Privacy statement

via donau – Österreichische Wasserstraßen-Gesellschaft mbH (hereinafter "we" or „viadonau“) takes data protection seriously. In the context of our professional activities we process – as the controller within the meaning of Article 4(7) of the General Data Protection Regulation (Regulation (EU) 2016/679; hereinafter "GDPR") – your personal data (hereinafter "you" or "your").

This privacy notice informs you of the details of the processing of your personal data. Personal data is all information which relates to an identified or identifiable person, such as his/her name, date of birth, address etc. (hereinafter "data").

NOTE: If legal entities, we kindly ask our contract and business partners to bring this privacy notice to the attention of the natural persons concerned (in particular employees and members of corporate bodies).

Name and address of the controller

For the purposes of the General Data Protection Regulation, other data protection legislation enacted at the national level by Member States and other data protection rules, the controller is:
via donau - Österreichische Wasserstraßen-Gesellschaft mbH
Donau-City-Strasse 1
1220 Vienna
AUSTRIA
Tel.: +43 (0) 50 4321 1000
Website:
www.viadonau.org  

Name and address of the data protection officer

The controller's data protection officer is:
Petra Held
Email:
datenschutz[at]viadonau.org

You can also contact the data protection officer by sending a letter to the controller's postal address, labelling it for the attention of the "Data protection officer".

A. Data processing in connection with our corporate activities

1) For what purposes do we process your data and on which legal basis?

We process your data for the following purposes and on the following legal bases:

a. Contractual performance

We process the data of our contract partners (e.g. distributors, tenents) for the purpose of the performance of a contract, i.e. so as to provide contractually agreed services. Such processing is lawful on the basis of Article 6(1)(b) GDPR (performance of a contract).

If this data is not provided to us in full or at all, we may not be able to meet all of our contractual obligations or to conclude the contract in the first place.

b. Compliance with legal obligations

Furthermore, we process personal data in order to comply with the legal obligations to which we are subject (e.g. retention periods established under the Austrian federal tax code, navigation act). Such processing is lawful on the basis of Article 6(1)(c) GDPR (compliance with a legal obligation).

Also in this regard, we may not be able to meet all of our contractual obligations or conclude the contract in the first place, if data are not provided in full or at all.

c. Administration and business management

Furthermore, we process your data for administration and business management purposes (e.g. bookkeeping, cost accounting, ERP, contact management, electronic mail register). Such processing is conducted on the basis of our legitimate interest in running our business properly and efficiently and in managing and optimising the selection of our contract partners (e.g. suppliers, service providers) and thus is lawful on the basis of Article 6(1)(f) GDPR.

2) Who receives your data?

Your data will be disclosed by us only if there is a valid legal basis for such disclosure and provided it does not violate our duty of confidentiality. In any case, we only disclose your data to the extent necessary for each specific purpose, or as required under the relevant legal provision, in line with any legitimate interest or, in the case of consent, as specified by you.

Where necessary, your data will be disclosed in particular to the following recipients:

  • Tax consultants or auditors
  • Legal representatives
  • Fiscal authorities
  • Banks
  • Insurance undertakings
  • Courts and authorities
  • Austrian Court of Auditors
  • Statistics Austria
  • Service providers
  • internal Accounting and Controlling

Furthermore, we sometimes use service providers (data processors) for data processing (in particular for technical support). These processors have agreed to maintain the confidentiality of your data, are carefully selected by us, and are bound by our instructions. In particular, we employ the services of the following processors:

  • Ramsauer Stürmer
  • Karanitsch IT

3) How long will your personal data be retained?

In principle, we retain your data until the contractual relationship is fulfilled or has ended. Furthermore, we are subject to multiple retention obligations, in accordance with which data are also required to be retained beyond the term of the contract, as stipulated for instance on the basis of retention periods provided under tax law. We also retain your data, where appropriate, as long as legal claims can be made in connection with your agreement. In the case of pending administrative or judicial proceedings, your data will be retained until termination of the respective proceedings.

