University of Vienna Data Protection Declaration

Version: 16 June 2026

Thank you for visiting the websites of the University of Vienna. The protection and security of your data are of the utmost importance to us. Therefore, we would like to take the opportunity to inform you which of your personal data are collected, in particular, when you visit our websites and for which purposes these data are used. Please note that this Data Protection Declaration only applies to the general data processing activities of the University of Vienna. The University of Vienna informs the data subjects about any further data processing separately, possibly referring to this general General Data Protection Declaration. Since legislative changes or changes to our internal processes may require an adjustment of this Data Protection Declaration, we ask you to consult it on a regular basis. The Data Protection Declaration is available for download and print at dsba.univie.ac.at/en/data-protection-declaration/ at any time.

The controller according to the General Data Protection Regulation (GDPR) and other national data protection acts of member states as well as other statutory data protection regulations is:

University of Vienna
Universitätsring 1
1010 Vienna
E-mail: dsba@univie.ac.at
Website: univie.ac.at/en

This Data Protection Declaration applies to all Internet services of the University of Vienna available under the domain univie.ac.at as well as the associated subdomains (henceforth “our websites” or “web presence”). In addition, it applies to the data processing activities specified below. From a functional perspective, the Data Protection Declaration applies to all organisational units of the University of Vienna. Information about data protection when using cloud services is provided in the University of Vienna’s data protection declaration for cloud services (in German), available at: zid.univie.ac.at/uaccount/datenschutzerklaerung-cloud-services/

The controller has authorised the following external Data Protection Officers:

Daniel Stanonik and Karsten Kinast, representing each other alternately
 

If the rights of data subjects according to section 13 of this Data Protection Declaration (e.g. right to information, right to erasure, etc.) are asserted, the relevant requests or applications must be sent to dsba(at)univie.ac.at or via mail to:

Personal data are individual information concerning personal or material details of an identified or identifiable natural person (data subject). This includes, for example, information, such as your name, address, telephone number, date of birth and e-mail address. Information that cannot be linked to your person (or only involving a disproportionate effort), such as anonymised information, is not considered personal data.

As a general principle, we collect and use personal data of our users only to the extent that is necessary for carrying out the relevant data processing activity. We use your personal data to provide information, products and desired services offered by the University, to answer your questions, to fulfil our legal mandate and statutory obligations, as well as to operate and improve our websites and applications.

We collect and use personal data of our users only based on a relevant legal foundation in accordance with the GDPR, e.g. only if the individual user has given their consent. Further details regarding the individual consents granted are specified in section 7 of this Data Protection Declaration under the respective processing activity.

Your personal data will not be used for any other purpose. Your personal data will not be transferred to third parties or used, for example, for advertising purposes without your consent, except in the cases specified below, and unless we are required by law to disclose the data.
 

Where processing is subject to the data subject's consent to the processing of their personal data, the legal basis for the processing is article 6, para. 1, sub-para. a of the EU General Data Protection Regulation (GDPR). If the processing of personal data is necessary to perform a contract to which the data subject is a party, article 6, para. 1, sub-para. b of the GDPR provides the legal basis. This also applies to processing activities that are necessary to take necessary steps prior to entering into a contract. Where processing of personal data is necessary for compliance with a legal obligation to which the University of Vienna is subject, article 6, para. 1, sub-para. c of the GDPR provides the legal basis.

If the processing of personal data is necessary to protect the vital interests of the data subject or of another natural person, article 6, para. 1, sub-para. d of the GDPR provides the legal basis. If the processing is necessary for the purposes of the legitimate interests pursued by the University of Vienna or a third party, except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject, article 6, para. 1, sub-para. f of the GDPR provides the legal basis for the processing activity.

If the University of Vienna processes personal data for academic and research purposes, the University of Vienna reserves the right to use suitable provisions specified in the Forschungsorganisationsgesetz (Austrian research organisation act, FOG) as a legal basis in addition to the legal foundations specified above. This also applies in connection with a declaration of consent (broad consent) with regard to the special provisions pursuant to section 2d, para. 3 of the FOG.

