Lennéstraße 3 ,10785 Berlin
VERBUND Green Power Italia S.R.L., Corsa di Porta Romana 23, 20122 Milano
VERBUND Hydro Power GmbH, Europaplatz 2, 1150 Wien
VERBUND Innkraftwerke GmbH, Werkstraße 1, 84513 Töging am Inn
VERBUND Thermal Power GmbH & Co KG, Kraftwerkstraße 1, 8410 Fernitz-Mellach
VERBUND Tourismus GmbH, Europaplatz 2, 1150 Wien

Email: office.hpr@verbund.com

The contact details of the data protection officer: datenschutz@verbund.com.

2. What kind of personal data will we process?

If you apply to VERBUND, we will process the following personal data (mandatory fields):

• Information about your person, such as first name, last name, date of birth, citizenship
• Your contact details, such as email address and telephone number – if you are a minor, please also provide the telephone number of a parent or guardian.
• Information about your desired gross annual salary, earliest possible start date, 
• details of your education/school qualifications and
• Your CV and, if specified as a separate field, your application video.

Should you not provide the data in the fields marked as mandatory, we will not be able to process your application, as certain details about you are required in order to assess your suitability for the position.

In addition, VERBUND also processes the following personal data that you voluntarily provide and that is not marked as mandatory:

• Salutation and title
• Address and country of residence
• Information about how you found out about the position
• Documents that you voluntarily provide and the data contained therein

We would like to point out that you will not be asked to provide us with special categories of personal data within the meaning of Art. 9 GDPR (e.g. health data, religious affiliation) as part of the online application. However, if you disclose such information or if it is apparent from the documents you upload, we will not take it into account. Such data will be deleted or blacked out by us immediately.

3. Legal basis and purpose of the data processing

The legal basis for the processing of applicant data is Art. 6(1)(b) GDPR and therefore the processing for the fulfilment of a contract or the performance of pre-contractual measures. By submitting an application, you are asking us to process your applicant data within the scope of the application, which requires the data processing described.

The legal basis for processing your information about how you became aware of the advertised position is our legitimate interest pursuant to Art. 6 (1) lit. f GDPR. This interest lies in being able to better understand the reach and effectiveness of our job advertisements and improve our internal application management processes. The legal basis for processing your application video is our legitimate interest pursuant to Art. 6(1)(f) GDPR. This interest consists of being able to better assess your suitability for our job advertisement in terms of your personality, communication skills and motivation.

Insofar as the processing also concerns data provided voluntarily, we base the processing on our legitimate interest pursuant to Art. 6 (1) lit. f GDPR. This legitimate interest lies in the well-founded selection of suitable applicants and in filling vacant positions. This includes, in particular, the possibility of taking into account qualifications, experience and place of residence or country of residence with regard to the intended place of work or legal framework conditions.
We process the title you provide in particular for the purpose of pursuing our goal of sustainably increasing the proportion of women in the company in order to promote a balanced gender ratio among our employees.

In addition, we may process your personal data on the basis of the (pre)contractual relationship pursuant to Art. 6 (1) lit. b GDPR or on the basis of our legitimate interest pursuant to Art. 6 (1) lit. f GDPR, insofar as this is necessary for the assertion, exercise or defence of legal claims.

• by letter (VERBUND AG, Am Hof 6a, 1010 Vienna),
• Email (office.hpr@verbund.at).

Even if you withdraw your consent, the lawfulness of processing operations carried out until you have withdrawn your consent shall not be affected.

4. Retention period

Your personal data will be stored for the duration of the application process and beyond, in any case for a period of seven months after completion of your application process.

If an employment relationship is established, we will store your data for the duration of your employment and delete it after termination of your employment in accordance with the statutory retention obligations.

If you consent to your application being kept on file for future job vacancies, we will store your data for a period of one year from the date of your consent. If you have given your consent to the processing of certain data, we will delete your data earlier if you revoke your consent.