We retain your data as long as necessary to serve the purpose of their collection.

B. Data processing in connection with our website

We are pleased you have visited our websites http://www.viadonau.org, http://blog.viadonau.org and/or https://www.doris.bmk.gv.at.

More detailed information on the use of your data can be found here:

I. Provision of the website and creation of log files

1. Description and scope of data processing
Each time our internet site is accessed, our system collects automated data and information from the computer system accessing our site. The following data is collected:

  • Information on the type of browser and the version being used
  • Language and version of the browser software
  • Operating system and interface used
  • The user's internet service provider
  • The user's IP address
  • Date and time of access and time zone difference to Greenwich Mean Time (GMT)
  • Volume of data transmitted
  • Websites from which the user's system accesses our website
  • Websites accessed by the user's system via our website
  • Access status / HTTP status code

The data is likewise stored in our system's log files.

2. Legal basis for data processing
Article 6(1)(f) GDPR provides the legal basis for the temporary storage of data and log files.

3. Purpose of data processing
The temporary storage of the IP address by the system is necessary so as to enable the user's computer to retrieve and display the website. For this purpose, the user's IP address must be stored for the duration of the session. The data is stored in log files to guarantee the functionality of the website. Furthermore, the data helps us to optimise the website and guarantee the security of our information technology systems. The data is not evaluated in this respect for marketing purposes. These purposes also include our legitimate interest in processing data as provided for under Article 6(1)(f) GDPR.

4. Duration of storage
The data is deleted after 30 days. In the event the data is stored in log files, these files will be deleted after 14 days. Data is not stored for a period exceeding this in any format which would make it possible for the persons concerned to be identified.

5. Recipient
Your data will be transferred to:

  • Typoheads GmbH, Pohlgasse 28A/4, 1120 Vienna, Austria
  • next layer Telekommunikationsdienstleistungs- und BeratungsGmbH, Mariahilfer Gürtel 37/7, 1150 Vienna, Austria
  • Google LLC, 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA

II. Use of cookies

1. Definition of Cookies
Cookies are small text files stored in your browser. They are downloaded by your browser the first time you visit our website. The next time this website is visited using the same terminal or browser, the cookie and the information stored in it will be sent either to the respective website which set it (first party cookie) or to another website to which it belongs (third party cookie). In this way, the cookie recognises that the website was requested using the respective browser and this changes the way in which content is displayed. For instance, cookies "remember" your preferences, how you use a site, and to some degree they adapt the offers shown to the individual.

2. Functionally necessary Cookies
We use the following cookies for the purpose of transmitting messages and providing the services requested by you. The data processing activities undertaken by employing the use of cookies are based on our legitimate interests in providing a fully functioning website and the services requested by you (Article 6(1)(f) GDPR, Section 96 para. 3 of the Telecommunications Act).

Cookie
Types of data

Purposes

Storage period

Recipient
accept_cookie_policy_viadonau
Value range: 0 or 1
(no personal data involved)
Shows whether the user has accepted the cookie policy.30 daysData is stored on our servers only. Data is not transmitted to third parties.

contrast
Value range: 0 or 1
(no personal data involved)
Shows whether the user would like to be shown the contrast optimised version of the website.Duration of the session
Data is stored on our servers only. Data is not transmitted to third parties.
Fe_typo_userHash (a sequence of randomly generated numbers)
(no personal data involved)

Makes it possible to clearly identify the user again during the session.
Duration of the session
Data is stored on our servers only. Data is not transmitted to third parties.
PHPSESSIDHash (a sequence of randomly generated numbers)
(no personal data involved)

Makes it possible to clearly identify the user again during the session.
Duration of the session
Data is stored on our servers only. Data is not transmitted to third parties.

ga_opt_out
Value range: 0 or 1
(no personal data involved)
Shows whether the user has deactivated (value: 1) or activated (value: 0) Google Analytics1 yearData is stored on our servers only. Data is not transmitted to third parties.

