The protection of your personal data is of great importance to VERBUND AG. We therefore comply with all applicable laws relating to the protection, lawful handling and confidentiality of personal data, data security, in particular the Austrian Data Protection Act, as amended (Datenschutzgesetz - DSG) and the General Data Protection Regulation ("GDPR"). This document describes which personal data we will process when you visit our website at www.verbund.com ("website").

1. Name and address of the controller

Controller for the processing of your personal data according to data protection laws is:

VERBUND AG
Am Hof 6a
1010 Vienna
Phone: +43 (0)50313-0
Email: service@verbund.at

You can email the Data Protection Officer at datenschutz@verbund.com

2. Processing in the context of the "website"

2.1. What kind of personal data will we process?

We automatically collect the following personal data when you visit our website:

• date and time when you visit a page on our website
• data of your terminal device (device-ID)IP address
• name and version of your browser
• session ID
• certain cookies (see Section 6. "Cookies").

 

2.2 What is our legal basis for the processing of personal data?

We process data when you visit our website based on our legitimate interest according to Article 6 (1) (f) GDPR, which consists in making our website user friendly and protecting it against attacks.

 

2.3. Purposes for which we process data

We process your data when you visit our website for the following purposes:

• to make our website and its functionality available to you and to further improve and develop this website;
• to create usage statistics;
• to detect, prevent, and investigate attacks on our website;
• to display personalised products and pages.

 

2.4. Retention periods

We will basically retain your data we have collected when you visit the website for three months. We store data longer only if this is necessary to examine detected attacks on our website and, furthermore, until the expiry of relevant limitation periods, legal retention periods, or until disputes, if any, have been resolved.

2.5. Data recipients

We regularly use IT service providers to operate and manage the website. These providers may also have access to personal data on our behalf and on our instruction in order to provide the commissioned IT services.

Your data will not be transferred to third parties for their own purposes without your consent.

 

3. Processing in the context of "online orders"

3.1. What kind of personal data will we process?

When you order a product online, you will provide the following information, depending on the product you have chosen: academic degree, sex, first name, surname, address, date of birth, email address, phone number, invoice address, customer number, the products you have bought, payment terms, credit card number, CVC code, expiration date of your credit card, bank details, invoice data, your energy consumption data and facility data (grid operator, metering point name, meter number, meter reading), name, address and customer number of a promoter, if any.

When you first visit the web shop, you have to register in order to use the VERBUND online services. You also have to enter a user name and password.

 

3.2. What is our legal basis for processing personal data?

We lawfully process the data referred to in Section 3.1. according to Article 6 (1) (b) GDPR for the performance of a contract. We have to store and process certain data in the user account so that you can benefit from the web shop functionality and control your settings of your VERBUND login.

You provide your contact details on a voluntary basis; however, if you do not provide such data, VERBUND will not be able to process your order in the online shop, or the processing of your order might be impaired.

3.3. Purposes for which we process data

VERBUND processes the personal data referred to in Section 3.1. to comply with its contractual obligations arising from the online order.

3.4. Retention periods

We process your data during the online ordering process as long as this is necessary to execute your order; we will keep data for the legal retention periods or until the expiry of guarantee and limitation periods.

3.5. Data recipients

We use an IT service provider to store and host personal data. That provider may also have access to personal data on our behalf and on our instruction in order to provide the commissioned IT services.

Your data will not be transferred to third parties for their own purposes without your consent.

 

4. Processing in the context of "online forms"

4.1. What kind of personal data will we process?

Our website offers online forms which you can use to contact us or to request various information. If you use this option, you can provide any of the following information, depending on the online form you use:

• personal details such as sex, academic degree, name, address
• the nature of your interest or information on your request
• contact details such as phone number and/or email address
• information on your energy consumption, grid operator, and current supplier

 

You can also contact us via the email address provided. In this case, we will store your personal data transferred via e-mail.

4.2. What is our legal basis for processing personal data?

We lawfully process the data referred to in Section 4.1. on the basis of our legitimate interest according to Article 6 (1) (f) GDPR. If you contact us with the aim of concluding a contract, we lawfully process data also according to Article 6 (1) (b) GDPR.

4.3. Purposes for which we process data

VERBUND processes the personal data referred to in Section 4.1 in order to answer your request.

4.4. Retention periods

We process your data to answer your request and keep them for three months. We store data longer only if this is necessary to complete your request and, furthermore, until the end of relevant limitation periods, legal retention periods, or until disputes, if any, have been resolved.

4.5. Data recipients

We regularly use IT service providers to operate and manage the website. These providers may also have access to personal data on our behalf and on our instruction in order to provide the commissioned IT services.

Your data will not be transferred to third parties for their own purposes without your consent.

 

5. Processing in the context of "forms for promotional contests and games"

5.1. What kind of personal data will we process?

You can use online forms to participate in promotional contests and games. If you do this, you can provide the following information:

• personal details such as sex, academic degree, name, address, date of birth
• contact details such as phone number and/or email address
• other information depending on the contest or game

 

5.2. What is our legal basis for processing personal data?

We lawfully process the data referred to in Section 5.1. according to Art 6 (1) (b) GDPR for the performance of a contract. These data must be stored and processed in order to carry out the promotional contest or game and to inform you of winnings, if any. Furthermore, we lawfully process your data for promotional contests and games on the basis of our legitimate interest according to Article 6 (1) (f) GDPR.

5.3. Purposes for which we process data

VERBUND processes the personal data referred to in Section 5.1 in order to carry out the promotional contest or game.

5.4. Retention periods

We process your data in order to carry out the promotional contest or game and erase data immediately after the contest or game is over, unless longer retention periods are prescribed by law.

5.5. Data recipients

We regularly use IT service providers to operate and manage the website. These providers may also have access to personal data on our behalf and on our instruction in order to provide the commissioned IT services.

Your data will not be transferred to third parties for their own purposes without your consent.

6. Cookies

The VERBUND website uses cookies. Cookies are tiny text files that are downloaded on your terminal device (e.g. computer, smart phone or tablet computer) when you visit our website. Cookies help the website remember certain entries and settings (such as language or font) for a certain period; it is therefore not necessary that you readjust these settings when you visit the website again. We use cookies to provide you with the best possible service on our website or to display personalised content. Cookies allow us to count the number of visits on our website and to identify the pages visited.

You may generally accept the use of cookies on our website and thereby benefit from the full functionality of the website. You can withdraw your general consent at any time by controlling and/or deleting cookies at your discretion. If you want to learn more on how to control cookies, please go to http://www.aboutcookies.org/. You can delete all cookies stored on your computer and adjust the settings of most browsers to block cookies. You can also disable only certain cookies. If you disable the use of all or even only certain cookies (single opt-out), you may not be able to benefit from the full functionality of our website.

6.1. Which cookies do we use?

The VERBUND website uses first-party-cookies (especially all absolutely necessary cookies) as well as third-party-cookies (such as marketing cookies). Some of the cookies we use do not contain personal data, that is to say information relating to an identifiable or identified individual (e.g. name, IP address, address, and location data). Other cookies or website technologies (such as plug-ins), however, process personal data. In this case, you may object to processing by single opt-out (see below). Furthermore, you can also adjust certain settings of a provider (e.g. Google) to block certain cookies (see below).

The categories of cookies described below are first-party cookies which will be sent and read exclusively by the Verbund domain:

6.2. Cookies which are necessary to operate the website

VERBUND uses cookies which are necessary to run the website www.verbund.com, and to make available its services, applications and functions. This includes technologies that allow you to access the website, services, applications and functions and which are necessary to verify the website’s functionality, to prevent fraud, and to improve security. These cookies are essential for your use of the website’s services. The services cannot function properly without these cookies. These Cookies do not contain any personal data or personal information about you. Information we collect from cookies does not allow us to identify an individual. These cookies are only stored as long as absolutely necessary for the services, thus regularly until the end of an online session or until you close your browser (session cookies).

