Data Protection Declaration
Data Protection Declaration
Data Protection Declaration of Innovationszentrum Universität Wien GmbH for the “Confucius Institute at the University of Vienna”
The Confucius Institute (hereinafter “CI”), which, alongside the Philharmonie, the Language Centre and the Summer School, forms part of Innovationszentrum Universität Wien GmbH (hereinafter “GmbH”), is delighted that you are visiting our website. The CI offers language courses and examinations in Chinese, as well as cultural events. Data protection and data security when using our website are very important to us. We would therefore like to take this opportunity to inform you about which of your personal data we collect when you visit our website and for what purposes this data is used.
As changes to legislation or to our internal company processes may require this privacy policy to be amended, we ask you to read through this privacy policy regularly. The privacy policy can be accessed, saved and printed at any time via Privacy Policy.
Data Controller and Scope
The controller according to the General Data Protection Regulation (GDPR) and other national data protection acts of member states as well as other statutory data protection regulations is:
Innovationszentrum Universität Wien GmbH
Hof 1.16, Alser Str. 4
1090 Vienna
Confucius Institute
Email: konfuzius-institut(at)univie.ac.at
Website: www.konfuzius-institut.at
This Privacy Policy applies to the Confucius Institute’s website, which is accessible via the domain www.konfuzius-institut.at (hereinafter referred to as ‘our website’ or ‘online presence’), as well as to the Confucius Institute’s other services.
Data Protection Officer and Contact Person
The external Data Protection Officer appointed by the data controller is:
Dr Daniel Stanonik, LL.M., and Kinast Rechtsanwaltschaft GmbH, represented by Dr Karsten Kinast on a mutual deputising basis.
If the rights of data subjects according to section 13 of this Data Protection Declaration (e.g. right to information, right to erasure, etc.) are asserted, the relevant requests or applications must be sent via mail to: konfuzius-institut(at)univie.ac.at or to
Innovationszentrum der Universität Wien GmbH
Alserstraße 4, Hof 1, Entrance 1.13
1090 Vienna
What is personal data?
Personal data is individual information concerning personal or material details of an identified or identifiable natural person (data subject). These include, for example, information, such as your name, address, telephone number, date of birth and e-mail address. Information that cannot be linked to your person (or only involving a disproportionate effort), such as anonymised information, is not considered personal data.
General information on data processing
a) Scope
As a general principle, we collect and use personal data of our users only to the extent that is necessary for carrying out the relevant data processing activity. We use your personal data to provide information, products and desired services offered by the CI, to answer your questions, to fulfil our legal mandate and statutory obligations, as well as to operate and improve our websites and applications.
We collect and use personal data of our users only based on a relevant legal foundation in accordance with the GDPR, e.g. only if the individual user has given their consent. Further details regarding the individual consents granted are specified in section 7 of this Data Protection Declaration under the respective processing activity.
Your personal data will not be used for any other purpose. Your personal data will not be transferred to third parties or used, for example, for advertising purposes without your consent, except in the cases specified below, and unless we are required by law to disclose the data.
b) Legal basis
Where we obtain the data subject’s consent for the processing of personal data, Article 6(1)(a) of the EU General Data Protection Regulation (GDPR) serves as the legal basis for the processing of personal data. Where the processing of personal data is necessary for the performance of a contract to which the data subject is a party, Article 6(1)(b) of the GDPR serves as the legal basis. This also applies to processing operations necessary for the implementation of pre-contractual measures. Where the processing of personal data is necessary for compliance with a legal obligation to which our company is subject, Article 6(1)(c) of the GDPR serves as the legal basis.
Where the processing of personal data is necessary to protect the vital interests of the data subject or of another natural person, Article 6(1)(d) of the GDPR serves as the legal basis. If processing is necessary to safeguard a legitimate interest of our company or a third party, and the interests, fundamental rights and freedoms of the data subject do not override the former interest, Article 6(1)(f) of the GDPR serves as the legal basis for the processing.
c) Data erasure and retention period
The data subject’s personal data shall be erased or blocked as soon as the purpose for which it was stored no longer applies (for example, when a language course attended has ended). Data may also be retained if this is provided for by European or national legislation in EU regulations, laws or other provisions to which the controller is subject. Data will also be blocked or erased when a retention period prescribed by the aforementioned standards expires, unless there is a need to continue storing the data for the conclusion or performance of a contract.
Individual processing operations
You can use the majority of our website without providing any personal data. The website is designed as a static site which, in principle, only displays information from the CI. No personal data is processed for this purpose.
To use the services on offer, such as registering for events or courses, personal data is entered into the forms provided (which are to be printed out) and these are then signed. The forms completed in this way are sent to the CI and stored there. When registering in person, this data is recorded using a registration form and transferred to the database. Furthermore, some of our services (e.g. excursions, [cultural] events, etc.) can only be booked in person. As a general rule, data is not passed on to third parties. Should such a transfer take place, this will be communicated separately for the service in question.