3. Other cookies – Google Analytics
This website uses Google Analytics, a web analytics service provided by Google LLC, 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA ("Google"). Data is processed on the basis of the consent given by you (Article 6(1)(a) GDPR, Section 96 para. 3 of the Telecommunications Act). Google Analytics uses what are known as "cookies", i.e. text files stored on your computer, which make it possible to analyse your use of the website. The information generated by the cookie concerning your use of the website (including a truncated version of your IP address) is – as a general rule – transferred to and stored on a server operated by Google in the United States.

This website uses Google Analytics solely with the "anonymizeIp()" extension, which guarantees the anonymization of the IP address by a process of truncation and eliminates any direct reference to individuals. By using this extension, your IP address will be truncated by Google within the Member States of the European Union or in other states party to the Agreement on the European Economic Area before such transfer of data takes place. Only in exceptional circumstances will the complete IP address be transferred to and stored on a server operated by Google in the United States.

The following Google Analytics cookies are deployed on our website:

CookieTypes of dataPurposesStorage periodRecipient
_gat
Integer value (e.g. 1)
Reduction of the request rate
1 minute
Google LLC

_ga
Unique identifier (e.g. GA1.2.80005952. 0504093160)Differentiation of users and the tracking of user behaviour

2 years
Google LLC

_gid
Unique identifier (e.g. GA1.2.80005952. 0504093160)
Differentiation of users and the tracking of user behaviour

24 hours
Google LLC

On our behalf, Google will make use of this information to evaluate your use of the website, to produce reports on website activities and to provide other services to us related to the use of the website and the Internet.
The (truncated) IP address transmitted by your browser as part of Google Analytics will not be merged by Google with other data. You can prevent the storage of cookies by changing your browser settings accordingly; however, we wish to draw your attention to the fact that if you do so you will not be able to take full advantage of all of the functions of this website. Furthermore, by clicking on the following link (http://tools.google.com/dlpage/gaoptout?hl=de) you can download and install a browser plugin which will enable you to prevent Google from collecting the data generated by the cookie, which relates to your use of the website (including your IP address), and it therefore also enables you to prevent Google from processing such data.

As an alternative to a browser plug-in or within browsers on mobile devices, please click on this link to prevent any future collection of data by Google Analytics within this website (the opt-out only functions in the browser and only for this domain). By clicking on the link, an opt-out cookie will be set on your device. If you delete your cookies in this browser, you will have to click on this link again.
You can find more information on Google Analytics conditions of use and data protection at https://www.google.de/intl/de/policies/.

4. Your cookie settings on this website
If you block cookies completely or would like to limit the placement of cookies, you can change the settings in your internet browser. Cookies already stored can be deleted at any time. If cookies are deactivated for our website, it is possible that you will not be able to take full advantage of all of the functions of the website.
You can find out how to manage and delete cookies in the help function integrated into the respective browser. Further information on this subject can be found under the following links:

Internet Explorer:
http://windows.microsoft.com/de-DE/windows-vista/Block-or-allow-cookies 
Firefox:
https://support.mozilla.org/de/kb/cookies-erlauben-und-ablehnen 
Chrome:
http://support.google.com/chrome/bin/answer.py?hl=de&hlrm=en&answer=95647 
Safari:
https://support.apple.com/kb/ph21411?locale=de_DE 
Opera:
http://help.opera.com/Windows/10.20/de/cookies.html 

Please click the following button to deactivate/activate Google Analytics:

III. Contact us using the online form and by email

1. Purpose
If you get in touch with us by using the contact form or by sending us an email, we will collect and process in each case your email address and the details of the issue of concern to you and – where applicable – the data you additionally provide us with or which you make available to us by uploading or attaching documents. The data is processed for the purpose of answering your query.

