As legislative changes or changes to processes within our university may require an adaptation of this privacy policy (“Privacy Policy”), we ask you to read such Policy regularly. The Privacy Policy can be retrieved, saved and printed under “Data protection” at any time.

§ 1 Controller and scope of application

The controller within the meaning of the EU’s General Data Protection Regulation (“GDPR”), other national data protection laws of Member States and other data protection regulations is:

University of Veterinary Medicine, Vienna
Veterinärplatz 1
A-1210 Vienna
Telephone: +43 1 25077-0
Fax: +43 1 25077-1090
E-mail: rektorat@vetmeduni.ac.at
www.vetmeduni.ac.at

This Privacy Policy shall apply to the online services of the University of Veterinary Medicine, available at www.vetmeduni.ac.at, and various subdomains of our website (“Our Website”).

§ 2 Data protection officer

RA Mag.^a Katharina Raabe-Stuppnig
E-mail: datenschutz@vetmeduni.ac.at

§ 3 What is personal data?

Personal data is any information related to an identified or identifiable natural person. It comprises, for example, information such as your name, your age, your address, your phone number, your date of birth, your e-mail address, your IP address or your user behaviour. Information we cannot (or only with a disproportionate effort) relate to you—for example, because the information is anonymised—is not personal data.

Processed personal data are erased as soon as the intended purpose of processing such data has been fulfilled, and there is no legal obligation to store such data any longer.

If we process your personal data to provide you with certain services, we shall inform you about the particular procedures, scope and purpose of the processing, the legal basis of such processing and the storage period.

§ 4 General information about data processing

1. Extent

We collect and use personal data from our users only to the extent which is necessary to provide them with an operational website, our contents and services.

We use your data to provide you with information, products and your required services, to answer your questions and to operate and improve Our Website and applications.

We only collect and use personal data in accordance with the relevant legal basis within the meaning of the GDPR.

2. Legal basis

If we seek the consent of a data subject to process personal data, art. 6 par. 1 lit. a GDPR shall provide the legal basis for the processing of personal data. If the processing of such data is necessary to perform a contract to which such data subject is a contracting party, art. 6 par. 1 lit. b GDPR shall be the legal basis. This also applies to the processing necessary to implement pre-contractual measures. If data processing is necessary to comply with a legal obligation to which the University of Veterinary Medicine is subject, art. 6 par. 1 lit. c GDPR shall provide the legal basis.

In cases in which the vital interests of a data subject or another natural person require the processing of personal data, art. 6 par. 1 lit d GDPR shall provide the legal basis. If such processing is necessary for the purposes of a legitimate interest pursued by the University of Veterinary Medicine or a third party, and the interests, fundamental rights and freedoms of such data subject do not override the former interest, art. 6 par. 1 lit. f GDPR shall provide the legal basis of such processing.

3. Erasure of data and storage period

The personal data of data subjects are erased or blocked as soon as the purpose of storing such data ceases to exist. Data may be stored beyond this period if such storage is required by European or national legislation in EU regulations, laws or other provisions to which the University of Veterinary Medicine is subject. Data are also blocked or erased as soon as one of the storage periods required by the aforementioned norms expires, unless further storage of the data is required to conclude or perform a contract.

§ 5 Processing in detail

1. Provision and use of Our Website

a. Nature and extent of data processing

When you access and use Our Website, we collect the personal data your browser automatically transmits to our server. This information is temporarily saved in a log file. When you use Our Website, we collect the following data, which are technically necessary to display Our Website and guarantee stability and security:

• IP address of the requesting computer
• date and time of access
• name and URL of the accessed file
• status of the access
• transmitted data volume
• the website from which Our Website is accessed
• identification data of the accessing browser and the operating system

b. Legal basis

Art. 6 par. 1 lit. f GDPR shall be the legal basis for the data processing described above. Processing of the aforementioned data is necessary to operate a website and serves, therefore, the protection of a legitimate interest of the University of Veterinary Medicine.

c. Storage period

As soon as the aforementioned data are no longer necessary to display Our Website, they will be erased. Collecting data to provide Our Website and saving them in log files is absolutely necessary to operate Our Website. Therefore, users cannot object to such saving. In specific cases, data may be stored longer if this is required by law.

