1. Name and address of the controller
Controller for the processing of your personal data according to data protection laws is:
VERBUND AG
Am Hof 6a
1010 Vienna
Phone: +43 (0)50313-0
Email: service@verbund.at
You can email the Data Protection Officer at datenschutz@verbund.com
2. Processing in the context of the "website"
2.1. What kind of personal data will we process?
We automatically collect the following personal data when you visit our website:
- date and time when you visit a page on our website
- data of your terminal device (device-ID)IP address
- name and version of your browser
- session ID
- certain cookies (see Section 6. "Cookies").
2.2 What is our legal basis for the processing of personal data?
We process data when you visit our website based on our legitimate interest according to Article 6 (1) (f) GDPR, which consists in making our website user friendly and protecting it against attacks.
2.3. Purposes for which we process data
We process your data when you visit our website for the following purposes:
- to make our website and its functionality available to you and to further improve and develop this website;
- to create usage statistics;
- to detect, prevent, and investigate attacks on our website;
- to display personalised products and pages.
2.4. Retention periods
We will basically retain your data we have collected when you visit the website for three months. We store data longer only if this is necessary to examine detected attacks on our website and, furthermore, until the expiry of relevant limitation periods, legal retention periods, or until disputes, if any, have been resolved.
2.5. Data recipients
We regularly use IT service providers to operate and manage the website. These providers may also have access to personal data on our behalf and on our instruction in order to provide the commissioned IT services.
Your data will not be transferred to third parties for their own purposes without your consent.
3. Processing in the context of "online orders"
3.1. What kind of personal data will we process?
When you order a product online, you will provide the following information, depending on the product you have chosen: academic degree, sex, first name, surname, address, date of birth, email address, phone number, invoice address, customer number, the products you have bought, payment terms, credit card number, CVC code, expiration date of your credit card, bank details, invoice data, your energy consumption data and facility data (grid operator, metering point name, meter number, meter reading), name, address and customer number of a promoter, if any.
When you first visit the web shop, you have to register in order to use the VERBUND online services. You also have to enter a user name and password.
3.2. What is our legal basis for processing personal data?
We lawfully process the data referred to in Section 3.1. according to Article 6 (1) (b) GDPR for the performance of a contract. We have to store and process certain data in the user account so that you can benefit from the web shop functionality and control your settings of your VERBUND login.
You provide your contact details on a voluntary basis; however, if you do not provide such data, VERBUND will not be able to process your order in the online shop, or the processing of your order might be impaired.
3.3. Purposes for which we process data
VERBUND processes the personal data referred to in Section 3.1. to comply with its contractual obligations arising from the online order.
3.4. Retention periods
We process your data during the online ordering process as long as this is necessary to execute your order; we will keep data for the legal retention periods or until the expiry of guarantee and limitation periods.
3.5. Data recipients
We use an IT service provider to store and host personal data. That provider may also have access to personal data on our behalf and on our instruction in order to provide the commissioned IT services.
Your data will not be transferred to third parties for their own purposes without your consent.
4. Processing in the context of "online forms"
4.1. What kind of personal data will we process?
Our website offers online forms which you can use to contact us or to request various information. If you use this option, you can provide any of the following information, depending on the online form you use:
- personal details such as sex, academic degree, name, address
- the nature of your interest or information on your request
- contact details such as phone number and/or email address
- information on your energy consumption, grid operator, and current supplier
You can also contact us via the email address provided. In this case, we will store your personal data transferred via e-mail.
4.2. What is our legal basis for processing personal data?
We lawfully process the data referred to in Section 4.1. on the basis of our legitimate interest according to Article 6 (1) (f) GDPR. If you contact us with the aim of concluding a contract, we lawfully process data also according to Article 6 (1) (b) GDPR.
4.3. Purposes for which we process data
VERBUND processes the personal data referred to in Section 4.1 in order to answer your request.
4.4. Retention periods
We process your data to answer your request and keep them for three months. We store data longer only if this is necessary to complete your request and, furthermore, until the end of relevant limitation periods, legal retention periods, or until disputes, if any, have been resolved.
4.5. Data recipients
We regularly use IT service providers to operate and manage the website. These providers may also have access to personal data on our behalf and on our instruction in order to provide the commissioned IT services.