2. Legal basis
viadonau processes data on the basis of its legitimate interest in communicating with website users (Article 6(1)(f) GDPR).

3. Storage / deletion 
viadonau deletes or anonymizes your personal data as soon as the data is no longer needed for the purposes for which it was collected and processed provided, however, that viadonau is not subject to other legal obligations which require it to continue to store the data. Record-keeping requirements and retention obligations stem specifically from corporate, company and tax law, as well as from anti-money laundering legislation. In addition, viadonau will continue to retain any personal data that may prove necessary in connection with the establishment or defence of legal claims or for their enforcement in administrative or judicial proceedings. The data will be retained until the expiry of the relevant limitation periods or until such time as the proceedings have reached a final conclusion.

IV. Distribution of the newsletter

1. Scope and purpose of data processing
By giving your consent, you can sign up for our newsletter through which we inform you of current news that may be of interest to you. To this end, we process the email address you provide. 

Furthermore, we analyse the newsletter by processing data on whether the newsletter was opened (yes/no) ("opening rate"), information on which sections of the newsletter were clicked ("click behaviour"), as well as information on the technical deliverability of the newsletter ("bounces", e.g. whether the newsletter could not be delivered due to an incorrect email address). This data is generated by the system.

2. Legal basis
Your email address is processed on the basis of the consent you have given in accordance with Section 107 of the Telecommunications Act and Article 6(1)(a) GDPR. You have the right to revoke your consent at any time free of charge. To revoke your consent, please click on the unsubscribe link in the respective newsletter or contact viadonau (you can find information about legal remedies and contact details in this privacy statement).

We base our processing of the information you provide voluntarily and the analysis of the data on the legitimate interests of viadonau (marketing purposes; Article 6(1)(f) GDPR).

After you have unsubscribed from the newsletter, your declaration of consent will continue to be stored on the basis of legitimate interests (Article 6(1)(f) GDPR). The legitimate interests of viadonau consist in documenting, as required, the consent given for evidence purposes.

You provide your data to viadonau voluntarily without being under a statutory or contractual obligation to do so. However, the processing of your email address is necessary in order to be able to send you the respective newsletter. Failure to provide an email address means that viadonau cannot send the newsletter to you.

3. Storage / deletion
When you unsubscribe from the newsletter, this is automatically noted in the newsletter database. This ensures you do not receive the newsletter from the time you unsubscribe. The final deletion of your data takes place within one month, calculated from the day on which you unsubscribe, provided statutory retention obligations do not prevent such deletion and we do not need the data on a case-by-case basis to defend against or enforce legal claims. We will store the declaration of consent for a period of 12 months from cancellation of the newsletter.

4. Processor
We employ the services of a processor to distribute the newsletter.  Newsletter2Go GmbH, Köpenicker Straße 126, 10179 Berlin, Germany, sends out our newsletter on our behalf. We provide the company with your email address and name.

V. Search for interested parties

1. Scope and purpose of data processing
The process of searching for interested parties (e.g. for properties) is handled exclusively online. You can both ask questions (anonymously) and submit your application for individual advertisements via our website. If you ask questions via our online form, your e-mail address will be processed so that a confirmation e-mail can be sent to you automatically. If you submit your application for a search via our online form, we collect and process the personal data you enter in the form and those you provide to us by uploading documents. These are your name, address, contact details and, depending on the type of prospect search, possibly a presentation of the prospect, legally valid declaration regarding insolvency/liquidation, development concept, investment plan and amounts, presentation of the financial situation and creditworthiness, references, interest offer.
he purpose of the data processing is to ask questions about and to apply for a search for interested parties, e.g. for commercially used properties.

2. Legal basis
The data processing is carried out so that viadonau can process your questions about or your application for a search for interested parties (Art. 6 para. 1 lit. b GDPR) and on the basis of the legitimate interest of viadonau to simplify the asking of questions and the application for searches for interested parties via an online application form (Art. 6 para. 1 lit. f GDPR).
In case that special categories of data are processed, you submit this personal data voluntarily and the legal basis is your agreement (Article 9(2)(a) GDPR).
viadonau is not able to process your application without the provision of your data.