Personal data of the data subject will be erased or blocked as soon as the purpose of the processing activity has been fulfilled. Furthermore, data may also be stored if specified by the European or national legislative authority in Union law regulations, laws, or other regulations to which the controller is subject. Personal data will also be erased or blocked when a storage period stipulated by one of the norms listed above expires, unless it is necessary to further store the data for the purpose of concluding or executing a contract.

We do not transfer any personal data to third countries unless we expressly inform you about this. In this case, the transfer of personal data to third countries takes place in accordance with articles 45 and 46 of the GDPR. In the absence of an adequacy decision by the European Commission, standard protection clauses adopted in accordance with article 46 of the GDPR guarantee an adequate level of protection. In individual cases, we will also obtain your consent for the transfer of personal data to third countries. In this case, it is our obligation to inform you that the level of data protection in third countries might not be comparable to that in the European Union. This poses a risk to your personal data since they may be accessed, in particular, by public authorities which are not subject to the legal protection mechanisms applicable within the European Union.

During a professorial appointment procedure, habilitation procedure or similar procedure (e.g. doctoral procedure), your personal data are transferred to external reviewers who may be located in third countries outside the European Union or the European Economic Area. These third countries may have a lower statutory level of data protection. However, we have to transfer your personal data to allow for a review of your documents. The processing of your personal data is based on article 6, para. 1, sub-para. c of the GDPR and section 2g of the Austrian Forschungsorganisationsgesetz (research organisation act, FOG). The transfer of data is permissible according to article 49, para. 1, sub-para. b and sub-para. c of the GDPR as well as to article 49, para. 1, sub-para. d of the GDPR.

We organise different events, such as lectures, conferences and similar events, also outside of regular teaching hours. During these events, we may take photographs or make video recordings of the event participants. We use and process these photographs/videos to present the event, offline and/or online (e.g. in magazines, on social media or on websites).

The legal basis for the data processing specified above is determined in article 6, para. 1, sub-para. f of the GDPR and section 12, para. 2, sub-para. 4 of the Datenschutzgesetz (Austrian Data Protection Act, DSG). The processing of the data specified above is necessary for the presentation of the events. Therefore, it serves the purposes of the legitimate interests pursued by the University of Vienna. Where necessary, we will obtain your consent to the processing of your photographs (article 6, para. 1, sub-para. a of the GDPR).

The University of Vienna erases photographs and videos as soon as they are no longer required for a legitimate interest to present the relevant event. This may be the case, for example, if the University does not have to advertise the event any longer because there will be no follow-up event.

If you wish to use services provided by us, such as our course offers, newsletter subscriptions, the u:account, etc., you have to provide further data. For further details see the description of specific data processing activities below. In particular, personal data are used as follows:

We offer our users the possibility to register for the u:account service available at https://zid.univie.ac.at/en/uaccount/ on our websites. To register for the u:account service, users have to provide personal data. The u:account is available to students and employees of the University of Vienna as well as to persons authorised by employees of the University of Vienna. After users have entered the required data in an input mask, the data are transferred to and stored by the University of Vienna. We will not transfer your personal data to third parties. The following data are collected during the registration process and will be erased after no more than 30 days:

• IP address of the calling computer
• Date and time of access
• Name and URL of the retrieved file
• Volume of data transmitted
• Report whether the request was successful
• Identification data of the accessing browser as well as operating system
• Website from which the user accessed the service

When you register for the u:account service, the following personal data are collected:

• Name (*)
• E-mail address (*)
• Social security number
• Date of birth (+)
• Gender (+)

Mandatory fields are marked with (*). Mandatory fields for prospective students are marked with (+). All other data are provided voluntarily by the data subject in the course of registration.

The legal basis for the processing of these personal data of students of the University of Vienna is article 6, para. 1, sub-para. c of the GDPR. The legal basis for the processing of these personal data of employees of the University of Vienna as well as of persons authorised by employees of the University of Vienna is article 6, para. 1, sub-para. b of the GDPR. For data provided voluntarily in the course of registration, article 6, para. 1, sub-para. a of the GDPR provides the legal basis.

