Source: https://www.viennahouse.com/en/data-protection/competitions.html
Timestamp: 2019-04-20 05:08:12+00:00

Document:
DATA PROTECTION POLICY "Competitions and Marketing Measures"
Direct advertisement: VIENNA HOUSE hereby provides information that it also processes customers' personal data for the purposes of direct advertisement (incl. profiling). VIENNA HOUSE intends to use direct advertisement to aid in the marketing of advertised (proprietary or third-party) products and services. The data will not be passed onto any (non-group-affiliated) third parties for this purpose. There is no incompatibility with the purpose of the original data collection.
The customer can object to the use of their personal data for direct advertisement (including "profiling") at any time without providing any reasons to the controller. By lodging an objection, VIENNA HOUSE can no longer use the customer's personal detail for these purposes in future.
VIENNA HOUSE complies with legal, communication-related requirements while using this data, particularly those of Section 107 TKG.
VIENNA HOUSE is part of a corporate group. VIENNA HOUSE also uses other affiliated companies on a collaborative basis to fulfil its extensive obligations. VIENNA HOUSE has a legitimate interest therein (Recital 48 of GDPR). Personal data is only received by parties within the corporate group which require this data to fulfil contractual and statutory obligations as well as to protect legitimate interests. All of these parties are contractually obliged to comply with all requirements under data protection law.
"Gathering and storing": VIENNA HOUSE stores customer activities (e.g. orders, complaints, etc.) to enable optimal customer care and to ensure relevant and targeted measures can be used to improve satisfaction and customer loyalty, and to adjust the service on an individual basis.
Analysis of personal interests: VIENNA HOUSE stores demand-related behaviour, reactions to offers, and deduces specific personal interests from this in order to prevent dispersion losses (and to minimise data processing operations) within direct advertisement. VIENNA HOUSE uses these analysed interests in order to communicate targeted, interest-specific offers and advertising to customers, in particular for customer loyalty, and thus prevent dispersion loss in advertising.
The customer can object to the use of their personal data for the purposes of profiling at any time without providing any reasons to the controller. By lodging an objection, VIENNA HOUSE can no longer use the customer's personal detail for the purpose of profiling in future.
Customers are under no obligation to provide data.
The customer is not subject to any automated decision that has a legal effect upon them.
Group companies: A list of current group companies can be found here.
In the course of competitions and other marketing measures, no data are transferred to states outside of the EU in the course of data processing.
All participants: On the legal bases mentioned above, VIENNA HOUSE generally continues to process data for an additional 24 months following the draw/end of the measure in a manner which is personally identifiable, and thereafter erases the data (or at least the data which allows reference to be drawn to the data subject's identity).
Winner/recipient of benefit: On the legal bases mentioned above, VIENNA HOUSE generally continues to process guest data for an additional 30 months following the announcement of the winner or end of the benefit receipt from the marketing measure (= 24 months for potential contractual damage claims + max. 6 months to file suit) in a manner which is personally identifiable, and thereafter erases the data (or at least the data which allows reference to be drawn to the data subject's identity). Personally-identifiable processing of possible invoice data is then performed until the statutory retention obligations have expired (currently generally 7 years).
Art. 15 GDPR "Right of access": The customer has the right to obtain confirmation as to whether their personal data is being processed.
Art. 16 GDPR "Rectification": The customer has the right to have inaccurate or incomplete personal data rectified.
Art. 17 GDPR "Erasure": The customer has the right to demand the erasure of personal data without undue delay where the grounds stated under Art. 17 Para. 1 GDPR apply.
Art. 18 GDPR "Restriction": The customer has the right to demand that the processing of personal data is restricted where the grounds stated under Art. 18 Para. 1 GDPR apply.
Art. 20 GDPR "Data portability": The customer has the right to receive their personal data in a structured, commonly used and machine-readable format.
Art. 21 GDPR "Object"Objecting to profiling: the customer has the right to lodge an objection at any time to the processing of their personal data for the purposes of profiling.
Objecting to direct advertisement: the customer has the right to lodge an objection at any time to the processing of their personal data for the purposes of direct advertisement.
Every customer has the right to lodge a complaint with a supervisory authority if they consider that the processing of personal data relating to them infringes this regulation.

References: Art. 15

Art. 16

Art. 17
 Art. 17

Art. 18
 Art. 18

Art. 20

Art. 21