Cookie	Description	Retention periods
ASP.NET_SessionId	Standard IIS session cookie to identify the user	Session cookies that are deleted when you close your browser
TempCookie	Random GUID value: used for session identification between Sitecore and IdentityProvider Server
verbund#country	Country of the current user (https://sitecore.namics.com/2015/03/13/sitecore-cookies/)
verbund#lang	Language of the current user (https://sitecore.namics.com/2015/03/13/sitecore-cookies/)
SID	Session ID of the registered user in key accounts platform
grosskunden#country	Country of the current user
grosskunden#lang	Language of the current user
idsrv.xsrf	Antiforgery Token (https://de.wikipedia.org/wiki/Cross-Site-Request-Forgery)
idsrv.clients	Saves the clients for which the user is registered
SignInMessage.XXX	The contextual information passed to the authorise endpoint. (https://identityserver.github.io/Documentation/docsv2/advanced/userService.html)

6.3. Functional cookies

VERBUND also uses functional cookies which allow you to save and use stored searches and similar functions (e.g. selected language). These cookies are stored also after you close an internet session (permanent cookies) and are available when you visit the website again to enhance your use of the website. Some of these cookies process your personal data to make available the functionalities to you. However, we do not use these data to identify you as an individual.

Cookie	Description	Retention periods
basketid	Basket allocation	1 year
NSC_MCwtsw-xxx_wc-ofv-TTM	Saves the IP address and the webserver port to which the client is referred (see https://docs.citrix.com/en-us/netscaler/12/load-balancing/load-balancing-persistence/http-cookie-persistence.html)	2 minutes
idsrv	If you have checked the "keep me logged in" functionality persistently. Otherwise, when you close your browser.
idsrv.session	If you have checked the "keep me logged in" functionality persistently. Otherwise, when you close your browser.
idsrv.username	Saves the last user name for preassignment in login	1 year

6.4. Performance cookies

VERBUND uses analytic cookies to analyse the use and to monitor the performance of the website. This feature allows us to establish, for example, which pages of our website are most often visited or how often content is retrieved on a given day, and what kind of content is retrieved. This allows us to adjust our offer and to provide first-class website experience, and to identify and rectify any problems that may arise without delay. If you visit our website, your user data are processed to compile statistic analysis without allowing us to identify you as an individual. These cookies will therefore not identify you.

Cookie	Description	Retention periods
SC_ANALYTICS_GLOBAL_COOKIE	Sitecore Analytics to recognise a user on the website.	10 years

The following third-party cookies are transmitted and read out by domains of other service providers:

6.5. Web analytics cookies

Google Analytics

VERBUND uses Google Analytics, a web analytics service provided by Google Inc ("Google"). Google Analytics also uses cookies to analyse your use of the website. Information generated by the cookies on the use of this website is transmitted to and stored by a Google server in the United States. Please note that the code "gat._anonymizeIp();" was added to this website to guarantee the anonymisation of IP addresses. The IP addresses of users are therefore truncated on this website before they are stored on the Google servers (IP masking). The full IP address is therefore not transmitted to a Google server in the United States. Only in exceptional cases will the full IP address be transmitted to a Google server in the United States and truncated there. On behalf of VERBUND, Google will use this information for the purpose of evaluating your use of our website, for compiling synthesis reports on website activity for website operators, and for the purpose of providing other services relating to website activity and internet usage.

You can adjust the settings of your browser to prevent the installation of cookies ("browser add-on"); please note, however, that if you do this, you might not be able to benefit from the full functionality of this website.

Furthermore, you may download and install the browser plugin provided below to prevent the collection of data relating to your use of this website generated by the cookie (including your anonymised IP address) by Google and the processing of such data by Google. The current link is available under https://tools.google.com/dlpage/gaoptout?hl=en.

More information on Google’s terms of use and privacy policy can be found under http://www.google.com/analytics/terms/gb.html and under https://support.google.com/analytics/answer/6004245?hl=en.

Visual Website Optimizer (VWO)
We want to offer you optimised experience and functions. The development of our website is therefore based on A/B testing and multivariate analysis. We use Visual Website Optimizer, an analysis software provided by Wingify (http://wingify.com/) to run these tests and analyses. VWO allows us to measure and analyse anonymously how a visitor uses the pages of our website (clicks, mouse movement, scroll height). The information collected on the use of our website and the corresponding analyses on website activity are carried out according to data protection laws and do not use any personal data. We cannot identify you based on these anonymously measured parameters, for example based on your IP address or otherwise. Also cookies are used to produce meaningful test results. The program uses the relevant function on your browser to cache information temporarily in order to retrieve it later on. Unless cookies already expire at the end of a session, they are available for a maximum of 100 days (if you want to learn more about this, please go to https://vwo.com/knowledge/cookies-used-by-vwo/), except for the cookie which contains the information that the user wants to block the processing/storage of his or her data; this cookie will be available for a maximum of 10 years. You can delete the cookies on your browser at any time. You can also object to take part in these tests at all. If you want to exercise your right to object, please use the following link: https://vwo.com/opt-out/.

6.6. Remarketing cookies

Google Adwords Conversion Tracking
This website uses Google Conversion Tracking, a service provided by Google Inc. (Google LLC., 1600 Amphitheatre Parkway Mountain View, CA 94043, USA). Google Adwords places a cookie on the computer of a visitor if he or she was referred to our website via a Google advert. These cookies expire after 30 days and are not used to identify you. If the user visits certain pages of the Adwords client’s website and the cookie has not expired, Google and the client can see that the user has clicked the advert and was transferred to the site. A different cookie is assigned to each Adwords client. The cookies can therefore not be tracked via the websites of Adwords clients. Information collected via the conversion cookie is used to compile conversion statistics for Adwords clients that opted for conversion tracking. Adwords clients will learn the total number of users that have clicked their adverts and were referred to a site featuring a conversion tracking tag. However, they will not receive information which would allow them to identify the user. A user who does not want to take part in the tracking procedure can adjust the settings on his or her browser to generally disable the automatic placing of cookies. A user may also adjust the settings on his or her browser to disable cookies for conversion tracking to block cookies of the domain "www.googleadservices.com". If you want to learn more about Google’s privacy policy, please go to https://policies.google.com/privacy?hl=en.

DoubleClick by Google
This website uses DoubleClick, an online marketing tool provided by Google. DoubleClick uses cookies to display adverts which users might like to see, to enhance reports on advertising performance or to ensure that a user does not see the same adverts twice. Via a cookie ID, Google recognises which adverts are placed in which browser and can thus prevent that these are displayed more than once. Furthermore, based on cookie IDs, DoubleClick can capture conversions which refer to advert requests, for example if a user sees a DoubleClick advert and uses the same browser later on to visit the advertiser’s website and buys something there. According to Google, DoubleClick cookies do not contain personal data.
Due to the marketing tools used, your browser automatically and directly connects to the Google server. We have no influence over the scope and further use of data that Google collects using that tool. Based on the level of knowledge we have, we can provide the following information: By integrating DoubleClick, Google is informed that you have visited a certain part of our website or have clicked one of our adverts. Google is able to match that visit with your account if you have registered for a Google service. Even if you have not signed up for a Google service or are not logged in, the provider might find out and store your IP address.
A user who does not want to take part in the tracking procedure can adjust the settings on his or her browser to generally disable the automatic placing of cookies. A user may also adjust the settings on his or her browser to disable cookies for conversion tracking to block cookies of the domain "www.googleadservices.com". If you want to learn more about DoubleClick by Google, please go to https://www.doubleclickbygoogle.com/.

Google Tag Manager
This website uses Google Tag Manager, a feature that allows marketers to manage website tags on a surface. The tag manager tool as such (which implements the tags) is a domain that does not involve cookies and does not collect personal data. The tool insures that other tags are set which may, under certain circumstances, collect data. Google Tag Manager does not access such data. Any deactivation on domain or cookie level is effective also for all tracking tags implemented via Google Tag Manager.

6.7. Deactivation of cookies:

You can also adjust the settings on your browser to generally block all cookies. If you want to learn more on how to control cookies please go to http://www.aboutcookies.org/.

Please use the following links if you want to learn more on how to block cookies in all common browsers:

• Mozilla Firefox: https://support.mozilla.org/en-US/kb/delete-cookies-remove-info-websites-stored
• Internet Explorer: https://support.microsoft.com/de-de/help/17442/windows-internet-explorer-delete-manage-cookies
• Google Chrome: https://support.google.com/accounts/answer/61416?hl=en
• Safari: https://support.apple.com/kb/PH17191?locale=de_AT&viewlocale=en_US
   

You can delete all cookies stored on your computer and adjust the settings of most browsers to block cookies. However, please note that if you do this, you may not be able to use the full functionality of this website. In this case, you might have to adjust some settings manually whenever you visit this website and accept that some functions might not work properly.

