The data controller, within the meaning of the EU GDPR and other national data protection laws of the member states as well as other data protection regulations, is:
Scope of processing of the personal data: In principle, we process personal data of our users only insofar as this is necessary for the maintenance of a functional website and the provision of our content and services. The processing of our users’ personal data generally occurs only following receipt of the user’s consent. An exception is made in cases where it is not possible to obtain consent in advance for practical reasons and where the processing of the data is permitted by statutory regulations.
Legal basis for the processing of personal data: Insofar as we obtain consent from the data subject for the processing of personal data, Art. 6 (1) a of the EU’s General Data Protection Regulation (GDPR) shall serve as the legal basis. Where the processing of personal data is required for the fulfilment of a contract to which the data subject is party, Art. 6 (1) b of the GDPR shall serve as the legal basis. This shall also apply to all processing operations required for the performance of pre-contractual measures. Insofar as the processing of personal data is required for the fulfilment of a legal obligation (statutory conditions) to which our company is bound, Art. 6 (1) c of the GDPR shall serve as the legal basis. If processing is necessary in order to protect the vital interests of the data subject or of another natural person, Art. 6 (1) d of the GDPR shall serve as the legal basis. If processing is necessary to safeguard a legitimate interest of our company or of a third party, and the interests, basic rights and fundamental freedoms of the data subject do not outweigh the aforementioned legitimate interest, Art. 6 (1) f of the GDPR shall serve as the legal basis for processing.
Deletion of data and storage duration: The personal data of the data subject are deleted or blocked as soon as the purpose for their storage no longer applies. Storage beyond this point may take place if this is provided for by the European or national legislator in EU regulations, laws or other provisions to which the data controller is subject. Data will also be blocked or deleted once the storage period prescribed by the aforementioned standards expires, unless further storage of the data is necessary for the conclusion or fulfilment of a contract.
III. Provision of the website and creation of log files
Description and scope of data processing: Each time this website is accessed, our system records data and information from the computer system of the calling computer by means of an automated system. The following data are collected as part of this process: These data are also stored in our system’s log files. These data are not stored together with other personal data of the user.
Legal basis for data processing: The legal basis for the temporary storage of data and log files is Art. 6 (1) f of the GDPR.
Purpose of data processing: The system temporarily stores the user’s IP address in order to make the website available on the user’s computer. To do this, the user’s IP address must be stored for the duration of the session.
The storage in log files is carried out to ensure the functional capability of the website. The data also help us to optimise the website and ensure the security of our IT systems. No data are evaluated for marketing purposes in this context.
This is also the reasoning behind our legitimate interest in data processing under Art. 6 (1) f of the GDPR.
Storage duration: The data are deleted as soon as they are no longer required to achieve the purpose for which they were collected. When data are collected in order to make the website available, this is the case when the respective session ends.
Possibility of objection and elimination: The collection of data for the provision of the website and the storage of data in log files is necessary for operating the website. Therefore, there is no possibility for the user to object.
IV. Newsletter
Description and scope of data processing: On our website, users may subscribe to our newsletter free of charge. The data entered in the input template when subscribing to the newsletter are transmitted to us.
Additionally, the following data will be collected during your registration: (1) IP address of the calling computer (2) Date and time of the registration To process the data, your consent is obtained during the registration process and you will be referred to this data protection statement.
No data that are processed for the purpose of sending our newsletters are disclosed to third parties. The data are used exclusively for the purpose of sending the newsletter.
Legal basis for data processing: The legal basis for the processing of data with the user’s consent following registration by the user to receive the newsletter is Art. 6 (1) a of the GDPR.
Purpose of data processing The purpose of collecting the e-mail address of the user is to send the newsletter.
The collection of other personal data during the registration process serves to prevent misuse of the service or of the e-mail address used.
Storage duration The data are deleted as soon as they are no longer required to achieve the purpose for which they were collected. The user’s e-mail address is stored as long as the subscription to the newsletter is active.
Other personal data collected during the registration process are as a rule deleted after a period of seven days.
Possibility of objection and elimination The subscription to the newsletter can be cancelled by the respective user at any time. A corresponding link can be found in every issue of the newsletter.
This also allows you to withdraw your consent to the storage of personal data collected during the registration process.
V. Contact form and e-mail contact
Description and scope of data processing: A contact form is provided on our website which may be used to make contact electronically. Should a user contact us via the contact form, the data entered in the input template are transferred to us and then stored. These data are:
Additionally, the following data are stored when the message is sent: (1) The IP address of the user (2) Date and time of the registration To process the data, your consent is obtained during this process and you will be referred to this data protection statement.
As an alternative, it is also possible to contact us using the e-mail address provided. In this case, personal data of the user which is transmitted along with the e-mail will be stored.
No data will be disclosed to third parties in this context. Data will be used exclusively for the purposes of correspondence.
Legal basis for data processing: The legal basis for the processing of data with the user’s consent is Art. 6 (1) a of the GDPR. The legal basis for the processing of data that are transmitted by e-mail is Art. 6 (1) f of the GDPR. If the purpose of making e-mail contact is to conclude a contract, then an additional legal basis for the processing of the data is Art. 6 (1) b of the GDPR.
Purpose of data processing: We only process personal data taken from the input template of the contact form for the purposes of making contact. If we are contacted by e-mail, we also have a necessary legitimate interest to process data. Other personal data processed during this process serve to prevent misuse of the contact form and to guarantee the security of our IT systems.
Storage duration: The data are deleted as soon as they are no longer required to achieve the purpose for which they were collected. For personal data taken from the input template of the contact form and sent by e-mail, data are deleted when the respective correspondence with the user has ended. Correspondence concludes when it can be inferred from the circumstances that the matter in question has been conclusively resolved.
The additional personal data that are collected in this process are deleted after a period of seven days at the latest.
Possibility of objection and elimination: The user can withdraw his/her consent for the processing of personal data at any time. Users can contact us by e-mail at any time to withdraw their consent for storing the personal data. In this case, correspondence cannot be continued.
If you wish to make use of your right to object, please write us an e-mail at kunstforum@strabag.com.
In this case, all personal data stored at the time of making contact will be deleted.
VI. Rights of the data subject
When your personal data is processed, you become the data subject within the meaning of the GDPR and you shall have the following rights in relation to the data controller:
Right of access
Right to rectification
Right to restriction of processing
Right to erasure
Right to be informed
Right to data portability
Right to object
Right to withdraw declaration of consent
Automated individual decision-making, including profiling
Right to lodge a complaint with a supervisory authority