In addition, we will also store your personal data beyond the aforementioned periods if necessary, as long as legal claims arising from the relationship between you and us can be asserted, in accordance with the applicable statutory limitation periods (in Austria pursuant to Section 1478 et seq. of the Austrian Civil Code (ABGB)) or until the final clarification of a specific incident or legal dispute. This longer storage period is necessary to safeguard our legitimate interests in asserting, clarifying and defending legal claims. Furthermore, we are obliged to retain business-related books and records for the duration of the statutory retention periods (currently seven years in Austria pursuant to Section 132 of the Austrian Federal Tax Code (BAO)).

5. Data recipients

Your data may be forwarded to the following recipients:

• commissioned service providers for order processing ("processor")
• (group) companies as joint data controllers (within the scope of (pre-contractual) contract fulfilment) or in accordance with granted consent
• to external third parties to the extent required by our legitimate interest (e.g. legal representatives as the occasion requires)
• courts, authorities and public bodies.

VERBUND works only with processors who provide sufficient guarantees that appropriate technical and organisational measures are implemented in such a way that the processing is carried out in accordance with the requirements of the applicable national data protection laws and the General Data Protection Regulation ("GDPR") as amended. The processing performed by a processor is always done on the basis of a contract that binds the processor to the obligations under data protection law. VERBUND uses processors outside the European Union only if an adequacy decision has been taken by the European Commission for the third country concerned or if appropriate data protection guarantees are available (e.g. binding internal data protection regulations or EU standard contract clauses).

6. Your rights

In principle, you have the right to information, correction, erasure, restriction, data portability, revocation of a granted consent and objection in respect of your data processed by VERBUND. To exercise these rights, please contact VERBUND at datenschutz@verbund.com. If you believe that the processing of your data violates data protection law or your data protection claims have otherwise been violated in any way, you can submit a complaint to the national supervisory authority where you live. In Austria, this supervisory authority is the Data Protection Authority.

You can find further details on your rights in the section "Data subjects' rights" at www.verbund.com/en-at/data-protection.

Correct as of July 2025

It is important for VERBUND to protect your personal data. We therefore comply with the applicable legal regulations for the protection, lawful handling and secrecy of personal data, as well as data security, in particular the General Data Protection Regulation ("GDPR”) and national data protection laws. The following information describes which personal data we will process if necessary when you visit an area under video or drone surveillance by VERBUND. The data controller for the respective area is directly named on the information board.

1. Name and address of the Data Controller

Responsible for processing your personal data in accordance with the data protection provisions is, depending on the area (location) under video surveillance or flown over by a drone:
 
VERBUND AG
Am Hof 6a
A-1010 Vienna

VERBUND Hydro Power GmbH
Europaplatz 2
A-1150 Vienna

VERBUND Green Power GmbH
Am Hof 6a
A-1010 Vienna

VERBUND Green Power Österreich GmbH
Am Hof 6a
A-1010 Vienna

VERBUND Thermal Power GmbH & Co KG
Kraftwerkstraße 1
A-8410 Fernitz-Mellach

VERBUND Tourismus GmbH
Europaplatz 2
A-1150 Vienna

VERBUND Digital Power GmbH
Am Hof 6a
A-1010 Wien

VERBUND Business Solutions GmbH
Am Hof 6a
A-1010 Wien

Innwerk AG
Schulstraße 2
D-84533 Stammham

Österreichisch-Bayerische Kraftwerke AG
Münchner Straße 48
D-84359 Simbach am Inn

Donaukraftwerk Jochenstein AG
Innstraße 121
D-94036 Passau

VERBUND Innkraftwerke GmbH
Werkstraße 1
D-84513 Töging am Inn

VERBUND Energy4Business Germany GmbH
Luise-Ullrich-Straße 20
D-80836 Munich

Contact details of the data protection officer: datenschutz@verbund.com.

2. Processing in the context of "video surveillance"

2.1. What kind of personal data will we process?

As part of the video surveillance activities, we process the following personal data:

• Image data of the from the data subject(s),
• Place in which the image was taken,
• Time at which the image was taken,
• Identity of the data subject(s), where recognisable from the recording,
• Role of the data subject(s) (e.g. perpetrator, victim, witness), where recognisable from the recording. 

