Data Protection Declaration of the University of Vienna
As of: 31 October 2022
Thank you for visiting the websites of the University of Vienna. The protection and security of your data is of the utmost importance to us. Therefore, we would like to take the opportunity to inform you about which of your personal data are collected, in particular, when you visit our websites and for which purposes these data are used. Please note that this Data Protection Declaration only applies to the general data processing activities of the University of Vienna. The University of Vienna informs the data subjects about any further data processing separately, possibly referring to this general General Data Protection Declaration. Since legislative changes or changes to our internal processes may require an adjustment of this Data Protection Declaration, we ask you to consult it on a regular basis. The Data Protection Declaration is available for download and print at dsba.univie.ac.at/en/data-protection-declaration/ at any time.
§ 1 Controller and scope
The controller according to the General Data Protection Regulation (GDPR) and other national data protection acts of member states as well as other statutory data protection regulations is:
University of Vienna
Universitätsring 1
1010 Wien
E-mail: dsba@univie.ac.at
Website: univie.ac.at
This Data Protection Declaration applies to all websites of the University of Vienna available under the domain univie.ac.at as well as the associated subdomains (henceforth “our websites” or “web presence”). In addition, it applies to the data processing activities specified below. From a functional perspective, the Data Protection Declaration applies to all organisational units of the University of Vienna. Information about data protection when using cloud services is provided in the University of Vienna’s data protection declaration for cloud services (in German), available at: Data Protection Declaration of the University of Vienna – cloud services and other IT applications (PDF, in German)
§ 2 Data protection officer and contact persons
The controller has authorised the following external data protection officers:
Daniel Stanonik and Karsten Kinast, representing each other alternately
If the rights of data subjects according to section 13 of this Data Protection Declaration (e.g. right to information, right to erasure, etc.) are asserted, the relevant requests or applications must be sent to dsba@univie.ac.at or via mail to:
University of Vienna
Data protection officer of the University of Vienna
Universitätsring 1
1010 Wien
§ 3 What are personal data?
Personal data is individual information concerning personal or material details of an identified or identifiable natural person (data subject). These include, for example, information, such as your name, address, telephone number, date of birth and e-mail address. Information that cannot be linked to your person (or only involving a disproportionate effort), such as anonymised information, is not considered personal data.
§ 4 General information about data processing
a) Scope
As a general principle, we collect and use personal data of our users only to the extent that is necessary for carrying out the relevant data processing activity. We use your personal data to provide information, products and desired services offered by the University, to answer your questions, to fulfil our legal mandate and statutory obligations, as well as to operate and improve our websites and applications.
We collect and use personal data of our users only based on a relevant legal foundation in accordance with the GDPR, e.g. only if the individual user has given their consent. Further details regarding the individual consents granted are specified in section 7 of this Data Protection Declaration under the respective processing activity.
Your personal data will not be used for any other purpose. Your personal data will not be transferred to third parties or used, for example, for advertising purposes without your consent, except in the cases specified below, and unless we are required by law to disclose the data.
b) Legal basis
Where processing is subject to the data subject's consent to the processing of their personal data, the legal basis for the processing is article 6, para. 1, sub-para. a of the EU General Data Protection Regulation (GDPR). If the processing of personal data is necessary to perform a contract to which the data subject is a party, article 6, para. 1, sub-para. b of the GDPR provides the legal basis. This also applies to processing activities that are necessary to take necessary steps prior to entering into a contact. Where processing of personal data is necessary for compliance with a legal obligation to which the University of Vienna is subject, article 6, para. 1, sub-para. c of the GDPR provides the legal basis.
If the processing of personal data is necessary to protect the vital interests of the data subject or of another natural person, article 6, para. 1, sub-para. d of the GDPR provides the legal basis. If the processing is necessary for the purposes of the legitimate interests pursued by the University of Vienna or a third party, except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject, article 6, para. 1, sub-para. f of the GDPR provides the legal basis for the processing activity.
If the University of Vienna processes personal data for academic and research purposes, the University of Vienna reserves the right to use suitable provisions specified in the Forschungsorganisationsgesetz (Austrian research organisation act, FOG) as a legal basis in addition to the legal foundations specified above. This also applies in connection with a declaration of consent (broad consent) with regard to the special provisions pursuant to section 2d, para. 3 of the FOG.
c) Erasure of data and storage period
Personal data of the data subject will be erased or blocked as soon as the purpose of the processing activity has been fulfilled. Furthermore, data may also be stored if specified by the European or national legislative authority in Union law regulations, laws, or other regulations to which the controller is subject. Personal data will also be erased or blocked when a storage period stipulated by one of the norms listed above expires, unless it is necessary to further store the data for the purpose of concluding or executing a contract.
d) Transfer of data to third countries
We do not transfer any personal data to third countries unless we expressly inform you about this. In this case, the transfer of personal data to third countries takes place in accordance with articles 45 and 46 of the GDPR. In the absence of an adequacy decision by the European Commission, standard protection clauses adopted in accordance with article 46 of the GDPR guarantee an adequate level of protection. In individual cases, we will also obtain your consent for the transfer of personal data to third countries. In this case, it is our obligation to inform you that the level of data protection in third countries might not be comparable to that in the European Union. This poses a risk to your personal data since they may be accessed, in particular, by public authorities which are not subject to the legal protection mechanisms applicable within the European Union.
§ 5 Transfer of data to third countries during professorial appointment procedures, habilitation procedures or similar procedures
During a professorial appointment procedure, habilitation procedure or similar procedure (e.g. doctoral procedure), your personal data are transferred to external reviewers who may be located in third countries outside the European Union or the European Economic Area. These third countries may have a lower statutory level of data protection. However, we have to transfer your personal data to allow for a review of your documents. The processing of your personal data is based on article 6, para. 1, sub-para. c of the GDPR and section 2g of the Austrian Forschungsorganisationsgesetz (research organisation act, FOG). The transfer of data is permissible according to article 49, para. 1, sub-para. b and sub-para. c of the GDPR as well as with to article 49, para. 1, sub-para. d of the GDPR.
§ 6 Processing of event photographs
We organise different events, such as lectures, conferences and similar events, also outside of regular teaching hours. During these events, we may take photographs or make video recordings of the event participants. We use and process these photographs/videos to present the event, offline and/or online (e.g. in magazines, on social media or on websites).