However, if you wish to make use of services offered by us on our website, such as subscribing to a newsletter, etc., you will need to provide further data. Details can be found below in the description of the specific data processing operations. In particular, personal data is used as follows:
Provision of the website and creation of log files
Each time our website is accessed, our system automatically collects data and information from the computer system of the accessing device. The following data is collected in this process:
• IP address of the accessing device
• Date and time of access
• Name and URL of the file accessed
• Amount of data transferred
• Indication of whether the access was successful
• Identification data of the accessing browser and the operating system
• Website from which the access is made
The log files contain IP addresses or other data that enable identification of a user. This could be the case, for example, if the link to the website from which the user accesses our website, or the link to the website to which the user navigates, contains personal data.
The data is also stored in our system’s log files. This data is not stored together with any other personal data relating to the user.
The legal basis for the temporary storage of the data and the log files is Article 6(1)(f) of the GDPR.
The data is stored in log files to ensure the website functions properly. Furthermore, the data helps us to optimise the website and ensure the security of our IT systems. The data is not analysed for marketing purposes in this context.
These purposes also constitute our legitimate interest in data processing pursuant to Article 6(1)(f) of the GDPR.
The data will be deleted as soon as it is no longer required to fulfil the purpose for which it was collected. This takes place after 30 days at the latest. In the case of data collected for the purpose of providing the website, this is the case once the respective session has ended. The collection of data for the purpose of providing the website and the storage of data in log files is absolutely essential for the operation of the website. Consequently, the user has no right to object.
Newsletter
On our website, you have the option to subscribe to a free newsletter. When you register for the newsletter, the data entered in the form is transmitted to us. In order to subscribe to our email newsletter service, we require, in addition to your consent, at least your email address to which the newsletter is to be sent. Any further details are provided on a voluntary basis and are used to address you personally, to personalise the content of the newsletter, and to clarify any queries regarding your email address. It is entirely up to you whether you provide us with this data. However, without this information, we cannot send you our newsletter.
In addition, the following data is collected upon registration and deleted after 30 days:
• IP address of the requesting computer
• Date and time of access
• Name and URL of the file accessed
• Amount of data transferred
• Indication of whether the request was successful
• Identification data of the accessing browser and the operating system
• Website from which access is made
If you register for the newsletter, the following mandatory details must be provided:
• First name
• Surname
• Email address*
Mandatory fields are marked accordingly (*). All other details are optional.
The legal basis for processing the data following the user’s registration for the newsletter is the user’s consent pursuant to Article 6(1)(a) of the GDPR:
I agree that the Confucius Institute (Innovationszentrum Universität Wien GmbH) may collect, store and process my email address and any other data entered in the form for the purpose of sending promotional material in the form of a newsletter. My data will be deleted as soon as the purpose of the processing has been fulfilled, provided that no other statutory retention period applies. I hereby declare that this declaration of consent is given on a voluntary basis. I have been informed that I may withdraw my consent at any time, informally and with future effect, without any adverse consequences for me. I may send my notice of withdrawal to konfuzius-institut(at)univie.ac.at. In the event of withdrawal, my data will be deleted by Innovationszentrum Universität Wien GmbH and any data processors.
We use the so-called double opt-in procedure for sending the newsletter; that is, we will only send you the newsletter once you have confirmed your subscription via a confirmation email sent to you for this purpose by clicking on the link contained therein. In this way, we wish to ensure that only you, as the owner of the email address provided, can subscribe to the newsletter. You must confirm your subscription promptly after receiving the confirmation email; otherwise, your newsletter subscription will be automatically deleted from our database.
The user’s email address is collected for the purpose of delivering the newsletter.
When you subscribe to the newsletter, your email address will be used for our own advertising purposes until you unsubscribe from the newsletter.
The collection of other personal data as part of the registration process serves to prevent misuse of the services or of the email address provided.
The data will be deleted as soon as it is no longer required to fulfil the purpose for which it was collected. The user’s email address will therefore be stored for as long as the newsletter subscription remains active.
Other personal data collected as part of the registration process is generally deleted after a period of 30 days.
To unsubscribe, you can either send us an informal email to newsletter@konfuzius-institut.at or cancel your subscription via the link at the end of the newsletter.
You may withdraw your consent to the collection of other personal data collected during the registration process at any time.
No data is passed on to third parties in connection with the data processing required for sending newsletters. The data is used exclusively for the purpose of sending the newsletter.
Use of cookies
We use so-called “cookies” (small text files containing configuration information). Cookies are small text files which, whilst you are using our website, are sent from our web server to your browser and stored by your browser on your computer for later retrieval. We use so-called session cookies (also known as temporary cookies), i.e. those that are stored only for the duration of your visit to our website.