2.2. What is our legal basis for processing personal data?

We process your personal data on the basis of our legitimate interests pursuant to Art. 6(1)(f) GDPR for the protection of property, to increase the safety of staff, visitors and customers, as well as to prevent, limit and investigate criminal offences (e.g. property damage, vandalism, break-in), as well as to protect domiciliary rights and to fulfil statutory due diligence including the preservation of evidence.

2.3. Purpose of the data processing

We process your personal data in connection with the video surveillance for the following purposes:

• to protect property and buildings,
• to fulfil our statutory due diligence obligations,
• to prevent, limit and clear up criminal conduct,
• to fulfil conditions imposed by the authorities for operating facilities and power plants.

2.4. Retention period

To the extent they do not involve live transmissions, your data will be stored for a maximum of 72 hours and then automatically erased, unless proceedings are initiated that necessitate a longer retention period. In such an event, the data will be stored for the duration of the proceedings and then erased.

2.5. Data recipients

A small number of selected employees of the respective data controller have access to the video surveillance recordings, as do the companies instructed with carrying out the video surveillance. To this end, the respective data controller has concluded with the respective company a processing agreement pursuant to Art. 28 GDPR for ensuring data protection.
Access takes place solely for the purpose of investigating criminal offences or for fulfilling statutory or official obligations. If there is suspicion of a crime, your personal data may, in the event of the initiation of proceedings, be forwarded to:

• Responsible authorities or courts (for the preservation of evidence in criminal cases),
• Security agencies (for security agency purposes),
• Courts (for the preservation of evidence in civil cases),
• Employees, witnesses, victims (within the scope of claim enforcement),
• Insurance companies (exclusively for the processing of insurance claims),
• Lawyers, courts, authorities and other bodies for the purposes of law enforcement.

Beyond that, your personal data will not be forwarded to recipients who intend to pursue their own purposes with these data.

3.  Processing in the context of “drone recordings”

3.1. What kind of personal data will we process?

Please note that the facilities of the respective data controller, in particular hydropower plants, thermal facilities, wind turbines, PV systems, dam walls, surrounding land and avalanche areas, are flown over by drones to make live recordings and image recordings (photos and videos). In some instances, drone flights and thus image recordings may be made in the facilities themselves. The drones are manually or automatically operated.

In the case of such drone flights over the facilities, it cannot be ruled out that houses, vehicles or persons on adjacent sites or plots of land will be recorded and are thus identifiable. Where technically feasible, drones will be used that pixelate all persons and vehicle registration plates during the recording by means of a special algorithm. This renders persons and vehicle registration plates anonymous (cannot be identified or recognised). Should it not be possible to use such drones for technical reasons, image recordings of identifiable persons and vehicle registration plates will be subsequently pixelated to render such images anonymous.

During image recording flights made by drones, the following personal data may therefore be collected:

• Image data of person(s),
• Identity of the data subject(s), where recognisable from the recording,
• Role of the data subject(s) (e.g. passer-by), where recognisable from the recording,
• Time at which the image was taken,
• Vehicle registration plate,
• Place in which the image was taken.

It is also noted that, in addition to image recordings via drones, surveying work may also include surveying data such as site photos, coordinates and property and owner-related data (which the data controller already has or has collected via the publicly accessible land register) as well as other publicly available GIS data (e.g. “INSPIRE Österreich”).

3.2. What is our legal basis for processing personal data?

The image recordings and anonymisation by means of pixelation are carried out on the basis of our legitimate interests pursuant to Art. 6(1)(f) GDPR for the purposes listed below.

3.3. Purpose of the data processing

The drones are used for planning, controlling, security, maintenance, surveying or other documentary purposes (e.g. for condition inspections, preservation of evidence, creation of surveying, planning or permission documents). The image recordings made are analysed for the purposes listed above and in some cases analysed using AI to detect any hazards or required repairs. Drones can be used in addition to video surveillance as a form of property protection by overflying the respective facility site along preprogrammed flight routes. Persons who access the facility without authorisation will be recorded by drone.