The legal basis for the data processing specified above is determined in article 6, para. 1, sub-para. f of the GDPR and section 12, para. 2, sub-para. 4 of the Austrian Data Protection Act (Datenschutzgesetz, DSG). The processing of the data specified above is necessary for the presentation of the events. Therefore, it serves the purposes of the legitimate interests pursued by the University of Vienna. Where necessary, we will obtain your consent to the processing of your photographs (article 6, para. 1, sub-para. 1 of the GDPR).
The University of Vienna erases photographs and videos as soon as they are no longer required for a legitimate interest to present the relevant event. This may be the case, for example, if the University does not have to advertise the event any longer because there will be no follow-up event.
§ 7 Individual processing activities
If you wish to use services provided by us, such as our course offers, newsletter subscriptions, the u:account, etc., you have to provide further data. For further details see the description of specific data processing activities below. In particular, personal data are used as follows:
a) Registration/user account
We offer our users the possibility to register for the u:account service available at zid.univie.ac.at/en/uaccount/ on our websites. To register for the u:account service, users have to provide personal data. The u:account is available to students and employees of the University of Vienna as well as to persons authorised by employees of the University of Vienna. After users have entered the required data in an input mask, the data are transferred to and stored by the University of Vienna. We will not transfer your personal data to third parties. The following data are collected during the registration process and will be erased after no more than 30 days:
- IP address of the calling computer
- Date and time of access
- Name and URL of the retrieved file
- Volume of data transmitted
- Message whether the request was successful
- Identification data of the accessing browser as well as operating system Website from which the user accessed the service
When you register for the u:account service, the following personal data are collected:
- Name (*)
- E-mail address (*)
- Social security number
- Date of birth (+)
- Gender (+)
Mandatory fields are marked with (*). Mandatory fields for prospective students are marked with (+). All other data is provided voluntarily by the data subject in the course of registration.
The legal basis for the processing of these personal data of students of the University of Vienna is article 6, para. 1, sub-para. c of the GDPR. The legal basis for the processing of these personal data of employees of the University of Vienna as well as of persons authorised by employees of the University of Vienna is article 6, para. 1, sub-para. b of the GDPR. For data provided voluntarily in the course of registration, article 6, para. 1, sub-para. a of the GDPR provides the legal basis.
User registration is a prerequisite for making available certain contents and services of the University of Vienna. Due to the continuously changing range of contents and services offered, it is not possible to provide an exhaustive list.
The use of the u:account is inseparably linked to the relevant relationship (e.g. student, employee, contracting partner) to the University of Vienna and must be used accordingly. The relevant data are stored in compliance with section 53 of the 2002 Universities Act (UG). Therefore, the u:account and its contents will be erased after the legal storage period in accordance with section 53 of the 2002 Universities Act has expired.
If the relevant data are necessary for the performance of a contract or to take necessary steps prior to entering into a contract, early erasure of these data is only possible if no contractual or statutory obligations prohibit it.
b) Administration of studying and teaching
For the administration of studying and teaching, the University of Vienna is operating numerous applications that can be used after logging in with the u:account (see section 7a), for example, applying for admission to a degree programme as well as registering for exams and courses. To operate these applications, the University collects, stores and processes personal data (such as name, address, date of birth, student ID number). The following tables specify the data processed and the corresponding legal basis for data processing.
The following abbreviations for laws and regulations are used:
- Universitätsgesetz 2002 (2002 Universities Act, henceforth “UG”)
- Universitätsberechtigungsverordnung (ordinance governing university entrance qualification, henceforth “UBVO”)
- Personengruppenverordnung 2018 (ordinance governing admission of certain groups of persons, henceforth “PersGV 2014”)
- Universitäts- und Hochschulstatistik- und Bildungsdokumentationsverordnung (ordinance governing university and higher education statistics and education documentation, henceforth “UHSBV”)
- Studienbeitragsverordnung (ordinance governing tuition fees, henceforth “StubeiV”)
- Allgemeines Verwaltungsverfahrensgesetz 1991 (General Administrative Procedure Act 1991, henceforth “AVG”)
- Bildungsdokumentationsgesetz 2020 (education documentation act, henceforth “BiDokG”)
- Zustellgesetz (service of documents act, henceforth “ZustellG”)
- Studienförderungsgesetz 1992 (student support act, henceforth “StudFG”)
- Hochschülerinnen- und Hochschülerschaftsgesetz 2014 (union of students act, henceforth “HSG”)
According to article 81c, para. 1 of the Austrian Federal Constitutional Law (B-VG), the University has the right to issue regulations and statutes within the framework of the law. In the administration of studying and teaching, the University exercises powers conferred by public law and has issued, in particular, the following regulations:
- Statutes of the University of Vienna, available in the University Gazette of the University of Vienna
- Regulations of the University of Vienna, published in the University Gazette of the University of Vienna in accordance with section 20, para. 6 of the Universities Act (UG), in particular:
- Regulations on the specification of admission periods and admission procedures (sections 60ff of the UG)
- Regulation on the university entrance qualification examination (section 64a of the UG)
- Regulations on the entrance exam procedures/aptitude tests for degree programmes with special admission requirements
- Regulations on the provision of evidence of language proficiency as part of the admission procedure
- Curricula for established degree programmes according to sections 54ff of the UG
- Regulations on the recognition of examinations
- Regulations on the allocation of places in courses
- Regulations on deviating digital modes of assessment for special groups of students in accordance with section 13i of the part of the Statutes governing university studies
In case an appeal is lodged against decisions of the University in matters of sovereign tasks in accordance with the provisions specified in articles 129ff of the B-VG and the Austrian VerwaltungsgerichtsbarkeitsNovelle 2012 (amendment to the administrative jurisdiction act), the University, for the purpose of ensuring compliance with the law, has the right and the obligation to transfer the required decisionrelevant personal data to the relevant bodies. In accordance with section 22 of the B-VG and section 46, para. 6 of the 2002 Universities Act, the University of Vienna is obliged to provide assistance within its scope of action.