2. Mailings from the University of Veterinary Medicine

Related to offers and services of the University of Veterinary Medicine, there are mailings that are not subject to the consent of the data subject. In such mailings, the e-mail address of the data subject is processed as personal data. Further personal data are processed according to the nature and legal basis of the mailing.

For mailings necessary to meet our legal obligations, art. 6 par. 1 lit. c GDPR shall provide the legal basis.

For mailings necessary to implement contractual or pre-contractual measures, art. 6 par. 1 lit. b GDPR shall provide the legal basis.

If personal data are not subject to further storage periods required by law, they are erased as soon as the purpose of data processing has been fulfilled.

If the mailing is necessary to protect a legitimate interest of the University of Veterinary Medicine or a third party, and the interests, fundamental rights and freedoms of such data subject do not override the former interest, art. 6 par. 1 lit. f GDPR shall provide the legal basis for such processing.

You may object to such processing. If no other contact address is provided for such processing, this objection can be sent to datenschutz@vetmeduni.ac.at or to

University of Veterinary Medicine, Vienna
Data protection officer of the University
Veterinärplatz 1
A-1210 Vienna

Personal data are erased as soon as the legitimate interest of the University of Veterinary Medicine ceases to exist, and the data are not subject to further storage periods required by law.

With regard to mailings, personal data are only transferred to third parties if such transfer is necessary to implement (pre-)contractual measures or such transfer is done in the overriding legitimate interest of the University of Veterinary Medicine.

If data are transferred to third parties, such transfer will be indicated in the particular mailing.

3. Contact form

a. Nature and extent of data processing

Our Website has a contact form which you may use to contact us. When you use this contact form, the data entered into the input mask are transmitted to us and saved. The following data may be processed:

• title
• name
• e-mail address
• address
• relation to the University of Veterinary Medicine
• nature of the message
• subject of the query
• message

Your e-mail address helps us to associate your query and answer it. We do not transfer your personal data to third parties when you use our contact form.

b. Legal basis

Data for contacting us are processed according to art. 6 par. 1 lit. a GDPR, and such processing is based on the informed consent of the user.

For processing data transmitted via e-mail, art. 6 par. 1 lit. f GDPR shall provide the legal basis. If contact via e-mail aims at concluding a contract, art. 6 par. 1 lit. b GDPR shall provide an additional legal basis.

If legal obligations make it necessary to contact us, art. 6 par. 1 lit. c GDPR shall provide an additional legal basis.

The processing of personal data from the input mask only serves to process your query. In the event that you contact us via e-mail, such contact also constitutes the required legitimate interest in processing your data.

Other personal data processed when sending a query serve to prevent abuse of our contact form and to guarantee the security of our IT systems.

c. Storage period

As soon as your query has been answered and the matter is fully clarified, the processed personal data from the contact form are erased. Such erasure also applies to personal data that have been transmitted via e-mail. In certain cases, data may be stored longer if this is required by law.

4. Fundraising

Private donors, foundations and responsible companies can support the University of Veterinary Medicine in many ways.

a. Nature and extent of data processing

The University of Veterinary Medicine processes the following categories of data:

• core data
• contact data
• information you might have shared with us
• history of communication
• history of donations
• classifications (such as type of membership, sponsorship)

These data are processed to prepare and conduct fundraising campaigns, administrate donations, comply with tax provisions and to wish you a happy birthday.

Providing your name and bank details is necessary to conclude donation agreements (donations/sponsoring) and required by tax laws and anti-money laundering provisions. If you do not provide these data, we cannot accept donations and sponsoring.

Furthermore, providing your name and date of birth is required for the automated employee tax assessment if donors wish to benefit from a tax advantage for their donations. If you do not provide the aforementioned data, your donations cannot be considered extraordinary expenses in your tax assessment.

We only transfer your personal data to third parties if such transfer is necessary to perform a contract or for billing, or if you have agreed to such transfer beforehand.

Service providers that support the University of Veterinary Medicine in the operation of fundraising websites and the communication with donors by mail or telephone have bound themselves to comply with the applicable provisions of data protection law when they cooperate with us. Processing contracts have been concluded with such service providers in accordance with art. 28 GDPR.