User registration is a prerequisite for making available certain contents and services of the University of Vienna. Due to the continuously changing range of contents and services offered, it is not possible to provide an exhaustive list.

The use of the u:account is inseparably linked to the relevant relationship of the user to the University of Vienna (e.g. student, employee, contracting partner) and must be used accordingly. The relevant data are stored in compliance with section 53 of the 2002 Universities Act (UG). Therefore, the u:account and its contents will be erased after the legal storage period in accordance with section 53 of the 2002 Universities Act has expired.

If the relevant data are necessary for the performance of a contract or to take necessary steps prior to entering into a contract, early erasure of these data is only possible if no contractual or statutory obligations prohibit it.

For the administration of studying and teaching, the University of Vienna is operating numerous applications that can be used after logging in with the u:account (see section 7a), for example, applying for admission to a degree programme as well as registering for exams and courses. To operate these applications, the University collects, stores and processes personal data (such as name, address, date of birth, student ID number). The following tables specify the data processed and the corresponding legal basis for data processing.

The following abbreviations for laws and regulations are used:

• Universitätsgesetz 2002 (2002 Universities Act, henceforth “UG”)
• Universitätsberechtigungsverordnung (ordinance governing university entrance qualification, henceforth “UBVO”)
• Personengruppenverordnung 2018 (ordinance governing admission of certain groups of persons, henceforth “PersGV 2018”)
• Universitäts- und Hochschulstatistik- und Bildungsdokumentationsverordnung (ordinance governing university and higher education statistics and education documentation, henceforth “UHSBV”)
• Studienbeitragsverordnung (ordinance governing tuition fees, henceforth “StubeiV”)
• Allgemeines Verwaltungsverfahrensgesetz 1991 (general administrative procedure act 1991, henceforth “AVG”)
• Bildungsdokumentationsgesetz 2020 (education documentation act, henceforth “BiDokG”)
• Zustellgesetz (service of documents act, henceforth “ZustellG”)
• Studienförderungsgesetz 1992 (student support act, henceforth “StudFG”)
• Hochschülerinnen- und Hochschülerschaftsgesetz 2014 (union of students act, henceforth “HSG”)

According to article 81c, para. 1 of the Austrian Federal Constitutional Law (B-VG), the University has the right to issue regulations and statutes within the framework of the law. In the administration of studying and teaching, the University exercises powers conferred by public law and has issued, in particular, the following regulations:

• Statutes of the University of Vienna, available in the University Gazette of the University of Vienna
• Regulations of the University of Vienna, published in the University Gazette of the University of Vienna in accordance with section 20, para. 6 of the UG, in particular:
  • Regulations on the specification of admission periods and admission procedures (sections 60 et seq. of the UG)
  • Regulation on the university entrance qualification examination (section 64a of the UG)
  • Regulations on the entrance exam procedures/aptitude tests for degree programmes with special admission requirements
  • Regulations on the provision of evidence of language proficiency as part of the admission procedure
  • Curricula for established degree programmes according to sections 54 et seq. of the UG
  • Regulations on the recognition of examinations
  • Regulations on the allocation of places in courses
  • Regulations on deviating digital modes of assessment for special groups of students in accordance with section 13i of the part of the Statutes governing university studies

In case an appeal is lodged against decisions of the University in matters of sovereign tasks in accordance with the provisions specified in articles 129 et seq. of the B-VG and the Austrian Verwaltungsgerichtsbarkeits-Novelle 2012 (amendment to the administrative jurisdiction act), the University, for the purpose of ensuring compliance with the law, has the right and the obligation to transfer the required decision-relevant personal data to the relevant bodies. In accordance with section 22 of the B-VG and section 46, para. 6 of the UG, the University of Vienna is obliged to provide administrative assistance within its scope of action. 