Your data will not be transferred to third parties for their own purposes without your consent.
5. Processing in the context of "forms for promotional contests and games"
5.1. What kind of personal data will we process?
You can use online forms to participate in promotional contests and games. If you do this, you can provide the following information:
- personal details such as sex, academic degree, name, address, date of birth
- contact details such as phone number and/or email address
- other information depending on the contest or game
5.2. What is our legal basis for processing personal data?
We lawfully process the data referred to in Section 5.1. according to Art 6 (1) (b) GDPR for the performance of a contract. These data must be stored and processed in order to carry out the promotional contest or game and to inform you of winnings, if any. Furthermore, we lawfully process your data for promotional contests and games on the basis of our legitimate interest according to Article 6 (1) (f) GDPR.
5.3. Purposes for which we process data
VERBUND processes the personal data referred to in Section 5.1 in order to carry out the promotional contest or game.
5.4. Retention periods
We process your data in order to carry out the promotional contest or game and erase data immediately after the contest or game is over, unless longer retention periods are prescribed by law.
5.5. Data recipients
We regularly use IT service providers to operate and manage the website. These providers may also have access to personal data on our behalf and on our instruction in order to provide the commissioned IT services.
Your data will not be transferred to third parties for their own purposes without your consent.
6. Cookies
The VERBUND website uses cookies. Cookies are tiny text files that are downloaded on your terminal device (e.g. computer, smart phone or tablet computer) when you visit our website. Cookies help the website remember certain entries and settings (such as language or font) for a certain period; it is therefore not necessary that you readjust these settings when you visit the website again. We use cookies to provide you with the best possible service on our website or to display personalised content. Cookies allow us to count the number of visits on our website and to identify the pages visited.
You may generally accept the use of cookies on our website and thereby benefit from the full functionality of the website. You can withdraw your general consent at any time by controlling and/or deleting cookies at your discretion. If you want to learn more on how to control cookies, please go to http://www.aboutcookies.org/. You can delete all cookies stored on your computer and adjust the settings of most browsers to block cookies. You can also disable only certain cookies. If you disable the use of all or even only certain cookies (single opt-out), you may not be able to benefit from the full functionality of our website.
6.1. Which cookies do we use?
The VERBUND website uses first-party-cookies (especially all absolutely necessary cookies) as well as third-party-cookies (such as marketing cookies). Some of the cookies we use do not contain personal data, that is to say information relating to an identifiable or identified individual (e.g. name, IP address, address, and location data). Other cookies or website technologies (such as plug-ins), however, process personal data. In this case, you may object to processing by single opt-out (see below). Furthermore, you can also adjust certain settings of a provider (e.g. Google) to block certain cookies (see below).
The categories of cookies described below are first-party cookies which will be sent and read exclusively by the VERBUND domain:
6.2. Cookies which are necessary to operate the website
VERBUND uses cookies which are necessary to run the website www.verbund.com, and to make available its services, applications and functions. This includes technologies that allow you to access the website, services, applications and functions and which are necessary to verify the website’s functionality, to prevent fraud, and to improve security. These cookies are essential for your use of the website’s services. The services cannot function properly without these cookies. These Cookies do not contain any personal data or personal information about you. Information we collect from cookies does not allow us to identify an individual. These cookies are only stored as long as absolutely necessary for the services, thus regularly until the end of an online session or until you close your browser (session cookies).
| Cookie | Description | Retention periods |
| ASP.NET_SessionId | Standard IIS session cookie to identify the user | Session cookies that are deleted when you close your browser |
| TempCookie | Random GUID value: used for session identification between Sitecore and IdentityProvider Server | |
| verbund#country | Country of the current user (https://sitecore.namics.com/2015/03/13/sitecore-cookies/) | |
| verbund#lang | Language of the current user (https://sitecore.namics.com/2015/03/13/sitecore-cookies/) | |
| SID | Session ID of the registered user in key accounts platform | |
| grosskunden#country | Country of the current user | |
| grosskunden#lang | Language of the current user | |
| idsrv.xsrf | Antiforgery Token (https://de.wikipedia.org/wiki/Cross-Site-Request-Forgery) | |
| idsrv.clients | Saves the clients for which the user is registered | |
| SignInMessage.XXX | The contextual information passed to the authorise endpoint. (https://identityserver.github.io/Documentation/docsv2/advanced/userService.html) |
6.3. Functional cookies
VERBUND also uses functional cookies which allow you to save and use stored searches and similar functions (e.g. selected language). These cookies are stored also after you close an internet session (permanent cookies) and are available when you visit the website again to enhance your use of the website. Some of these cookies process your personal data to make available the functionalities to you. However, we do not use these data to identify you as an individual.