7. Google Maps

This website uses "Google Maps", a service of Google (Google LLC., 1600 Amphitheatre Parkway Mountain View, CA 94043, USA) which provides information on geographical regions and sites. If you use this function, Google will also process the data relating to the use of this function by visitors of our website. If you want to learn more about Google’s privacy policy, please go to https://policies.google.com/privacy?hl=en.

8. 3^rd Party Social Plugins

8.1. Facebook

This website uses Social Plugins of the social network www.facebook.com. Facebook Inc., of 1601 S. California Ave, Palo Alto, CA 94304, USA ("Facebook") offers plugins for website operators, which VERBUND has embedded on the pages of its website. You can recognise the plugins by the Facebook logo or the Facebook "Like" and "Recommend" buttons. If you visit a page of the VERBUND website that contains such a plugin, your browser will connect to the servers of the plugin provider. The content of the plugin is directly transmitted to your browser by Facebook and shown on the page. We cannot influence the content of the plugin that is shown. Facebook might be able to track your visit of the corresponding pages of the website and match it with a Facebook account if you have signed up for Facebook or have recently visited a Facebook page or a page containing Facebook content. If you actively use plugins, for example by clicking the "Like" button or recommending a page, your browser will transfer the corresponding information directly to Facebook, without any influence on our part. If you do not want Facebook to collect information when you visit a website, you should read the privacy policy on the Facebook website http://www.facebook.com/policy.php and/ or log out of Facebook before you visit a page that embeds a social plugin.
If you want to learn more about the purposes for which Facebook collects data, which data are collected by Facebook and how they are used, which rights you have and how you can adjust your settings to protect your privacy, you should read the privacy policy of Facbeook http://www.facebook.com/policy.php.
If you do not want Facebook to match your visit of our website with your Facebook account, you should log out of your Facebook account.

8.2. Twitter

Our pages embed functions of Twitter, a service provided by Twitter Inc., of 795 Folsom St., Suite 600, San Francisco, CA 94107, USA ("Twitter") that offers plugins for website operators which VERBUND uses on the pages of its website. You can recognise the plugins by the Twitter "Tweet" or "Follow" buttons. Pages featuring these plugins establish a direct connection to Twitter and transfer different data, depending on your Twitter login status. This might enable Twitter to extract information on your internet use on the VERBUND websites, which Twitter might use for its own purposes. Content of the plugins is kept on Twitter servers and is only displayed on the VERBUND website. VERBUND has no influence over the purposes for which Twitter collects data, which data are collected and how Twitter processes data, nor is VERBUND able to access such data.
If you want to know more about the purposes for which Twitter collects data, which data are collected by Twitter and how they are used, which rights you have and how you can adjust your settings to protect your privacy, please go to http://twitter.com/privacy. You can adjust the settings of your account to change your Twitter privacy settings at http://twitter.com/account/settings .

8.3. Google

VERBUND uses the "+1″ button of Google Plus, a social network provided by Google Inc., 1600 Amphitheatre Parkway, Mountain View, CA 94043, United States ("Google"). You can recognise the plugins by the Google-Plus-One button. Pages featuring these plugins establish a direct connection to Google and transfer different data, depending on your Google login status. This allows Google to extract information on your internet use on the VERBUND websites or on the search engine hits on Google. Content of the plugins is kept on Google servers and only displayed on the VERBUND website. VERBUND has no influence over the purposes for which Google collects data, which data are collected and how Google processes data, nor is VERBUND able to access such data. If you want to know more about the purposes for which Google collects data, which data are collected by Google and how they are used, which rights you have and how you can adjust your settings to protect your privacy, please go to http://www.google.com/intl/en/+/policy/+1button.html.
If you are a Google Plus member and do not want Google to collect information about you via our website and to merge such data with your membership data stored with Google, you have to log out of Google Plus before you visit our website.

8.4. Instagram

Our website embeds functions of Instagram, a service provided by Instagram Inc., 1601 Willow Road, Menlo Park, CA, 94025, United States. When you are logged into Instagram, you can click the Instagram button to link the content of our website with your Instagram profile. This allows Instagram to match your visit of our website with your user account. Please note that we are not aware which data are collected and transferred and how they are used by Instagram. If you want to learn more about Instagram’s privacy policy, go to https://www.instagram.com/about/legal/privacy.

9. Comment plugin

VERBUND has embedded Disqus, a comment plugin for website operators provided by Big Head Labs Inc., 589 Howard Street, San Francisco, CA 94105, USA ("Disqus") on its websites.
You can recognise the plugin by the comment area (comment box and comment summary) and the Disqus logo. Pages featuring these plugins establish a direct connection to Disqus and transfer the comments previously stored with VERBUND. You can log in on the Disqus website at disqus.com or via your personal accounts with Facebook, Twitter, Yahoo, Google, OpenID and others. Authentication also works via a valid email address. disqus.com is managed and provided by its operator in the United States, the original controller according to data protection laws.
The data privacy policies of disqus.com are available at http://docs.disqus.com/help/30/ and http://docs.disqus.com/help/29/. Disqus collects and processes the personal data you have provided when you use the comment feature, both in respect of the use of an existing Disqus account and also if you use the comment feature as a "guest". If you sign up for disqus.com via a third service (e.g. Facebook, Twitter, Yahoo or other OpenID accounts ), also these providers might store, process and use data. If you want to learn more about that, please read the privacy policies of these providers.
VERBUND will know not only the text of your comment and your user name, but also the email address provided for authentication and your IP address. The email address will be used only for communication if problems arise and services are contracted and may be stored within the VERBUND group for these purposes.

10. Rights of the data subject

10.1. Right to information

You have the right to obtain information from us on all your data processed by VERBUND. You have the right to obtain information as to whether your personal data will be transferred to a third state or to an international organisation. You may demand information in this context on whether we have provided appropriate safeguards according to Article 46 GDPR in connection with the transfer of your data.

10.2. Right to rectification and right to restriction of processing

You have the right to obtain the rectification of inaccurate data and the right to have incomplete data completed. Under certain circumstances, for example if the accuracy of data is contested, you have the right to obtain the restriction of processing; in this event, data may only be processed with your consent or for the establishment, exercise or defence of legal claims or for the protection of the rights of another natural or legal person or for reasons of important public interest.

10.3. Right to data portability

You have the right to request that VERBUND transmit to you or to a third party nominated by you, where technically feasible, a copy of your data in a structured, commonly used and machine readable format. Furthermore, you have the right to transmit such data to another controller without hindrance from the controller to which the data have been provided, whereby

(1) the processing is based on consent pursuant to point (a) of Article 6(1) or point (a) of Article 9(2) or on a contract pursuant to point (b) of Article 6(1) GDPR and

(2) the processing is carried out by automated means.

In exercising this right to data portability, you also have the right to have the personal data transmitted directly from one controller to another, where technically feasible. This right shall not adversely affect the rights and freedoms of others.

10.4. Right to erasure

You have the right to obtain erasure of data under certain circumstances, if the data have been unlawfully processed.

The so-called "right to be forgotten" is not applicable, because VERBUND will not publish your personal data under any circumstances.

If you have exercised the right to rectification, erasure or restriction of processing vis-à-vis VERBUND, we are obliged to communicate any rectification or erasure of data or restriction of processing to each recipient to whom the personal data have been disclosed, unless this proves impossible or involves disproportionate effort.

10.5. Right to object

You have the right to object at any time, on grounds relating to your particular situation, to the processing of your personal data which is based on point (e) or (f) of Article 6(1) GDPR.

In this case, VERBUND will no longer process your personal data, unless we can demonstrate compelling legitimate grounds for the processing which override your interests, rights and freedoms or for the establishment, exercise or defence of legal claims.

10.6. Right to withdraw consent

You have the right to withdraw your data privacy consent at any time. Even if you withdraw your consent, the lawfulness of processing operations carried out until you have withdrawn your consent shall not be affected.

