---
title: "Privacy policy • Legal"
---

# Privacy policy

### Processing activity

- Provision of information about ‘brut’ and its events
- Fulfilment of the event contract with customers [1](https://archiv2.brut-wien.at/de/Global/Datenschutz#1)

### Data controller

Koproduktionshaus Wien GmbH  
Nordwestbahnstraße 8-10, 1200 Vienna  
[info@brutwien.at](mailto:infor@brutwien.at,)  
[+43 1 587 8774](tel:004315878774)

### Purposes of data processing on the legal basis

of freedom of communication

- The primary purpose of data processing by the data controller is to provide information about ‘brut’ events. Data processing in this area is carried out on the basis of freedom of the press, freedom of expression and freedom of communication, which are protected under international conventions and constitutional law (Article 13 of the Austrian Constitution; Article 10 of the European Convention on Human Rights)
- Promotion of the activities of the cooperation partners

of the performance of or preparation for a contract

- Sale of tickets, season tickets and vouchers
- Making information available to (potential) customers regarding the events and services of the data controller and its cooperation partners
- Provision of communication channels for disseminating information and managing customer relationships
- Operation of venues for events
- Planning and staging of theatre performances, workshops and other events (hereinafter collectively referred to as ‘events’)
- Fulfilment of the event contract with customers arising from the purchase of tickets

of consent

- Provision of newsletters to interested parties on the basis of consent, with the option to opt out at any time

of personal interest

- Dissemination/presentation of information (including promotional material) regarding the data controller’s services and events, insofar as this is done for members by way of direct marketing (‘marketing purposes’), to the extent permitted by law
- Maintaining and enhancing customer satisfaction and loyalty by analysing usage behaviour with the aim of improving the range of services offered, using Google Analytics
- Filming of events for (including promotional) documentary purposes and current media coverage
- Provision of newsletters to interested parties on the legal basis of Section 174(4) of the Telecommunications Act (TKG), with the option to opt out at any time

### Legal basis for data processing

Performance of a contract

- Online use: The use of the controller’s online media is based on a contract within the meaning of Article 6(1)(b) of the GDPR [2](https://archiv2.brut-wien.at/de/Global/Datenschutz#2); registration establishes a registration relationship.
- Participation in events: When purchasing tickets and participating in events organised by the controller, data processing is based on the legal basis of the event contract.
- Additional services: Consent. For individual services (e.g. newsletters), the controller expressly obtains the customer’s consent. This consent may be withdrawn at any time with future effect.

Legitimate interests

### Description of legitimate interests for the purposes

of IT security:  
The data controller stores its customers’ IP addresses for a period of 7 days in order to be able to defend against targeted attacks in the form of server overload (‘denial-of-service’ attacks) and other damage to the systems. The data controller has an overriding legitimate interest in this data processing for the purpose of maintaining the functionality of its online services (Recital 49 of the GDPR).

the dissemination of information/direct marketing[3](https://archiv2.brut-wien.at/de/Global/Datenschutz#3):  
The controller also processes customer data (excluding data relating to children or special categories of personal data within the meaning of Article 9 of the GDPR[4](https://archiv2.brut-wien.at/de/Global/Datenschutz#4) (‘sensitive data’)) in order to use it for the purposes of direct marketing for (further) offers from the controller and the association’s members. The data controller has a legitimate interest in the processing of personal data for the purposes of direct marketing (Recital 47, last sentence, of the GDPR). In doing so, the data controller relies on its freedom to conduct a business, which is protected under the Convention and constitutional law (Article 6 of the Austrian Basic Law), and on the freedom of communication (in particular Article 10 of the ECHR, which also protects advertising activities) and on the rights

- to send postal advertising;
- to send electronic mail on the basis of the contractual relationship, following consent and in accordance with Section 174(4) of the Telecommunications Act (TKG).

When using this data, the data controller complies with the provisions of communications law, in particular Section 174 of the Telecommunications Act (TKG).

Funding accounting:  
The data controller receives funding from public bodies and is subject to scrutiny by the funding bodies when accounting for the funding. During audits by the funding bodies, customer data may be disclosed (on a random basis) for the purpose of verifying performance; the data controller has no influence over this.

Audio and video recordings of events:  
At its events, the data controller makes audio and video recordings in order to document the event and the data controller’s activities, and to report on and promote them (live). Although the primary focus is on the stage or the podium, it cannot be ruled out that event participants may also be captured in the audio and video recordings. The data controller has a legitimate interest in the audio and video recordings, which are based on the freedom of the press, freedom of expression and freedom of communication, as protected under convention and constitutional law (Article 13 of the Austrian Constitution and Article 10 of the ECHR).