For students enrolled in a jointly established teacher education programme in accordance with the Bundesrahmengesetz zur Einführung einer neuen Ausbildung für Pädagoginnen und Pädagogen (framework legislation on the introduction of a new teacher education programme, Federal Legal Gazette No. 124/2013 as amended) to obtain a teaching degree for secondary schools (general education) in Vienna and Lower Austria and/or for prospective students and new entrants, the University of Vienna collects and manages the data listed below. The personal data required for the administration of teaching and examinations are transferred to partner institutions, in particular, via the data network of the universities and higher education institutions (§ 10 BilDokG) and via the Austrian Higher Education Systems Network (§ 11 BilDokG). Pursuant to section 54 c of the 2002 Universities Act, the following institutions are partner institutions cooperating within the North-East Schools’ Group:
- University College of Teacher Education of Christian Churches Vienna/ Krems, Mayerweckstraße 1, 1210 Vienna
- University College of Teacher Education in Lower Austria, Mühlgasse 67, 2500 Baden
- University College of Teacher Education in Vienna, Grenzackerstraße 18, 1100 Vienna
- University College for Agrarian and Environmental Pedagogy, Angermayergasse 1, 1130 Vienna
For students who are enrolled on other jointly established degree programmes or joint degree programmes, the corresponding cooperation agreement between the partner institutions provides the legal basis for collecting, processing and storing data. The transfer of data to partner institutions within Austria may take place via the data network of the universities and higher education institutions (§ 10 BilDokG) and via the Austrian Higher Education Systems Network (§ 11 BilDokG), if this is specified in the cooperation agreement.
If the processing requires a transfer of the listed data to third parties, the data will be transferred to the following recipients:
| Data network of the universities and higher education institutions according to section 10 of the BilDokG and/or university colleges of teacher education within the North-East Schools’ Group according to section 54c of the 2002 Universities Act | 1 |
| Statistics Austria | 2 |
| Bank of the University of Vienna | 3 |
| Recipient bank | 4 |
| Austrian National Union of Students and Austrian National Union of Students at the University of Vienna according to the 2002 Universities Act and the HSG | 5 |
The second column specifies the legal basis for the processing of personal data. Below you will find the main legal foundations (especially statutory foundations [incomplete list]). In all other respects, please refer to sections 3 and 18 of the BilDokG. Due to their central role, these data categories together with the legal foundations are presented in a table:
Master data
| Name | § 9 BilDokG, § 74 UG, § 53 UG, § 6, § 13, § 43 HSG | 1, 5 |
| Student ID number | § 9 BilDokG, § 74 UG, § 53 UG, § 6, § 13, § 43 HSG | 1, 5 |
| u:account information | internal university regulation, see service above | |
| u:account e-mail address | internal university regulation, § 6, § 13, § 43 HSG | 1, 5 |
Other personal data
| Bereichsspezifisches Personenkennzeichen (areaspecific personal code; bPK) | § 9 BilDokG | 1, 5 |
| Bildungsevidenzkennzahl (education evidence index; BEKZ) | § 24 Abs. 8 BilDokG | 1 |
| Social security number/alternative identifier | § 3 BilDokG | 1, 5 |
| Awarded/other academic degrees | § 9 BilDokG | 1 |
| Date of birth | § 9 BilDokG | 1 |
| Gender | § 9 BilDokG | 1, 5 |
| Nationality, Certificate of nationality | § 9 BilDokG | 1, 5 |
| Bank details (for tuition fee reimbursement or merit scholarships) | Consent | 3, 4 |
| Home address and, if additionally available, address of the place of residence located nearest to the educational institution (delivery address) | § 9 BilDokG | |
| Private e-mail address | § 9 BilDokG; after admission, the University exclusively uses the u:account e-mail address to provide information and for communication. | |
| Photograph (proof of identity) | § 9 Z 9 BilDokG in the specified versions | |
| Information about parents’ level of education and occupation | § 18 Abs 6 Z 7 BilDokG | 2 |
| Information about employment, childcare obligations or other comparable care obligations | Consent in acc. with § 59 Abs. 3 UG | 2 |
| Evidence of a disability in accordance with § 3 BGStG | Upon request for exclusion from the group of students affected by § 59a UG (minimum number of credits) | |
| Approval of alternative mode(s) of assessment | Upon request subject to provision of evidence in accordance with § 59 Abs 1 Z 12 UG | |
| Medical certificate of an impairment for the purpose of alternative mode(s) of assessment (without diagnosis | § 59 Abs 1 Z 12 UG |
Contact details
| Delivery address/home address | § 9 BilDokG, §§ 1ff ZustG | 1, 5 |
| Other contact details (e-mail address, telephone number, fax number) | Consent | 1 (u:account e-mail address) |
| Delivery details for official decisions and notices (delivery details, incoming and outgoing correspondence) | §§ 1ff ZustG |
Study data per degree programme to which students are and/or were admitted
| Degree programme code | Annex 7 to § 10 Abs 4 BilDokG | 1, 5 |
| Version of curriculum per degree programme | Annex 7 to § 10 Abs 4 BilDokG, § 74 UG | |
| Date of entry | Annex 7 to § 10 Abs 4 BilDokG | 1 |
| Stage of the degree programme per degree programme | Annex 4 to § 18 Abs 2 UHSBV | 1 |
| Re-enrolment per semester and degree programme and status of admission | Annex 7 to § 10 Abs 4 BilDokG, § 62 UG, § 6, § 13, § 43 HSG | 1, 5 |
| Number of admitted and re-enrolled semesters per degree programme | Annex 7 to § 10 Abs 4 BilDokG | 1 |
| Date of examinations to complete a degree programme/subject | § 68 UG, § 71 UG, § 53 UG | 1 |
| Reason for termination per case | § 68 UG, § 71 UG | |
| Successful completion of the degree programme | § 68 UG, § 71 UG, § 53 UG | 1 |
| Date of first admission to the University of Vienna/ Date of last graduation or withdrawal | §§ 63ff UG | |
| Leave of absence semester(s), start and end of the leave of absence from studies | § 67 UG | 1 |
| Evidence of the reason for taking a leave of absence according to the law and Statutes per application | § 67 UG | |
| Duration of studies in semesters | Annex 4 to § 18 Abs 2 UHSBV | 1 |
| Study progress in terms of completed achievements according to the curriculum | § 74 UG | |
| Date of each transcript of records print-out | § 74 UG | |
| Obtained hours per week per semester and ECTS credits per student, degree programme, subject and semester | § 74 UG, § 53 UG | 1 |
| Hours per week per semester and ECTS credits obtained through a positive grade per student, degree programme, subject and semester | § 74 UG, § 53 UG | 1 |
| Number of admission semester(s) per student, degree programme, stage of the degree programme and subject | Annex 4 to § 18 Abs 2 UHSBV | 1 |
| Application data regarding merit grants and scholarships | § 1 StudFG |
Registration details
| Registration system data regarding courses/exams; title of the course/exam; preference specifications, such as prioritisation of courses or points allocated; allocation of place/waiting list/time of registration and de-registration | Regulations on the allocation of places in courses | |
| Name of the relevant teachers/examiners | § 74 UG, § 53 UG | 1 |
Examination data
| Data about examination attempts (date, identifier/designation of the performance range, teacher/examiner, grade, date of the examination record, date of registration); if applicable, date of deregistration; data regarding recognitions (application data, processing data); data regarding achievements completed during entrance examination and selection procedures | §§ 60ff UG, § 74 UG, § 53 UG, § 79 UG | |
| Recognised achievements (including evidence of achievements completed at another educational institution or in another degree programme) | § 78 UG | |
| Date of revocation/non-assessment of an achievement | § 73 UG | |
| Date of annulment of an assessment | § 73 UG | |
| Non-attendance in an examination for which the data subject was registered including information about how long the student is blocked to register for the same examination again | Statutes of the University of Vienna | |
| ECTS credits/hours per week per semester | § 53 UG | 1 |
| Name of the lecturer | § 53 UG | |
| Allocation to the relevant module in the curriculum | Statutes of the University of Vienna in conjunction with the curricula of the University of Vienna | 1 |
| Documentation for declaring an assessment null and void, in particular registration under false pretences, fraudulent intent to obtain a grade and/or plagiarism check of written achievements | § 73 UG |
In accordance with section 76a of the 2002 Universities Act, examinations may also be held in a digital form. However, no additional processing of data takes place in this context. If necessary, students may have to provide their university e-mail address. In this case, the processing is based on the legal foundations mentioned above.
