Data Protection

The controller of the website www.kaiserschild-stiftung.at, within the meaning of Article 4(7) of the General Data Protection Regulation (GDPR), is:

Gemeinnützige Privatstiftung Kaiserschild

(charitable private foundation established under the Austrian Private Foundation Act, with its registered office in Hieflau, FN 304326p)

Jassingau 23

8920 Hieflau-Landl,

Österreich

E-Mail: [email protected]

The Foundation is represented by its Executive Board, comprising:

• Marco Alfter

• Anna Maria Bischof

• Univ.-Prof. i.R. Dr. Markus Achatz

If you have any questions or comments regarding this Privacy Notice or data protection matters in general, please contact us by email or post using the contact details provided above.

You may exercise the following rights free of charge by contacting the controller, subject to the applicable legal requirements:

• Right to withdraw consent: You may withdraw your consent at any time (Article 7(3) GDPR).

• Right of access: You may request access to the personal data we process about you (Article 15 GDPR).

• Right to rectification or erasure: You may request the correction of inaccurate personal data or the deletion of your data (Articles 16 and 17 GDPR).

• Right to restriction of processing: You may request that the processing of your personal data be restricted (Article 18 GDPR).

• Right to data portability: You may request to receive your personal data in a structured, commonly used and machine-readable format (Article 20 GDPR).

• Right to object: You may object to the processing of your personal data where such processing is based on Article 6(1)(e) or Article 6(1)(f) GDPR (Article 21 GDPR).

Where the processing of your personal data is based on your consent, you may withdraw that consent at any time with effect for the future. Withdrawal of consent does not affect the lawfulness of processing carried out before the withdrawal.

If you believe that our processing of your personal data infringes the provisions of the GDPR or the Austrian Data Protection Act (Datenschutzgesetz – DSG), you have the right to lodge a complaint with a data protection supervisory authority pursuant to Article 77 GDPR in conjunction with Section 24 DSG.

In Austria, the competent supervisory authority is:

Austrian Data Protection Authority (Datenschutzbehörde – DSB)
Barichgasse 40–42
1030 Vienna
Email: [email protected]
Website: https://www.dsb.gv.at

As a general rule, we only process personal data where a legal basis for doing so exists. The legal basis applicable to each individual processing activity is explained in the relevant sections of this Privacy Notice. The following applies in general:

Where we obtain the consent of the data subject to the processing of personal data, the legal basis is Article 6(1)(a) in conjunction with Article 7 GDPR.

Where the processing of personal data is necessary for the performance of a contract or a grant agreement, the legal basis is Article 6(1)(b) GDPR. This also applies to processing activities necessary in order to take steps at the request of the data subject prior to entering into a contract.

Where the processing of personal data is necessary for compliance with a legal obligation to which our Foundation is subject, the legal basis is Article 6(1)(c) GDPR.

Where the processing of personal data is necessary for the purposes of the legitimate interests pursued by our Foundation or a third party, except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject which require protection of personal data, the legal basis is Article 6(1)(f) GDPR.

The personal data we process are erased or restricted in accordance with the applicable legal requirements, in particular Articles 17 and 18 GDPR. Where no specific storage periods are stated in this Privacy Notice, we retain personal data only for as long as is necessary for the purposes for which they are processed. The data are then erased unless statutory retention obligations (in particular, retention obligations under company, foundation or tax law pursuant to Section 212 of the Austrian Commercial Code (UGB) and Section 132 of the Austrian Federal Fiscal Code (BAO)) or legitimate interests (e.g. the establishment, exercise or defence of legal claims) prevent their erasure. In such cases, processing of the data is restricted, meaning that the data are blocked from being processed for any other purpose.

We use external service providers to process some of your personal data. These services help us ensure that our website is functional, secure and visually appealing, and enable us to carry out the Foundation’s activities efficiently.

Where service providers act as processors, they are bound by our data protection instructions under a data processing agreement in accordance with Article 28 GDPR. We carefully select these processors and monitor them regularly. They include, in particular, IT service providers responsible for maintenance and support, as well as hosting and infrastructure providers involved in operating our IT systems and this website (e.g. web hosting and backup services).

Where personal data are transferred across borders to a third country outside the European Union (EU) or the European Economic Area (EEA), we provide separate information in the relevant sections of this Privacy Notice about the recipient and the applicable legal basis. Transfers of personal data to recipients in third countries take place on the basis of an adequacy decision adopted by the European Commission pursuant to Article 45 GDPR or appropriate safeguards, in particular the European Commission’s Standard Contractual Clauses pursuant to Article 46(2)(c) GDPR.

Under the EU-U.S. Data Privacy Framework (DPF), the European Commission adopted an adequacy decision on 10 July 2023, recognising that certified organisations in the United States ensure an adequate level of data protection. The list of certified organisations and further information about the Data Privacy Framework are available on the website of the U.S. Department of Commerce at https://www.dataprivacyframework.gov. The relevant sections of this Privacy Notice specify which of the U.S. service providers we use are certified under the Data Privacy Framework.

Our website may contain links to third-party websites. Please note that, if you follow a link to one of these websites, the respective website is subject to its own privacy provisions and we are not responsible for the processing of personal data carried out there. Before providing personal data on any such website, please consult the privacy notice of the relevant provider.

We implement technical and organisational measures in accordance with Article 32 GDPR to protect personal data, in particular against accidental or unlawful alteration, loss or destruction, and against unauthorised access. We continuously improve our security measures in line with technological developments. When transmitting your data via our website, we use transport encryption that meets current technological standards (TLS – Transport Layer Security).

Our online services are not intended for minors under the age of 14 who lack legal capacity (§ 4(4) Austrian Data Protection Act (DSG)). Where individual programmes, competitions or events organised by our Foundation are aimed at school students, we comply with the applicable legal requirements concerning the capacity to give consent and the involvement of parents or legal guardians.

Unless expressly stated otherwise in the following sections, you are under no statutory or contractual obligation to provide your personal data. However, certain data are required in order to use specific services (e.g. to process enquiries, grant applications or event registrations). If you do not provide the required data, we will be unable to process your enquiry or request (Article 13(2)(e) GDPR).

No decision is based solely on automated processing, including profiling, within the meaning of Article 22 GDPR (Article 13(2)(f) GDPR).