For students enrolled on a jointly established teacher education programme in accordance with the Bundesrahmengesetz zur Einführung einer neuen Ausbildung für Pädagoginnen und Pädagogen (framework legislation on the introduction of a new teacher education programme, Federal Legal Gazette No. 124/2013 as amended) to obtain a teaching degree for secondary schools (general education) in Vienna and Lower Austria and/or for prospective students and new entrants, the University of Vienna collects and manages the data listed below. The personal data required for the administration of teaching and examinations is transferred to partner institutions, in particular, via the data network of the universities and higher education institutions (section 10 of the BilDokG) and via the Austrian Higher Education Systems Network (section 11 of the BilDokG). Pursuant to section 54c of the UG, the following institutions are partner institutions cooperating within the North-East Schools’ Group:

• University College of Teacher Education of Christian Churches Vienna/ Krems, Mayerweckstrasse 1, 1210 Vienna
• University College of Teacher Education in Lower Austria, Mühlgasse 67, 2500 Baden
• University College of Teacher Education in Vienna, Grenzackerstrasse 18, 1100 Vienna
• University College for Agrarian and Environmental Pedagogy, Angermayergasse 1, 1130 Vienna

For students who are enrolled on other jointly established degree programmes or joint degree programmes, the corresponding cooperation agreement between the partner institutions provides the legal basis for collecting, processing and storing data. The transfer of data to partner institutions within Austria may take place via the data network of the universities and higher education institutions (section 10 of the BilDokG) and via the Austrian Higher Education Systems Network (section 11 of the BilDokG), if this is specified in the cooperation agreement.

If the processing requires a transfer of the listed data to third parties, the data will be transferred to the following recipients:

The second column specifies the legal basis for the processing of personal data. Below you will find the main legal foundations (especially statutory foundations [incomplete list]). In all other respects, please refer to sections 3 and 18 of the BilDokG. Due to their central role, these data categories together with the legal foundations are presented in a table:

Master data

Other personal data

Contact details

Study data per degree programme to which students are and/or were admitted

Registration details

Examination data

Prüfungen können gemäß den Bestimmungen des § 76a UG auch elektronisch durchgeführt werden. Eine zusätzliche Verarbeitung von Daten erfolgt in diesem Zusammenhang jedoch nicht. Gegebenenfalls ist die Angabe der universitätseigenen E-Mail-Adresse erforderlich. Diesfalls stützt sich die Verarbeitung auf die soeben genannten rechtlichen Grundlagen.

Academic theses

Tuition fee data

Admission data

Mobility data

The legal basis for the processing of these personal data is the specified legal foundation according to article 6, para. 1, sub-para. c of the GDPR. If the University transfers these data, the transfer is also based on the same legal foundation. Article 6, para. 1, sub-para. a of the GDPR provides the legal basis for the processing of personal data if the data subject has given their consent.

The relevant personal data will be erased after the legal storage periods have expired.

For the preparation and fulfilment of the performance agreement with the Federal Government in accordance with section 13 of the Universities Act in conjunction with section 71a of the Universities Act, the University of Vienna prepares analyses of the following areas based on course and examination data of students (e.g. student ID number, duration of studies, study progress, examination attempts, course data, status of the academic thesis):

• Measures aimed at reducing the number of students dropping out (in acc. with section 13, para. 2, sub-para. 1, lit. d of the Universities Act, in particular measures aimed at further developing counselling offers for students, coaching and mentoring in the introductory and orientation period)
• Degree programmes for students who are employed during their studies (in acc. with section 13, para. 2, sub-para. 1, lit. f of the Universities Act)
• Measures aimed at achieving societal objectives (in acc. with section 13, para. 2, sub-para. 1, lit. g of the Universities Act), especially social dimensions in teaching as well as the integration of groups that are under-represented in higher education
• Measures aimed at increasing internationality and mobility (in acc. with section 13, para. 2, sub-para. 1, lit. g of the Universities Act)
• Measures aimed at increasing the number of students who take a certain number of examinations and graduations (in acc. with section 71a of the Universities Act)
• Target-group-specific, personal counselling for students and/or information via e-mail (in acc. with section 13, para. 2, lit. d of the Universities Act)

The legal basis for the processing of the data mentioned above as well as of relevant data are the legal provisions specified above as well as article 6, para. 1, sub-para. f of the GDPR.

