Source: https://www.mww-forschung.de/en/data-privacy/?menuopen=1
Timestamp: 2019-04-25 12:45:00+00:00

Document:
The following data protection policy outlines the type, scope and purpose of processing of personal data (hereafter referred to as “data”) performed in connection with our online services, linked web pages, functions and content, as well as external platforms, e.g. our presence on social media platforms (hereafter referred to “online services”). With regard to terminology used in this policy, e.g. “processing” or “controller”, please refer to the definitions provided in Art. 4 of the EU’s General Data Protection Regulation (GDPR).
- Usage data (e.g. visited web pages, interest in content, access times).
“Personal data” is defined as all information that makes reference to identified or identifiable natural persons (hereafter referred to as “data subjects”). A natural person is regarded as identifiable if he/she can be directly or indirectly identified by means of an ID (e.g. a name), an ID number, location data, an online ID (e.g. cookie) or by one or more specific characteristics which convey the physical, physiological, genetic, psychological, financial, cultural or social identity of this natural person.
“Processing” is defined as any procedure conducted with or without automated assistance, or any sequence of procedures conducted in connection to personal data. The term is broadly applicable and includes practically every case of data handling.
“Pseudonymisation” refers to the processing of personal data in such a way that the data can no longer be assigned to any specific data subject without the provision of further information, whereby this information is specially safeguarded and is subject to organisational measures which ensure that the personal data cannot be assigned to an identified or identifiable natural person.
“Profiling” refers to any type of automated processing of personal data with the aim evaluating, analysing or predicting distinctive aspects related to a natural person, especially those related to work performance, financial situation, health, personal preferences, reliability, geographical location or changes in location of this natural person.
The term “responsible controller” distinguishes the natural or legal person, agency, organisation or other entity which is entitled to make decisions alone or in consultation with others concerning the purposes and means of processing personal data.
The term “processor” distinguishes a natural or legal person, agency, organisation or other entity who/which processes personal data on behalf of the responsible controller.
If we commission a third party to process data on the basis of a “data processing agreement”, this will occur in compliance with Art. 28 GDPR.
If we process data in a third country (i.e. outside of the European Union (EU) or the European Economic Area (EEA)), or if data is processed by, disclosed or transmitted to third parties in connection to using third-party services, this will only occur if necessary for meeting our (pre-)contractual obligations, if you have provided your consent, for the purpose of complying with legal obligations, or in pursuit of our legitimate interests. Insofar as data transfer does not require special legal or contractual permission, we only process or allow data to be processed in a third country if the specific provisions stipulated in Art. 44 ff GDPR apply. This means that data processing will only take place in accordance with guarantees contained in officially recognised data protection standards which correspond to those of the EU (e.g. the “Privacy Shield” in the USA) or with specific, officially recognised contractual obligations (so-called “standard contractual clauses”).
The data subject has the right to withdraw previously granted consent to process personal data with immediate effect for the future in accordance with Art. 7 (3) GDPR.
In accordance with Art. 21 GDPR, the data subject has the right to object at any time to having his/her personal data processed with immediate effect for the future. The objection can apply to data processing for direct marketing purposes.
“Cookies” are small files saved on the user’s computer. Cookies may contain a variety of data. The primary purpose of cookies is to store information about the user (or the device on which the cookie is saved) during and, in some cases, after the user’s visit to a website. Temporary cookies, also called “session cookies” or “transient cookies”, are erased as soon as the user leaves a website and closes his/her browser. Such cookies may contain information regarding the contents of an online shopping cart or one’s login status, for example. “Permanent” or “persistent” cookies remain saved on the user’s computer even after the browser is closed. These cookies may contain the user’s login status for up to several days after visiting a specific website. They may also contain information about the user’s interests which could be used for marketing purposes and tracking analysis. “Third-party cookies” are those which originate from external providers in contrast to those created by the controller of the visited website, which would be designated as “first-party cookies”.
In accordance with legal regulations in Austria, in particular §§ 132 (1) BAO, such data must be kept for a period of seven years (e.g. accounts, records/invoices, accounts, statements, business documents, income and expense reports, etc.), for 22 years for documents related to property and real estate, and ten years for documents related to electronically provided services, telecommunication, radio and television services rendered to non-business entities in EU member states and for the Mini-One-Stop-Shop (MOSS).
If a user chooses to leave a comment or other contribution on our website, we reserve the right to store his/her IP address for seven days based on legitimate interest in accordance with Art. 6 (1 f) GDPR. This is done to protect ourselves in case a comment or contribution contains illegal or improper content (insults, forbidden political propaganda etc.). In such cases, we may be held liable for the comment or contribution, for which reason we wish to discover the identity of the author in question.
Furthermore, we reserve the right on the basis of legitimate interest to process user information for the purpose of recognising spam in accordance with Art 6 (1 f) GDPR.
All data provided in connection with comments and contributions, including personal, contact and website information, are stored permanently until the user files an objection.
In pursuit of our legitimate interests as provided in Art. 6 (1 f) GDPR, we or our hosting provider collect and store data on every access query made to content saved on our server (so-called “server log files”). These log files contain the name of the accessed web page, file, date and time of the query, transmitted amount of data, report on whether the query was successful, the browser type and version, the user's operating system, referrer URL (i.e. previously visited page), IP address and the querying provider.
For security reasons (e.g. for investigating cases of possible misuse of fraud), log file data is saved for a period of 7 days max., after which time it is erased. Data retained as evidence in criminal investigations is exempt from erasure until the respective case is conclusively clarified.
As part of the Matomo tracking analysis software and in keeping with our legitimate interests (e.g. analysing, optimising and efficiently operating our online services as provided in Art. 6 (1 f) GDPR), we process the following data: user’s browser type and version, user’s operating system, country of origin, date and time of the server query, number of visits, length of time the user spends on our website, and the clicked external links. The user’s IP address is anonymised before it is saved.
Users can withdraw their consent to having anonymised data collected by Matomo with immediate effect for the future by clicking on the provided link below. In such cases, Matomo places an “opt-out cookie” onto the user’s browser which prevents it from collecting any data during their visit to our website. If users delete all cookies in their browser, the opt-out cookie will also be erased, which means they will have to reactivate the opt-out cookie during their next visit.
The data logs are erased within a period of six months.
We integrate videos via the video sharing platform “YouTube”, owned and operated by Google LLC, 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA. Privacy statement: https://www.google.com/policies/privacy/, Opt-Out: https://adssettings.google.com/authenticated.

References: Art. 4
 Art. 28
 Art. 44
 Art. 7
 Art. 21
 Art. 6
 Art 6
 Art. 6
 Art. 6