Academic theses
| Type of academic thesis | §§ 80ff UG, § 53 UG |
| Information about the academic thesis (topic of the academic thesis, subject-specific/organisational allocation information regarding the topic of the academic thesis, description of the academic thesis, language in which the academic thesis is written) | §§ 80ff UG, § 53 UG |
| Status of the academic thesis, including status history | §§ 80ff UG |
| Assessment of the academic thesis | §§ 80ff UG, § 53 UG |
| Result of the plagiarism check | §§ 80ff UG |
| Assessment (grades, participation confirmation, overall assessment) | §§ 80ff UG, § 53 UG |
| Date on which the academic thesis was forwarded to the University Library/special library/Austrian National Library | § 86 UG |
| Restriction of access to the academic thesis (thesis embargo) for use in the library including reasons and duration of the embargo | § 86 UG |
| Documentation on measures to assure good academic practice (in particular, fraudulent intent to obtain a grade by false pretences and/or plagiarism check) | § 73 UG |
Tuition fee data
| Tuition fee status per semester | §§ 91ff UG | 1 |
| Information about the payment of the Students’ Union fee (ÖH fee)/tuition fee (university, posting date, time and type of payment) | §§ 91ff UG | 1 |
| Applications for remission or reimbursement of the tuition fee, including evidence of the provided reason | §§ 91ff UG | |
| Legal basis, beginning and end of the legal claim to remission or reimbursement | §§ 91ff UG | 1 |
| Payment status, tuition fee claims | Annex 3 to § 18 para. 1 UHSBV | |
| Evidence of equality with EU citizens | § 91 UG, PersGV 2014 | |
| Posting date | Annex 3 to § 18 para. 1 UHSBV | |
| Reimbursement data (semester, student ID number, amount, employee in charge of recording the reimbursement via the Austrian Federal Computing Centre (BRZ), employee reimbursement) | § 92 UG | 1 |
| Remission with binding force (= defined reasons for remission of the tuition fee according to the interface documentation), student ID number, semester, number of semesters for which the remission applies | § 92 UG | 1 |
| Information about the payment of the fee for participation in entrance exam procedures and aptitude tests (university, posting date, time and type of payment) | Regulations on entrance exam procedures/aptitude tests |
Admission data
| Application for admission | §§ 60ff UG | |
| Application for admission to the university entrance qualification examination, including proofs submitted in the course of application | § 64a UG, regulation on the university entrance qualification examination issued by the Rectorate | |
| Data about the university entrance qualification examination | § 64a UG | |
| Admission semester(s) | Annex 3 to § 18 para. 1 UHSBV | 1 |
| Date and status of admission per degree programme | Annex 3 to § 18 para. 1 UHSBV | 1 |
| History of prior education: Information about the type of degree/nationality/designation of the institution/date, including assessments | §§ 60ff UG | |
| Additional/supplementary examinations that students have to pass | UBVO, §§ 64ff UG | |
| Term of the admission | §§ 60ff UG | |
| Official notices of (non-)admission to specific degree programmes | §§ 60ff UG | |
| History of the application for admission and its processing | §§ 60ff UG | |
| Copies of certificates that must be submitted in the course of the application for admission | §§ 60ff UG | |
| Evidence of required qualifications (non-degree programmes) | §§ 60ff UG | |
| Type of application (non-degree programme student/co-registered student/mobility programme), intended degree programme, semester of intended admission, official notices of (non-)admission, including statement of reasons, other application data | §§ 60ff UG | |
| Information about parents’ education, information about own employment | § 18 para. 6 Z 7 BilDokG | 2 |
| Information about the parents’ migration background and first language, and about the own migration background | Consent | |
| Evidence of the general university entrance qualification (secondary-school leaving certificate, university graduations, university entrance qualification examination certificate) | §§ 60ff UG | |
| Evidence of belonging to the group of persons according to PersGV 2014. In particular: Diplomat status, foreign journalist, social insurance data sheet and residence registration form: in case of dependency on one of these persons: Birth certificate; marriage certificate or other proof Residence permit issued to persons granted asylum, applicant for asylum status, evidence of subsidiary protection granted, scholarship award, secondaryschool leaving certificate issued by an Austrian school abroad, visiting master/PhD confirmation | § 65 UG in conjunction with § 1 PersGV 2014 | |
| Certificate of proficiency in German or university preparation programme certificate | § 63 para. 1 Z 3 UG | |
| Certificate of proficiency in English | § 63a UG in conjunction with a regulation issued by the Rectorate or curricula | |
| GRE test certificate | § 63a UG in conjunction with a regulation issued by the Rectorate or curricula | |
| Proof of sporting aptitude | § 63 para. 1 Z 5 UG | |
| Curriculum vitae | § 63a UG in conjunction with a regulation issued by the Rectorate or curricula | |
| Letter of motivation | § 63a UG in conjunction with a regulation issued by the Rectorate or curricula | |
| Photograph | § 60 para. 4 UG | |
| Proof of identity | § 13 AVG, § 43 AVG | |
| Disabled person card | § 67 UG, § 92 UG | |
| Residence permit for equal treatment in terms of tuition fee | § 91 UG or PersGV 2014 | |
| Project proposal, description of the intended doctoral project or the master's thesis or research proposal (information about topic and supervisor of the doctoral thesis or master's thesis) | § 63a UG in conjunction with a regulation issued by the Rectorate or curricula | |
| Confirmation from the Akademische Prüfstelle (academic examination office) or another expert about the authenticity of the graduation documents | § 60 para. 3a UG | |
| Proof of impossibility to submit documents during the admission procedure | § 60 para. 3a UG | |
| Type/date/country of prior education per degree programme | § 63 UG | 1 |
| Data about the admission procedure (exception from the procedure, registration confirmation for admission to other educational institutions, status of procedure per stage: payment and submission of the application, type and time of payment, mandatory online selfassessment, participation in test, result, admission decision) | Regulations on the entrance exam procedures/aptitude tests | |
| u:card data (card number, photograph, master data, amount of tuition fee claim, type and time of payment) | Regulation issued by the Rectorate on the u:card for students and the fee for issuing duplicate copies of student ID cards |
Mobility data
| Participation in international mobility (programme, country, semester) | § 9 Z 16 BilDokG | 1 |
| Nomination of a partner institution | § 63 para. 6 UG |
The legal basis for the processing of these personal data is the specified legal foundation according to article 6, para. 1, sub-para. c of the GDPR. If the University transfers these data, the transfer is also based on the same legal foundation. Article 6, para. 1, sub-para. a of the GDPR provides the legal basis for the processing of personal data if the data subject has given their consent.