### Change of purpose

Dissemination of information/direct marketing:  
The data controller hereby informs you that it also processes the customer’s personal data for the purposes of disseminating information and direct marketing. In doing so, the data controller aims to provide information about its own services and those of its cooperation partners. There is no incompatibility with the purpose of the original data collection.  

The customer may object to the use of their personal data for direct marketing purposes at any time and without giving reasons.

### Assessment of the customer’s personal characteristics

No assessment of the customer’s personal characteristics takes place.

### Obligation to provide data

The customer is under no obligation to provide data. Members of the association are obliged to provide their full contact details.

### Automated decision-making

The customer is not subject to any automated decision that has legal effect on them.

### Types of data processed

Provided by customers/data subjects:

- Name, academic title
- Telephone and fax numbers
- E-mail address
- Postal address
- Company/organisation employed by
- Job title/position within the company/organisation

Additionally collected by the data controller:

- IP addresses (log files)
- Device data
- Browser used
- Device used, type of device
- Communication log
- Responses to email newsletters, campaign details (receipt, opening, clicks)

### Data sources (unless disclosed by the customer or collected by the data controller)

Source:

- Cooperation partners (where permitted by law)

Data types:

- Contact details

### External recipients of data

External ticket shop operator:

- mtms Solutions Gmbh, Nordstraße 4, A-5301 Eugendorf  
    [https://www.mtms.at/page/datenschutz](https://www.mtms.at/page/datenschutz "Öffnet ein neues Fenster")

Data processor:

- Newsletter distribution: Körbler GmbH, Hofweg 1, 8430 Leitring, Austria [https://www.koerbler.com/unternehmen/kontakt/datenschutzerklaerung/](https://www.koerbler.com/unternehmen/kontakt/datenschutzerklaerung/ "Öffnet ein neues Fenster")
- Google Analytics (with IP anonymisation): Google LLC, 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA https://privacy.google.com/# Opt-out: [https://tools.google.com/dlpage/gaoptout?hl=de](https://tools.google.com/dlpage/gaoptout?hl=de)
- Hostprovider: Hetzner Online GmbH: [https://www.hetzner.com/de/](https://www.hetzner.com/de/)
- External IT support provider: Christian Seidl (RSnet - Christian Seidl KG)

The data controller expressly reserves the right to engage further data processors. These will then be listed in the update to the privacy policy following the commencement of their engagement. Such data processing by the data processors takes place under the responsibility of the data controller.

In this context, we also refer to our [Cookie Policy](https://archiv2.brut-wien.at/de/Global/Cookie-Richtlinie).

### Internal recipients

- System administration
- Management
- Specialist departments

### Transfers to third countries

Folgende Daten werden im Zuge der Datenverarbeitung an Staaten außerhalb der EU übermittelt:

- Country: USA
- Application: Google (EU-US Privacy Shield)
- Data types: Google Analytics: anonymised IP address, website title, browser-specific information, information on website usage

### Social media channels

The data controller hereby informs you that it maintains independent online presences on social media channels for the purposes of advertising and communicating with customers. On these online platforms, the customer’s data may be processed outside the European Union, which entails an increased risk of a breach of data protection. The operators of the social media platforms, insofar as they are based in the USA, have, for the most part, submitted to the EU-US Privacy Shield.

These online platforms are hosted within the technical infrastructure of the respective social media operator. The social media operators then use the customer’s visit to the online platform for their own purposes, in particular to display (interest-based) advertising. The social media operators use the visit to store ‘cookies’ on the customer’s device, read existing cookies or identifiers, infer the customer’s interests from their usage behaviour, and thereby enrich the usage profile created for the customer or identifier. The aim is to display interest-based advertising to the customer, which may also occur on third-party websites visited at a later date.

The processing of the customer’s personal data is based on the controller’s overriding legitimate interests in advertising measures and customer communication, which are protected under convention and constitutional law by the freedom to conduct business (Article 6 of the Austrian Constitution) and the freedom of communication (in particular Article 10 of the ECHR, which also protects advertising measures). If customers are users of social media channels, the data processing may also be covered by the customer’s consent.

