§ 1 Controller and scope of application
The controller within the meaning of the EU’s General Data Protection Regulation (“GDPR”), other national data protection laws of Member States and other data protection regulations is:
§ 2 Data protection officer
RA Mag.a Katharina Raabe-Stuppnig
§ 3 What is personal data?
Personal data is any information related to an identified or identifiable natural person. It comprises, for example, information such as your name, your age, your address, your phone number, your date of birth, your e-mail address, your IP address or your user behaviour. Information we cannot (or only with a disproportionate effort) relate to you—for example, because the information is anonymised—is not personal data.
Processed personal data are erased as soon as the intended purpose of processing such data has been fulfilled, and there is no legal obligation to store such data any longer.
If we process your personal data to provide you with certain services, we shall inform you about the particular procedures, scope and purpose of the processing, the legal basis of such processing and the storage period.
§ 4 General information about data processing
We collect and use personal data from our users only to the extent which is necessary to provide them with an operational website, our contents and services.
We use your data to provide you with information, products and your required services, to answer your questions and to operate and improve Our Website and applications.
We only collect and use personal data in accordance with the relevant legal basis within the meaning of the GDPR.
2. Legal basis
If we seek the consent of a data subject to process personal data, art. 6 par. 1 lit. a GDPR shall provide the legal basis for the processing of personal data. If the processing of such data is necessary to perform a contract to which such data subject is a contracting party, art. 6 par. 1 lit. b GDPR shall be the legal basis. This also applies to the processing necessary to implement pre-contractual measures. If data processing is necessary to comply with a legal obligation to which the University of Veterinary Medicine is subject, art. 6 par. 1 lit. c GDPR shall provide the legal basis.
In cases in which the vital interests of a data subject or another natural person require the processing of personal data, art. 6 par. 1 lit d GDPR shall provide the legal basis. If such processing is necessary for the purposes of a legitimate interest pursued by the University of Veterinary Medicine or a third party, and the interests, fundamental rights and freedoms of such data subject do not override the former interest, art. 6 par. 1 lit. f GDPR shall provide the legal basis of such processing.
3. Erasure of data and storage period
The personal data of data subjects are erased or blocked as soon as the purpose of storing such data ceases to exist. Data may be stored beyond this period if such storage is required by European or national legislation in EU regulations, laws or other provisions to which the University of Veterinary Medicine is subject. Data are also blocked or erased as soon as one of the storage periods required by the aforementioned norms expires, unless further storage of the data is required to conclude or perform a contract.
§ 5 Processing in detail
1. Provision and use of Our Website
a. Nature and extent of data processing
When you access and use Our Website, we collect the personal data your browser automatically transmits to our server. This information is temporarily saved in a log file. When you use Our Website, we collect the following data, which are technically necessary to display Our Website and guarantee stability and security:
- IP address of the requesting computer
- date and time of access
- name and URL of the accessed file
- status of the access
- transmitted data volume
- the website from which Our Website is accessed
- identification data of the accessing browser and the operating system
b. Legal basis
Art. 6 par. 1 lit. f GDPR shall be the legal basis for the data processing described above. Processing of the aforementioned data is necessary to operate a website and serves, therefore, the protection of a legitimate interest of the University of Veterinary Medicine.
c. Storage period
As soon as the aforementioned data are no longer necessary to display Our Website, they will be erased. Collecting data to provide Our Website and saving them in log files is absolutely necessary to operate Our Website. Therefore, users cannot object to such saving. In specific cases, data may be stored longer if this is required by law.
2. Mailings from the University of Veterinary Medicine
Related to offers and services of the University of Veterinary Medicine, there are mailings that are not subject to the consent of the data subject. In such mailings, the e-mail address of the data subject is processed as personal data. Further personal data are processed according to the nature and legal basis of the mailing.
For mailings necessary to meet our legal obligations, art. 6 par. 1 lit. c GDPR shall provide the legal basis.
For mailings necessary to implement contractual or pre-contractual measures, art. 6 par. 1 lit. b GDPR shall provide the legal basis.
If personal data are not subject to further storage periods required by law, they are erased as soon as the purpose of data processing has been fulfilled.
If the mailing is necessary to protect a legitimate interest of the University of Veterinary Medicine or a third party, and the interests, fundamental rights and freedoms of such data subject do not override the former interest, art. 6 par. 1 lit. f GDPR shall provide the legal basis for such processing.
You may object to such processing. If no other contact address is provided for such processing, this objection can be sent to email@example.com or to
University of Veterinary Medicine, Vienna
Data protection officer of the University
Personal data are erased as soon as the legitimate interest of the University of Veterinary Medicine ceases to exist, and the data are not subject to further storage periods required by law.
With regard to mailings, personal data are only transferred to third parties if such transfer is necessary to implement (pre-)contractual measures or such transfer is done in the overriding legitimate interest of the University of Veterinary Medicine.
If data are transferred to third parties, such transfer will be indicated in the particular mailing.