10.7. Supervisory authority

Notwithstanding any other remedies, if you feel that your personal data were unlawfully processed, you may lodge a complaint with the national supervisory authority in your place of residence. In Austria, this supervisory authority is the Data Protection Authority.

Last update: 25/05/2018

The protection of your personal data is of great importance to VERBUND AG. We therefore comply with all applicable laws relating to the protection, lawful handling and confidentiality of personal data, data security, in particular the Austrian Data Protection Act, as amended (Datenschutzgesetz - DSG) and the General Data Protection Regulation ("GDPR"). This document describes how VERBUND AG will process personal data in the context of its energy marketing activities.

1. Name and address of the controller

Controller in the context of the processing operations according to Sections 3. to 5. is

VERBUND AG
Am Hof 6a
1010 Vienna
Phone: +43 (0)50313-0
Email: service@verbund.at
(hereinafter "VERBUND")

in cooperation with VERBUND Sales GmbH, Am Hof 6a, 1010 Vienna.

Controller in the context of the processing operations according to Sections 6. and 7. is

VERBUND AG
Am Hof 6a
1010 Vienna
Phone: +43 (0)50313-0
Email: service@verbund.at

in cooperation with VERBUND Solutions GmbH, Europaplatz 2, 1150 Vienna.

You can email the Data Protection Officer at datenschutz@verbund.com

2. Processing operations of processors

Where we have outsourced the following processing operations to "processors" such as IT service providers, postal services providers, marketing services providers, payment services providers, debt collection services, licenced credit agencies and address databases providers, these may have access to personal data on our behalf and on our instruction. VERBUND only cooperates with processors providing sufficient guarantees to implement appropriate technical and organisational measures in such a manner that processing will meet the requirements of the Austrian Data Protection Act (DSG) and the General Data Protection Regulation (GDPR), as amended. Processing by a processor is always governed by a contract that is binding on the processor and sets out the obligations of the processor under data protection laws. VERBUND uses processors outside the European Union only if the European Commission has taken an adequacy decision in respect of the third country or if appropriate safeguards or binding internal data protection provisions have been agreed with the processor.

3. Processing in the context of "sending informational materials to prospects"

3.1. What kind of personal data will we process?

Prospects can contact VERBUND in different ways (for example via phone or email). If you choose any of these options to contact us, we can process the following information you have provided, depending on the option chosen:

• personal details such as sex, academic degree, name, address
• the nature of your interest or information on your request
• contact details such as phone number and/or email address
• information on energy consumption, grid operator, and current supplier

3.2. What is our legal basis for processing personal data?

We lawfully process the data referred to in Section 3.1. on the basis of our legitimate interest according to Article 6 (1) (f) GDPR. If you contact us with the aim of concluding a contract, we lawfully process data also according to Article 6 (1) (b) GDPR in order to take steps prior to entering into a contract.

3.3. Purposes for which we process data

VERBUND processes the personal data referred to in Section 3.1 in order to execute your request.

3.4. Retention periods

We process your data to execute your request and retain them for three months. We store data longer only if this is necessary to complete your request and, furthermore, until the expiry of relevant limitation periods, legal retention periods, or until disputes, if any, have been resolved.

3.5. Data recipients

Your data will not be transferred to third parties for their own purposes without your consent.

4. Processing in the context of "energy supply agreements and photovoltaic supply agreements"

4.1. What kind of personal data will we process?

We will process the following personal data which you provide to us when you enter into an electricity or gas supply contract, as well as data collected during the performance of the contract, such as academic degree, sex, first name, surname, address, date of birth, email address, phone number, invoice address, customer number, type of contract, the products you have bought, payment terms, bank details, invoice data, your energy consumption data and facility data (grid operator, metering point name, meter number, meter reading), name, address and customer name of a promoter, if any.

If you enter into a contract on the supply of electricity from photovoltaic systems, VERBUND will also process the following additional data: data of the photovoltaic system (performance in kWpeak, feed-in in kWh, commissioning date, previous pantograph, case number of decree which recognises the system as green electricity system), VAT number, if any.

Prior to the conclusion of a contract and during an active contractual relationship VERBUND uses the information you have provided in the pre-contractual stage (first name, surname, date of birth) to obtain information on your credit rating from Wirtschaftsauskunftei CRIF GmbH, Diefenbachgasse 35, A-1150 Vienna.

4.2. What is our legal basis for processing personal data?

We lawfully process the data referred to in Section 4.1. according to Art 6 (1) (b) GDPR for the performance of a contract and for the compliance with legal obligations according to Article 6 (1) (c) GDPR. These obligations may arise in particular from the Electricity Management and Organisation Act, the Gas Management Act, the Ordinance on Change of the Electricity Supplier, the Commercial Code, the Green Electricity Act, and the Federal Energy Efficiency Act.

VERBUND has a legitimate interest according to point (f) of Article 6 (1) GDPR to learn more about your credit standing and to obtain credit reports according to Section 4.1.

You provide your contact details on a voluntary basis; however, if you do not provide such data, VERBUND will not be able to process your request to conclude an energy supply or photovoltaic supply agreement.

4.3. Purposes for which we process data

We process your data according to Section 4.1. for the purpose of the conclusion, performance, amendment and termination of the contract with you, as well as for the purpose of billing.
We also process these personal data for marketing purposes in the context of "customer support and marketing for our own benefit" (see Section 5.).

4.4. Retention periods

These data will be erased after termination of the contract, unless we must keep data under tax laws (for example according to § 212 of the Commercial Code (UGB) or §§ 124 et seq of the Federal Tax Code (BAO)), or as long as claims can be asserted from the contractual relationship.
Instead of erasing data, we can also anonymise data. In this case, any reference to you as an individual is irretrievably deleted. If we do this, we no longer have to erase data according to data protection laws.

4.5. Data recipients

We transfer data to third parties only where necessary for the compliance with (pre)contractual or legal obligations or for the safeguarding of our legitimate interests.
Data can be transferred to appointed service providers according to Section 2 or, where legally necessary, to other participants of the electricity or gas market (e.g. grid operators and suppliers of energy in the context of changing suppliers), and to authorities and public agencies (e.g. tax authorities).

5. Processing in the context of "customer support and marketing for our own benefit"

5.1. What kind of personal data will we process?

We will collect the following data directly from the customer or take these from the processing operations carried out in the context of "energy supply agreements and photovoltaic supply agreements": academic degree, sex, first name, surname, address, date of birth, email address, phone number, products purchased.
We collect the following data from the customer’s transactions and service requests of VERBUND or from processing operations in the context of "energy supply agreements and photovoltaic supply agreements" (see Section 4.): cost model, customer number, data of request/transaction, products bought, and your energy consumption data (annual consumption).
We also collect different data from several sources which, taken in isolation, are not personal data and will turn into personal data collected by VERBUND only in combination with other data and resulting analyses.
We also collect personal data on prospects via commercially licensed rating agencies. Based on mathematical-statistical models, VERBUND creates a customer profile which allows us to create personalised offers based on an individual’s interests.

5.2. What is our legal basis for processing personal data?

VERBUND has a legitimate interest (Article 6 (1) (f) GDPR) in sending direct marketing materials based on these personal data in order to reach its customers in the best way and to adjust its marketing strategies accordingly. We will collect, store and use only data that clearly match the customer’s preferences based on his or her purchases and requests.

VERBUND will send direct mail for marketing purposes in compliance with the requirements laid down in § 107 of the Telecommunications Act 2003 (TKG 2003). VERBUND also uses your data to match them with different customer segments, in order to be able to send you direct mail offering value added personalised and customised products and services and to analyse customer satisfaction.

Data are lawfully processed for extended, demand-oriented marketing according to Article 6 (1) (a) GDPR. Data are processed for this purpose only if you have given your consent. You can give your consent when you order online or conclude a contract.

