of the Institute of Science and Technology – Austria (IST Austria)
The protection of your personal data is of particular concern to us. We treat your personal data confidential and in accordance with the statutory data protection regulations and this data privacy statement.
As a scientific research institute, IST Austria is subject to special publication and data processing needs. In particular, IST Austria must keep permanent, confidential records of certain application and resume data for scientists, including external review letters; of author- and ownership data for research reports, research data, research software, lab books, and intellectual property; and of certain graduate-school and course data for students. These records will not be erased and, in some cases such as review letters, will not be disclosed, even if requested by individuals that are mentioned in the records. The Institute must also, without seeking individual consent, regularly publish customary resume, in general publicly available data about its current and former scientists.
The General Data Protection Regulation as well as the Austrian Research Organisation Act provide for special provisions in order to be able to continue to carry out data processing essential for scientific operations in order to establish authorships (see point 4.8/4.9 below), to secure confidentiality of expert opinions in the application process (see reference to trade secret under point 7), to archive grades and research results (see point 4.8), and to publish names and publication lists of researchers that have been working at the Institute (see point 4.9).
Since changes in the law or changes in our internal processes may make it necessary to adapt this data privacy statement, we ask you to read this data privacy statement regularly.
This data privacy statement applies to the Institute of Science and Technology – Austria (IST Austria, “we“, “us“, “our“), Am Campus 1, 3400 Klosterneuburg, Austria, as controller within the meaning of the EU General Data Protection Regulation (GDPR). IST Austria complies with the applicable provisions on the processing of personal data, in particular the Austrian Data Protection Act, the GDPR, the Austrian Research Organisation Act and the Austrian Telecommunications Act. In the following, we will inform you about the institute, as well as the nature, scope and purpose of the data collection and processing and your rights as data subject.
Institute of Science and Technology – Austria
c/o Legal Affairs
Address: Am Campus 1, 3400 Klosterneuburg, Austria
Phone: +43 02243 9000
E-mail:
office(at)ist.ac.at
E-mail in case you want to exercise your rights as a data subject (see point 7): dataprotection(at)ist.ac.at
Data Protection Officer at IST Austria:
Dr. Svenja Kutnig, LL.M. (UCL)
Address: Am Campus 1, 3400 Klosterneuburg, Austria
Phone: +43 02243 9000
E-Mail:
dataprotectionofficer(at)ist.ac.at
Personal data is any information that on its own or together with other information relate to an identified or identifiable natural person. This includes, for example, your name, your address, your telephone number or your date of birth. Information that we cannot (or only with disproportionately high effort) relate to your person, e.g. anonymized information, is not personal data according to the GDPR. The person whose personal data is processed is the data subject.
In this data privacy statement we want to inform you about the following activities where we process your personal data:
4.1 Use of our websites
4.2 Use of cookies
4.3 Sending information (e.g. Newsletter) and events registration
4.4 Contact management (Customer Relationship Management – CRM)
4.5 Applications for positions in the fields of administration and Scientific Service Units
4.6 Application for positions in the academic field (e.g. Interns, PhD students, PostDocs, Assistant Professors, Professors)
4.7 Alumni Networking
4.8 Career tracking and quality management
4.9 Public Relations
4.10 Contract management
4.11 Processing images (Picture Pool)
In general you may use the IST Austria websites without disclosing your personal data. However, this may be different for the use of individual services to which we will draw your attention separately.
When you use our websites, we usually process your IP address, the name and version of your web browser, cookies that identify your web browser, which pages you visit exactly when on our websites (URL, date, time), and the website you visited before visiting our websites. All this data is transmitted to us by your web browser when you visit our website. This data will not be used by us to identify the individual user; the data is evaluated exclusively for statistical purposes while maintaining the anonymity of the individual users.
In addition to the processing activities listed in point 4.2 (use of cookies), we carry out the following data processing on our website:
Your access data to the IST Austria websites will not be passed on to third parties. We process your data based on our legitimate interest according to Art 6 (1) point (f) GDPR in order to make the IST Austria websites user-friendly and protect them from attacks.