| Cookie | Description | Retention periods |
| basketid | Basket allocation | 1 year |
| NSC_MCwtsw-xxx_wc-ofv-TTM | Saves the IP address and the webserver port to which the client is referred (see https://docs.citrix.com/en-us/netscaler/12/load-balancing/load-balancing-persistence/http-cookie-persistence.html) | 2 minutes |
| idsrv | If you have checked the "keep me logged in" functionality persistently. Otherwise, when you close your browser. |
|
| idsrv.session | If you have checked the "keep me logged in" functionality persistently. Otherwise, when you close your browser. |
|
| idsrv.username | Saves the last user name for preassignment in login | 1 year |
6.4. Performance cookies
VERBUND uses analytic cookies to analyse the use and to monitor the performance of the website. This feature allows us to establish, for example, which pages of our website are most often visited or how often content is retrieved on a given day, and what kind of content is retrieved. This allows us to adjust our offer and to provide first-class website experience, and to identify and rectify any problems that may arise without delay. If you visit our website, your user data are processed to compile statistic analysis without allowing us to identify you as an individual. These cookies will therefore not identify you.
| Cookie | Description | Retention periods |
| SC_ANALYTICS_GLOBAL_COOKIE | Sitecore Analytics to recognise a user on the website. | 10 years |
The following third-party cookies are transmitted and read out by domains of other service providers:
6.5. Web analytics cookies
Google Analytics
VERBUND uses Google Analytics, a web analytics service provided by Google Inc ("Google"). Google Analytics also uses cookies to analyse your use of the website. Information generated by the cookies on the use of this website is transmitted to and stored by a Google server in the United States. Please note that the code "gat._anonymizeIp();" was added to this website to guarantee the anonymisation of IP addresses. The IP addresses of users are therefore truncated on this website before they are stored on the Google servers (IP masking). The full IP address is therefore not transmitted to a Google server in the United States. Only in exceptional cases will the full IP address be transmitted to a Google server in the United States and truncated there. On behalf of VERBUND, Google will use this information for the purpose of evaluating your use of our website, for compiling synthesis reports on website activity for website operators, and for the purpose of providing other services relating to website activity and internet usage.
You can adjust the settings of your browser to prevent the installation of cookies ("browser add-on"); please note, however, that if you do this, you might not be able to benefit from the full functionality of this website.
Furthermore, you may download and install the browser plugin provided below to prevent the collection of data relating to your use of this website generated by the cookie (including your anonymised IP address) by Google and the processing of such data by Google. The current link is available under https://tools.google.com/dlpage/gaoptout?hl=en.
More information on Google’s terms of use and privacy policy can be found under http://www.google.com/analytics/terms/gb.html and under https://support.google.com/analytics/answer/6004245?hl=en.
Visual Website Optimizer (VWO)
We want to offer you optimised experience and functions. The development of our website is therefore based on A/B testing and multivariate analysis. We use Visual Website Optimizer, an analysis software provided by Wingify (http://wingify.com/) to run these tests and analyses. VWO allows us to measure and analyse anonymously how a visitor uses the pages of our website (clicks, mouse movement, scroll height). The information collected on the use of our website and the corresponding analyses on website activity are carried out according to data protection laws and do not use any personal data. We cannot identify you based on these anonymously measured parameters, for example based on your IP address or otherwise. Also cookies are used to produce meaningful test results. The program uses the relevant function on your browser to cache information temporarily in order to retrieve it later on. Unless cookies already expire at the end of a session, they are available for a maximum of 100 days (if you want to learn more about this, please go to https://vwo.com/knowledge/cookies-used-by-vwo/), except for the cookie which contains the information that the user wants to block the processing/storage of his or her data; this cookie will be available for a maximum of 10 years. You can delete the cookies on your browser at any time. You can also object to take part in these tests at all. If you want to exercise your right to object, please use the following link: https://vwo.com/opt-out/.