The relevant personal data will be erased after the legal storage periods have expired.
c) Statistics and analyses
For the preparation and fulfilment of the performance agreement with the Federal Government in accordance with section 13 of the Universities Act in conjunction with section 71a of the Universities Act, the University of Vienna prepares analyses of the following areas based on course and examination data Page 18 of students (e.g. student ID number, duration of studies, study progress, examination attempts, course data, status of the academic thesis):
- Measures aimed at reducing the number of students dropping out (in acc. with section 13, para. 2, sub-para. 1, lit. d of the Universities Act, in particular measures aimed at further developing counselling offers for students, coaching and mentoring in the introductory and orientation period)
- Degree programmes for students who are employed during their studies (in acc. with section 13, para. 2, sub-para. 1, lit. f of the Universities Act)
- Measures aimed at achieving societal objectives (in acc. with section 13, para. 2, sub-para. 1, lit. g of the Universities Act), especially social dimensions in teaching as well as the integration of groups that are under-represented in higher education
- Measures aimed at increasing internationality and mobility (in acc. with section 13, para. 2, subpara. 1, lit. g of the Universities Act)
- Measures aimed at increasing the number of students who take a certain number of examinations and graduations (in acc. with section 71a of the Universities Act)
- Target-group-specific, personal counselling for students and/or information via e-mail (in acc. with section 13, para. 2, lit. d of the Universities Act)
The legal basis for the processing of the data mentioned above as well as of relevant data are the legal provisions specified above as well as article 6, para. 1, sub-para. f of the GDPR.
The data used for the analyses specified above will be erased after no more than 6 months.
d) Provision of websites and creating log files
For every visit to our websites, our system automatically records data and information about the computer system of the calling computer. The following data are collected:
- IP address of the calling computer
- Date and time of access
- Name and URL of the retrieved file
- Volume of data transmitted
- Message whether the request was successful
- Identification data of the accessing browser as well as operating system
- Website from which the user accessed the service
The log files contain IP addresses or other data that can be linked to a specific user. For example, this could be the case when the link to the website from which the user is accessing the University’s website or the link to the website to which the user is switching contains personal data.
Also these data are recorded in the log files of your system. They are not stored together with other personal data of the user.
The legal basis for the temporary storage of the relevant personal data and the log files is article 6, para. 1, sub-para. f of the GDPR.
The storage of personal data in log files is necessary to ensure the functionality of the website. Furthermore, these data help us to optimise the website and ensure the security of our IT systems. The data will not be analysed for marketing purposes.
These purposes also constitute our legitimate interest in the data processing according to article 6, para. 1, sub-para. f of the GDPR.
The data will be erased as soon as their collection no longer serves the fulfilment of their purpose, at the latest after 30 days. The collection of these data for the provision of the website is essential for operating the website. Therefore, the user does not have any possibility to lodge an appeal.
e) Online shops of the University of Vienna (purchase of goods)
We offer users the possibility to order goods via our websites, such as ushop.univie.ac.at/, given they provide certain personal data. After users have entered the required data in an input mask, the data are transferred to and stored by the University of Vienna.
The University of Vienna collects the following data during the ordering process:
- Name
- Address
- Delivery address
- Company
- E-mail address
- Student ID number
- User ID
- Password
- Bank account details
- Credit card or other financial information
- Data about transactions or orders
Your data will be transferred to the shipping company entrusted with the delivery as far as this is necessary for the delivery of the goods. For the processing of payments, we will transfer your payment data to the authorised banking institution. These companies may only use your data to process the order and not for any other purposes.
We use the data you disclose when ordering goods solely to fulfil and process your order, without your separate consent.
If the processing of personal data is necessary to perform a contract to which the data subject is a party, article 6, para. 1, sub-para. b of the GDPR provides the legal basis.
Upon the complete fulfilment of the contract and complete payment of the purchase price, your data will be erased after the legal storage periods have expired, unless you have given your explicit consent to the further use of your data.
f) Newsletters of the University of Vienna
On our websites, it is possible to subscribe to newsletters free of charge. When subscribing to the relevant newsletter, the data you entered in the input mask are transferred to us. To subscribe to our e-mail newsletter service, in addition to your consent, we require at least your e-mail address to which the newsletter should be sent.
Furthermore, the following data are collected during subscription and will be erased after 30 days:
- IP address of the calling computer
- Date and time of access
- Name and URL of the retrieved file
- Volume of data transmitted
- Message whether the request was successful
- Identification data of the accessing browser as well as operating system
- Website from which the user accessed the service
If you purchase goods via our website, provide your e-mail address and additionally consent to receiving direct advertising, this e-mail address may subsequently be used for sending a newsletter to you.