The data controller hereby informs customers that it has no access whatsoever to their data. The data controller therefore recommends that customers contact the relevant social media platform directly should they wish to exercise their rights to access, rectification, erasure, restriction, objection and data portability. Users of social media platforms may also make changes themselves via their privacy settings. The data controller will assist the customer with this should it be necessary. The customer can find further information at:

- Facebook (Facebook Ireland Ltd., 4 Grand Canal Square, Grand Canal Harbour, Dublin 2, Ireland) Privacy policy: [https://www.facebook.com/about/privacy/](https://www.facebook.com/about/privacy/) Opt-out: [https://www.facebook.com/settings?tab=ads](https://www.facebook.com/settings?tab=ads) and [http://www.youronlinechoices.com](http://www.youronlinechoices.com/)
- Instagram (Instagram Inc., 1601 Willow Road, Menlo Park, CA, 94025, USA) Privacy Policy / Opt-out: [http://instagram.com/about/legal/privacy/](http://instagram.com/about/legal/privacy/)
- Vimeo: Google LLC, 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA https://privacy.google.com/# Opt-out: [https://tools.google.com/dlpage/gaoptout?hl=de](https://tools.google.com/dlpage/gaoptout?hl=de)
- TIDAL: TIDAL Music AS c/o CSC (Norway) AS, Postboks 2051 Vika, 0125 Oslo, Norway: https://tidal.com/privacy

### Retention period

- Unregistered customers: The personal data (in particular IP addresses) of (unregistered) website visitors is stored for 7 days for IT security purposes and is subsequently deleted.
- Legal basis: contractual relationship: The data is generally processed by the data controller on the basis of the above-mentioned legal basis for up to 40 months after the termination of the contract (= 36 months for potential contractual claims for damages + a maximum of 4 months for the service of a legal claim), after which it is deleted (in any event, the personal reference is removed). Where there is a statutory obligation to retain data, in particular pursuant to Section 132(1) of the Austrian Federal Tax Code (BAO), the processing of personal data relating to accounting purposes continues until the end of the statutory retention period (currently, in principle, 7 years after the end of the financial year in which the data was generated).

### Rights of the data subject

Legal basis: Content:

- Article 15 of the GDPR ‘Right of access’: The customer/data subject has the right to request information as to whether and to what extent their personal data is being processed.
- Article 16 of the GDPR ‘Right to rectification’: The customer/data subject has the right to request the rectification of inaccurate personal data or the completion of incomplete personal data without delay.
- Article 17 of the GDPR ‘Erasure’: The customer/data subject has the right to request that personal data be erased without undue delay, provided that the grounds set out in Article 17(1) of the GDPR are met.
- Article 18 of the GDPR ‘Restriction of processing’: The customer/data subject has the right to request that the processing of personal data be restricted, provided that the grounds set out in Article 18(1) of the GDPR are met.
- Article 21 of the GDPR “Objection”: The customer/data subject has the right to object to the processing of their personal data on the grounds of an overriding legitimate interest.
- Article 20 of the GDPR “Data portability”: The customer/data subject has the right to receive their personal data, which they have provided, in a structured, commonly used and machine-readable format.

### Right to lodge a complaint

Article 77 of the GDPR, Section 24 of the Data Protection Act: Every customer/data subject has the right to lodge a complaint with the supervisory authority if they consider that the processing of personal data relating to them infringes this Regulation.

### Supervisory authority

Austrian Data Protection Authority  
Barichgasse 40-42  
1030 Vienna  
Telephone: [+43 1 521 52-0](tel:00431521520)  
E-mail: [dsb@dsb.gv.at](mailto:dsb@dsb.gv.at "Öffnet ein neues Fenster")

1Where terms referring to natural persons are used in the masculine form only in this privacy notice, they refer to both women and men equally. When applying the term to specific natural persons, the respective gender-specific form must be used. The term ‘customers’ refers to both consumers and businesses.

2Kühling/Buchner, GDPR2, Art. 6, para. 59

3Direct marketing is the direct addressing of the data subject for advertising purposes, for example by sending letters or leaflets, or by means of telephone calls or electronic messages.

4[General Data Protection Regulation](http://eur-lex.europa.eu/legal-content/DE/TXT/?uri=CELEX%3A32016R0679)

```json
{"@context":"https:\/\/schema.org","@type":"WebSite","url":"https:\/\/brut-wien.at\/en","name":"brut Wien","description":"House of Performing Arts"}
{"@context":"https:\/\/schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Legal","item":"https:\/\/brut-wien.at\/en\/en\/legal\/barrierefreiheitserklaerung"},{"@type":"ListItem","position":2,"name":"Privacy policy","item":"https:\/\/brut-wien.at\/en\/legal\/datenschutzerklaerung"}]}
{"@context":"https:\/\/schema.org","@type":"Organization","name":"brut Wien","url":"https:\/\/brut-wien.at\/en","slogan":"House of Performing Arts","sameAs":["https:\/\/www.instagram.com\/brut_wien\/","https:\/\/www.facebook.com\/brutWien\/","https:\/\/vimeo.com\/brut"]}
```