Furthermore, drones are used to make image recordings of the facilities of a data controller for advertising purposes, in order to publish them at a later date in print and/or online media of VERBUND. Recordings of persons and vehicle registration plates will be used either in pixelated form or not at all. 
Image recordings by drone are also made for the purposes of creating 3D power plant tours, so that these can be shown at certain VERBUND locations for tourist or internal purposes using 3D glasses. Recordings of persons and vehicle registration plates will be used either in pixelated form or not at all.

3.4. Retention period
We pixelate image recordings of persons and vehicle registration plates immediately after the recording where pixelation is not already technically possible beforehand. Image recordings containing identifiable persons and vehicle registration plates are therefore stored solely for the purpose of protecting properties. In this case, the image recordings will be stored for a maximum of 72 hours and then automatically erased, unless proceedings are initiated that necessitate a longer retention period. In such an event, the data will be stored for the duration of the proceedings and then erased.

3.5. Data recipients

A small number of selected employees of the respective data controller have access to the live and stored recordings of the drone, as do the companies instructed with carrying out the drone flights. To this end, the respective data controller has concluded with the respective company a processing agreement pursuant to Art. 28 GDPR for ensuring data protection.

Identifiable persons and vehicle registration plates will, except in the case of property protection, be pixelated or removed from the image recordings and not forwarded to any other parties.

Access to the image recordings regarding the data for the purpose of property protection takes place solely for the purpose of investigating criminal offences. If there is suspicion of a crime, the image recordings including any identifiable persons may, in the event of the initiation of proceedings as indicated under 2.5, be forwarded to the relevant authorities.
Beyond that, personal data will not be forwarded to recipients who intend to pursue their own purposes with these data.

4. Processing in the context of “time-lapse videos”

4.1. What kind of personal data will we process?

Within the scope of the video recordings for time-lapse videos, we collect the following personal data by video systems installed on the premises of the respective data controller:

• Image data of person(s),
• Vehicle registration plate,
• Place in which the image was taken,
• Time at which the image was taken,
• Identity of the data subject(s), where recognisable from the recording.

Where technically feasible, video systems will be used that pixelate all persons and vehicle registration plates and plots of land adjacent to the facilities during the recording by means of a special algorithm. This renders these anonymous (cannot be identified or recognised). Should it not be possible to use such video systems for technical reasons, recordings of identifiable persons and vehicle registration plates will be subsequently pixelated to render such images anonymous.

4.2. What is our legal basis for processing personal data?

The video recordings and anonymisation by means of pixelation are carried out on the basis of our legitimate interests pursuant to Art. 6(1)(f) GDPR for the purposes listed above.

4.3. Purposes for which we process data

We process your personal data to create time-lapse videos that document construction progress, as well as for the promotional presentation of our construction projects and the progress of construction work.

4.4. Retention period

We pixelate video recordings of persons, vehicle registration plates and plots of land adjacent to the facilities immediately after the recording where pixelation is not already technically possible beforehand. The unpixelated video recordings are erased after being rendered anonymous; video recordings containing identifiable persons are not stored.

4.5. Data recipients

A small number of selected employees of the respective data controller have access to the video surveillance recordings, as do the companies instructed with make the time-lapse videos. To this end, the respective data controller has concluded with the respective company a processing agreement pursuant to Art. 28 GDPR for ensuring data protection.

Data will only be transmitted to lawyers, courts, authorities and other public bodies to the extent required by law and to insurance companies in the event of an insurance claim in order to fulfil legal or official obligations.

Beyond that, your personal data will not be forwarded to recipients who intend to pursue their own purposes with these data.

5. Rights of the data subject

In principle, you have the right to information, correction, erasure, restriction, data portability, revocation of a granted consent and objection in respect of your data processed by us. To exercise these rights, please write to us at datenschutz@verbund.com. If you believe that the processing of your data violates data protection law or your data protection claims have otherwise been violated in any way, you can submit a complaint to the national supervisory authority where you live. In Austria, this supervisory authority is the Data Protection Authority.

You can find further details on your rights in the section "Data subjects' rights" at  www.verbund.com/en-at/data-protection.

Updated: February 2025

It is important for VERBUND Hydro Power GmbH to protect your personal data and to explain to you how we handle them.