The data used for the analyses specified above will be erased after no more than 6 months.

For every visit to our websites, our system automatically records data and information about the computer system of the calling computer. The following data are collected:

• IP address of the calling computer
• Date and time of access
• Name and URL of the retrieved file
• Volume of data transmitted
• Report whether the request was successful
• Identification data of the accessing browser as well as operating system
• Website from which the user accessed the service

The log files contain IP addresses or other data that can be linked to a specific user. For example, this could be the case when the link to the website from which the user is accessing the University’s website or the link to the website to which the user is switching contains personal data.

Also these data are recorded in the log files of our system. They are not stored together with other personal data of the user.

The legal basis for the temporary storage of the relevant personal data and the log files is article 6, para. 1, sub-para. f of the GDPR.

The storage of personal data in log files is necessary to ensure the functionality of the website. Furthermore, these data help us to optimise the website and ensure the security of our IT systems. The data will not be analysed for marketing purposes.

These purposes also constitute our legitimate interest in the data processing according to article 6, para. 1, sub-para. f of the GDPR.

The data will be erased as soon as their collection no longer serves the fulfilment of their purpose, at the latest after 30 days. The collection of these data for the provision of the website is essential for operating the website. Therefore, the user does not have any possibility to lodge an appeal.
 

We offer users the possibility to order goods via our websites, such as ushop.univie.ac.at, given they provide certain personal data. After users have entered the required data in an input mask, the data are transferred to and stored by the University of Vienna.

The University of Vienna collects the following data during the ordering process:

• Name
• Address
• Delivery address
• Company
• E-mail address
• Student ID number
• User ID
• Password
• Bank account details
• Credit card or other financial information
• Data about transactions or orders

Your data will be transferred to the shipping company entrusted with the delivery as far as this is necessary for the delivery of the goods. For the processing of payments, we will transfer your payment data to the authorised banking institution. These companies may only use your data to process the order and not for any other purposes.

We use the data you disclose when ordering goods solely to fulfil and process your order, without your separate consent.

If the processing of personal data is necessary to perform a contract to which the data subject is a party, article 6, para. 1, sub-para. b of the GDPR provides the legal basis.

Upon the complete fulfilment of the contract and complete payment of the purchase price, your data will be erased after the legal storage periods have expired, unless you have given your explicit consent to the further use of your data.

On our websites, it is possible to subscribe to newsletters free of charge. When subscribing to the relevant newsletter, the data you entered in the input mask are transferred to us. To subscribe to our e-mail newsletter service, in addition to your consent, we require at least your e-mail address to which the newsletter should be sent.

Furthermore, the following data are collected during subscription and will be erased after 30 days:

• IP address of the calling computer
• Date and time of access
• Name and URL of the retrieved file
• Volume of data transmitted
• Report whether the request was successful
• Identification data of the accessing browser as well as operating system
• Website from which the user accessed the service

If you purchase goods via our website, provide your e-mail address and additionally consent to receiving direct advertising, this e-mail address may subsequently be used for sending a newsletter to you.

In accordance with article 6, para. 1, sub-para. a of the GDPR, the processing of personal data is based on the following declaration of consent by the data subject:

I consent that the University of Vienna collects, stores and processes the personal data that I provide for the purpose of sending me a newsletter. My personal data will be erased as soon as the purpose of the processing activity has been fulfilled and if no other statutory storage period applies. I hereby declare that I am giving my consent freely. I have also been informed that I have the right to withdraw my consent at any time informally with future effect, and without any negative consequences for me. I can withdraw my consent by contacting . The University of Vienna and any processors will erase all relevant data stored as soon as they receive my withdrawal of consent.