6.6. Remarketing cookies
Google Adwords Conversion Tracking
This website uses Google Conversion Tracking, a service provided by Google Inc. (Google LLC., 1600 Amphitheatre Parkway Mountain View, CA 94043, USA). Google Adwords places a cookie on the computer of a visitor if he or she was referred to our website via a Google advert. These cookies expire after 30 days and are not used to identify you. If the user visits certain pages of the Adwords client’s website and the cookie has not expired, Google and the client can see that the user has clicked the advert and was transferred to the site. A different cookie is assigned to each Adwords client. The cookies can therefore not be tracked via the websites of Adwords clients. Information collected via the conversion cookie is used to compile conversion statistics for Adwords clients that opted for conversion tracking. Adwords clients will learn the total number of users that have clicked their adverts and were referred to a site featuring a conversion tracking tag. However, they will not receive information which would allow them to identify the user. A user who does not want to take part in the tracking procedure can adjust the settings on his or her browser to generally disable the automatic placing of cookies. A user may also adjust the settings on his or her browser to disable cookies for conversion tracking to block cookies of the domain "www.googleadservices.com". If you want to learn more about Google’s privacy policy, please go to https://policies.google.com/privacy?hl=en.
DoubleClick by Google
This website uses DoubleClick, an online marketing tool provided by Google. DoubleClick uses cookies to display adverts which users might like to see, to enhance reports on advertising performance or to ensure that a user does not see the same adverts twice. Via a cookie ID, Google recognises which adverts are placed in which browser and can thus prevent that these are displayed more than once. Furthermore, based on cookie IDs, DoubleClick can capture conversions which refer to advert requests, for example if a user sees a DoubleClick advert and uses the same browser later on to visit the advertiser’s website and buys something there. According to Google, DoubleClick cookies do not contain personal data.
Due to the marketing tools used, your browser automatically and directly connects to the Google server. We have no influence over the scope and further use of data that Google collects using that tool. Based on the level of knowledge we have, we can provide the following information: By integrating DoubleClick, Google is informed that you have visited a certain part of our website or have clicked one of our adverts. Google is able to match that visit with your account if you have registered for a Google service. Even if you have not signed up for a Google service or are not logged in, the provider might find out and store your IP address.
A user who does not want to take part in the tracking procedure can adjust the settings on his or her browser to generally disable the automatic placing of cookies. A user may also adjust the settings on his or her browser to disable cookies for conversion tracking to block cookies of the domain "www.googleadservices.com". If you want to learn more about DoubleClick by Google, please go to https://www.doubleclickbygoogle.com/.
Google Tag Manager
This website uses Google Tag Manager, a feature that allows marketers to manage website tags on a surface. The tag manager tool as such (which implements the tags) is a domain that does not involve cookies and does not collect personal data. The tool insures that other tags are set which may, under certain circumstances, collect data. Google Tag Manager does not access such data. Any deactivation on domain or cookie level is effective also for all tracking tags implemented via Google Tag Manager.
Google Signals
VERBUND has activated Google Signals, a supplemental service of Google Analytics. This feature sends aggregated (non-personal) data, such as interests or demographics of Google users who have activated personalised advertisements, to Google Analytics. The data will be used by VERBUND for remarketing purposes. Cross-device user behaviour can also be measured. You can find more information about Google Signals at
https://support.google.com/analytics/answer/7532985?hl=de
6.7. Deactivation of cookies:
You can also adjust the settings on your browser to generally block all cookies. If you want to learn more on how to control cookies please go to http://www.aboutcookies.org/.
Please use the following links if you want to learn more on how to block cookies in all common browsers:
- Mozilla Firefox: https://support.mozilla.org/en-US/kb/delete-cookies-remove-info-websites-stored
- Internet Explorer: https://support.microsoft.com/de-de/help/17442/windows-internet-explorer-delete-manage-cookies
- Google Chrome: https://support.google.com/accounts/answer/61416?hl=en
- Safari: https://support.apple.com/kb/PH17191?locale=de_AT&viewlocale=en_US
You can delete all cookies stored on your computer and adjust the settings of most browsers to block cookies. However, please note that if you do this, you may not be able to use the full functionality of this website. In this case, you might have to adjust some settings manually whenever you visit this website and accept that some functions might not work properly.
