Data Privacy
Responsible party: Vienna Film Commission GmbH, Karl-Farkas-Gasse 18, 1030 Vienna, Austria
Phone: +43 1 4000-87000
Email: office@viennafilmcommission.at
FN 323447h HG Vienna
We take the protection of your personal data seriously. We therefore respect all applicable laws, in particular the General Data Protection Regulation (»DPR«) and the applicable Austrian Data Protection Act (Datenschutzgesetz – »DSG«) as amended, for the protection, proper handling and secrecy of personal data and data security. The privacy statement and the information on cookies explain how we collect, use, and process your personal data and sets out the scope, duration, and purpose of our use of your personal data when we provide services and offers, including when you use our website www.viennafilmcommission.at (»Website«).
1. Definition of personal data
Personal data includes information on affected persons (in this case: users of this website, customers, interested persons, cooperation partners) who have been identified or are at least identifiable (e.g. Name, email address or IP address).
2. What personal data on you do we collect?
Master Data: The master data we process are the personal information given voluntarily by you when you actively contact us or which is necessary for registration on our website (title, academic degree, name, address, date of birth, preferred language, username, password, email address and telephone numbers). In case of legal entities, the master data are processed in terms of data protection if they can be traced to a private individual (e.g., name, telephone number, email address of a contact person). In addition to master data, we also process the contents of correspondence.
Technical data: We record the IP address of your device, the Internet browser used, the browser language, your operating system, the data requested on our website, screen resolution, color depth, your clicking behavior on the website (time of access, clicks) as well as the website from which you accessed us (referrer URL).
Images of persons and other photographs: We also process photos with persons made with the consent of the affected persons for the purposes set out in Clause 4.
3. How do we collect your data?
The data produced when you visit our website is collected automatically. Otherwise, we only collect data on the grounds of your entries on our website (particularly regarding master data, order and booking data) or other provision of information (e.g. by correspondence, a telephone call, by completing forms).
4. What do we use your data for?
We process the personal data set out under Clause 2 for the following purposes and according to the stated legal grounds:
Contract fulfillment and carrying out of pre-contractual measures under Art 6 para1 lit b GDPR: The master data are processed for the purpose of providing an online account. Master data are used for the fulfillment and processing of contracts, customer services, customer support and customer information, services and administration of master and contract data and amendments. The conclusion and fulfillment of the contract are only possible on the grounds of this data processing. If the customer does not provide the requisite data, no contract can be concluded.
Fulfillment of statutory obligations under Art 6 para1 lit c GDPR: The personal data set out in Clause 2 are further processed for the purpose of observing requirements under the laws on associations, trusts and taxes.
Legitimate interests of the Vienna Film Commission or third parties pursuant to Art. 6 para. 1 lit. f GDPR: All data listed under Clause 2 are used for the purpose of internal market research, statistical analyses, direct advertising and for providing services.
Consent to data processing under Art 6 para1 lit a GDPR: If none of the legal grounds set out above is given, we will separately obtain consent to data processing. The Vienna Film Commission requires specifically the voluntary consent to being contacted electronically and by telephone for marketing purposes. This consent can be revoked at any time and with effect for the future by contacting us by email at office@viennafilmcommission.at.
We use images of individuals on the basis of your consent in accordance with Art. 6 (1) (a) GDPR for the documentation, announcement, and promotion of events and activities in both digital and print media, and we archive these images exclusively for these purposes. The exact purposes are listed in full in the respective declaration of consent. The prospective recipients are the general public via various print media and via the Internet, YouTube, etc.
5. How long do we store your data?
We do not store personal data for longer than is necessary to fulfill our business purposes or due to legal requirements, at most for 7 years. Beyond this term, personal data is only stored as far as required for raising or defending legal claims or for the fulfillment of a legal obligation. If you have consented to receiving advertising information, we store your data until you revoke your consent, at most for 3 years after the last contact.
Your rights as a affected person
You have the right to receive information in a clear, transparent, and easily understandable manner about how we process your personal data and about your rights as an affected person (Art. 13 ff GDPR):
Right of access under Art 15 GDPR: You have a right to demand from the Vienna Film Commission a copy of the personal data we have stored on you (subject to certain limitations).
Right to rectification under Art 16 GDPR: You have the right to demand from the Vienna Film Commission the rectification of your personal data if they are wrong or no longer up to date, and/or have a right to amend missing information.
Right to erasure/right to be forgotten under Art 17 GDPR: You have the right to demand of the Vienna Film Commission that your personal data be deleted without delay. Please note that this is no absolute right because there may exist statutory or legitimate grounds for maintaining data.
Right to restriction of processing under Art 18 GDPR: You have the right to demand of the Vienna Film Commission the limitation of processing if one of the grounds set out in Art 18 GDPR is given.
Disclosure requirement in connection with the rectification or erasure of personal data or limitation of processing Art 19 GDPR: The Vienna Film Commission will notify all affected persons of any rectification or erasure of personal data or any limitation of processing under Article 16, Article 17 para 1 and Article 18 unless this proves impossible or involves an unreasonable effort.
Right to data portability under Art 20 GDPR: You have the right to receive the personal data concerning you in a structured, commonly used, and machine-readable format from the Vienna Film Commission, and every person has a right to transmit these data to another controller without hindrance by us. This shall only apply to data provided by you, data where the processing is based on contract or your consent, or the processing is carried out by automated means.