For sending the newsletters, we use a so-called double opt-in procedure, i.e. we will only send you newsletters once you have confirmed your subscription via a link provided in the confirmation e-mail sent to you for this purpose. We thus aim to ensure that only you as the owner of the specified e-mail address can subscribe to the newsletter. Your confirmation regarding this matter must follow promptly upon receiving the confirmation e-mail. Otherwise, your subscription to the newsletter is erased automatically from our database.

Collecting the user’s e-mail address serves the purpose of delivering the relevant newsletter.

Your subscription to the relevant newsletter allows us to use your e-mail address for our own (advertising) purposes until you unsubscribe from the newsletter.

In addition, we collect other personal data during the subscription process to prevent any misuse of the services or the e-mail address used.

The data will be erased as soon as their collection no longer serves the fulfilment of their purpose. Therefore, the user’s e-mail address is stored as long as the subscription to the relevant newsletter is active.

Any other personal data collected as part of the subscription process are generally erased after a period of 30 days.

In connection with the data processing for sending newsletters, the University of Vienna will not transfer any personal data to third parties. The data provided will be used exclusively for sending the relevant newsletters.

Employees and students of the University of Vienna as well as persons from outside the University can use the university-wide Wiki for jointly working on projects. You require an active student or employee u:account, or an active extended u:account for guests to log in.

For the purpose of operating the u:wiki service, the University of Vienna processes the following categories of personal data. The designation of the relevant SAML2 attribute for the ACOnet Identity Federation is specified in brackets:

• unique user ID (subjectId or eduPersonPrincipalName)
• name (displayName)
• e mail adress (mail)
• status group at the home organisation (eduPersonScopedAffiliation)

Users can create a personal profile in the u:wiki on a voluntary basis. In their profile, they can enter some of the following data, change them at any time and delete them on their own:

• their photo used as a profile picture
• phone number
• instant Messenger ID
• link to their personal website
• position within their organisation
• unit within their organisation
• place/address

Employees can create, edit and comment on content on the platform. The platform stores metadata related to this content (creator, time stamp of changes made).

In accordance with article 6, para. 1a of the GDPR, the user’s consent given when creating a user account on a voluntary basis provides the legal foundation for the processing activity.

Depending on the permissions granted, the following data stored on u:wiki may also be transferred to the following services offered by the manufacturer Atlassian and operated by the University of Vienna for the integration of applications:

• Servicedesk
• Jira software
• Bitbucket (a tool produced by the software manufacturer Atlassian to exchange program code based on the git system between partner universities).

In addition, members of other educational institutions who also use the u:wiki of the University of Vienna and contribute to it (project or cooperation partners) can access the personal data stored on the University’s Wiki.

In connection with the use of offers and services of the University of Vienna, the University may send e-mails that do not require active consent of the data subject and therefore do not constitute newsletters according to section 7f of this Data Protection Declaration.

In any case, the e-mail address will be processed as personal data for such e-mails. Other personal data are processed according to the type and legal basis of the e-mail.

Necessary steps (prior) to entering a contract

For e-mails that are necessary for the performance of a contract or to take necessary steps prior to entering into a contract, article 6, para. 1, sub-para. b of the GDPR provides the legal basis.

Unless personal data are subject to any other statutory storage periods, they are erased as soon as the purpose of the data processing is fulfilled.

Upon the complete fulfilment of the contract and complete payment of the purchase price, your data are blocked from further use and will be erased after the legal storage periods in accordance with tax and corporate law have expired, unless you have given your explicit consent to the further use of your data. 

Overriding legitimate interest of the University of Vienna

If the e-mail serves the purpose of a legitimate interest pursued by the University of Vienna or a third party, and if the interests, fundamental rights and fundamental freedoms of the data subject do not outweigh the interest pursued by the University, article 6, para. 1, sub-para. f of the GDPR provides the legal basis for the processing activity.
The data subject has the right to object against this type of processing. Unless a separate contact address is provided for the relevant data processing, the data subject may lodge their objection by e-mail to  dsba(at)univie.ac.at or by mail to the following address:

The University of Vienna erases the personal data as soon as the legitimate interest of the University no longer exists.