In accordance with article 6, para. 1, sub-para. a of the GDPR, the processing of personal data is based on the following declaration of consent by the data subject:
I consent that the University of Vienna collects, stores and processes the personal data that I provide for the purpose of sending me a newsletter. My personal data will be erased as soon as the purpose of the processing activity has been fulfilled and if no other statutory storage period applies. I hereby declare that I am giving my consent freely. I have also been informed that I have the right to withdraw my consent at any time informally with future effect, and without any negative consequences for me. I can withdraw my consent by contacting dsba@univie.ac.at. The University of Vienna and any processors will erase all relevant data stored as soon as they receive my withdrawal of consent.
For sending the newsletters, we use a so-called double opt-in procedure, i.e. we will only send you newsletters once you have confirmed your subscription via a link provided in the confirmation e-mail sent to you for this purpose. We thus aim to ensure that only you as the owner of the specified e-mail address can subscribe to the newsletter. Your confirmation regarding this matter must follow promptly upon receiving the confirmation e-mail. Otherwise, your subscription to the newsletter is erased automatically from our database.
Collecting the user’s e-mail address serves the purpose of delivering the relevant newsletter.
Your subscription to the relevant newsletter allows us to use your e-mail address for our own (advertising) purposes until you unsubscribe from the newsletter.
In addition, we collect other personal data during the subscription process to prevent any misuse of the services or the e-mail address used.
The data will be erased as soon as their collection no longer serves the fulfilment of their purpose. Therefore, the user’s e-mail address is stored as long as the subscription to the relevant newsletter is active.
Any other personal data collected as part of the subscription process are generally erased after a period of 30 days.
In connection with the data processing for sending newsletters, the University of Vienna will not transfer any personal data to third parties. The data provided will be used exclusively for sending the relevant newsletters.
g) University Wiki
Employees and students of the University of Vienna as well as persons from outside the University can use the university-wide Wiki for jointly working on projects. You require an active student or employee u:account, or an active extended u:account for guests to log in.
For the purpose of operating the u:wiki service, the University of Vienna processes the following categories of personal data. The designation of the relevant SAML2 attribute for the ACOnet Identity Federation is specified in brackets:
- unique user ID (subjectId or eduPersonPrincipalName)
- name (displayName)
- e-mail address (mail)
- status group at the home organisation (eduPersonScopedAffiliation)
Users can create a personal profile in the University’s Wiki on a voluntary basis. In their profile, they can enter some of the following data, change them at any time and delete them on their own:
- their photo used as a profile picture
- phone number
- instant messager ID
- link to their personal website
- position within their organisation
- unit within their organisation
- place/address
Employees can create, edit and comment on content on the platform. The platform stores metadata related to this content (creator, time stamp of changes made).
In accordance with article 6, para. 1a of the GDPR, the user’s consent given when creating a user account on a voluntary basis provides the legal foundation for the processing activity.
Depending on the permissions granted, the following data stored on u:wiki may also be transferred to the following services offered by the manufacturer Atlassian and operated by the University of Vienna for the integration of applications:
- Service Desk
- Jira Software
- Bitbucket t (a tool produced by the software manufacturer Atlassian to exchange program code based on the git system between partner universities)
In addition, members of other educational institutions who also use the u:wiki of the University of Vienna and contribute to it (project or cooperation partners) can access the personal data stored on the University’s Wiki.
h) E-mails sent by the University of Vienna
In connection with the use of offers and services of the University of Vienna, the University may send emails that do not require active consent of the data subject and therefore do not constitute newsletters according to section 7f of this Data Protection Declaration.
In any case, the e-mail address will be processed as personal data for such e-mails. Other personal data are processed according to the type and legal basis of the e-mail.
Necessary steps (prior) to entering into a contract
For e-mails that are necessary for the performance of a contract or to take necessary steps prior to entering into a contract, article 6, para. 1, sub-para. b of the GDPR provides the legal basis.
Unless personal data are subject to any other statutory storage periods, they are erased as soon as the purpose of the data processing is fulfilled.
Upon the complete fulfilment of the contract and complete payment of the purchase price, your data are blocked from further use and will be erased after the legal storage periods in accordance with tax and corporate law have expired, unless you have given your explicit consent to the further use of your data.
Overriding legitimate interest of the University of Vienna
If the e-mail serves the purpose of a legitimate interest pursued by the University of Vienna or a third party, and if the interests, fundamental rights and fundamental freedoms of the data subject do not outweigh the interest pursued by the University, article 6, para. 1, sub-para. f of the GDPR provides the legal basis for the processing activity.
The data subject has the right to object against this type of processing. Unless a separate contact address is provided for the relevant data processing, the data subject may lodge their objection by e-mail to dsba@univie.ac.at or by mail to the following address:
University of Vienna
Data protection officer of the University of Vienna
Universitätsring 1
1010 Wien
The University of Vienna erases the personal data as soon as the legitimate interest of the University no longer exists.
Unless personal data are subject to any other statutory storage periods, they are erased as soon as the purpose of the data processing is fulfilled.
Transfer of personal data to third parties
As a general rule, the University of Vienna transfers personal data to third parties as part of e-mails only if this is required to take necessary steps (prior) to entering into a contact or if it is based on the overriding legitimate interest of the University of Vienna.
If the University transfers personal data to third parties, the data subject will be informed about this in the context of the relevant e-mail.
i) Contact forms
Our websites contain contact forms which users can use to contact us electronically. After users have entered the required data in the contact form, the data entered in the input mask are transferred to and stored by the University of Vienna. The University of Vienna collects the following data in the contact forms:
- Topic
- E-mail address
- Name
- u:account UserID
- Subject
- Message
- Attachment
- Prior education
- Phone number
- Gender
- Date of birth
- Academic degrees
In addition, the following data are stored at the time the message is sent:
- IP address of the calling computer
- Date and time of access
- Name and URL of the retrieved file
- Volume of data transmitted
- Message whether the request was successful
- Identification data of the accessing browser as well as operating system
- Website from which the user accessed the service
When you complete the contact form, you are asked to consent to the data processing and are referred to this Data Protection Declaration. Alternatively, you can contact the University via the e-mail address provided. In this case, the University of Vienna stores the user’s personal data transferred as part of the email.
In this context, we will not transfer personal data to third parties. The data are solely used for the purpose of processing the conversation.