We only cooperate with service providers who sufficiently guarantee appropriate technical and organisational measures to process data according to the requirements of data protection provisions and protect your data.

Apart from the cases described above, we do not transfer your personal data to third parties unless we are required by law to disclose such data.

b. Legal basis

The legal basis for processing your personal data shall be art. 6 par. 1 lit. a GDPR (consent) and art. 6 par. 1 lit. b GDPR (performance of a contract).

If the processing of personal data is necessary to fulfil legal obligations to which the University of Veterinary Medicine is subject, art. 6 par. 1 lit. c GDPR shall provide such legal basis.

The processing of personal data to attract donor support and sponsors serves the protection of a legitimate interest of the University of Veterinary Medicine pursuant to art. 6 par. 1 lit. f GDPR. The University of Veterinary Medicine thereby pursues objectives of public interest according to § 4a EStG and §§ 34 ff BAO and makes an essential contribution to society, particularly to the health of animals and humans.

In order to reach these publicly acknowledged organisational goals, targeted action is taken, and personal data are processed. We take particular care to meet our supporters’ requirements in the best possible way and to avoid wastage. Raised funds are used in the most cost-efficient way possible, in the interest of all persons supporting the University of Veterinary Medicine.

c. Storage period

Your personal data are processed until you file an objection. They may only be stored beyond this period if it is required by European or national legislation in EU regulations, laws or other provisions, to which the University of Veterinary Medicine is subject.

§ 6 Transferring data

We only transfer your personal data to third parties if

• you have given your explicit consent according to art. 6 par. 1 lit. b GDPR
• such transfer is permitted by law and necessary to perform a contract with you according to art. 6 par. 1 lit. b GDPR
• there is a legal obligation to transfer such data according to art. 6 par. 1 lit. c GDPR
• such transfer is necessary according to art. 6 par. 1 lit. f GDPR to protect legitimate interests of the University of Veterinary Medicine, as well as to establish, exercise or defend legal claims, provided that there is no reason to believe that you have an overriding interest worthy of protection that we do not transfer your data.

§ 7 Use of Cookies

1. Nature and extent of data processing

We use cookies on Our Website. Cookies are small text files that are sent to your browser and saved on your device when you visit Our Website. Thus, Our Website can remember certain input and settings (e.g. language settings) for a certain period of time, for the time the cookie is stored.

Cookies help us, among others, to make our internet services more effective and user-friendly for you.

Cookies do not cause any harm to your device. They cannot run programmes or contain viruses.

2. Legal foundation

Personal data are processed using cookies on the basis of the legitimate interests of the University of Veterinary Medicine, according to art. 6 par. 1 lit. f GDPR.

3. Storage period

As soon as the data transmitted to us via cookies are no longer necessary to fulfil the above-mentioned purpose, such data will be erased. In certain cases, data may be stored longer if this is required by law.

4. Configuration of browser settings

Most browsers have standard settings so that they accept cookies. However, you can configure your browser in a way that it only accepts certain cookies or no cookies at all. Please note that you might not be able to use all functions on Our Website if cookies on Our Website are deactivated in your browser settings. In your browser settings, you can also delete cookies already stored in your browser or display the storage period. Furthermore, you can configure your browser so that you receive a notification before cookies are saved. As browser functions may differ from one browser to another, please consult the help menu of your browser for configuration options.

In case you wish to have a comprehensive overview of any third-party access to your web browser, we recommend installing plug-ins specially developed for that purpose.

§ 8 Statistical evaluation

We use Matomo on Our Website, which is an open-source software for the statistical evaluation of the visits to Our Website. Matomo uses cookies. The information generated by the cookie concerning your use of Our Website will be stored on the web server. You can prevent the installation of cookies through the configuration of your browser. Please note that in this case you might not be able to make full use of all the functions on Our Website.

Name	Provider	Purpose of processing	Duration of storage
MATOMO_SESSID	Matomo	statistical evaluation	Until the end of the browser session
_pk_id.1.3717	Matomo	statistical evaluation	13 months
_pk_ref.1.3717	Matomo	statistical evaluation	6 months
_pk_ses.1.3717	Matomo	statistical evaluation	30 minutes

After processing the IP address and before saving it, it will be anonymised. We explicitly point out that complete anonymisation cannot be reached despite the fully active anonymisation function; it is only a pseudo-anonymisation. Matomo generates an internal hash value which is calculated from different factors such as the IP address, the resolution, the browser, the plug-ins used and the operating system. Even when the anonymisation function is active, this heuristic uses the full IP address for internal purposes. Thus, the values can be recalculated to the IP address with some effort and, consequently, the other information can be deduced to a highly reliable degree.