5.3. Purposes for which we process data

We use the personal data referred to in Section 5.1. on the basis of our legitimate interest for the following purposes:

• For direct marketing to send you general information and offers in connection with the VERBUND products and services and product innovations (especially in the fields of mobile telephony, internet TV, etc.) by post and - if we have your consent according to § 107 Telecommunications Act (TKG), as amended, - also via email or text message or by phone.
• To classify customers into segments in order to be able to offer you customised and personalised value-added products and services tailored to your consumption pattern based on direct marketing measures. For the purpose of customer segmentation, we analyse data processed in the context of "energy supply agreements and photovoltaic supply agreements" (see Section 4.) using different statistical methods and by integrating aggregated socio-demographic data. Analysis means to calculate probabilities on the basis of the matched data with the aid of automated analysis models, e.g. your interest in gas products based on which we will select personalised recommendations and offers. Furthermore, these results are used to create personalised customer profiles to gain long-term knowledge about the needs and interests of customers.
• To process these data along with data obtained from commercially licenced rating agencies according to § 151 Commercial Code (GewO). Your personal data VERBUND has collected according to Section 5.1. and the customer segments created on this basis will also be merged with data of third parties (e.g. address data base providers and direct marketing firms) that can also constitute personal data (e.g. socio-demographic data per customer) to improve the data base and to analyse customer behaviour. The merging of such personal data allows us to integrate into our analysis, for example, a customer’s current stage of life, the size of a community, as well as the purchasing power.
• Customer satisfaction analyses.

As a whole, VERBUND is taking these measures to give you a better offer by

• focusing its product range on your needs, so that we can send you personalised offers,
• personalising communication with you, so that you can find those offers that fit your needs and get less advertising,
• simplifying processes such as the conclusion of contracts or online orders, so that you get what you want more quickly.

If you have also given your consent to additional marketing measures, we will process your data also in order to offer you differentiated products on the basis of the customer profiles created. You can withdraw your consent at any time and free of charge with effect for the future. Even if you withdraw your consent, the lawfulness of processing operations carried out until you have withdrawn your consent shall not be affected.

5.4. Retention periods

After termination of our business relationship, VERBUND will use your personal data for up to 3 years after you last contacted us for the purpose of VERBUND’s own marketing measures and in order to send you advertising materials on VERBUND’s own activities and products and to solicit business in respect of VERBUND’s own product offer, unless you have previously objected to the use of your data for these purposes. We will erase your data 3 years after you last contacted VERBUND or earlier, if you have objected to such use.
Instead of erasing data, we can also anonymise data. In this case, any reference to you as an individual is irretrievably deleted. If we do this, we no longer have to erase data according to data protection laws.

5.5. Data recipients

We transfer data to third parties only where necessary for the compliance with (pre)contractual or legal obligations, for the safeguarding of our legitimate interests or based on your consent.
Data can be transferred to appointed service providers for processing operations according to Section 2 or to companies based on your consent.

5.6. Right to object and withdrawal of consent

You can object at any time to the processing of such data for the purposes of direct marketing, which we base on our legitimate interest (see Section 8.).
You can exercise your right to withdraw your consent at any time without giving reasons, with effect for the future, by sending a letter or email to the following contact details or by calling the phone number provided below. You will not incur any expenses if you exercise this right.
Postal address: VERBUND AG, Am Hof 6a, 1010 Vienna
Email: datenschutz@verbund.at
Service line: 0800 210 210

6. Processing in the context of "Smart Home contract"

6.1. What kind of personal data will we process?

We will process the following personal data which you provide to us when you enter into a Smart Home contract, as well as data collected during the performance of a contract, namely academic degree, sex, first name, surname, address, date of birth, email address, phone number, customer number, invoice address, type of contract, the products you have bought, payment terms, In case of credit card payments, we will also collect your credit card number, CVC code, and the expiry date of your credit card.

6.2. What is our legal basis for processing personal data?

We lawfully process the data referred to in Section 6.1. according to Art 6 (1) (b) GDPR and therefore for the performance of a contract.

You provide your contact details on a voluntary basis; however, if you do not provide this information, VERBUND will not be able to process your request to conclude a Smart Home contract.

6.3. Purposes for which we process data

We process your data according to Section 6.1. for the purpose of the conclusion and performance of the contract with you, as well as for the purpose of billing.
We also process these personal data for marketing purposes in the context of "customer support and marketing for our own purposes in the context of Smart Home" (see Section 7.).

6.4. Retention periods

These data will be erased after termination of the contract, unless we must keep data under tax laws (for example according to § 212 of the Commercial Code (UGB) or §§ 124 et seq of the Federal Tax Code (BAO)), or as long as claims can be asserted from the contractual relationship.
Instead of erasing data, we can also anonymise data. In this case, any reference to you as an individual is irretrievably deleted. If we do this, we no longer have to erase data according to data protection laws.

6.5. Data recipients

We transfer data to third parties only where necessary for the compliance with (pre)contractual or legal obligations or for the safeguarding of our legitimate interests.
Data can be transferred to appointed service providers for processing according to Section 2 or, where legally necessary, to authorities and public agencies (e.g. tax authorities). If you opt for payment via credit card, your credit card details will be transferred to the payment provider that processes your payment.

7. Processing in the context of "customer support and marketing for our own purposes relating to Smart Home"

7.1. What kind of personal data will we process?

We will collect the following data directly from the customer or take these from processing operations carried out in the context of the "Smart Home contract" (see Section 6.): academic degree, sex, first name, surname, address, date of birth, email address, phone number, products purchased.

7.2. What is our legal basis for processing personal data?

VERBUND has a legitimate interest (Article 6 (1) (f) GDPR) in sending direct marketing materials based on these personal data in order to reach its customers in the best way and to adjust its marketing strategies accordingly. We will collect, store and use only data that clearly match the customer’s preferences based on his or her purchases and requests. VERBUND will send direct mail for marketing purposes in compliance with the requirements laid down in § 107 of the Telecommunications Act 2003 (TKG 2003). VERBUND also uses your data to allocate you to internal customer segments in order to be able to offer you customised and personalised value-added products and services tailored to your consumption pattern based on direct marketing measures, and to carry out customer satisfaction analyses.

7.3. Purposes for which we process data

We use the personal data referred to in Section 7.1. for the following purposes: For marketing in connection with our own products and services, to divide customers into segments for purposes of marketing, and for customer satisfaction analyses.
Where you have given your consent to the processing of your data, we will process such data for the purposes defined and in the scope covered by your consent. You can withdraw your consent at any time and free of charge with effect for the future. Even if you withdraw your consent, the lawfulness of processing operations carried out until you have withdrawn your consent shall not be affected.
As a whole, VERBUND is taking these measures to give you a better offer by

• focusing its product range on your needs, so that we can send you personalised offers,
• personalising communication with you, so that you can find those offers that fit your needs and get less advertising,
• simplifying processes such as the conclusion of contracts or online orders, so that you get what you want more quickly.

7.4. Retention periods

After termination of our business relationship, VERBUND will use your personal data for up to 3 years after you last contacted us for the purpose of VERBUND’s own marketing measures and in order to send you advertising materials on VERBUND’s own activities and products and to solicit business in respect of VERBUND’s own product offer, unless you have previously objected to the use of your data for these purposes. We will erase your data 3 years after you last contacted VERBUND or earlier, if you have objected to such use.
Instead of erasing data, we can also anonymise data. In this case, any reference to you as an individual is irretrievably deleted. If we do this, we no longer have to erase data according to data protection laws.

7.5. Data recipients

We transfer data to third parties only where necessary for the compliance with (pre)contractual or legal obligations, for the safeguarding of our legitimate interests or based on your consent.
Data can be transferred to appointed service providers for processing according to Section 2 or to companies based on your consent.

7.6. Right to object and withdrawal of consent

You can object at any time to the processing of such data for the purposes of direct marketing, which we base on our legitimate interest (see Section 8.).
You can exercise your right to withdraw your consent at any time without giving reasons, with effect for the future, by sending a letter or email to the following contact details or by calling the phone number provided below. You will not incur any expenses if you exercise this right.
Postal address: VERBUND AG, Am Hof 6a, 1010 Vienna
Email address: datenschutz@verbund.at
Service line: 0800 210 210

8. Rights of the data subject

8.1. Right to information

You have the right to obtain information from us on all your data processed by VERBUND. You have the right to obtain information as to whether your personal data will be transferred to a third state or to an international organisation. You may demand information in this context on whether we have provided appropriate safeguards according to Article 46 GDPR in connection with the transfer of your data.