Article 6, para. 1, sub-para. a of the GDPR provides the legal basis for the processing of personal data to which the data subject has given their consent. Users have to agree to the following declaration of consent:
I consent that the University of Vienna collects, stores and processes the personal data that I have entered in the contact form above for the purpose of sending a message and/or information. My personal data will be erased as soon as the purpose of the processing activity has been fulfilled and if no other statutory storage period applies. I hereby declare that I am giving my consent freely. I have also been informed that I have the right to withdraw my consent at any time informally with future effect, and without any negative consequences for me. I can withdraw my consent by contacting dsba@univie.ac.at. The University of Vienna and any processors will erase all relevant data stored as soon as they receive my withdrawal of consent.
Article 6, para. 1, sub-para. f of the GDPR provides the legal basis for the processing of personal data transferred in the course of sending an e-mail. If the e-mail contact aims at the conclusion of a contract, article 6, para. 1, sub-para. b of the GDPR provides an additional legal basis.
Furthermore, if the e-mail contact is necessary for compliance with a statutory obligation, article 6, para. 1, sub-para. c of the GDPR provides the legal basis.
The processing of the personal data entered in the input mask serves the sole purpose of processing your contact request. If data subjects contact us by e-mail, this also constitutes the necessary legitimate interest in the data processing.
Any other personal data processed during the sending process serve to prevent the misuse of the contact form and to ensure the security of the University’s IT systems.
The data will be erased as soon as their collection no longer serves the fulfilment of their purpose. For the personal data provided in the input mask of the contact form and for those sent by e-mail, this applies when the relevant conversation with the user has been concluded. A conversation is deemed concluded when the circumstances suggest that the matter in question has been fully resolved.
Personal data additionally collected as part of the sending process are erased after no more than 30 days, unless a longer storage period applies due to a statutory provision (e.g. if the University of Vienna takes official sovereign action; see in particular the section “Administration of studying and teaching” above).
j) Evaluation and quality assurance
The University of Vienna processes personal data of teachers, students and employees as part of evaluation and quality assurance processes. The purpose of the related data processing is the analysis and provision of basic information about the University's performance in the areas of research, teaching and administration. This analysis and the related quality assurance services aim at improving the organisation and operation of the University of Vienna.
Personal data are processed in accordance with article 6, para. 1, sub-para. c of the GDPR in conjunction with section 14 of the Universities Act in conjunction with the Statutes of the University of Vienna. Personal data are erased when they are no longer necessary in relation to the purposes for which they were collected.
§ 8 Use of cookies
We use so-called cookies. Cookies are small text files that are sent from our web server to your browser when you visit our websites. Your browser holds these cookies available on your computer for later retrieval. Cookies contain a characteristic string of characters that allows your browser to be uniquely identified when the website is accessed again. We use only so-called session cookies (also known as temporary cookies), i.e. cookies that are stored only temporarily (cached) for the duration of your visit to one of our websites.
We use the following cookies:
- Session cookies (ID)
- TYPO3 session cookies
- JavaScript cookies
- Matomo-/Piwik cookies for statistical analysis
The collected usage data do not allow for any conclusions regarding the user (except those cookies that serve the recording of data in connection with an active log-in). All usage data are collected in anonymised form; they will not be linked to your personal data and will be erased immediately after the end of the statistical analysis. All cookies are erased after termination of the session, i.e. as soon as you end your browser session.
Furthermore, on our websites we use cookies which allow for an analysis of our users’ surfing behaviour. This way, the following data may be transferred:
- Search terms entered
- Frequency of page views
- Use of website features
The legal basis for the processing of data, subject to the user’s consent, is article 6, para. 1, sub-para. a of the GDPR as specified in the cookie banner as well as the University of Vienna’s legitimate interest in accordance with article 6, para. 1, sub-para. f of the GDPR, unless these are cookies necessary for the operation of the website.
The legal basis for the processing of personal data when using technically necessary cookies is article 6, para. 1, sub-para. f of the GDPR.
In particular, the used cookies serve the purpose of analysing the frequency of use and the number of visitors to our websites. Furthermore, they are used to continue to identify your computer during a visit on our website when surfing from one page to the next, and to establish the end of your visit. This allows us to determine which sections of our websites and which other websites our users visited.
The purpose of using technically necessary cookies is to simplify the use of websites for their users. Some features of our web presence cannot be provided without the use of cookies. To provide these features, it is imperative to recognise your browser even when you have switched to a different page.
The following applications require cookies:
- Shopping cart
- Transferring language settings
- Remembering search terms
The user data collected by technically necessary cookies are not used to create user profiles.
§ 9 Integration of social plug-ins
On our websites, we integrate social plug-ins of the following social networks: Facebook (Meta Platforms, Inc., One Hacker Way, Menlo Park, CA 9402, USA), Youtube (Google Inc., 1600 Amphitheatre Parkway, Mountain View, California 94043, USA), Instagram (Meta Platforms, Inc., One Hacker Way, Menlo Park, CA 9402, USA), X (X Inc., 1355 Market St, Suite 900, San Francisco, California 94103, USA), Xing (New Work SE, Am Strandkai 1, 20457 Hamburg, Deutschland), LinkedIn (LinkedIn Ireland Unlimited Company Wilton Place, Dublin 2, Ireland), Vimeo (Vimeo Inc., New York, NY HQ, United States, 555 W 18th St) and flickr (Oath Inc., 22000 AOL Way, Dulles, VA 20166). It is possible that these plug-ins also collect personal data of the visitors of our websites, transfer them to the respective service and link them to the respective service of the visitor.
We do not collect any personal data via the social plug-ins and their use. To prevent the user’s data from being transferred to service providers in the US without the user's knowledge, we have implemented the so-called Shariff solution on our websites. Therefore, the relevant social plug-ins on our websites are initially only embedded as graphics. These graphics contain links to the websites of the corresponding plug-in providers. Only by clicking these graphics, you will be redirected to the service of the relevant provider. This solution guarantees that personal data are not automatically transferred to the respective social plug-in provider when you visit our websites. By clicking one of the social plug-in graphics, data may be transferred to and stored by the corresponding service provider. If you do not click any of the graphics, no data is transferred between you and the respective provider of the social plug-in. For further information about the Shariff solution, see the following website (in German): heise.de/ct/artikel/Shariff-Social-Media-Buttons-mitDatenschutz-2467514.html
After clicking a social plug-in, the corresponding service provider receives the information that you visited the relevant page of our internet presence. Please note that for this to happen, you do not need a user account with the respective service, nor do you have to be logged in there. However, if you already have a user account with the respective service provider and you are already logged in to this account when visiting our website, the data collected by the social plug-in will be linked directly to your account. If you would like to block the service providers from linking your account to the data collected by the social plug-in, you must log out on the relevant user account before clicking one of the social plug-ins.