3. Contact form
a. Nature and extent of data processing
Our Website has a contact form which you may use to contact us. When you use this contact form, the data entered into the input mask are transmitted to us and saved. The following data may be processed:
- e-mail address
- relation to the University of Veterinary Medicine
- nature of the message
- subject of the query
Your e-mail address helps us to associate your query and answer it. We do not transfer your personal data to third parties when you use our contact form.
b. Legal basis
Data for contacting us are processed according to art. 6 par. 1 lit. a GDPR, and such processing is based on the informed consent of the user.
For processing data transmitted via e-mail, art. 6 par. 1 lit. f GDPR shall provide the legal basis. If contact via e-mail aims at concluding a contract, art. 6 par. 1 lit. b GDPR shall provide an additional legal basis.
If legal obligations make it necessary to contact us, art. 6 par. 1 lit. c GDPR shall provide an additional legal basis.
The processing of personal data from the input mask only serves to process your query. In the event that you contact us via e-mail, such contact also constitutes the required legitimate interest in processing your data.
Other personal data processed when sending a query serve to prevent abuse of our contact form and to guarantee the security of our IT systems.
c. Storage period
As soon as your query has been answered and the matter is fully clarified, the processed personal data from the contact form are erased. Such erasure also applies to personal data that have been transmitted via e-mail. In certain cases, data may be stored longer if this is required by law.
Private donors, foundations and responsible companies can support the University of Veterinary Medicine in many ways.
a. Nature and extent of data processing
The University of Veterinary Medicine processes the following categories of data:
- core data
- contact data
- information you might have shared with us
- history of communication
- history of donations
- classifications (such as type of membership, sponsorship)
These data are processed to prepare and conduct fundraising campaigns, administrate donations, comply with tax provisions and to wish you a happy birthday.
Providing your name and bank details is necessary to conclude donation agreements (donations/sponsoring) and required by tax laws and anti-money laundering provisions. If you do not provide these data, we cannot accept donations and sponsoring.
Furthermore, providing your name and date of birth is required for the automated employee tax assessment if donors wish to benefit from a tax advantage for their donations. If you do not provide the aforementioned data, your donations cannot be considered extraordinary expenses in your tax assessment.
We only transfer your personal data to third parties if such transfer is necessary to perform a contract or for billing, or if you have agreed to such transfer beforehand.
Service providers that support the University of Veterinary Medicine in the operation of fundraising websites and the communication with donors by mail or telephone have bound themselves to comply with the applicable provisions of data protection law when they cooperate with us. Processing contracts have been concluded with such service providers in accordance with art. 28 GDPR.
We only cooperate with service providers who sufficiently guarantee appropriate technical and organisational measures to process data according to the requirements of data protection provisions and protect your data.
Apart from the cases described above, we do not transfer your personal data to third parties unless we are required by law to disclose such data.
b. Legal basis
The legal basis for processing your personal data shall be art. 6 par. 1 lit. a GDPR (consent) and art. 6 par. 1 lit. b GDPR (performance of a contract).
If the processing of personal data is necessary to fulfil legal obligations to which the University of Veterinary Medicine is subject, art. 6 par. 1 lit. c GDPR shall provide such legal basis.
The processing of personal data to attract donor support and sponsors serves the protection of a legitimate interest of the University of Veterinary Medicine pursuant to art. 6 par. 1 lit. f GDPR. The University of Veterinary Medicine thereby pursues objectives of public interest according to § 4a EStG and §§ 34 ff BAO and makes an essential contribution to society, particularly to the health of animals and humans.
In order to reach these publicly acknowledged organisational goals, targeted action is taken, and personal data are processed. We take particular care to meet our supporters’ requirements in the best possible way and to avoid wastage. Raised funds are used in the most cost-efficient way possible, in the interest of all persons supporting the University of Veterinary Medicine.
c. Storage period
Your personal data are processed until you file an objection. They may only be stored beyond this period if it is required by European or national legislation in EU regulations, laws or other provisions, to which the University of Veterinary Medicine is subject.
§ 6 Transferring data
We only transfer your personal data to third parties if
- you have given your explicit consent according to art. 6 par. 1 lit. b GDPR
- such transfer is permitted by law and necessary to perform a contract with you according to art. 6 par. 1 lit. b GDPR
- there is a legal obligation to transfer such data according to art. 6 par. 1 lit. c GDPR
- such transfer is necessary according to art. 6 par. 1 lit. f GDPR to protect legitimate interests of the University of Veterinary Medicine, as well as to establish, exercise or defend legal claims, provided that there is no reason to believe that you have an overriding interest worthy of protection that we do not transfer your data.
1. Nature and extent of data processing
Cookies help us, among others, to make our internet services more effective and user-friendly for you.
Cookies do not cause any harm to your device. They cannot run programmes or contain viruses.
2. Legal foundation
Personal data are processed using cookies on the basis of the legitimate interests of the University of Veterinary Medicine, according to art. 6 par. 1 lit. f GDPR.
3. Storage period
As soon as the data transmitted to us via cookies are no longer necessary to fulfil the above-mentioned purpose, such data will be erased. In certain cases, data may be stored longer if this is required by law.