If you do not agree to us saving and evaluating these data, you can always object to storage and use (per mouse click afterwards). (Subsequently, a so-called opt-out cookie will be saved in your browser which prevents Matomo from collecting session data.)

Matomo enables us to statistically evaluate the use of Our Website and improve our online services for you as a result of the information obtained from such evaluation. The legal basis for processing is consent according to § 96/3 TKG and Art 6/1 lit a GDPR. Your consent can be withdrawn anytime.

§ 9 Hyperlinks

There are so-called hyperlinks to websites of other providers on Our Website. When you activate these hyperlinks, you are automatically directed to the website of the other provider. This is indicated, among others, by the change of URL. We cannot assume any responsibility for the confidential use of your data on these websites of third parties, as we cannot influence whether these companies respect data protection provisions. Please consult these websites directly for information on the handling of your personal data. The University of Veterinary Medicine shall not be liable for external links.

§ 10 Rights of the data subject

As a data subject whose personal data are processed, you may exercise the following rights under the GDPR:

• According to art. 15 GDPR, you may request information about your personal data which we process.
• According to art. 16 GDPR, you may immediately request the rectification of incorrect data or the completion of your personal data we have stored. As a student, you are obliged to inform each university at which you are enrolled about changes in name or address, pursuant to § 59 par. 2 UG.
• According to art. 17 GDPR, you may request the erasure of your personal data which we have stored. The right to erasure may be limited in the cases mentioned in the law, particularly when the right to freedom of expression and information is performed, to fulfil legal obligations, for archiving and research purposes in the public interest, as well as to establish, exercise or defend legal claims.
• According to art. 18 GDPR, you may request restriction of the processing of your personal data if you contest the accuracy of such data, such processing is unlawful, we no longer need such data and you reject the erasure of such data because you need such data to establish, exercise or defend legal claims. You also have this right under art. 18 if you have objected to processing according to art. 21 GDPR.
• According to art. 20 GDPR, you may request to receive the personal data you have provided to us in a structured, commonly used and machine-readable format. You may also request that such data be transmitted to another controller.
• According to art. 7 par. 3 GDPR, you may withdraw the consent you have given at any time. Consequently, we shall no longer continue data processing based on this consent.
• According to art. 77 GDPR, you have the right to lodge a complaint with a supervising authority. In most cases, you can contact the supervising authority of your habitual residence, your place of work or our university. The Austrian supervising authority is Österreichische Datenschutzbehörde, Barichgasse 40-42, 1030 Vienna, telephone: +43 1 52 152-0, e-mail: dsb@dsb.gv.at, web: www.dsb.gv.at

§ 11 Right to object

According to art. 21 GDPR, you have the right to object to the processing of your personal data based on legitimate interests according to art. 6 par. 1 lit. f GDPR if there are reasons resulting from your particular situation. In the event you file an objection, the University of Veterinary Medicine shall no longer process your personal data unless the University of Veterinary Medicine can demonstrate compelling legitimate grounds for the processing which override the interests, rights and freedoms of the data subject or for the establishment, exercise or defence of legal claims.

If direct advertising is objected to, the University of Veterinary Medicine shall no longer process personal data from the data subject for this purpose.

§ 12 Data security and security measures

We commit ourselves to protecting your privacy and handling your personal data confidentially. In order to avoid manipulation, loss or abuse of your personal data we have stored, we take comprehensive technical and organisational measures which are regularly evaluated and adjusted to technological developments. This comprises, among others, the use of recognised encryption methods (TLS). However, we point out that the structure of the internet makes it possible other persons and institutions that do not fall within our area of responsibility to neglect the rules of data protection and the above-mentioned security measures. In particular, unencrypted data – enclosed via e-mail, for example – can be read by third parties. We do not have any technical influence on this issue. It is the responsibility of the user to protect the data they provide against abuse by encryption or other means.