8.2. Right to rectification and right to restriction of processing

You have the right to obtain the rectification of inaccurate data and the right to have incomplete data completed. Under certain circumstances, for example if the accuracy of data is contested, you have the right to obtain the restriction of processing; in this event, data may only be processed with your consent or for the establishment, exercise or defence of legal claims or for the protection of the rights of another natural or legal person or for reasons of important public interest.

8.3. Right to data portability

You have the right to request that VERBUND transmit to you or to a third party nominated by you, where technically feasible, a copy of your data in a structured, commonly used and machine readable format. Furthermore, you have the right to transmit such data to another controller without hindrance from the controller to which the data have been provided, whereby

(1) the processing is based on consent pursuant to point (a) of Article 6(1) or point (a) of Article 9(2) or on a contract pursuant to point (b) of Article 6(1) GDPR; and

(2) the processing is carried out by automated means.

In exercising this right to data portability, you also have the right to have the personal data transmitted directly from one controller to another, where technically feasible. This right shall not adversely affect the rights and freedoms of others.

8.4. Right to erasure

You have the right to obtain erasure of data under certain circumstances, if the data have been unlawfully processed.

The so-called "right to be forgotten" is not applicable because VERBUND will not publish your personal data under any circumstances.

If you have exercised the right to rectification, erasure or restriction of processing vis-à-vis VERBUND, we are obliged to communicate any rectification or erasure of data or restriction of processing to each recipient to whom the personal data have been disclosed, unless this proves impossible or involves disproportionate effort.

8.5. Right to object

You have the right to object at any time, on grounds relating to your particular situation, to the processing of your personal data which is based on point (e) or (f) of Article 6(1) GDPR.

In this case, VERBUND will no longer process your personal data, unless we can demonstrate compelling legitimate grounds for the processing which override your interests, rights and freedoms or for the establishment, exercise or defence of legal claims.

8.6. Right to withdraw consent

You have the right to withdraw your data privacy consent at any time. Even if you withdraw your consent, the lawfulness of processing operations carried out until you have withdrawn your consent shall not be affected.

8.7. Supervisory authority

Notwithstanding any other remedies, if you feel that your personal data were unlawfully processed, you may lodge a complaint with the national supervisory authority in your place of residence. In Austria, this supervisory authority is the Data Protection Authority.

Last update: 25/05/2018

The protection of your personal data is of great importance to VERBUND Trading GmbH (hereinafter "VERBUND"). We therefore comply with all applicable laws relating to the protection, lawful handling and confidentiality of personal data, data security, in particular the Austrian Data Protection Act, as amended (Datenschutzgesetz - DSG) and the General Data Protection Regulation ("GDPR"). This document describes which personal data we will process when you visit our website at www.verbund.com ("website").

 

1. Name and address of the controller

Controller for the processing of your personal data according to data protection laws is:

VERBUND Trading GmbHAm Hof 6a

1010 Vienna

Phone: +43 (0)50313-0

Email: trading@verbund.com

You can email the Data Protection Officer at datenschutz@verbund.com.

2.  Data processing "VISION-Website"

2.1 Scope of processing of personal data

 

We automatically collect the following personal data when you use our VISION website:

• Date and time when you visit a page on our website
• Data of your terminal device (device-ID)
• IP address
• Name and version of your browser
• Session ID
• Certain cookies (see Section 6. "Cookies").

 

2.2. Lawfulness of processing of personal data

We process data in connection with your use of our VISION website on the basis of the requirement to perform a contract according to Article 6 (1) (b) GDPR and based on our legitimate interest according to Article 6 (1) (f) GDPR, which consists in making our website user friendly and protecting our VISION website against attacks.

2.3. Purposes for which we process data

 

We process your data in connection with your visit of our VISION website for the following purposes:

• to make our website and its functionality available to you and to further improve and develop this website;
• to create usage statistics;
• to detect, prevent, and investigate attacks on our website.

 

2.4. Retention periods

We will basically retain your data related to the use of the VISION website for the duration of the existing contractual relationship and also during the retention periods prescribed by law. We store data longer only if this is necessary to examine detected attacks on our website and, furthermore, until the end of relevant limitation periods, legal retention periods, or the termination of disputes, if any.

 

2.5. Data recipients

We regularly use IT service providers to operate and manage the VISION website. These providers may have access to personal data on our behalf and on our instruction in order to provide the commissioned IT services.

Your data will not be transferred to third parties for their own purposes without your consent.

 

3. Processing to "solicit and perform energy trading transactions"

3.1. Scope of processing of personal data

We collect and process the following personal data which you disclose to us when you conclude an energy trading transaction or a similar contract and, furthermore, during the performance of the contract: company name (especially sole proprietor), academic degree, sex, first name, surname, address, email address, phone number, content of telephone conversations, IP address, credit worthiness data, CDD data (incl. negative media coverage), sanction lists data (when needed, date of birth, passport number, nationality), payment terms, bank details, invoice data, metering points of your facility, registry number, EIC, shipper code, VAT number, ACER code and LEI.

Prior to the conclusion of a contract and during an active contractual relationship VERBUND uses the information you have provided and additional data we have collected to obtain information on your credit rating from Moody’s or the credit rating agencies KSV1870 and/or Creditreform, as well as further information about you from Factiva (Dow Jones) and/or Bureau van Dijk (Compliance Catalyst).

3.2. Lawfulness of processing of personal data

We lawfully process the data referred to in Section 3.1. according to Art 6 (1) (b) GDPR for the performance of a contract and for the compliance with legal obligations according to Article 6 (1) (c) GDPR. These obligations may arise in particular from the Electricity Management and Organisation Act, the Gas Management Act, the Commercial Code, the Green Electricity Act, the Federal Energy Efficiency Act, the EU regulations, such as sanctions lists, REMIT, EMIR, MAR, and MiFID.

VERBUND has a legitimate interest according to point (f) of Article 6 (1) GDPR to learn more about your credit standing and integrity prior to the conclusion of a contact and during the existing contractual relationship.

You provide information on a voluntary basis; however, if you do not provide such data, you will not fulfil the requirements which are necessary for the conclusion and processing of a contract by VERBUND.

3.3. Purposes for which we process data

We process your data according to Section 3.1. for the purpose of the conclusion, performance, amendment and termination of the contract with you, as well as for billing purposes.

3.4. Retention periods

These data will be erased after termination of the contract, unless data are needed longer according to legal retention periods (such as those according to § 212 of the Commercial Code (UGB) or §§ 124 et seq of the Federal Tax Code (BAO)), or as long as claims can be asserted from the contractual relationship.

3.5. Data recipients

 

           We transfer data to third parties only where necessary for the compliance with (pre)contractual or legal obligations or for the safeguarding of our legitimate interests.

Data can be transferred to appointed service providers or, where legally necessary, to other participants of the energy market (e.g. grid operators), and to authorities and public agencies (e.g. regulatory authorities or fiscal authorities).

           

4. Cookies

The VISION website of VERBUND uses cookies. Cookies are tiny text files that are downloaded onto your terminal device (e.g. computer, smartphone or tablet computer) when you visit our website. Cookies help the website remember certain entries and settings (such as language or font) for a certain period; it is therefore not necessary that you readjust these settings when you visit the website again. We use cookies to provide you with the best possible service on our website or to display content tailored to your needs. Cookies allow us to count the number of visits on our website and identify the pages visited.

You may generally accept the use of cookies on our website and thereby benefit from the full functionality of the website. You can withdraw your general consent at any time by controlling and/or deleting cookies at your discretion. If you want to learn more on how to control cookies, please go to http://www.aboutcookies.org/. You can delete all cookies stored on your computer and adjust the settings of most browsers to block cookies. You can also disable only some cookies. If you disable the use of all or even only some cookies (single opt-out), you may not be able to benefit from the full functionality of our website.

 

4.1. Which cookies do we use?

The VERBUND website uses first-party-cookies (especially all absolutely necessary cookies) as well as third-party-cookies (such as marketing cookies). Some of the cookies we use do not contain personal data, that is to say information relating to an identifiable or identified individual (e.g. name, IP address, address and location data). Other cookies or website technologies (such as plug-ins), however, process personal data. In this case, you may object to processing by single opt-out (see below). Furthermore, you can also adjust certain settings of a provider (e.g. Google) to block certain cookies (see below).

