Privacy policy
  1. OBVSG Home
  2. Privacy policy

Privacy Policy

1. General information

Protecting your personal data is important to Österreichische Bibliothekenverbund und Service GmbH (OBVSG). We process your personal data in accordance with the applicable data protection provisions, in particular the General Data Protection Regulation (GDPR) and the Austrian Data Protection Act (DSG).

We take appropriate technical and organisational measures to ensure a level of protection appropriate to the risk from processing personal data.

This Privacy Policy informs you of the personal data we process in connection with use of our website, the purposes for which the data is processed, and the rights you have in this regard. We update this Privacy Policy whenever changes to our data processing activities or to the legal framework make an update necessary.

2. Data controller and contact for data protection

Data controller within the meaning of the GDPR

Österreichische Bibliothekenverbund und Service GmbH (OBVSG)
Raimundgasse 1/3
1020 Vienna
Austria
Phone: +43 1 4035158-0
Email: office@obvsg.at

Contact for data protection queries

If you have any questions about the processing of your personal data or want to exercise your data protection rights, please contact our data protection officer:

Email: datenschutz@obvsg.at

3. Competent supervisory authority and right to lodge a complaint

If you believe that the processing of your personal data infringes data protection law, you have the right to lodge a complaint with a data protection supervisory authority. In Austria, the competent authority for this purpose is the Austrian Data Protection Authority.

Austrian Data Protection Authority
Barichgasse 40–42
1030 Vienna
Austria
Phone: +43 1 52 152-0
Email: dsb@dsb.gv.at
Website: https://www.dsb.gv.at/ 

4. Categories of personal data processed

4.1 Data processed automatically when you visit our website

When you access our website, the following data may be processed in particular:

  • The internet protocol (IP) address you are using
  • The browser and operating system you are using
  • The time and date of access
  • The referrer URL (the website from which you have reached our website)
  • Where applicable, further technical access data

Information about web analytics using Matomo is provided in Section 7 of this Privacy Policy. Matomo is run on our website without using cookies.

4.2 Data you voluntarily provide to OBVSG

If you contact us or use our services, you may provide us with the following personal data in particular:

  • First name, last name and title
  • Email address
  • Postal address
  • Name of your organisation

The data that is required in a specific case depends on the particular service or the purpose of your enquiry.

4.3 Data that your organisation sends to us

Where necessary for the use of our services or the performance of contractual obligations, we may receive the following data in particular from the organisation for which you work:

  • Contact details (name, email address, phone number, postal address)
  • Organisational user ID

4.4 Registration on our website

Registration for a user account is required to use certain protected areas of our website. The following data is collected for this purpose:

  • First name
  • Last name
  • Name of your organisation, if you are an employee of an organisation
  • Email address

OBVSG stores the data in an internal database on its own servers and uses it to set up and manage your user account and to provide the restricted areas.

The user accounts are deleted as soon as we are informed that they are no longer needed. They are currently not deleted automatically after a certain period of inactivity. If emails to a user account repeatedly cannot be delivered, we check whether the account is still needed. For this purpose, we may contact the affected organisation. If the account is no longer required, or if we receive no response, it is deleted.

You may request access to your stored personal data and have inaccurate data rectified. Subject to the applicable statutory requirements, you may also request that your data is erased. Further information about your rights is provided in Section 11 of this Privacy Policy.

4.5 Newsletter

You can sign up to our newsletter on our website. Signing up for the newsletter is voluntary. The newsletter is sent on the basis of your consent.

We process your data for the purpose of sending invitations and information, and to document your consent. The following data may be processed for this purpose in particular:

  • Email address
  • Title
  • First name and last name
  • Name of your organisation

We use CleverReach to send and manage the newsletter. This also involves analyses of our newsletter mailouts, in particular regarding opens, clicks, undeliverable emails and unsubscribes. These analyses are designed to assess the reach and use of our newsletters and to improve our information.

The data is processed by OBVSG and by CleverReach GmbH & Co. KG, which acts as a processor on our behalf under a data processing agreement.

The recipient data is generally stored for as long as you are subscribed to our newsletter. You may withdraw your consent at any time with effect for the future, in particular via the unsubscribe link included in every newsletter, or by contacting us directly. After you unsubscribe, or make a corresponding request for erasure, your recipient data is deleted from the newsletter distribution list.

Further information about your rights is provided in Section 11 of this Privacy Policy.

