Terms of Use

When you access our website for information purposes only, you are not required to actively provide any personal data. In this case, we only process the technical access data that your internet browser automatically transmits to our server. This includes:

• The date and time of access to one of our subpages;

• The browser type, browser version and language settings;

• The operating system used;

• The referring website (referrer URL);

• The volume of data transferred and the HTTP status code returned; and

• Your IP address.

The processing of this data is technically necessary to display our website and to ensure the stability, security and proper functioning of our IT systems. Where technically necessary information is stored on or accessed from your terminal equipment for this purpose, this is done on the basis of Section 165(3) of the Austrian Telecommunications Act 2021 (TKG 2021), as such storage or access is strictly necessary to provide the service explicitly requested by you.

The personal data listed above are processed on the basis of Article 6(1)(f) GDPR. Our legitimate interest lies in providing a secure, stable and properly functioning website.

Server log files are generally stored for up to 7 days and are then erased or anonymised. They may be retained for longer, for up to 60 days, only where there are specific indications of a security incident or unlawful attack (e.g. DDoS attacks or unauthorised access attempts). This extended retention is necessary to investigate and prevent such incidents and, where appropriate, take legal action. At the end of this period, the data are erased or anonymised. These data are not combined with data from other sources or analysed for marketing purposes in a way that identifies individuals.

We use Vercel Inc., 440 N Barranca Avenue #4133, Covina, CA 91723, USA (“Vercel”), as our hosting service provider. We have concluded a data processing agreement with Vercel in accordance with Article 28 GDPR. We have selected the Frankfurt am Main (Germany) server region to run the server-side functions of our website. In the course of providing hosting services, Vercel processes, in particular, metadata and communications data relating to visitors to our website (such as IP addresses and technical information about website visits).

Vercel uses a global network to deliver website content. Despite our selection of the Frankfurt am Main region, it cannot therefore be ruled out that connection data required for technical purposes may also be processed outside the EU or EEA, in particular in the USA. Vercel is certified under the EU-U.S. Data Privacy Framework, meaning that transfers of personal data to the USA may take place on the basis of the European Commission’s adequacy decision pursuant to Article 45 GDPR. In addition, the data processing agreement provides for the European Commission’s Standard Contractual Clauses pursuant to Article 46(2)(c) GDPR.

Further information is available in Vercel’s Privacy Policy at https://vercel.com/legal/privacy-policy and its Data Processing Addendum at https://vercel.com/legal/dpa.

We use a content delivery network (CDN) and security features (e.g. DDoS protection and a web application firewall) provided by Cloudflare, Inc., 101 Townsend St., San Francisco, CA 94107, USA (“Cloudflare”). A CDN enables the fast, secure and reliable delivery of the content on our website through a globally distributed network of servers. In this context, Cloudflare processes, in particular, IP addresses, system configuration information and other technical connection and access data. The purpose of using these services is to ensure the efficient delivery of our website and maintain its security and functionality, particularly by protecting it against malicious attacks and server overload.

We use these services on the basis of our legitimate interests in ensuring the secure and efficient provision of our website, pursuant to Article 6(1)(f) GDPR. We have concluded a data processing agreement with Cloudflare in accordance with Article 28 GDPR.

In connection with the use of Cloudflare, personal data may also be processed outside the EU or EEA, in particular in the USA. Cloudflare is certified under the EU-U.S. Data Privacy Framework. To the extent that transfers to Cloudflare in the USA are covered by this certification, they take place on the basis of the relevant European Commission adequacy decision pursuant to Article 45 GDPR. In addition, the European Commission’s Standard Contractual Clauses pursuant to Article 46(2)(c) GDPR have been agreed with Cloudflare.

Further information is available in Cloudflare’s Privacy Policy at https://www.cloudflare.com/de-de/privacypolicy/ and its Data Processing Agreement at https://www.cloudflare.com/de-de/cloudflare-customer-dpa/.

We use the CRM solution provided by CAS Software AG, CAS-Weg 1–5, 76131 Karlsruhe, Germany (hereinafter referred to as the “CRM System”), to manage our Foundation’s contacts, project partnerships, activities and events. The CRM System supports us in fulfilling the Foundation’s charitable purposes, in particular by maintaining and developing partnerships and collaborations in pursuit of the objectives set out in our statutes in the fields of education, science and the arts.