Unless personal data are subject to any other statutory storage periods, they are erased as soon as the purpose of the data processing is fulfilled.

Transfer of personal data to third parties

As a general rule, the University of Vienna transfers personal data to third parties as part of e-mails only if this is required to take necessary steps (prior) to entering into a contact or if it is based on the overriding legitimate interest of the University of Vienna.

If the University transfers personal data to third parties, the data subject will be informed about this in the context of the relevant e-mail.

Our websites contain contact forms which users can use to contact us electronically. After users have entered the required data in the contact form, the data entered in the input mask are transferred to and stored by the University of Vienna. The University of Vienna collects the following data in the contact forms:

• Topic
• e mail adress
• Name
• u:account UserID
• Subject
• Message
• Attachment
• Prior education
• Phone number
• Gender
• Date of birth
• Academic degrees

In addition, the following data are stored at the time the message is sent: 

• IP address of the calling computer
• Date and time of access
• Name and URL of the retrieved file
• Volume of data transmitted
• Report whether the request was successful
• Identification data of the accessing browser as well as operating system
• Website from which the user accessed the service

When you complete the contact form, you are asked to consent to the data processing and are referred to this Data Protection Declaration. Alternatively, you can contact the University via the e-mail address provided. In this case, the University of Vienna stores the user’s personal data transferred as part of the e-mail. 

In this context, we will not transfer personal data to third parties. The data are solely used for the purpose of processing the conversation.

Article 6, para. 1, sub-para. a of the GDPR provides the legal basis for the processing of personal data to which the data subject has given their consent. Users have to agree to the following declaration of consent:

I consent that the University of Vienna collects, stores and processes the personal data that I have entered in the contact form above for the purpose of sending a message and/or information. My personal data will be erased as soon as the purpose of the processing activity has been fulfilled and if no other statutory storage period applies. I hereby declare that I am giving my consent freely. I have also been informed that I have the right to withdraw my consent at any time informally with future effect, and without any negative consequences for me. I can withdraw my consent by contacting . The University of Vienna and any processors will erase all relevant data stored as soon as they receive my withdrawal of consent.
Article 6, para. 1, sub-para. f of the GDPR provides the legal basis for the processing of personal data transferred in the course of sending an e-mail. If the e-mail contact aims at the conclusion of a contract, article 6, para. 1, sub-para. b of the GDPR provides an additional legal basis.

Furthermore, if the e-mail contact is necessary for compliance with a statutory obligation, article 6, para. 1, sub-para. c of the GDPR provides the legal basis.

The processing of the personal data entered in the input mask serves the sole purpose of processing your contact request. If data subjects contact us by e-mail, this also constitutes the necessary legitimate interest in the data processing.

Any other personal data processed during the sending process serve to prevent the misuse of the contact form and to ensure the security of the University’s IT systems.

The data will be erased as soon as their collection no longer serves the fulfilment of their purpose. For the personal data provided in the input mask of the contact form and for those sent by e-mail, this applies when the relevant conversation with the user has been concluded. A conversation is deemed concluded when the circumstances suggest that the matter in question has been fully resolved.

Personal data additionally collected as part of the sending process are erased after no more than 30 days, unless a longer storage period applies due to a statutory provision (e.g. if the University of Vienna takes official sovereign action; see in particular the section “Administration of studying and teaching” above).

The University of Vienna processes personal data of teachers, students and employees as part of evaluation and quality assurance processes. The purpose of the related data processing is the analysis and provision of basic information about the University's performance in the areas of research, teaching and administration. This analysis and the related quality assurance services aim at improving the organisation and operation of the University of Vienna.

Personal data are processed in accordance with article 6, para. 1, sub-para. c of the GDPR in conjunction with section 14 of the Universities Act in conjunction with the Statutes of the University of Vienna. Personal data are erased when they are no longer necessary in relation to the purposes for which they were collected.
 

The University of Vienna operates an Alumni Community platform, which serves to provide information to students, graduates and other persons affiliated with the University and enables them to participate in offers of the Alumni Community. In this context, the University of Vienna processes personal data to maintain in contact with students and graduates and to maintain a university network.