1. Name and address of the data controller

Responsible for processing your data is VERBUND Hydro Power GmbH, Europaplatz 2, 1150 Vienna, ("VERBUND", "we", "us").

The contact details of the data protection officer: datenschutz@verbund.com.

2. Processing in the context of "taking minutes of meeting"

2.1. Scope of the processing of personal data
During communication via certain, clearly defined telephone numbers at VERBUND, the following personal data are processed: name, telephone number, contents of telephone calls.

2.2. What is our legal basis and purpose for processing personal data?
The legal basis for the processing of the data and recording the meeting mentioned under point 2.1. is (i) Art. 6(1)(b) GDPR provided that we have a contractual relationship with you and have declared this to be part of the contract or have agreed to perform the contract by telephone or (ii) our legitimate interest pursuant to Art. 6(1)(f) GDPR. The recording of telephone calls relating to disaster control, disruptions, contract processing and service, which is in our interest, serves not only to preserve evidence (especially in the case of disaster reports) but in particular also to ensure the quality of sensitive processes and the necessary communication chains (cf. in particular the standard required by DIN EN 50518-2 or ÖVE/ÖNORM EN 50518-2). In this way, we can better understand (i) when we received which notification, (ii) what information we received, (iii) which steps we took on this basis and in which timeframe, and (iv) what was agreed. In this way, we can ensure for the long term that we ask you the right questions and provide you with sufficient support and information – whether in an emergency, in the professional handling of joint contractual relationships, or in service.

2.3. Retention period
Your personal data will (i), if they represent contractual content, and depending on the legal situation, be stored for seven years (Austria: Art. 132 Federal Tax Code (BAO) and Art. 212 Corporate Code (UGB)) or ten years (Germany: Art. 238 in conjunction with Art. 257 (1) (4) Commercial Code (HGB) and Art. 14b VAT Act (UStG)), or (ii) in all other cases for a maximum of three years as evidence in the event of claims for damages (see Art. 1489 General Civil Code (ABGB) and Arts. 195 et seq. Civil Code (BGB)). If necessary, your data will be stored only for as long as court or administrative proceedings are pending, which may require a longer retention period. In such an event, the data will be stored for the duration of the proceedings and then erased.

2.4. Data recipients
The data will never be passed to third parties. If courts or authorities demand disclosure in pending proceedings, the data will be disclosed only if they can provide proof of a sufficient legal basis.

3. Your rights

In principle, you have the right to information, correction, erasure, restriction, data portability, revocation of a granted consent and objection in respect of your data processed by us. To exercise these rights, please write to us at datenschutz@verbund.com. If you believe that the processing of your data violates data protection law or your data protection claims have otherwise been violated in any way, you can submit a complaint to the national supervisory authority where you live.

You can find further details on your rights in the section "Data subjects' rights" at www.verbund.com/en-at/data-protection.

Correct as of May 2019

It is important for VERBUND Innkraftwerke GmbH to protect your personal data and to explain to you how we handle them.

1. Name and address of the data controller

Responsible for processing your data is VERBUND Innkraftwerke GmbH, D-84513 Töging am Inn, Werkstraße 1, ("VERBUND", "we", "us").

The contact details of the data protection officer: datenschutz@verbund.com.

2. Processing in the context of "taking minutes of meeting"

2.1. What kind of personal data will we process?
During communication via certain, clearly defined telephone numbers at VERBUND, the following personal data are processed: name, telephone number, contents of telephone calls.

2.2. What is our legal basis and purpose for processing personal data?
The legal basis for the processing of the data and recording the meeting mentioned under point 2.1. is (i) Art. 6(1)(b) GDPR provided that we have a contractual relationship with you and have declared this to be part of the contract or have agreed to perform the contract by telephone or (ii) our legitimate interest pursuant to Art. 6(1)(f) GDPR. The recording of telephone calls relating to disaster control, disruptions, contract processing and service, which is in our interest, serves not only to preserve evidence (especially in the case of disaster reports) but in particular also to ensure the quality of sensitive processes and the necessary communication chains (cf. in particular the standard required by DIN EN 50518-2 or ÖVE/ÖNORM EN 50518-2). In this way, we can better understand (i) when we received which notification, (ii) what information we received, (iii) which steps we took on this basis and in which timeframe, and (iv) what was agreed. In this way, we can ensure for the long term that we ask you the right questions and provide you with sufficient support and information – whether in an emergency, in the professional handling of joint contractual relationships, or in service.

