Information obligation with the collection of personal data according to the general data protection regulation
Within the framework of the JKU conference booking system
Johannes Kepler University of Linz (hereinafter "JKU") informs you below about the processing of your personal data (more precisely: personal data that refer to you) within the meaning of Art. 4 Subclause 1 General Data Protection Regulation (hereinafter "GDPR"), which the applicable data protection law serves to protect. "Processing", within the meaning of Art. 4 Subclause 2 GDPR, is in particular the collection, recording and storage of personal data with or without the aid of automated (technical) processes.
Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the Protection of Individuals with regard to the Processing of Personal Data, on the Free Movement of such Data and Repealing Directive 95/46/EC (GDPR); Austrian Federal Act on the Protection of Individuals with regard to the Processing of Personal Data (DPA), Federal Law Gazette ("BGBl.") I No. 165/1999 as last amended by BGBl. I No. 14/2019; Directive (EU) 2016/680 of the European Parliament and of the Council of 27 April 2016 on the Protection of Individuals with regard to the Processing of Personal Data by Competent Authorities for the Purposes of the Prevention, Investigation, Detection or Prosecution of Crime or the Execution of Criminal Penalties, as well as on the Free Movement of such Data, and Repealing Council Framework Decision 2008/977/JHA (The Data Protection Directive for Justice and Home Affairs), implemented in Sections 36-61 of the DPA.
I. Entry of the contact data
The controller of the data processing described below within the meaning of Art. 4 Subclause 7 GDPR is Johannes Kepler University of Linz (JKU), Altenberger Straße 69, 4040 Linz, datenschutz@jku.at.
The data protection officer within the meaning of Art. 37 GDPR can be contacted at Johannes Kepler University of Linz (JKU), Data Protection Unit, Altenberger Straße 69, 4040 Linz, datenschutz@jku.at.
II. Background of the processing / statement of the purpose, for which the personal data are to be processed / legal basis of the processing / recipients of the personal data
1. Background and purposes of the processing
1.1. As the operator of a conference booking system (webshop for registering for JKU events, such as conferences, congresses, university balls, etc.), JKU processes personal data of you as a user of the webshop, such as first and last name, gender, address, company/organisation, e-mail address, user ID, password (only encrypted - when entering via the Shibboleth login, the password is not collected by the JKU, unless it concerns its own staff/students), payment data (in particular credit card or other financial information, data on transactions or orders) as well as other personal data voluntarily provided by you (e.g. uploading a profile picture) within the scope of your registration (creation of a user account) for the purpose of the correct implementation resp. administrative and organisational processing of the registration procedure and your participation in selected events as well as the assertion, exercise resp. defence of possible legal claims.
1.2. In addition, when you access the JKU website, your internet browser automatically transmits data to the JKU web server for technical reasons (e.g. date and time of access, URL of the referring website, your IP address). This data is stored separately from other data that you enter in the course of using our webshop. The storage of this data/information is necessary, for example, to analyse system misconduct or to clarify abuses.
1.3. Please note that for the purpose of simplifying the shopping process and for the subsequent processing of the contract, the JKU, as the operator of the conference booking system, stores the IP data of the connection owner in cookies, as well as the name, address and payment data (e.g. credit card number of the buyer). The purpose of the use of technically necessary cookies is thus to simplify the use of websites.
1.4. If necessary, JKU will process image and sound material (photographs and videos) of the participants of the event, in unchanged or edited form while respecting their personal rights, for the purpose of documenting and informing the public about the fulfilment of the tasks assigned to JKU, as well as for the overall purpose of reporting or achieving a certain advertising effect through publication on the publicly accessible website and the social media channels (YouTube, Facebook and Instagram) of JKU and, if applicable, also in the local press, journals and magazines (print media as well as online publications via the Internet).
If you do not wish to have your images and sound recordings published, please let us know!
2. Legal basis
2.1. The legal basis for the processing of personal data according to point II.1.1. is the preparation of the conclusion of a contract resp. the establishment, fulfilment and processing of a contractual relationship between you and the JKU according to Art. 6 para. 1 letter b GDPR as well as the legitimate interest of the JKU according to Art. 6 para. 1 letter f GDPR in the proper (lawful) administration, organisation and processing of the registration procedure resp. your participation in selected events as well as the entire legal relationship with you.
2.2. The legal basis for the processing of personal data according to points II.1.2. and II.1.3. is the legitimate interest of JKU according to Art. 6 para. 1 letter f GDPR in the proper technical implementation and guarantee of the functionality of the conference booking system.
2.3. The legal basis for the processing of personal data according to point II.1.4. is Art. 6 para. 1 letter e and para. 3 GDPR in conjunction with §§ 2, 3 UG (Federal Act on Organisation of Universities and their Courses of Study (University Act 2002 - UG)) and Art. 6 para. 1 letter f GDPR. The data processing is lawful because it is necessary for the performance of a task which is in the public interest or in the exercise of official authority assigned to the JKU. Furthermore, the data processing is necessary to protect the legitimate interests of JKU in the documentation and reporting in the external presentation.
There is no legal obligation to provide the personal data; however, if the data is not provided, the purposes stated under point II.1. cannot be achieved.
3. Recipients
3.1. Recipients of personal data are the organisational units of the JKU necessary for the respective processing - in particular the institute/department organising the respective event, the department of financial accounting, event management and the legal department.
3.2. Any processors used in the context of artistic/graphical design and technical support, hosting, maintenance and administration, insofar as access by them to personal data cannot be excluded by technical and organisational measures.
3.3. Banking institutions, payment service providers and external consultants (e.g. tax consultants, auditors).
3.4. In the event of publication, provision or use of data - as described in point II.1.4. - in any reports in the local press, journals or magazines, your data may also be forwarded to press and media representatives.
3.5. If, during or after the termination of the legal relationship, a possible court and/or regulatory dispute arises, the data necessary for the appropriate legal prosecution will be transmitted to legal representatives and courts or authorities.
3.6. By the publication of your data, as described under point II.1.4., on the publicly accessible website and the social media channels (YouTube, Facebook and Instagram) of JKU and, where appropriate, in other online publications via the Internet your data is principally made accessible to everyone. Owing to the accessibility of this personal data worldwide, this can be found using search engines, be linked with other information and also be copied or further processed for other purposes not covered by this privacy policy. Against this background, it is also possible that personal data can be found in another place even after its erasure on the original website respectively the social media channels. JKU has no influence on this whatsoever and therefore assumes no liability.
III. Details regarding the storage duration:
The personal data will be stored by JKU for the duration of legal retention periods. In addition, the storage period will be determined according to criteria such as topicality and relevance with regard to the aforementioned purposes as well as any proof required for the correct implementation of the legal relationship with you in connection with any disagreements or disputes, namely up to three years after this proof is available.
The storage resp. processing of personal data according to point II.1.4. is also carried out in accordance with the criteria defined for the storage period, such as the necessity for informing the public about the fulfilment of the tasks of the university, the topicality and relevance with regard to the intended advertising presence resp. documentation and communication style of the JKU.
IV. Rights pursuant to Art. 15 to 21 GDPR:
- Right to information
- Right to rectification
- Right to erasure
- Right to restriction of the processing
- Right to data portability
- Right to object
V. Information regarding the Data Protection Authority and the right to lodge a complaint:
In addition, you can lodge a complaint regarding data processing that is inadmissible in your opinion at the Austrian Data Protection Authority, Barichgasse 40-42, 1030 Vienna, tel.: + 43 1 52 152-0, email: dsb@dsb.gv.at.
Status: December 2022