3. Storage / deletion
viadonau deletes or anonymizes your personal data as soon as the data is no longer needed for the purposes for which it was collected and processed provided, however, that viadonau is not subject to other legal obligations which require it to continue to store the data. Record-keeping requirements and retention obligations stem specifically from corporate, company and tax law, as well as from anti-money laundering legislation. In addition, viadonau will continue to retain any personal data that may prove necessary in connection with the establishment or defence of legal claims or for their enforcement in administrative or judicial proceedings. The data will be retained until the expiry of the relevant limitation periods or until such time as the proceedings have reached a final conclusion.

VI. Application for vehicle access permissions

1. Purpose
If you apply for a vehicle access permission by using the online application form, we will collect and process the personal data you entered into the form and the personal data which you make available to us by uploading documents. This is your name, address, contact details, licence tag, scan of driving licence, scan of car licence, if applicable fishing licence, if applicable handicapped ID.
The data is processed for the purpose of a possible issue of a vehicle access permission.

2. Legal basis
viadonau processes data to handle your application for a vehicle access permission (Article 6(1)(b) GDPR) and on the basis of its legitimate interest to simplify the issue of vehicle access permissions by providing an online application form (Article 6(1)(f) GDPR).
In case that special categories of data are processed, you submit this personal data voluntarily and the legal basis is your agreement (Article 9(2)(a) GDPR).
viadonau is not able to process your application for a vehicle access permission without the provision of your data.

3. Storage / deletion
viadonau deletes or anonymizes your personal data as soon as the data is no longer needed for the purposes for which it was collected and processed provided, however, that viadonau is not subject to other legal obligations which require it to continue to store the data. Record-keeping requirements and retention obligations stem specifically from corporate, company and tax law, as well as from anti-money laundering legislation. In addition, viadonau will continue to retain any personal data that may prove necessary in connection with the establishment or defence of legal claims or for their enforcement in administrative or judicial proceedings. The data will be retained until the expiry of the relevant limitation periods or until such time as the proceedings have reached a final conclusion.

VII. Whistleblowing reporting channel

1. Scope and purpose of data processing
If you wish to report suspected cases of improper conduct in connection with viadonau's business or operational processes, our whistleblowing reporting channel is available to you. This is how we implement the EU Whistleblowing Directive 2019/1937 of October 23, 2019 and national implementation standards within the company. When using the tool, the following data will be collected from you: contact details (optional), whistleblower notification, personal data included in the notification (e.g. in body text or documents).

2. Legal basis
The data processing is based on the fulfillment of a legal obligation (Art. 6 (1) lit. c DSGVO). 

3. Storage / deletion
Reports of founded suspicion are stored for the duration of any (extra)judicial or official proceedings. Reports of unfounded suspicion are anonymized after one calendar year.

4. Processor
For the whistleblowing reporting channel, we use Sage GmbH, Stella-Klein-Löw-Weg 15, 1020 Vienna, Austria as a processor. The tool is provided to data subjects in a data center of Sage GmbH via the Internet (https). Once a report has been made via the system, the report is forwarded directly to an external law firm, which is a contractual partner of Sage GmbH. This ensures your anonymity. viadonau has at no time the possibility to identify the whistleblower.

VIII. "Share" function

A plug-in developed by AddThis, which has its headquarters at 1900 Oracle Way, Reston, VA 20190, USA, is used on our website. This plug-in makes it possible for you to post and share content from our website on social networks, such as Facebook, Twitter, LinkedIn and Xing. You can recognise the "share buttons" integrated via AddThis by the fact that "Share this article" appears only after you click on the link.

