1) Processing activity
2) Responsible party
Koproduktionshaus Wien GmbH
Nordwestbahnstraße 8-10, 1200 Vienna
E-mail: firstname.lastname@example.org, T: +43 1 5878774
3) Purposes of data processing on the legal basis of
4) Legal basis of data processing
5) Description of the (predominant) legitimate interests for purposes of
The responsible party stores the IP addresses of its customers for a period of 7 days in order to be able to respond to targeted attacks in the form of server overload ("denial of service" attacks) and other damage to the systems. The controller has an predominant legitimate interest in this data processing for the purpose of maintaining the functionality of its services provided online (recital 49 of the GDPR).
The controller also processes the customer data (but not those of children or special categories of personal data within the meaning of Art 9 of the DSGVO3 ("sensitive data")) in order to use them for the purpose of direct advertising for (further) offers of the controller and the members of the association. The controller has a legitimate interest in processing personal data for the purpose of direct marketing (Recital 47, last sentence of the DSGVO). In doing so, the responsible party relies on its freedom of acquisition (Art. 6 of the Austrian Constitution) and freedom of communication (ins. Art. 10 of the EMRK, which also protects advertising measures), which are protected by the Convention and the Constitution, and on the rights to
When using this data, the responsible party complies with the provisions of communications law, in particular § 107 TKG.
The responsible party is funded by public bodies and is subject to the control of the funding bodies when accounting for the funding. During the controls of the funding agencies, data of the customers may be disclosed (on a random basis) for the purpose of proving proof, over which the responsible party has no influence.
At its events, the responsible party records the sound and the image in order to be able to document the event and the activity of the responsible party, to report (live) and to advertise. Although the main interest is the stage or the podium, it cannot be excluded that event participants are also captured by the sound and image recordings. The responsible party has a legitimate interest in the sound and image recordings, which is based on the freedom of the press, freedom of opinion and freedom of communication, which is protected by convention and constitutional law (Article 13 of the Austrian Constitution and Article 10 of the European Convention on Human Rights).
6) Description of the (predominant) legitimate interests for the purposes of sound and image recording of events:
At its events, the responsible party records the sound and the image in order to be able to document the event and the activity of the responsible party, to report (live) and to promote it. Although the main interest is the stage or the podium, it cannot be excluded that event participants are also captured by the sound and image recordings. The responsible party has a legitimate interest in the sound and image recordings, which are based on the freedom of the press, freedom of opinion and freedom of communication, which is protected by convention and constitutional law (Article 13 of the Austrian Constitution and Article 10 of the European Convention on Human Rights).
7) Change of purpose:
The customer may object to the use of his/her personal data for direct advertising purposes at any time and without giving reasons.
8) Assessments of personal aspects of the customer:
An evaluation of personal aspects of the customer does not take place.
9) Obligation to provide data:
The customer is not obliged to provide data. Association members are obliged to provide full contact details.
10) Automated decision making:
The customer is not subject to any automated decision-making that has legal effect for him/her.
11) Types of data processed:
12) Data sources (unless disclosed by the client or collected by the data responsible party):
13) External recipients of data
The responsible party expressly reserves the right to use further commissioned data processors. These will then be identified in the update of the data protection information following the start of use. These data processing operations by the commissioned data processors take place under the responsibility of the data responsible party.
14) Internal recipients:
15) Third country transfer:
The following data is transferred to countries outside the EU in the course of data processing:
16) Appearances in social media channels:
The data responsible party informs that it maintains independent online presences in social media channels for the purposes of advertising and communicating with customers. In these online presences, the customer's data may be processed outside the European Union, which increases the risk of a breach of data protection. The operators of the social media channels, insofar as they are based in the USA, have for the most part submitted to the EU-US Privacy Shield.
These online presences are kept accessible in the technical environment of the respective social media operator. The social media operators then use the customer's visit to the online presence for their own purposes, in particular to display (interest-based) advertising. The social media operators use the visit to place "cookies" on the customer's end device, to read existing cookies/identifiers, to infer the customer's interests from the usage behaviour and thus to enrich the usage profile created for the customer or identifier. The aim is to display interest-based advertising to the customer, which can also be displayed on websites of third parties visited later.
The processing of the customer's personal data is based on the predominant legitimate interests of the responsible party in the advertising measures and customer communication, which is protected by the freedom of acquisition (Art 6 of the Austrian Constitution) and freedom of communication (ins. Art 10 ECHR, which also protects advertising measures) under convention and constitutional law. If the customers are users of the social media channels, the data processing may also be covered by the customer's consent.
The responsible party informs that it does not have any access to the client's data. The responsible party therefore recommends that the customer contacts the respective social media channel directly in the event of asserting his or her rights to information, correction, deletion, restriction, objection and data portability. The users of social media channels can also make changes themselves in the area of their privacy settings. The data responsible party will support the customer in doing so, should this be necessary. The customer can find further information at:
17) Storage period:
18) Rights of the data subject:
19) Right of complaint:
Art 77 DSGVO § 24 DSG: Every customer/affected person has the right to lodge a complaint with the supervisory authority if he/she is of the opinion that the processing of personal data concerning him/her violates this Regulation.
20) Supervisory authority:
Austrian Data Protection Authority
Telephone: +43 1 52 152-0
3 Basic Data Protection Regulation, available at http://eur-lex.europa.eu/legal-content/DE/TXT/?uri=CELEX%3A32016R0679.
Nordwestbahnstraße 8-10, 1200 Wien
Subway: U1, U2 (Praterstern), U4 (Friedensbrücke), U6 (Dresdnerstraße) Tram: 5 (Nordwestbahnstraße) Bus: 5A (Wasnergasse)
Zieglergasse 25, 1070 Wien
Subway: U3 (Zieglergasse), Tram: 49 (Westbahnstraße / Zieglergasse)
Heldenplatz, 1010 Wien
Subway: U3 (Volkstehater) Tram: 1, 2, 46, 71, D (Volkstheater) Bus: 48A (Volkstheater)