7. Google Maps
This website uses "Google Maps", a service of Google (Google LLC., 1600 Amphitheatre Parkway Mountain View, CA 94043, USA) which provides information on geographical regions and sites. If you use this function, Google will also process the data relating to the use of this function by visitors of our website. If you want to learn more about Google’s privacy policy, please go to https://policies.google.com/privacy?hl=en.
8. 3rd Party Social Plugins
8.1. Facebook
This website uses Social Plugins of the social network www.facebook.com. Facebook Inc., of 1601 S. California Ave, Palo Alto, CA 94304, USA ("Facebook") offers plugins for website operators, which VERBUND has embedded on the pages of its website. You can recognise the plugins by the Facebook logo or the Facebook "Like" and "Recommend" buttons. If you visit a page of the VERBUND website that contains such a plugin, your browser will connect to the servers of the plugin provider. The content of the plugin is directly transmitted to your browser by Facebook and shown on the page. We cannot influence the content of the plugin that is shown. Facebook might be able to track your visit of the corresponding pages of the website and match it with a Facebook account if you have signed up for Facebook or have recently visited a Facebook page or a page containing Facebook content. If you actively use plugins, for example by clicking the "Like" button or recommending a page, your browser will transfer the corresponding information directly to Facebook, without any influence on our part. If you do not want Facebook to collect information when you visit a website, you should read the privacy policy on the Facebook website http://www.facebook.com/policy.php and/ or log out of Facebook before you visit a page that embeds a social plugin.
If you want to learn more about the purposes for which Facebook collects data, which data are collected by Facebook and how they are used, which rights you have and how you can adjust your settings to protect your privacy, you should read the privacy policy of Facebook http://www.facebook.com/policy.php.
If you do not want Facebook to match your visit of our website with your Facebook account, you should log out of your Facebook account.
8.2. Twitter
Our pages embed functions of Twitter, a service provided by Twitter Inc., of 795 Folsom St., Suite 600, San Francisco, CA 94107, USA ("Twitter") that offers plugins for website operators which VERBUND uses on the pages of its website. You can recognise the plugins by the Twitter "Tweet" or "Follow" buttons. Pages featuring these plugins establish a direct connection to Twitter and transfer different data, depending on your Twitter login status. This might enable Twitter to extract information on your internet use on the VERBUND websites, which Twitter might use for its own purposes. Content of the plugins is kept on Twitter servers and is only displayed on the VERBUND website. VERBUND has no influence over the purposes for which Twitter collects data, which data are collected and how Twitter processes data, nor is VERBUND able to access such data.
If you want to know more about the purposes for which Twitter collects data, which data are collected by Twitter and how they are used, which rights you have and how you can adjust your settings to protect your privacy, please go to http://twitter.com/privacy. You can adjust the settings of your account to change your Twitter privacy settings at http://twitter.com/account/settings .
8.3. Google
VERBUND uses the "+1″ button of Google Plus, a social network provided by Google Inc., 1600 Amphitheatre Parkway, Mountain View, CA 94043, United States ("Google"). You can recognise the plugins by the Google-Plus-One button. Pages featuring these plugins establish a direct connection to Google and transfer different data, depending on your Google login status. This allows Google to extract information on your internet use on the VERBUND websites or on the search engine hits on Google. Content of the plugins is kept on Google servers and only displayed on the VERBUND website. VERBUND has no influence over the purposes for which Google collects data, which data are collected and how Google processes data, nor is VERBUND able to access such data. If you want to know more about the purposes for which Google collects data, which data are collected by Google and how they are used, which rights you have and how you can adjust your settings to protect your privacy, please go to http://www.google.com/intl/en/+/policy/+1button.html.
If you are a Google Plus member and do not want Google to collect information about you via our website and to merge such data with your membership data stored with Google, you have to log out of Google Plus before you visit our website.