The social media plug-ins located at the beginning and end of an article call up the corresponding function solely when clicked on by a person and thus only make a connection with the respective social media platform at that point. Please be advised that as a website operator we have no knowledge of the complete content of the data transmitted or its use by the respective social media platform. If you click on social media plug-ins while you are logged into your social media account, you may link the content of our website to your social media account. As a result, the social media platform can associate your visit to our website with your account. If you do not wish this to happen, please log out of your social media account.

IX. Processor

In some instances, we engage the services of external service providers (so-called processors) to process personal data. They were carefully selected and commissioned by us, are bound by our instructions and are regularly monitored.
The following processors act on our behalf:

  • Typoheads GmbH, Pohlgasse 28A/4, 1120 Vienna, Austria
  • next layer Telekommunikationsdienstleistungs- und BeratungsGmbH, Mariahilfer Gürtel 37/7, 1150 Vienna, Austria
  • Google LLC, 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA
  • Newsletter2Go GmbH, Köpenicker Straße 126, 10179 Berlin, Germany
  • Sage GmbH, Stella-Klein-Löw-Weg 15, 1020 Vienna, Austria

X. Transfers outside of the EEA

We send data to recipients domiciled outside of the EEA in the following cases:

  • Google LLC ("Google"), which has its registered office at 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA, processes data on our behalf. We send Google your IP address (in an anonymised format), information on websites accessed (URLs) and estimations regarding demography and age. Our legitimate interest in performing statistical analysis of the user behaviour for optimisation and marketing purposes provides the legal basis for the transfer (Article 6 (1)(f) GDPR).
    Google is certified for the US-EU data protection framework "Privacy Shield", which guarantees compliance with the level of data protection applicable in the European Union. Furthermore, in addition to our general security measures which are used group-wide, the data will only be transmitted in pseudonymous form. It is thus not possible to associate any specific data with you.

XI. Your rights in connection with data processing

The General Data Protection Regulation (Regulation (EU) 2016/679) grants you as a data subject certain rights to which we wish to draw your attention in the following. Please note that these rights are complementary, which means that you can for instance either request that your data be corrected/completed or that it be deleted.

1. Revocation of consent
viadonau stores and processes your personal data with your consent. You are entitled to revoke such consent at any time. However, this does not affect the lawfulness of the processing of data conducted up until the time at which revocation is issued.

2. Right to information
You may request information regarding the origin, categories, storage duration, recipients, and purpose of the data relating to you that is processed by viadonau, as well as information on the type of processing.

3. Right to correction and deletion
In the event viadonau processes data relating to you that is incorrect or incomplete, you can request it be corrected or completed. Further, you can request the deletion of data processed unlawfully.

4. Right to restrict processing
If it is unclear whether the data relating to you that has been processed is incorrect or incomplete or whether it is being or has been processed unlawfully, you may request that the processing of your data be restricted until such time as this issue is clarified.

5. Right to object
Even if the data relating to you is correct and complete and even if it is being processed lawfully by viadonau, you can file an objection to the processing of this data. However, you may only do so in situations in which you provide special justification.

6. Right to data portability
You are entitled to receive the data relating to you that has been processed by viadonau, which viadonau received from you, in a machine-readable format determined by viadonau or you may instruct viadonau to transfer the data directly to a third party of your choosing provided, however, that viadonau makes this possible for the recipient from a technical perspective and that the transfer of data is not hindered or impeded due to it being an unreasonable burden and providing no other confidentiality obligations or considerations on the part of viadonau or third parties stand in the way of such transfer.

7. Right to file a complaint
Lastly, you have the right to appeal to the Data Protection Agency if you are of the view that the processing of the personal data relating to you breaches the provisions of the General Data Protection Regulation (Regulation (EU) 2016/679).

8. To whom can you turn to enforce your rights as a data subject?
To assert the aforementioned rights, please write (a letter or email) to the contact person specified under section I or directly to the following email address: datenschutz[at]viadonau.org.