Source: http://www.emissionshandelsregister.at/ms/emissionshandelsregister/ehr_en/ehren_legal/ehren_dataprotection/
Timestamp: 2019-04-23 20:27:37+00:00

Document:
The protection and lawful processing of your personal data are a matter of great importance for us, the Umweltbundesamt GmbH (Environment Agency Austria). We would like to make processing transparent for you. The purpose of this privacy notice is to inform you about how your data will be processed. This also applies to personal data which will be collected in the future.
You must provide us with those personal details that are necessary for the proper implementation of the business relationship, for the fulfilment of legal obligations or for the performance of tasks which are carried out in the public interest, in particular under the Environmental Control Act.
Personal data is all information that refers to an identified or identifiable person and thus information that can be assigned to you individually, e.g. your name, your address, telephone number or e-mail address.
For any processing of personal data undertaken in the Union Registry, the Austrian Emissions Trading Registry is a data processor within the meaning of the GDPR.
For responsibilities of the European Commission we refer you to the following privacy statement: http://ec.europa.eu/clima/sites/registry/privacy_en.htm .
We process your personal data: For the fulfilment of contractual obligations or for the implementation of pre-contractual measures (Art 6 para 1 point b): The purpose of processing is in particular to deliver all the transactions that are carried out on the basis of contracts concluded for the purpose of the management of accounts in the Union Registry (opening of accounts, approval of account representatives, regular Know Your Customer (KYC) checks).
For the fulfilment of legal obligations (Art 6 para 1 point c of the GDPR) and for the performance of tasks carried out in the public interest (Art 6 para 1 point e GDPR): The purpose of processing is the fulfilment of legal requirements for the implementation of the emissions trading system, notably Directive 2003/87/EC establishing a scheme for greenhouse gas emission allowance trading within the Community (EU-ETS), the Regulation (EU) No 2013/389/EU as amended, Section 43 of the Austrian Act on Emissions Allowances etc.
In order to protect legitimate interests (Art 6 para 1 point f of the GDPR): We may process your data to protect our legitimate interests. In this case, the purpose of processing is to respond to your enquiries, and to pursue our interest in initiating, maintaining or intensifying a business relationship with you as an existing and potential customer, unless you object to the use of your data pursuant to Art 21 of the GDPR.
Within the scope of your consent (Art 6 para 1 point a of the GDPR): If you have given us your consent to the processing of your personal data, processing will be carried out only within the scope specified and agreed in the declaration of consent. Any consent given can be withdrawn independently at any time with future effect. The withdrawal of consent does not affect the lawfulness of processing based on consent before its withdrawal.
We receive your data on a regular basis from you or from publicly accessible registers (e.g.: company register, land registry, population register), or from general public sources (e.g. internet).
To carry out periodical reviews to establish whether the information submitted for an account is still complete, up-to-date, accurate and true, the Registry collects some of the data required not directly from you but from the Ministry for Sustainability and Tourism. Likewise, Know Your Customer (KYC) checks are also carried out in part by the Ministry for Sustainability and Tourism (e.g. for the approval of new account representatives).
Within the Umweltbundesamt GmbH your data is processed only by those employees who need the data for the fulfilment of contractual and legal obligations, for the performance of a task which is carried out in the public interest or to safeguard legitimate interests of the Umweltbundesamt GmbH.
A transfer of your personal data is only carried out on the basis of legal or contractual authorisation or provisions or if you have given us your consent (e.g. release of personal data in accordance with Article 110 para 6 of Regulation (EU) No 389/2013 on the grounds of refusal as set out in Section 22 para 2 point a-c and Art 24 para 5 point a and b of Regulation (EU) No 389/2013).
If required, your personal data will be processed and stored for as long as necessary for the fulfilment of our contractual duties (contracts concluded for the purpose of the management of accounts) and legal obligations (the obligation to store records in accordance with Art 108 of Regulation (EU) No 389/2013), and to safeguard against any warranty claims or claims for damages. Especially for purposes under criminal law (prevention of fraud, money laundering or terrorist financing) under Sections 146-148, 165 and 278(d) of the Austrian Criminal Code there is a statutory storage obligation of 10 years for all personal data exported from the Union Registry or otherwise compiled by the registry administration.
Changes to this privacy notice may be necessary from time to time for legal or organisational reasons.
As a data subject you have the right to request information according to Art 15 of the GDPR, and the right to rectification according to Art 16 of the GDPR. You can also demand the erasure of your personal data according to Art 17 of the GDPR, provided that there is no existing contract establishing a business relationship or none of the above mentioned legal storage obligations.
If you have any questions or requests regarding the processing of your personal data, or would like to submit an application in accordance with the above-mentioned GDPR provisions, please send them by e-mail to our data protection officer: datenschutzbeauftragter@umweltbundesamt.at.
To protect your privacy and security, we reserve the right to verify your identity before taking any of the above measures.
If you believe that the processing is unlawful, you can lodge a complaint with the competent supervisory authority. In Austria this is the data protection authority.

References: Art 21
 Art 24
 Art 108
 Art 15
 Art 16
 Art 17