Data Protection Information

Transcription

1 Data Protection Information 1) Processing activity Online processing of information regarding the event and topic affordable housing for interested parties and customers 1 within the framework of private-sector administration 2) Person responsible Stadt Wien Wiener Wohnen Rosa-Fischer-Gasse 2, A-1030 Wien Tel post@wrw.wien.gv.at 3) Contact details of the data protection officer 4) Purpose of data processing On the legal basis of the performance or preparation of a contract on the legal basis of public interest Stadt Wien Wiener Wohnen c/o data protection officer Rosa-Fischer-Gasse 2, A-1030 Wien conference@housing-for-all.eu a) Keeping information regarding the event and topic affordable housing in the public interest b) Provision of communication channels for the dissemination of content c) Customer relations service for the implementation of the event d) Retention and increase of customer satisfaction customer loyalty through analysis of the usage behaviour with the aim of improving the service offering e) Survey of user numbers to document reach f) Saving of IP addresses for a duration of 7 days to avoid Denial-of- Service attacks on the legal basis of consent 5) Legal basis of data processing g) Provision of a newsletter for the dissemination of information in the public interest 1) Online usage: Contract performance The use of online media and the responsible person is based on a contract within the meaning of art. 6 para. 1 lit b of the General Data Protection Regulation (GDPR) 2 ; registration creates a registration relationship. With regard to the responsible person s use of social media, the primary contractual relationship is with the respective service provider. 2) Additional services: Consent. 1 If this data t information includes references to natural persons in the masculine, they shall apply to men and women in equal measure. When applying the designation to specific natural persons, the respective gender-specific form should be used. Both consumers (users) and contractors fall under the term customers. 2 Kühling/Buchner GDPR 2018, art 6 point 59

2 The responsible person shall request written consent from the customer for individual services (e.g. electronic newsletter, share buttons etc.). This consent can be withdrawn at any time, effective for the future. 3) Public interest (see point 7.) 6) Change in purpose The responsible person shall not undertake any changes to the purpose when processing personal data. 7) Description of public interest with regard to purposes Dissemination of information on the subject affordable housing : The responsible person recognises public interest in providing information on the subject for the good of citizens, in encouraging discussion on this subject, which is of importance for the citizens, and to politically implement affordable housing for citizens. Both the online information offering and the survey thus cover this subject. IT security the responsible person saves the IP address of interested parties and customers for the duration of 7 days in order to repel targeted attacks in the shape of server overload ( denial of service attacks) and other damage to the systems. The responsible person has an overwhelming and justifiable interest (recital 49 of GDPR) in this data processing for the purpose of maintaining the functionality of the services he has provided online. 8) Assessment of personal An assessment of the personal aspects of the customer does not take place. aspects of the customer 9) Obligation to provide data The customer is under no obligation to provide data. in case he registers for the event, the customer must provide the following data: Name, address, address, organisation 10) Automated decision making The customer is not subject to automated decisions that has legal effect. 11) Processed data divulged by the customer collected additionally by the responsible person Name/company, academic title IP addresses (log files) User name, password Data on the terminal device Telephone- and fax number Utilised browser address Equipment used Address Communication protocol Gender Information concerning account usage (e.g. date of creation, number of logins, date of last query) Date of birth Information concerning the newsletter subscription

3 User ID Facebook user ID Facebook address. Facebook profile link Date of last Facebook reconciliation Location 12) Data sources Source Data types (unless declared otherwise by the customer, or collated by the responsible person) MailChimp: IP location, preferred client, source of the login, campaign details (receipt, opening, click) 13) Internal recipients The following divisions of the responsible person have access to the data: Department Purpose PR department Event implementation, provision of information IT department Technical data 14) External recipients of data Processors campaign distribution MailChimp : The Rocket Science Group, LLC, 675 Ponce de Leon Ave NE, Suite 5000, Atlanta, GA USA Analysis tools: Google Analytics (with anonymize IP ): Google Inc., 1600 Amphitheatre Parkway Mountain View, CA 94043, USA Cloud- and technical services: Website maintenance: Indeco.ee e.u., Schönbrunnerstraße 2/65, 1040 Wien This data processing of the contract data processor takes place under the responsibility of the responsible person. With the above mentioned recipients, it was 15) Third country transfer The following data is transferred to countries outside the EU in the course of data processing: Country Use Data types Google Google Analytics: anonymised IP-address, website title, browser-specific information, information on website usage Contact details: Google Inc., 1600 Amphitheatre Parkway Mountain View, CA 94043, USA Data protection:

4 Facebook Twitter MailChimp: Social-Plug-ins (after consent by double click): IP-address, website title, browser-specific information, information on website usage Contact details: Facebook Inc., 1601 S. California Ave, Palo Alto, CA 94304, USA Data protection: Social-Plug-ins (after consent by double click): IP-address, website title, browser-specific information, information on website usage Contact details: Twitter Inc., 795 Folsom Street, Suite 600, San Francisco, CA 94107, USA Data protection: distribution: address, name 16) Duration of storage Unregistered customers: Personal Data (especially IP address) of (unregistered) website visitors are stored for IT security reasons for a duration of 7 days. Registered customers (newsletter subscribers): Data of registered customers is processed by the responsible person on the above mentioned legal basis for the duration of availability of information on the subject affordable housing from the City of Vienna. The data can be modified and deleted by the responsible person at any time. The usage contract ends in any event with the cancellation of the newsletter subscription; this results in immediate deletion. Event partici[ants: The data of event participants is generally stored by the responsible person for a duration of 12 months/years, and then deleted. 17) Rights of the affected person Basis Art. 15 GDPR information Art. 16 GDPR Rectification Art. 17 GDPR Deletion Contents The customer has the right to demand disclosure whether his personal data is being processed. The customer has the right to demand immediate rectification or amendment of personal data. The customer has the right to demand that personal data is immediately deleted, provided that the conditions laid out in art. 17 para. 1

5 GDPR are met. Art. 18 GDPR Limitation The customer has the right to demand that the processing of personal data is limited, provided that the conditions laid out in art. 18 para. 1 GDPR are met. Art. 21 GDPR Objection The customer has the right to enter an objection against the processing of his personal data, on the basis of overwhelming and justified interest, at any time. Art. 20 GDPR Data transferability The customer has the right to receive his personal data in a structured, common and machine-readable format. 18) Right of appeal Art. 77 GDPR Every customer has a right of appeal before the supervisory authority, if he is of the opinion that the processing of his personal data violates this directive. 19) Supervisory body Österreichische Datenschutzbehörde [Austrian data protection authority] Wickenburggasse 8-10 A Vienna Telephone: dsb@dsb.gv.at