The cookies used also serve to determine the frequency of use and the number of users of our website, and to identify when you have finished using it. This enables us to find out which sections of our website our users have accessed. However, this usage data does not allow any conclusions to be drawn about the individual user. None of this anonymised usage data is combined with your personal data as defined in Section 3 of this privacy policy, and it is deleted immediately after the statistical analysis has been completed. Once the session has ended – that is, as soon as you have logged out of our website – the cookies are deleted (session cookies).
Other cookies (in particular persistent cookies) remain on your computer and enable us to recognise your computer the next time you visit. These cookies are used to greet you by your username and mean you do not need to re-enter your password or fill in forms with your details. The cookies generated have an expiry period of several months. Our partners are not permitted to collect, process or use personal data via our website by means of cookies.
Most browsers are set by default to accept cookies automatically. However, you can disable the storage of cookies or set your browser to notify you before cookies are stored. Users who do not accept cookies may not be able to use certain areas of our website.
Security measures to protect the data stored by us
We are committed to protecting your privacy and treating your personal data confidentially. To prevent the loss or misuse of the data stored by us, we implement comprehensive technical and organisational security measures, which are regularly reviewed and adapted to technological progress. However, we would like to point out that, due to the structure of the internet, it is possible that data protection rules and the aforementioned security measures may not be observed by other individuals or organisations outside our sphere of responsibility. In particular, data disclosed in unencrypted form – for example, via email – may be read by third parties. We have no technical control over this. It is the user’s responsibility to protect the data they provide against misuse, whether through encryption or by other means.
Hyperlinks to external websites
Our website contains so-called hyperlinks to websites operated by other providers. When you click on these hyperlinks, you will be redirected directly from our website to the websites of these other providers. You can recognise this, amongst other things, by the change in the URL. We cannot accept any responsibility for the confidential handling of your data on these third-party websites, as we have no control over whether these companies comply with data protection regulations. Please refer directly to these websites for information on how these companies handle your personal data.
Consent and withdrawal / objection
You may have expressly given the following consents. We would like to point out that you may, in principle, withdraw any consent you have given at any time with future effect and may also object at any time to the processing and use of your data for advertising purposes: To do so, please contact __konfuzius-institut(at)univie.ac.at___oder in writing at Innovationszentrum Universität Wien GmbH Confucius Institute, Alserstraße 4, Hof 1, Entrance 1.13; 1090 Vienna.
Consent to email marketing/newsletters
I agree that the Confucius Institute (Innovationszentrum Universität Wien GmbH) may collect, store and process my email address and any other data I have entered in the form for the purpose of sending me marketing material in the form of a newsletter. My data will be deleted as soon as the purpose of the processing has been fulfilled, provided that no other statutory retention period applies. I hereby declare that this declaration of consent is given on a voluntary basis. I have been informed that I may withdraw my consent at any time, informally and with future effect, without any adverse consequences for me. I may send my notice of withdrawal to konfuzius-institut(at)univie.ac.at. In the event of withdrawal, my data will be deleted by Innovationszentrum Universität Wien GmbH and any data processors.
Your rights as a data subject
Under the GDPR, you, as a data subject whose personal data is being processed, have the following rights:
• In accordance with Article 15 of the GDPR, you may request information about your personal data processed by us. In particular, you may request information regarding the purposes of processing, the categories of personal data, the categories of recipients to whom your data has been or will be disclosed, the intended storage period, the existence of a right to rectification, erasure, restriction of processing or the right to object, the existence of a right to lodge a complaint, the origin of your data where it was not collected by us, any transfer to third countries or to international organisations, and the existence of automated decision-making, including profiling, and, where applicable, meaningful information regarding its details.
• In accordance with Article 16 of the GDPR, you may request, without delay, the rectification of inaccurate personal data or the completion of your personal data stored by us.
• In accordance with Article 17 of the GDPR, you may request the erasure of your personal data stored by us, provided that the processing is not necessary for the exercise of the right to freedom of expression and information, for compliance with a legal obligation, for reasons of public interest, or for the establishment, exercise or defence of legal claims.
• In accordance with Article 18 of the GDPR, you may request the restriction of the processing of your personal data where you contest the accuracy of the data, the processing is unlawful, we no longer require the data and you object to its erasure because you need it to establish, exercise or defend legal claims. You are also entitled to the right under Article 18 of the GDPR if you have objected to the processing in accordance with Article 21 of the GDPR.
• In accordance with Article 20 of the GDPR, you may request to receive the personal data you have provided to us in a structured, commonly used and machine-readable format, or you may request that it be transmitted to another controller.
• In accordance with Article 7(3) of the GDPR, you may withdraw your consent at any time by notifying us. As a result, we may no longer continue to process your data on the basis of that consent in future.
• Under Article 77 of the GDPR, you have the right to lodge a complaint with a supervisory authority. As a general rule, you may contact the supervisory authority for your usual place of residence, your place of work or our registered office.