The categories of cookies described below are first-party cookies, which will be sent and read exclusively by the VERBUND domain:                

4.2. Cookies which are necessary to operate the website

VERBUND uses cookies, which are necessary to run the website https://vision.verbund.com/ and to make available its services, applications and functions. This includes technologies that allow you to access the website, services, applications and functions and which are necessary to verify the website’s functionality, to prevent fraud, and to improve security. These cookies are essential for your use of the website’s services. The services cannot function properly without these cookies. These Cookies do not contain any personal data or personal information about you. Information we collect from cookies does not allow us to identify an individual. These cookies are only stored for as long as absolutely necessary for the services, thus regularly until the end of an online session or until you close your browser (session cookies).

 

Cookie	Description	Retention period
ASP.NET_SessionId	Standard IIS session cookie to identify the user	Session cookies that are deleted when you close your browser
TempCookie	Random GUID value: used for session identification between Sitecore and IdentityProvider Server
verbund#country	Country of the current user (https://sitecore.namics.com/2015/03/13/sitecore-cookies/)
verbund#lang	Language of the current user (https://sitecore.namics.com/2015/03/13/sitecore-cookies/)
SID	Session ID of the registered user in key accounts platform
grosskunden#country	Country of the current user
grosskunden#lang	Language of the current user
idsrv.xsrf	Antiforgery Token (https://de.wikipedia.org/wiki/Cross-Site-Request-Forgery)
idsrv.clients	Saves the clients for which the user is registered
SignInMessage.XXX	The contextual information passed to the authorise endpoint. (https://identityserver.github.io/Documentation/docsv2/advanced/userService.html)

 

 

4.3. Functional cookies

VERBUND also uses functional cookies, which allow you to save and use stored searches and similar functions (e.g. selected language). These cookies are stored also after you close an internet session (permanent cookies) and are available again when you visit the website again to enhance your use of the website. Some of these cookies process your personal data to make available the functionalities to you. However, we do not use these data to identify you as an individual.

 

Cookie	Description	Retention periods
basketid	Basket allocation	1 year
NSC_MCwtsw-xxx_wc-ofv-TTM	Saves the IP address and the webserver port to which the client is transferred (see https://docs.citrix.com/en-us/netscaler/12/load-balancing/load-balancing-persistence/http-cookie-persistence.html)	2 minutes
idsrv	If you have checked the "keep me logged in" functionality persistently. Otherwise, when you close your browser.
idsrv.session	If you have checked the "keep me logged in" functionality persistently. Otherwise, when you close your browser.
idsrv.username	Saves the last user name for preassignment in login	1 year

 

 

4.4. Performance cookies

VERBUND currently does not use any analytic cookies to analyse the use or to monitor the performance of the VISION website.

The following third-party cookies are transmitted and read out by domains of other service providers:

 

               

4.5. Web analytics cookies

Google Analytics

VERBUND uses Google Analytics, a web analytics service provided by Google Inc ("Google"). Google Analytics also uses cookies to analyse your use of the website. Information generated by the cookies on the use of this website is transmitted to and stored by a Google server in the United States. Please note that the code "gat._anonymizeIp();" was added to this website to guarantee the anonymisation of IP addresses. The IP addresses of users are therefore truncated on this website before they are stored on the Google servers (IP masking). The full IP address is therefore not transmitted to a Google server in the United States. Only in exceptional cases will the full IP address be transmitted to a Google server in the United States and truncated there. On behalf of VERBUND, Google will use this information for the purpose of evaluating your use of our website, for compiling synthesis reports on website activity for website operators, and for the purpose of providing other services relating to website activity and internet usage.

You can adjust the settings of your browser to prevent the installation of cookies ("browser add-on"); please note, however, that if you do this, you might not be able to benefit from the full functionality of this website.

Furthermore, you may download and install the browser plugin provided below to prevent the collection of data relating to your use of this website generated by the cookie (including your anonymised IP address) to Google and the processing of such data by Google. The current link is available under https://tools.google.com/dlpage/gaoptout?hl=en-GB.

More information on Google’s terms of use and data privacy policy is available under http://www.google.com/analytics/terms/gb.html or under http://www.google.com/intl/en/analytics/privacyoverview.html.

 

4.6. Deactivation of cookies:

 

You can also adjust the settings of your browser to generally block all cookies. If you want to learn more on how to control cookies, please go to http://www.aboutcookies.org/.

Please use the following links if you want to learn more on how to block cookies in all common browsers:


• Mozilla Firefox: https://support.mozilla.org/en-US/kb/delete-cookies-remove-info-websites-stored

• Internet Explorer: https://support.microsoft.com/en-gb/help/17442/windows-internet-explorer-delete-manage-cookies

• Google Chrome: https://support.google.com/accounts/answer/61416?hl=en

• Safari: https://support.apple.com/kb/PH17191?locale=de_AT&viewlocale=en_US

 

You can delete all cookies stored on your computer and adjust the settings of most browsers to block cookies. However, please note that if you do this, you may not be able to use the full functionality of this website. In this case, you might have to adjust some settings manually whenever you visit this website and accept that some functions might not work properly.

 

5. Local storage

We use Local Storage Technology to adjust the VISION website to your personal needs and use. Data are stored locally in your browser’s cache and will remain there and can be read out even after you close the browser window or the program, unless you delete the cache.

Local storage allows us to store your preferences in connection with the use of the VISION website on your computer, and you may use these without having to log in.

Data stored in local storage cannot be accessed by third parties and are not transmitted to third parties or used for purposes of advertising.

You can adjust the settings of your browser if you want to block the use of the local storage functions. These settings will also give you an overview of data saved in local storage. Browser extensions are available for more information (e.g. Firebug and Fire Storage Plus! for Firefox; Storage Area Explorer for Chrome).

You can manage local storage content via the "History" or "Local Data" settings, depending on your browser.

 

6. Rights of the data subject

6.1. Right to information

You have the right to obtain information from us on all your data processed by VERBUND. You have the right to obtain information as to whether your personal data will be transferred to a third state or to an international organisation. You may demand information in this context on whether we have provided appropriate safeguards according to Article 46 GDPR in connection with the transfer of your data.

6.2. Right to rectification and right to restriction of processing

You have the right to obtain the rectification of inaccurate data and the right to have incomplete data completed. Under certain circumstances, for example if the accuracy of data is contested, you have the right to obtain the restriction of processing; in this event, data may only be processed with your consent or for the establishment, exercise or defence of legal claims or for the protection of the rights of another natural or legal person or for reasons of important public interest.

6.3. Right to data portability

You have the right to request that VERBUND transmit to you or to a third party nominated by you, where technically feasible, a copy of your data in a structured, commonly used and machine-readable format. Furthermore, you have the right to transmit such data to another controller without hindrance from the controller to which the data have been provided, whereby        

1. the processing is based on consent pursuant to point (a) of Article 6(1) or point (a) of Article 9(2) or on a contract pursuant to point (b) of Article 6(1) GDPR; and
2. the processing is carried out by automated means.

 

In exercising this right to data portability, you also have the right to have the personal data transmitted directly from one controller to another, where technically feasible. This right shall not adversely affect the rights and freedoms of others.

 

6.4. Right to erasure

Notwithstanding any other remedies, if you feel that your personal data was unlawfully processed, you may lodge a complaint with the national supervisory authority in your place of residence. In Austria, this supervisory authority is the Data Protection Authority.

 

Last update: 25/05/2018

 

We would like to inform you below how VERBUND AG processes your personal data.

I. Name and address of the controller

VERBUND AG has implemented the "Lumesse TalentLink" tool of Lumesse GmbH to process your job application. This tool allows you to apply for a position with VERBUND AG or with any affiliate of VERBUND AG according to Section 1.6. ("affiliates") via this platform at www.verbund.com or provide the job application information directly in the web interface. VERBUND AG is entrusted with managing human resources for these affiliates and therefore organises the job application process and the platform centrally for these affiliates.

Controller of your job application data is therefore VERBUND AG, Am Hof 6a, 1010 Vienna, T +43 (0)50313-0, E information@verbund.com, jointly with the relevant affiliate if you have applied to any of the affiliates listed in Section 1.6.