5. Purposes and legal bases of data processing

The personal data referred to in Section 4 is processed by the OBVSG as data controller, in particular for the following purposes:

  • Performance of a contract and steps prior to entering into a contract: We process personal data to the extent that this is necessary for the performance of a contract or to take steps prior to entering into a contract. The legal basis is Article 6(1)(b) GDPR.
  • Providing our services and user accounts: We process personal data to make authorised access to our services possible, to manage user accounts and to process support enquiries. Where necessary for the performance of a contract, such processing is based on Article 6(1)(b) GDPR; otherwise, it is based on our legitimate interest in providing and managing our services pursuant to Article 6(1)(f) GDPR.
  • Technical and secure operation of the website: Technical access data and web server log files are processed to ensure that our website runs securely and functions correctly, to detect errors and to analyse suspicious access activity. The legal basis is our legitimate interest pursuant to Article 6(1)(f) GDPR.
  • Web analytics using Matomo: We process data to analyse the use of our web presence and to improve our offering. Matomo is run for this purpose without using cookies. The legal basis is our legitimate interest pursuant to Article 6(1)(f) GDPR.
  • Newsletter: We process personal data on the basis of your consent to receive our newsletter and to analyse our newsletter mailouts. The legal basis is Article 6(1)(a) GDPR. Consent may be withdrawn at any time with effect for the future.
  • Compliance with legal obligations: We process personal data to the extent necessary to comply with statutory obligations. The legal basis is Article 6(1)(c) GDPR.

6. Cookies

Our website uses technically necessary session cookies that are required in order to run and provide certain functions of the website. In particular, these are cookies set by our content management system, TYPO3.

These session cookies are stored only for the duration of the applicable browser session and are deleted when the browser is closed.

No cookies are used for web analytics with Matomo. Further information about web analytics is provided in Section 7 of this Privacy Policy.

7. Web analytics and web server log files

7.1 Matomo

We use the web analytics tool, Matomo, to analyse the use of our website. The web analytics are designed to analyse the use of our web presence and to improve our offering.

Matomo is run on our website without using cookies.

7.2 Web server log files and AWStats

When you access our website, technical access data is recorded in web server log files, which are analysed using AWStats.

Such analysis is designed, in particular, to detect suspicious or incorrect access activity and changes over time, and to make it possible to respond to technical issues more quickly.

The web server log files are retained for a period of four weeks.

8. Recipients of personal data

Within OBVSG, personal data is made accessible only to the people who need the data in order to perform their respective duties.

Where necessary in order to provide our services, we engage external service providers, who process personal data as data processors on our behalf. These include, in particular, CleverReach GmbH & Co. KG for distributing and managing our newsletter.

Personal data is only transferred beyond this to the extent necessary for the performance of our tasks or contractual obligations, where there is a legal obligation to do so, or where corresponding consent has been given.

9. Transfer of data to recipients in third countries

Personal data is generally processed within the European Union or the European Economic Area. Where using external service providers requires the transfer of personal data to a third country outside the EU or the EEA, such data is only transferred in compliance with the requirements of Articles 44 ff. GDPR.

10. Storage period for personal data

As a general rule, we store personal data only for as long as necessary for the applicable purposes of processing, or for as long as statutory retention obligations apply.

The storage period depends on the particular processing activity concerned. Information about the deletion of website user accounts is provided in Section 4.4, and information about the storage and deletion of newsletter recipient data is provided in Section 4.5 of this Privacy Policy.

Where personal data is processed on the basis of consent, you may withdraw such consent at any time with effect for the future. After consent is withdrawn, the applicable data is erased, unless there is another legal basis or a statutory retention obligation that prevents erasure.

Further information about exercising your rights is provided in Section 11 of this Privacy Policy.

11. Rights of data subjects

Subject to the applicable statutory requirements, you have the following rights in particular:

  • Right of access to information about the processing of your personal data (Article 15 GDPR)
  • Right to rectification of inaccurate personal data or completion of incomplete personal data (Article 16 GDPR)
  • Right to erasure of your personal data (Article 17 GDPR)
  • Right to restriction of processing (Article 18 GDPR)
  • Right to data portability (Article 20 GDPR)
  • Right to object to the processing of your personal data (Article 21 GDPR)
  • Right not to be subject to a decision based solely on automated processing, including profiling, which produces legal effects concerning you or similarly significantly affects you, provided the legal requirements are met (Article 22 GDPR)

Withdrawal of consent

Where personal data is processed on the basis of consent, you may withdraw such consent at any time with effect for the future. The lawfulness of processing carried out on the basis of consent before its withdrawal is not affected by the withdrawal of consent (Article 7(3) GDPR).

Right to lodge a complaint

If you believe that the processing of your personal data infringes data protection law, you have the right to lodge a complaint with a data protection supervisory authority. The contact details for the Austrian Data Protection Authority are provided in Section 3 of this Privacy Policy.

To exercise your rights, you may use the contact details provided in Section 2.