We store your personal data for as long as we need it for the fulfilment of the above-mentioned purposes. When we no longer need your personal data, we erase it from our systems and records or anonymise it so that you cannot be identified anymore.
The IST Austria websites may contain so-called hyperlinks to the websites of other providers. If you click on these hyperlinks, you will be redirected from the IST Austria websites directly to the websites of other providers. We cannot assume any responsibility for the confidential handling of your data on these third-party websites, as we have no influence on whether these providers comply with data protection regulations.
In order to make use of our IST Austria websites as optimal as possible for you, we use so-called “cookies”. Cookies are text files that can be stored on the user’s computer if the user’s browser settings allow this. Information can be written into these text files, which can be read out again at a later time. A cookie is bound to a certain domain and contains information that can later only be read out again from this domain.
Before we use cookies on our websites, we ask for your consent. You can also express your consent simply by continuing to use our websites after taking notice of our cookie information.
In data protection, a distinction is made between cookies that require your consent before they may be stored on your terminal device and cookies that may be stored without your consent in accordance with the Telecommunications Act, as these are absolutely necessary so that we can make our service available to you. The majority of our cookies are those for which no consent is required. Of course, we only use the other cookies after we have obtained your consent.
The legal basis for setting cookies is therefore either your consent or the exception provided for in the Telecommunications Act and therefore our legitimate interest according to Art 6 (1) point (f) GDPR in order to implement data security measures, for abuse prevention and website optimisation.
You can withdraw your consent at any time with effect for the future by blocking the storage of cookies by setting your browser software accordingly. Thereby, you can generally prevent the setting of cookies on your device and shorten the storage period of the cookies. More detailed information can be found in the help menu of your browser or e.g. under the URL http://www.aboutcookies.org. Disabling cookies may result in disabling certain functionality and features of the IST Austria websites.
We appreciate it if you register for events or subscribe to receive information on activities, news on research and events of IST Austria (including newsletters, event invitations, and annual report), and further consent that we transfer your data to our subsidiaries for this purpose.
For the above mentioned purposes, we collect and process data that you have made available to us, like your name, e-mail address and address, your telephone number as well as your organisation and function. You need a valid e-mail address to register online. We may check the e-mail address you have entered to ensure that you are actually the owner of the e-mail address provided. This is done by sending you a confirmation e-mail with a link to confirm your registration to the e-mail address you have provided.
In connection with your registration we also process your IP address, the date and time of your registration. This is done for security reasons in case we have to prove that we have received your consent for processing.
For the purpose to provide you with information on activities, news on research and events of our subsidiaries, your data is transmitted to our subsidiaries, in particular to IST Cube Management GmbH, Am Campus 1, 3400 Klosterneuburg, Austria, Tel +43 02243 9000 , e-mail: office(at)ist-cube.com , and IST Austria PARK GmbH, Am Campus 1, 3400 Klosterneuburg, Austria, Tel +43 02243 9000 , info(at)istpark.at . Legal basis according to Art 6 (1) point (a) GDPR is your consent. We want to inform you that you may withdraw your consent at any time with effect for the future (see also point 6).
IST Austria reserves the right to use personal data provided by you for direct marketing purposes, especially in order to inform and invite you to events, send newsletters, and to transmit your data to our subsidiaries for this purpose; this is based on our legitimate interest according to Art 6 (1) point (f) GDPR. As a person interested in IST Austria we would like to inform you about the institute and its subsidiaries. You have the right to object to receiving information any time with effect for the future (see point 7).
We process your data until you withdraw your consent or object to processing, but no longer than necessary to fulfil the purpose pursued with the processing, or if the storage is or becomes unlawful for other legal reasons.
For the purpose of contacting and developing individual communication strategies with contractual partners, interested parties and (potential) supporters of IST Austria we process your contact data (name, telephone number, e-mail address, address, organisation and function), information on your education and your professional career, date of birth, nationality, funding data and main interests. This also serves to optimise our contact management (Customer Relationship Management – CRM). We process your data either for contract initiation and performance of contract according to Art 6 (1) point (b) GDPR, on the basis of your consent according to Art 6 (1) point (a) GDPR, or our legitimate interest according to Art 6 (1) point (f) GDPR in order to ideally design the contact management or if the data are publicly available. As far as data processed for this purpose is not obtained from you, data is obtained from a telephone query or publicly available sources like publicly available websites, registries, or publicly available contents in social media networks like LinkedIn or XING.