Personal data are processed for the purpose of managing the Alumni Community, disseminating information and newsletters about events, programmes and offers provided by the University of Vienna as well as organising and carrying out events. Furthermore, the University may process personal data for the purpose of processing prize draws, enquiries received via contact forms and managing the programmes of the Alumni Community, such as the mentoring programme. In addition, as part of digital mailings, the University may also collect open and click rates to improve communication and to disseminate information in a more targeted way.

Personal data are processed in accordance with article 6, para. 1, sub-para. e of the GDPR in conjunction with section 3 of the 2002 Universities Act, as well as in accordance with article 6, para. 1, sub-para. f of the GDPR, since the University of Vienna pursues the legitimate interest of maintaining contact with its students and graduates, maintaining an alumni network and providing information about university-related activities. If certain communication offers are based on consent, personal data are processed in accordance with article 6, para. 1, sub-para. a of the GDPR.

In the context of the Alumni Community, the University may process in particular the following categories of personal data: Master data such as name or academic degree, contact data such as e-mail address, postal address or telephone number, study-related information such as degree programme or year of graduation, as well as communication and preference specifications such as on newsletter subscriptions or event registrations. In addition, the University may process data about participation in events and programmes as well as technical usage data with regard to digital mailings.

To fulfil the purposes mentioned above, personal data may be processed within the University of Vienna as well as using technical systems required for the operation of the Alumni Community platform. The platform Salesforce is used for the technical operation of the Alumni Community platform. Salesforce is the processor in accordance with article 28 of the GDPR and processes personal data solely on behalf of and following instruction by the University of Vienna.

Personal data are stored only for as long a period as necessary for the fulfilment of the purposes mentioned above or for the duration of statutory storage periods. Data are erased, in particular, when a user account on the Alumni Community platform is deleted, when the purpose of the processing no longer applies or when statutory storage periods have expired.
 

We use so-called cookies. Cookies are small text files that are sent from our web server to your browser when you visit our websites. Your browser holds these cookies available on your computer for later retrieval. Cookies contain a characteristic string of characters that allows your browser to be uniquely identified when the website is accessed again. We use only so-called session cookies (also known as temporary cookies), i.e. cookies that are stored only temporarily (cached) for the duration of your visit to one of our websites.

We use the following cookies:

• Session Cookies (ID)
• TYPO3 session cookies
• JavaScript cookies
• Matomo cookies for statistical analysis

The collected usage data do not allow for any conclusions regarding the user (except those cookies that serve the recording of data in connection with an active log-in). All usage data are collected in anonymised form; they will not be linked to your personal data and will be erased immediately after the end of the statistical analysis. All cookies are erased after termination of the session, i.e. as soon as you end your browser session.

Furthermore, on our websites we use cookies which allow for an analysis of our users’ surfing behaviour. This way, the following data may be transferred:

• Search terms entered
• Frequency of page views
• Use of website features

The legal basis for the processing of data, subject to the user’s consent, is article 6, para. 1, sub-para. a of the GDPR as specified in the cookie banner as well as the University of Vienna’s legitimate interest in accordance with article 6, para. 1, sub-para. f of the GDPR, unless these are cookies necessary for the operation of the website.

The legal basis for the processing of personal data when using technically necessary cookies is article 6, para. 1, sub-para. f of the GDPR.

In particular, the used cookies serve the purpose of analysing the frequency of use and the number of visitors to our websites. Furthermore, they are used to continue to identify your computer during a visit on our website when surfing from one page to the next, and to establish the end of your visit. This allows us to determine which sections of our websites and which other websites our users visited.

The purpose of using technically necessary cookies is to simplify the use of websites for their users. Some features of our websites cannot be provided without the use of cookies. To provide these features, it is imperative to recognise your browser even when you have switched to a different page.

The following applications require cookies:

• Shopping cart
• Transferring language settings
• Remembering search terms

The user data collected by technically necessary cookies are not used to create user profiles.