4. Configuration of browser settings
Most browsers have standard settings so that they accept cookies. However, you can configure your browser in a way that it only accepts certain cookies or no cookies at all. Please note that you might not be able to use all functions on Our Website if cookies on Our Website are deactivated in your browser settings. In your browser settings, you can also delete cookies already stored in your browser or display the storage period. Furthermore, you can configure your browser so that you receive a notification before cookies are saved. As browser functions may differ from one browser to another, please consult the help menu of your browser for configuration options.
In case you wish to have a comprehensive overview of any third-party access to your web browser, we recommend installing plug-ins specially developed for that purpose.
§ 8 Statistical evaluation
Purpose of processing
Duration of storage
Until the end of the browser session
After processing the IP address and before saving it, it will be anonymised. We explicitly point out that complete anonymisation cannot be reached despite the fully active anonymisation function; it is only a pseudo-anonymisation. Matomo generates an internal hash value which is calculated from different factors such as the IP address, the resolution, the browser, the plug-ins used and the operating system. Even when the anonymisation function is active, this heuristic uses the full IP address for internal purposes. Thus, the values can be recalculated to the IP address with some effort and, consequently, the other information can be deduced to a highly reliable degree.
If you do not agree to us saving and evaluating these data, you can always object to storage and use (per mouse click afterwards). (Subsequently, a so-called opt-out cookie will be saved in your browser which prevents Matomo from collecting session data.)
Matomo enables us to statistically evaluate the use of Our Website and improve our online services for you as a result of the information obtained from such evaluation. The legal basis for processing is consent according to § 96/3 TKG and Art 6/1 lit a GDPR. Your consent can be withdrawn anytime.
§ 9 Hyperlinks
There are so-called hyperlinks to websites of other providers on Our Website. When you activate these hyperlinks, you are automatically directed to the website of the other provider. This is indicated, among others, by the change of URL. We cannot assume any responsibility for the confidential use of your data on these websites of third parties, as we cannot influence whether these companies respect data protection provisions. Please consult these websites directly for information on the handling of your personal data. The University of Veterinary Medicine shall not be liable for external links.
§ 10 Rights of the data subject
As a data subject whose personal data are processed, you may exercise the following rights under the GDPR:
- According to art. 15 GDPR, you may request information about your personal data which we process.
- According to art. 16 GDPR, you may immediately request the rectification of incorrect data or the completion of your personal data we have stored. As a student, you are obliged to inform each university at which you are enrolled about changes in name or address, pursuant to § 59 par. 2 UG.
- According to art. 17 GDPR, you may request the erasure of your personal data which we have stored. The right to erasure may be limited in the cases mentioned in the law, particularly when the right to freedom of expression and information is performed, to fulfil legal obligations, for archiving and research purposes in the public interest, as well as to establish, exercise or defend legal claims.
- According to art. 18 GDPR, you may request restriction of the processing of your personal data if you contest the accuracy of such data, such processing is unlawful, we no longer need such data and you reject the erasure of such data because you need such data to establish, exercise or defend legal claims. You also have this right under art. 18 if you have objected to processing according to art. 21 GDPR.
- According to art. 20 GDPR, you may request to receive the personal data you have provided to us in a structured, commonly used and machine-readable format. You may also request that such data be transmitted to another controller.
- According to art. 7 par. 3 GDPR, you may withdraw the consent you have given at any time. Consequently, we shall no longer continue data processing based on this consent.
- According to art. 77 GDPR, you have the right to lodge a complaint with a supervising authority. In most cases, you can contact the supervising authority of your habitual residence, your place of work or our university. The Austrian supervising authority is Österreichische Datenschutzbehörde, Barichgasse 40-42, 1030 Vienna, telephone: +43 1 52 152-0, e-mail: firstname.lastname@example.org, web: www.dsb.gv.at
§ 11 Right to object
According to art. 21 GDPR, you have the right to object to the processing of your personal data based on legitimate interests according to art. 6 par. 1 lit. f GDPR if there are reasons resulting from your particular situation. In the event you file an objection, the University of Veterinary Medicine shall no longer process your personal data unless the University of Veterinary Medicine can demonstrate compelling legitimate grounds for the processing which override the interests, rights and freedoms of the data subject or for the establishment, exercise or defence of legal claims.
If direct advertising is objected to, the University of Veterinary Medicine shall no longer process personal data from the data subject for this purpose.
§ 12 Data security and security measures
We commit ourselves to protecting your privacy and handling your personal data confidentially. In order to avoid manipulation, loss or abuse of your personal data we have stored, we take comprehensive technical and organisational measures which are regularly evaluated and adjusted to technological developments. This comprises, among others, the use of recognised encryption methods (TLS). However, we point out that the structure of the internet makes it possible other persons and institutions that do not fall within our area of responsibility to neglect the rules of data protection and the above-mentioned security measures. In particular, unencrypted data – enclosed via e-mail, for example – can be read by third parties. We do not have any technical influence on this issue. It is the responsibility of the user to protect the data they provide against abuse by encryption or other means.