2.3. Retention period
Your personal data will (i), if they represent contractual content, and depending on the legal situation, be stored for seven years (Austria: Art. 132 Federal Tax Code (BAO) and Art. 212 Corporate Code (UGB)) or ten years (Germany: Art. 238 in conjunction with Art. 257 (1) (4) Commercial Code (HGB) and Art. 14b VAT Act (UStG)), or (ii) in all other cases for a maximum of three years as evidence in the event of claims for damages (see Art. 1489 General Civil Code (ABGB) and Arts. 195 et seq. Civil Code (BGB)). If necessary, your data will be stored only for as long as court or administrative proceedings are pending, which may require a longer retention period. In such an event, the data will be stored for the duration of the proceedings and then erased.

2.4. Data recipients
The data will never be passed to third parties. If courts or authorities demand disclosure in pending proceedings, the data will be disclosed only if they can provide proof of a sufficient legal basis.

3. Your rights

In principle, you have the right to information, correction, erasure, restriction, data portability, revocation of a granted consent and objection in respect of your data processed by us. To exercise these rights, please write to us at datenschutz@verbund.com. If you believe that the processing of your data violates data protection law or your data protection claims have otherwise been violated in any way, you can submit a complaint to the national supervisory authority where you live. 

You can find further details on your rights in the section "Data subjects' rights" at www.verbund.com/en-at/data-protection.

Correct as of May 2019

It is important for Grenzkraftwerke GmbH to protect your personal data and to explain to you how we handle them.

1. Name and address of the data controller

Responsible for processing your data is Grenzkraftwerke GmbH, D-84359 Simbach am Inn, Münchner Strasse 48, ("VERBUND", "we", "us").

The contact details of the data protection officer: datenschutz@verbund.com.

2. Processing in the context of "taking minutes of meeting"

2.1. What kind of personal data will we process?
During communication via certain, clearly defined telephone numbers at VERBUND, the following personal data are processed: name, telephone number, contents of telephone calls.

2.2. What is our legal basis and purpose for processing personal data?
The legal basis for the processing of the data and recording the meeting mentioned under point 2.1. is (i) Art. 6(1)(b) GDPR provided that we have a contractual relationship with you and have declared this to be part of the contract or have agreed to perform the contract by telephone or (ii) our legitimate interest pursuant to Art. 6(1)(f) GDPR. The recording of telephone calls relating to disaster control, disruptions, contract processing and service, which is in our interest, serves not only to preserve evidence (especially in the case of disaster reports) but in particular also to ensure the quality of sensitive processes and the necessary communication chains (cf. in particular the standard required by DIN EN 50518-2 or ÖVE/ÖNORM EN 50518-2). In this way, we can better understand (i) when we received which notification, (ii) what information we received, (iii) which steps we took on this basis and in which timeframe, and (iv) what was agreed. In this way, we can ensure for the long term that we ask you the right questions and provide you with sufficient support and information – whether in an emergency, in the professional handling of joint contractual relationships, or in service.

2.3. Retention period
Your personal data will (i), if they represent contractual content, and depending on the legal situation, be stored for seven years (Austria: Art. 132 Federal Tax Code (BAO) and Art. 212 Corporate Code (UGB)) or ten years (Germany: Art. 238 in conjunction with Art. 257 (1) (4) Commercial Code (HGB) and Art. 14b VAT Act (UStG)), or (ii) in all other cases for a maximum of three years as evidence in the event of claims for damages (see Art. 1489 General Civil Code (ABGB) and Arts. 195 et seq. Civil Code (BGB)). If necessary, your data will be stored only for as long as court or administrative proceedings are pending, which may require a longer retention period. In such an event, the data will be stored for the duration of the proceedings and then erased.