You can email the Data Protection Officer at datenschutz@verbund.com

II. Processing operations

1. Processing in the context of the "job application process"

1.1. What kind of personal data will we process?

We process certain personal data that VERBUND AG needs to handle your application: form of address, first name and surname, address, phone number, email address, education, desired gross annual salary, earliest possible entry date, and information on how you became aware of the vacancy.

You provide this information on a voluntary basis. However, if you do not complete the mandatory fields and provide the required information, we might not be able to process your application, because certain information about you is necessary to assess your qualifications for the position.

You can complete the other non-mandatory fields and disclose your date of birth, academic degree, nationality, CV or other sensitive data (such as religious denomination) voluntarily, and you may upload the corresponding documents. VERBUND and the affiliate to which your application is addressed will then process such data for the same purpose as data provided in mandatory fields.

1.2. What is our legal basis for processing personal data?

We lawfully and jointly process a job applicant’s data according to Art 6 (1) (b) GDPR for the performance of a contract or in order to take steps prior to entering into the contract. By submitting your application, you are submitting a request to process your job application data in the context of your application. This requires us to carry out the processing operation described above.

If you send us an unsolicited application and do not apply for a specific position, we will process your data only with your consent (Article 6 (1) (a) GDPR).

1.3. Purposes for which we process data

VERBUND AG and the affiliate that has advertised the position for which you have applied collect, keep and process data an applicant has provided via the platform only in order to handle your application, to include you in the application process and to fill the post for which you have applied. The platform is supported and organised by VERBUND AG. VERBUND AG and the affiliate to which you have sent your application share the processing of data during the application process.

If you have sent an unsolicited application, VERBUND AG will store your job application data for a period of 12 months in a candidate pool and will transfer your data to the relevant affiliate if there is a vacancy.

All requests relating to data protection laws should be addressed to VERBUND AG.

1.4. Retention periods

We will store your personal data by electronic means during the application process and then as long as you are entitled to lodge claims due to your application.

If you have given your consent to the processing of certain data, we will erase your data earlier in case you should withdraw your consent.

You can withdraw your consent at any time, with effect for the future, without giving any reasons. You can exercise this right orally or by sending a letter or email to VERBUND AG or to the relevant VERBUND AG affiliate.

1.5. Data recipients

Lumesse GmbH operates the recruitment platform as software-as-a-service. Lumesse GmbH is therefore a processor that may have access to personal data on our behalf and on our instruction in order to provide the commissioned IT services. Data are stored and hosted in Frankfurt, Germany.

Lumesse GmbH uses Amazon Web Services, Inc. in Seattle as another processor that provides IT services. Amazon Web Services, Inc. is certified according to the EU-US Privacy Shield Framework.

Without your consent, your data will not be transferred to third parties or to other affiliates that are not joint controllers to be used for their own purposes.

1.6. List of affiliates (joint controllers)

• VERBUND AG, Am Hof 6a, 1010 Vienna, T +43 (0)50313-0,
• VERBUND Hydro Power GmbH, Europaplatz 2, 1150 Vienna, T +43 (0)50313-0,
• VERBUND Sales GmbH, Am Hof 6a, 1010 Vienna, T +43 (0)50313-0,
• VERBUND Trading GmbH, Am Hof 6a, 1010 Vienna, T +43 (0)50313-0,
• VERBUND Services GmbH, Am Hof 6a, 1010 Vienna, T +43 (0)50313-0,
• VERBUND Tourismus GmbH, Europaplatz 2, 1150 Vienna, T +43 (0) 50313-0
• VERBUND Solutions GmbH, Europaplatz 2, 1150 Vienna, T +43 (0)50313-0,
• VERBUND Thermal Power GmbH, Ankerstraße 6, 8054 Graz, T +43 (0)50313-0,
• VERBUND Umwelttechnik GmbH, Lakeside B06b, 9020 Klagenfurt am Wörthersee, T +43 (0)50313-0
• Ennskraftwerke Aktiengesellschaft, Resthofstraße 2, 4400 Steyr, T +43 (0)7252 81122-0
• Grenzkraftwerke Gesellschaft mit beschränkter Haftung, Münchner Straße 48, 84359 Simbach, T +49 (0)8571 609-0
• VERBUND Trading & Sales Deutschland GmbH, Sonnenstraße 17, 80331 Munich, T +49 (0)89 89056-0
• VERBUND Innkraftwerke Deutschland GmbH, Innwerkkanal, 84513 Töging am Inn, T +49 (0) 8631 39-0
• Innwerk AG, Schulstraße 2 84533 Stammham, +49 (0)8678 988922750
• smart Energy Personal GmbH, Dietrichgasse 27/3.OG, 1030 Wien, +43 (0) 153 152 51978

2. Processing in the context of the "candidate pool"

2.1. What kind of personal data will we process?

We keep your job application data (see Section 1.1) in a candidate pool that VERBUND can use to search for qualified applicants in case a vacancy arises with a VERBUND AG affiliate.

2.2. What is our legal basis for processing personal data?

We lawfully process your data in this case according to Article 6 (1) (a) GDPR and therefore based on your consent.

2.3. Purposes for which we process data

If you separately consent that we keep your data in our candidate pool after we have not hired you for a position you have applied for, we must store your job application data so that we can inform you should there be a suitable vacancy for you at any of our affiliates later on.
VERBUND will transfer your job application data to the relevant affiliate that can offer you a suitable position and will then contact you.

2.4. Retention periods

We will retaein your data in our candidate pool for a period of 12 months, unless you withdraw your consent already earlier.

You can withdraw your consent at any time, with effect for the future, without giving any reasons. You can exercise this right orally or by sending a letter or email to VERBUND AG or to the relevant VERBUND AG affiliate.

2.5. Data recipients

Subject to your consent, we will transfer your job application data to the relevant affiliate if there is a vacancy.

3. Rights of the data subject

3.1. Right to information and access of data

You have the right to obtain information from us on all your data processed by VERBUND. You have the right to obtain information as to whether your personal data will be transferred to a third state or to an international organisation. You may demand information in this context on whether we have provided appropriate safeguards according to Article 46 GDPR in connection with the transfer of your data.

3.2. Right to rectification and right to restriction of processing

You have the right to obtain the rectification of inaccurate data and the right to have incomplete data completed. Under certain circumstances, for example if the accuracy of data is contested, you have the right to obtain the restriction of processing; in this event, data may only be processed with your consent or for the establishment, exercise or defence of legal claims or for the protection of the rights of another natural or legal person or for reasons of important public interest.

3.3. Right to data portability

You have the right to request that VERBUND transmit to you or to a third party nominated by you, where technically feasible, a copy of your data in a structured, commonly used and machine-readable format. Furthermore, you have the right to transmit such data to another controller without hindrance from the controller to which the data have been provided, where

(1) the processing is based on consent pursuant to point (a) of Article 6(1) or point (a) of Article 9(2) or on a contract pursuant to point (b) of Article 6(1) GDPR and

(2) the processing is carried out by automated means.

In exercising this right to data portability, you also have the right to have the personal data transmitted directly from one controller to another, where technically feasible. This right shall not adversely affect the rights and freedoms of others.

3.4. Right to erasure

You have the right to obtain erasure of data under certain circumstances, if the data have been unlawfully processed.

The so-called "right to be forgotten" is not applicable because VERBUND will not publish your personal data under any circumstances.

If you have exercised the right to rectification, erasure or restriction of processing vis-à-vis VERBUND, we are obliged to communicate any rectification or erasure of data or restriction of processing to each recipient to whom the personal data have been disclosed, unless this proves impossible or involves disproportionate effort.

3.5. Right to object

You have the right to object at any time, on grounds relating to your particular situation, to the processing of your personal data which is based on point (e) or (f) of Article 6(1) GDPR.

In this case, VERBUND will no longer process your personal data, unless we can demonstrate compelling legitimate grounds for the processing which override your interests, rights and freedoms or for the establishment, exercise or defence of legal claims.

3.6. Right to withdraw consent

You have the right to withdraw your data privacy consent at any time. Even if you withdraw your consent, the lawfulness of processing operations carried out until you have withdrawn your consent shall not be affected.

4. Supervisory authority

Notwithstanding any other remedies, if you feel that your personal data were unlawfully processed, you may lodge a complaint with the national supervisory authority in your place of residence. In Austria, this supervisory authority is the Data Protection Authority.