1. Name and address of the controller
The controller for the processing of your personal data according to the data protection laws is:
VERBUND AG
Am Hof 6a
1010 Vienna
The contact details of the Data Protection Officer are as follows:
Email: datenschutz@verbund.com
2. Processing in the context of the "website"
2.1. What kind of personal data will we process?
We automatically collect the following personal data when you visit our website:
- date and time when you visit a page on our website
- data of your terminal device (device-ID)
- IP address
- name and version of your browser
- session ID.
Please see our cookie policy in section 3 for information about the cookies we use when you visit our website.
2.2. What is our legal basis for the processing of personal data?
We process data when you visit our website based on our legitimate interest according to Art. 6 (1) (f) GDPR, which consists of making our website user friendly and protecting it against attacks.
2.3. Purposes for which we process data
We process your data when you visit our website for the following purposes:
- to make our website and its functionality available to you and to further improve and develop this website;
- to create usage statistics;
- to detect, prevent and investigate attacks on our website;
- to display personalised products and pages.
2.4. Retention periods
We will basically retain your data we have collected when you visit the website for a period of three months. We store data longer only if this is necessary to investigate detected attacks on our website and, furthermore, until the expiry of relevant limitation periods, legal retention periods, or until disputes, if any, have been resolved.
2.5. Data recipients
In order to operate and administer the website, we regularly use IT service providers which, in accordance with our order and instructions, may under certain circumstances also have access to personal data in order to be able to render the commissioned IT services.
We will also transfer your personal data to the following recipients:
- to external third parties to the extent required by our legitimate interest (e.g. auditors, insurance companies in the event of an insured event, legal representatives as the occasion requires, etc.);
- to authorities and other public bodies to the extent required by law (e.g. financial authorities, courts, etc.).
Your data will not be passed to any other third parties for their own purposes without your consent.
3. Rights of the data subject
3.1. Right to information
You have the right to obtain information from us on all your data processed by VERBUND. You have the right to obtain information as to whether your personal data will be transferred to a third state or to an international organisation. In this regard, you may request information on whether we have provided appropriate safeguards pursuant to Article 46 GDPR in connection with the transfer of your data.
3.2. Right to rectification and right to restriction of processing
You have the right to obtain the rectification of inaccurate data and the right to have incomplete data completed. Under certain circumstances, for example if the accuracy of data is contested, you have the right to obtain the restriction of processing; in this event, data may only be processed with your consent or for the establishment, exercise or defence of legal claims or for the protection of the rights of another natural or legal person or for reasons of important public interest.
3.3. Right to data portability
You have the right to request that VERBUND transmit to you or to a third party nominated by you, where technically feasible, a copy of your data in a structured, commonly used and machine readable format. Moreover, you have the right to transmit this data to another data controller without any obstruction from the data controller to whom the personal data has been given, if
(1) the processing is based on consent pursuant to Art. 6(1) (a) GDPR or Art. 9(2) (a) GDPR or on a contract pursuant to Art. 6(1) (b) GDPR, and
(2) the processing is carried out by automated means.
In exercising this right to data portability, you also have the right to have the personal data transmitted directly from one controller to another, where technically feasible. This right shall not adversely affect the rights and freedoms of others.
3.4. Right to erasure
You have the right to obtain erasure of data under certain circumstances, such as if the data have been unlawfully processed.
The so-called "right to be forgotten" does not apply because VERUND will never disclose your personal data.
If you have exercised the right to rectification, erasure or restriction of processing vis-à-vis VERBUND, we are obliged to communicate any rectification or erasure of data or restriction of processing to each recipient to whom the personal data have been disclosed, unless this proves impossible or involves disproportionate effort.
3.5. Right to object
You have the right to object at any time, on grounds relating to your particular situation, to the processing of your personal data which is based on point (e) or (f) of Art. 6(1) GDPR.
In this case, VERBUND will no longer process your personal data, unless we can demonstrate compelling legitimate grounds for the processing which override your interests, rights and freedoms or for the establishment, exercise or defence of legal claims.
3.6. Right to withdraw consent
You have the right to withdraw at any time your declaration of consent under data protection law. The revocation of consent shall not affect the lawfulness of the processing carried out on the basis of the consent until revocation.
3.7. Supervisory authority
Notwithstanding any other remedies, if you feel that your personal data were unlawfully processed, you may lodge a complaint with the national supervisory authority in your place of residence. In Austria, this supervisory authority is the Data Protection Authority.
As at: October 2021