Please note that it is beyond the scope of our influence whether and to what extent the respective service provider collects personal data. We are not aware of the extent, purpose and storage periods of the corresponding data collection. However, please note that it must be assumed that social plug-ins serve to use and record, at least, the IP address and device-related information. Furthermore, it is possible that the respective service providers use cookies.
For information about the extent and purpose of data collection by the respective service as well as the further processing and use of your data, please refer to the privacy notices directly on the website of the corresponding service. There, you will also find further information about your rights as a data subject and configuration options for safeguarding your privacy.
a) Meta Platforms, Inc., One Hacker Way, Menlo Park, CA 9402, USA
b) Google Inc., 1600 Amphitheater Parkway, Mountain View, California 94043, US
c) X Inc., 1355 Market St, Suite 900, San Francisco, California 94103, USA
d) Oath Inc., 70 Broadway 4th, 5th, 6th and 9th Floor New York, NY 10003, USA
The legal basis for the processing of data subject to the user’s consent is article 6, para. 1, sub-para. a of the GDPR as specified in the cookie banner as well as the University of Vienna’s legitimate interest in accordance with article 6, para. 1, sub-para. f of the GDPR.
If you do not want Facebook to link the data collected via our web presence directly to your Facebook profile, you must log out of Facebook before you visit our website. Alternatively, you can also block the Facebook plug-in from loading altogether by means of add-ons for your browser. For example,
- for Mozilla Firefox: addons.mozilla.org/de/firefox/addon/facebook-blocker/
- for Opera: addons.opera.com/de/extensions/details/facebook-blocker/
- for Chrome: https://chrome.google.com/webstore/ (search for “Facebook blocker“)
If you do not want Google or X to link the data collected via our web presence directly to your YouTube (Google) or X profile, you must log out of YouTube (Google) or X before you visit our website. Alternatively, you can also block the Google/X plug-in from loading altogether by means of add-ons for your browser; for example, using the script blocker NoScript (noscript.net).
§ 10 Security measures for protecting data stored by the University of Vienna
We commit ourselves to protecting your privacy and treating your personal data strictly confidential. To prevent manipulation, loss, or abuse of your personal data stored by us, we have implemented extensive technical and organisational security measures which are reviewed on a regular basis and updated in accordance with technological advances. These security measures include, among other things, the use of recognised encryption methods (TLS). However, please note that due to the nature of the Internet, other persons or institutions outside our area of responsibility may not adhere to the rules of data protection and the security measures specified above. In particular, data that are revealed without encryption – for example, data transferred via e-mail – may be accessed by third parties. We have no technical influence on this. It is the user’s responsibility to protect the data they provide against misuse by means of encryption or other measures.
§ 11 Hyperlinks to third-party websites
On our websites, we place so-called hyperlinks to websites of other providers. Activating these hyperlinks will redirect you from one of our websites directly to the website(s) of the other provider. For example, you can recognise this by the change of the URL. Since it is beyond our scope of influence whether third parties adhere to the data protection regulations, we cannot assume any responsibility for the confidential handling of your data on the websites of third parties. For information about the handling of your personal data by these companies, please refer directly to the respective companies’ websites.
§ 12 Right to object
Regarding the processing of your personal data based on the legitimate interest of the University of Vienna in accordance with article 6, para. 1, sub-para. f of the GDPR, you have the right to object to the processing of your personal data on grounds relating to your particular situation and/or to object against the use of your personal data for direct marketing purposes. In case of direct marketing, you have a general right to object which we will enforce without you having to specify a particular situation. Please contact us at dsba@univie.ac.at or at the e-mail address specified for the relevant processing activity.
§ 13 Your rights as a data subject
The GDPR specifies the following rights for data subjects regarding the processing of personal data:
- In accordance with article 15 of the GDPR, you have the right to obtain information from us about the personal data we are processing. In particular, you have the right to obtain information about the purposes of the processing, the categories of personal data concerned, the categories of recipients to whom the personal data have been or will be disclosed, the envisaged period for which the personal data will be stored, the existence of the right to request the rectification or erasure of your personal data or restriction of processing your data or to object to such processing, the right to lodge a complaint with a supervisory authority, the source of personal data collected about but not from you, the transfer of your data to third countries or international organisations, as well as about the existence of automated decision-making, including profiling and, if applicable, meaningful information about the logic involved.
- In accordance with article 16 of the GDPR, you have the right to request from us the rectification of inaccurate personal data concerning you and to have incomplete personal data completed. Pursuant to section 59, para. 2 of the Universities Act, students are obliged to immediately notify the university to which they are admitted about any changes to their name and address. You can fulfil this obligation via u:space.
- • In accordance with article 17 of the GDPR, you have the right to request from us the erasure of personal data concerning you, unless the processing is necessary for exercising the right of freedom of expression and information, for compliance with a legal obligation, for reasons of public interest, or for the establishment, exercise or defence of legal claims.
- In accordance with article 18 of the GDPR, you have the right to request the restriction of processing of personal data concerning you, if you contest the accuracy of the personal data, if the processing is unlawful, if the University no longer needs the personal data, and if you oppose the erasure of the personal data because they are required for the establishment, exercise or defence of legal claims. Your right pursuant to article 18 of the GDPR also applies if you object to the processing in accordance with article 21 of the GDPR.
- In accordance with article 20 of the GDPR, you have the right to receive the personal data which you have provided to us in a structured, commonly used and machine-readable format and to transmit those data to another controller
- In accordance with article 7, para. 3 of the GDPR, you have the right to withdraw your consent to the processing of your data at any time. Consequently, the University of Vienna may no longer continue the data processing based on this consent in future.
- In accordance with article 77 of the GDPR, you have the right to lodge a complaint with a supervisory authority. In general, you can lodge a complaint with the supervisory authority in your habitual residence, your place of work, or our registered place of business. In Austria, the responsible supervisory authority is the Data Protection Authority, Barichgasse 40-42, 1030 Vienna, Telephone: +43 1 52 152-0, E-mail: dsb@dsb.gv.at, Website: dsb.gv.at