Profiling in accordance with Art. 22 GDPR: The Vienna Film Commission does not engage in profiling. There is no automated decision-making.
Right to lodge a complaint with a supervisory authority under Art 77 GDPR: You also have the right to lodge a complaint with the data protection agency if you believe that the processing of your personal data violates the GDPR or the DSG. The competent data protection supervisory authority is the Austrian Data Protection Agency (Österreichische Datenschutzbehörde), www.dsb.gv.at, Barichgasse 40-42, 1030 Vienna.
7. How do we protect your data?
We take appropriate technical and organizational security measures in terms of Art 5 Abs 1 lit f or Art 32 GDPR, as the case may be, in order to protect your personal data against unintended or unlawful erasure, modification, damage or loss, unauthorized disclosure or unauthorized access. In accordance with Sec 6 DSG (Austrian Data Protection Act, Datenschutzgesetz) we have also concluded confidentiality agreements with all staff members with access to your personal data, protecting your data secrecy. Furthermore, we also take numerous measures on our website:
Your data is secure on www.viennafilmcommission.at. The Vienna Film Commission uses the SSL (Secure Socket Layer)-protocol on its entire website. This encrypts data during the transmission between the user and the Vienna Film Commission server, so that the data cannot be read by third parties.
Data is transmitted by way of a 128 Bit encrypted SSL-connection (Secure Socket Layer)
By encrypted transmission we ensure that your data is protected from access and/or manipulation by unauthorized parties. The SSL connection further guarantees that you only establish and maintain a connection with the Vienna Film Commission server.
The Vienna Film Commission-Server has been certified by DigiCert Inc, USA
How can you see whether the website is secured? The address (URL) starts with https:// and a lock or a key is shown in the status bar.
The safety certificate belongs to the Vienna Film Commission, was issued by DigiCert Inc and is valid. By clicking on the symbol of DigiCert Inc in your browser (lock or key in the status bar) you can show detailed information on the safety certificate.
Video Streaming
Description of the service: Ignite Video is a European video hosting platform that is integrated into our website to enable visitors to use video content without cookie tracking.
Processing company: Ignite Video GmbH Immermannstraße 59 40210 Düsseldorf Germany
Transmitted data: The IP address is transmitted automatically when the video is accessed. Ignite expressly does not store or further process this data.
Place of processing: This is the primary location where the collected data is processed. If the data is also processed in other countries, you will be informed separately.
European Union: Cookie policy of the data processor: https://ignite.video/de/datenschutz
9. Analytics (Cookieless)
Description of the service: We use PostHog to understand how users interact with our website and to improve our services. We have configured PostHog to operate in a strict privacy mode that prioritizes user anonymity.
Data Processor: PostHog Inc 2261 Market Street #4008 San Francisco, CA 94114 USA
Transmitted data
No cookies: We do not place cookies or store information in your browser's local storage for analytics purposes if no consent was given.
Ephemeral hashing: Instead of tracking you via a persistent ID, we utilize a server-side hashing mechanism. This process combines your IP address and User Agent with a random "salt" (a secret key) to generate a temporary identifier.
Daily anonymization: This "salt" key rotates and is permanently deleted every 24 hours. Once deleted, it is mathematically impossible to link your activity from previous days to your current visit. Consequently, we cannot track your behavior across different days or build a long-term behavioral profile.
Location of processing:
Data hosting: All analytics data is processed and stored within the European Union (Frankfurt, Germany).
Legal basis: We process this information on the basis of our legitimate interest (Art. 6 (1) (f) GDPR) in order to analyze the performance and traffic of the website without compromising your fundamental data protection rights.
Data privacy of the data processor: https://posthog.com/docs/privacy/gdpr-compliance
Cookies, social media, and Google
Our website uses cookies. These are small text files that are temporarily stored on your computer and saved by your browser. Cookies enable the website to store important data. This makes your use of the website more convenient. Like most websites, we use cookies for a variety of purposes to improve the use of our website, provided you have given your consent. If you do not give your consent, we only collect anonymous data, e.g. to determine the total number of visitors to our website.
auth:expiresIn
Purpose: Stores the expiration time of the current authentication session.
Category: Essential (authentication).
Persistence: Session (transient).
auth:token
Purpose: JWT for authentication (confirms login and roles).
Category: Essential (authentication).
Lifespan: Session (transient).
cookie_session_domain
Purpose: Persistent session information, applies to domain and subdomains (.viennafilmcommission.at).
Category: Essential/functional.
Duration: 1 year.
cookie-consent
Purpose: Stores your cookie consent/selected settings.
Category: Preferences (Consent).
Retention period: 1 year.
form-translation:language
Purpose: Remembers the selected language for form translations.
Category: Preferences.
Persistence: Session (transient).
i18n_redirected
Purpose: Stores your language/country selection for automatic redirection to the page in the respective language.
Category: Preferences.
Persistence: 1 year.
Starting with ph_phc_
Purpose: Analytical tracking by PostHog to evaluate sessions and user behavior (third-party provider) when cookie-less tracking is used.
Category: Analytics (non-essential, third-party provider).
Retention period: Defined by Posthog.
sidebar_state
Purpose: Remembers the state of the sidebar (expanded/collapsed).
Category: Preferences / UI.
Duration: 7 days.
Management: Cookies can be deleted or rejected via the cookie settings or browser settings.