The CRM System serves as a central platform for managing the master data of our project and cooperation partners, scholarship holders, award recipients, educational and research institutions, event participants, suppliers and other interested parties and contacts. It also records enquiries and other activities relating to the Foundation, such as the distribution of information about projects and events, correspondence and project documentation. Depending on the nature of the relationship with our Foundation, we process the following categories of personal data in particular:

• Personal identification and address data: including academic degrees and titles, positions and affiliations with organisations or educational institutions;

• Communication and contact details: e.g. telephone numbers and email addresses;

• Project and contractual master data: information relating to applications, participation in competitions, project agreements, cooperation arrangements and orders;

• Communication, project and event history: correspondence, invitations and participation in Foundation events and award ceremonies;

• Accounting, payment and banking details: e.g. for the payment of grants, scholarships and prize money, and for invoice processing;

• Planning and organisational data: information required for the planning and implementation of Foundation projects;

• Special categories of personal data within the meaning of Article 9(1) GDPR: e.g. voluntary disclosures concerning allergies, food intolerances or accessibility requirements in connection with event registrations. Such data are processed exclusively on the basis of your explicit consent pursuant to Article 9(2)(a) GDPR.

The processing of the above-mentioned data in the CRM System serves the following purposes and is based on the following legal grounds:

• Contractual and project administration: initiating, managing and settling project agreements, competition entries, event registrations and supplier contracts, on the basis of Article 6(1)(b) GDPR;

• Foundation administration and network management: maintaining structured contact records, handling enquiries efficiently, documenting the Foundation’s activities, and organising and issuing invitations to events and initiatives relating to the Foundation’s work in education, science and the arts. This processing is based on our legitimate interests pursuant to Article 6(1)(f) GDPR in ensuring the orderly administration of the Foundation and conducting public relations activities in pursuit of its charitable purposes. You have the right to object at any time to processing based on Article 6(1)(f) GDPR, in accordance with Article 21 GDPR.

Access to our CRM System is governed by a role-based access control system. Users must log in separately and undergo an authorisation check, in accordance with the need-to-know principle. All access to the CRM System and the data it contains is logged.

Where necessary for the respective purposes, data processed through the CRM System may be disclosed to the following categories of recipients:

• Internal recipients: relevant employees and governing bodies within our Foundation (e.g. project managers and the Board of Trustees);

• Maintenance, hosting and IT support: CAS Software AG, as the provider of our CRM solution, and other IT service providers engaged by us may be granted access to the system in connection with system administration, hosting, maintenance and support requests. Data processing agreements in accordance with Article 28 GDPR have been concluded with these service providers;

• Event management and project partners: for the organisation and implementation of Foundation events, award ceremonies, competitions and joint projects in the fields of education, science and the arts, necessary data may be disclosed to participating cooperation partners (e.g. universities, educational, scientific and cultural institutions, and jury members) or event service providers (e.g. event venues and seminar providers).

We store the data recorded in the CRM System for the duration of the respective project, grant or contractual relationship. Other contact details relating to interested parties and network partners are erased as soon as they are no longer necessary for the fulfilment of the Foundation’s purposes or if you object to their further processing. Where data are subject to statutory retention obligations (in particular, books, supporting documents and contracts and grant-related records relevant to accounting pursuant to Section 212 of the Austrian Commercial Code (UGB) and Section 132 of the Austrian Federal Fiscal Code (BAO)), they are retained in a restricted form for the statutory period of seven years (or for any longer applicable grant-related or legal limitation periods) and erased once the relevant retention period has expired.

Depending on the nature of your enquiry, the processing of your personal data when you contact us by email, telephone or contact form is based on the following legal grounds:

• Where your enquiry relates to entering into or performing a grant agreement, participating in an event or another contractual relationship, the legal basis is Article 6(1)(b) GDPR;

• For all other enquiries, the legal basis is our legitimate interest pursuant to Article 6(1)(f) GDPR in responding appropriately to enquiries and maintaining the Foundation’s relationships with its partners and other contacts.

You have the right to object at any time to processing based on Article 6(1)(f) GDPR, in accordance with Article 21 GDPR.

Once your enquiry has been fully dealt with, your personal data are erased from our active systems, unless an ongoing project, grant or business relationship exists (see Section B.3) or statutory retention obligations (in particular, the seven-year retention requirements under Section 212 of the Austrian Commercial Code (UGB) and Section 132 of the Austrian Federal Fiscal Code (BAO) for business-related or accounting correspondence) require longer retention.