8.4. Instagram
Our website embeds functions of Instagram, a service provided by Instagram Inc., 1601 Willow Road, Menlo Park, CA, 94025, United States. When you are logged into Instagram, you can click the Instagram button to link the content of our website with your Instagram profile. This allows Instagram to match your visit of our website with your user account. Please note that we are not aware which data are collected and transferred and how they are used by Instagram. If you want to learn more about Instagram’s privacy policy, go to https://www.instagram.com/about/legal/privacy.
9. Comment plugin
VERBUND has embedded Disqus, a comment plugin for website operators provided by Big Head Labs Inc., 589 Howard Street, San Francisco, CA 94105, USA ("Disqus") on its websites.
You can recognise the plugin by the comment area (comment box and comment summary) and the Disqus logo. Pages featuring these plugins establish a direct connection to Disqus and transfer the comments previously stored with VERBUND. You can log in on the Disqus website at disqus.com or via your personal accounts with Facebook, Twitter, Yahoo, Google, OpenID and others. Authentication also works via a valid email address. disqus.com is managed and provided by its operator in the United States, the original controller according to data protection laws.
The data privacy policies of disqus.com are available at http://docs.disqus.com/help/30/ and http://docs.disqus.com/help/29/. Disqus collects and processes the personal data you have provided when you use the comment feature, both in respect of the use of an existing Disqus account and also if you use the comment feature as a "guest". If you sign up for disqus.com via a third service (e.g. Facebook, Twitter, Yahoo or other OpenID accounts ), also these providers might store, process and use data. If you want to learn more about that, please read the privacy policies of these providers.
VERBUND will know not only the text of your comment and your user name, but also the email address provided for authentication and your IP address. The email address will be used only for communication if problems arise and services are contracted and may be stored within the VERBUND group for these purposes.
10. Rights of the data subject
10.1. Right to information
You have the right to obtain information from us on all your data processed by VERBUND. You have the right to obtain information as to whether your personal data will be transferred to a third state or to an international organisation. You may demand information in this context on whether we have provided appropriate safeguards according to Article 46 GDPR in connection with the transfer of your data.
10.2. Right to rectification and right to restriction of processing
You have the right to obtain the rectification of inaccurate data and the right to have incomplete data completed. Under certain circumstances, for example if the accuracy of data is contested, you have the right to obtain the restriction of processing; in this event, data may only be processed with your consent or for the establishment, exercise or defence of legal claims or for the protection of the rights of another natural or legal person or for reasons of important public interest.
10.3. Right to data portability
You have the right to request that VERBUND transmit to you or to a third party nominated by you, where technically feasible, a copy of your data in a structured, commonly used and machine readable format. Furthermore, you have the right to transmit such data to another controller without hindrance from the controller to which the data have been provided, whereby
(1) the processing is based on consent pursuant to point (a) of Article 6(1) or point (a) of Article 9(2) or on a contract pursuant to point (b) of Article 6(1) GDPR and
(2) the processing is carried out by automated means.
In exercising this right to data portability, you also have the right to have the personal data transmitted directly from one controller to another, where technically feasible. This right shall not adversely affect the rights and freedoms of others.
10.4. Right to erasure
You have the right to obtain erasure of data under certain circumstances, if the data have been unlawfully processed.
The so-called "right to be forgotten" is not applicable, because VERBUND will not publish your personal data under any circumstances.
If you have exercised the right to rectification, erasure or restriction of processing vis-à-vis VERBUND, we are obliged to communicate any rectification or erasure of data or restriction of processing to each recipient to whom the personal data have been disclosed, unless this proves impossible or involves disproportionate effort.
10.5. Right to object
You have the right to object at any time, on grounds relating to your particular situation, to the processing of your personal data which is based on point (e) or (f) of Article 6(1) GDPR.
In this case, VERBUND will no longer process your personal data, unless we can demonstrate compelling legitimate grounds for the processing which override your interests, rights and freedoms or for the establishment, exercise or defence of legal claims.
10.6. Right to withdraw consent
You have the right to withdraw your data privacy consent at any time. Even if you withdraw your consent, the lawfulness of processing operations carried out until you have withdrawn your consent shall not be affected.
10.7. Supervisory authority
Notwithstanding any other remedies, if you feel that your personal data were unlawfully processed, you may lodge a complaint with the national supervisory authority in your place of residence. In Austria, this supervisory authority is the Data Protection Authority.
As at: 25/5/2018