2.4. Data recipients
The data will never be passed to third parties. If courts or authorities demand disclosure in pending proceedings, the data will be disclosed only if they can provide proof of a sufficient legal basis.

3. Your rights

In principle, you have the right to information, correction, erasure, restriction, data portability, revocation of a granted consent and objection in respect of your data processed by us. To exercise these rights, please write to us at datenschutz@verbund.com. If you believe that the processing of your data violates data protection law or your data protection claims have otherwise been violated in any way, you can submit a complaint to the national supervisory authority where you live.

You can find further details on your rights in the section "Data subjects' rights" at www.verbund.com/en-at/data-protection.

Correct as of May 2019

VERBUND is the respective VERBUND group company indicated as the data controller ("VERBUND", "we", "us").

1.   Right to information

You have the right to obtain information from VERBUND on all your data processed by VERBUND. You have the right to obtain information as to whether your personal data will be transferred to a third state or to an international organisation. In this regard, you may request information on whether we have provided appropriate safeguards pursuant to Article 46 GDPR in connection with the transfer of your data.

2.   Right to rectification and right to restriction of processing

You have the right to obtain the rectification of inaccurate data and the right to have incomplete data completed. Under certain circumstances, for example if the accuracy of data is contested, you have the right to obtain the restriction of processing; in this event, data may only be processed with your consent or for the establishment, exercise or defence of legal claims or for the protection of the rights of another natural or legal person or for reasons of important public interest.

3.   Right to data portability

You have the right to request that VERBUND transmit to you or to a third party nominated by you, where technically feasible, a copy of your data in a structured, commonly used and machine readable format. Moreover, you have the right to transmit this data to another data controller without any obstruction from the data controller to whom the personal data have been given, if
(1) the processing is based on consent pursuant to Article 6(1)(a) or Article 9(2)(a) or on a contract pursuant to Article 6(1)(b) GDPR; and
(2) the processing is carried out by automated means.

In exercising this right to data portability, you also have the right to have the personal data transmitted directly from one controller to another, where technically feasible. This action must not affect the freedoms and rights of other persons.

4.   Right to erasure

You have the right to obtain erasure of data under certain circumstances, such as if the data have not been processed in accordance with data protection requirements. 
If you have exercised the right to rectification, erasure or restriction of processing vis-à-vis VERBUND, we are obliged to communicate any rectification or erasure of data or restriction of processing to each recipient to whom the personal data have been disclosed, unless this proves impossible or involves disproportionate effort.

5.   Right to object

You have the right to object at any time, on grounds relating to your particular situation, to the processing of your personal data, which is based on Art. 6(1)(e) or (f) GDPR.

In this case, VERBUND will no longer process your personal data, unless we can demonstrate compelling legitimate grounds for the processing which override your interests, rights and freedoms or for the establishment, exercise or defence of legal claims.

6.   Right to withdraw consent

You have right to withdraw your consent at any time without giving reason and with effect for the future by, for example, letter, email or telephone to the VERBUND company indicated as the data controller and without further costs.

The contact details of the data protection officer: datenschutz@verbund.com.

Even if you withdraw your consent, the lawfulness of processing operations carried out until you have withdrawn your consent shall not be affected.

7.   Right to lodge a complaint with the supervisory authority

Notwithstanding any other remedies, if you feel that your personal data were unlawfully processed, you may lodge a complaint with the national supervisory authority in your place of residence. Responsible in Austria, the Data Protection Authority (Datenschutzbehörde (DSB, Barichgasse 40-42, 1030 Vienna [www.dsb.gv.at]) and in Bavaria the Data Protection Authority for the State of Bavaria (Bayerische Landesamt für Datenschutzaufsicht (BayLDA, Promenade 18, 91522 Ansbach [www.lda.bayern.de]).

8.    Identification of the individual

Kindly submit your request by clearly identifying yourself and briefly describing the scope of how you intend to exercise your data subjects' rights as listed above, so that we can process your request relating to your above-mentioned rights and to ensure that personal data is not disclosed to unauthorised third parties.

November 2022