You may withdraw your consent at any time with effect for the future (see also point 6) or object, on grounds relating to your particular situation, to processing at any time according to point 7.
We process your data until you withdraw your consent or object to processing your data, but no longer than necessary to fulfil the purpose pursued with the processing, or if the storage is or becomes unlawful for other legal reasons.
If you apply for an open position in administration or Scientific Service Units of IST Austria, we collect and process personal data which you have either provided to us or which we obtain, for example in the course of job interviews, or in the course of internal assessment centers or the performance of tests. We process your data according to Art 6 (1) point (b) GDPR in order to take necessary steps prior to entering into a contract.
We do not collect any special categories of personal data during the application process (in particular data revealing your racial or ethnic origin, political opinion, religious or philosophical beliefs or trade union membership, as well as health data or data on sex life or sexual orientation). However, if you provide us with information that contains special categories of personal data, this constitutes your explicit consent pursuant to Art 9 (2) point (a) GDPR that we may process this data. We store your data for 3 years after the end of the application process and delete it after such period. We will store your data beyond that period only if you consent, if we further process your data based on another legal basis (e.g. in connection with an employment relationship) or if it is necessary for the completion of possible legal disputes, in which the data is needed as evidence. You may withdraw your consent at any time with effect for the future (see also point 6).
If you apply for an open position in the academic field of IST Austria (e.g. as an intern, PhD student, PostDoc, Assistant Professor or Professor), we collect and process personal data which you have either provided to us or which we obtain, for example, in the course of job interviews or in the course of internal assessment centres or the performance of tests.
Obtaining independent expert opinions of scientists worldwide is part of the internationally recognised application process in the course of scientific applications. For this purpose and for applications for positions as Professor or Assistant Professor, the necessary data of applicants (that is, application documents such as CV including publication list, cover letter, and research statement including a description of scientific achievements and planned future research activities) is transferred to external experts (who may reside in third countries) in order to obtain an assessment of the applicant. In order to preserve the independence of these experts, the identity of the experts as well as the expert assessments they offer are kept strictly confidential and qualify as business and trade secrets of IST Austria and therefore will not be disclosed to applicants. Appropriate confidentiality agreements are concluded with the experts.
We process your data on the legal basis of contract initiation and performance of a contract according to Art 6 (1) point (b) GDPR (in connection with Art 49 (1) point (b) in case of transmission to experts in third countries). We do not collect any special categories of personal data during the application process (in particular data revealing your racial or ethnic origin, political opinion, religious or philosophical beliefs or trade union membership, as well as health data or data on sex life or sexual orientation). If you nevertheless provide us with information that contains special categories of personal data, this constitutes your explicit consent pursuant to Art 9 (2) point (a) GDPR that we may process this data.
We store your data for a period of 3 years after the end of the application process, and beyond that only for documentation purposes of funded programmes with a view to possible auditing by the funding agencies (e.g. applications for ISTplus fellowships must be kept for 5 years after completion of the funding programme), if we further process your data based on another legal basis (e.g. in connection with an employment relationship), or if it is necessary until the completion of possible legal disputes, in which the data is needed as evidence.
If you reject an offer of admission from IST Austria, IST Austria also is entitled to process certain data for the purpose of career tracking andquality management (see point 4.8).
We are happy that you register as an alumni of IST Austria at our alumni website, in order to remain in contact with us and other IST Austria alumni and build up your network. In the course of the registration you have agreed that we can use your e-mail address for the purpose of sending information about our alumni program (competitions, success stories, new developments, etc.) and furthermore that we can process the data submitted by you for the purpose of career tracking and quality management (see also point 4.8).
Certain information provided by you (in particular your name) is also visible to other registered users of our alumni website. These fields are marked accordingly in the input mask and are entered voluntarily by you.
We process your data based on your consent according to Art 6 (1) point (a) GDPR.
You can withdraw your consent at any time with effect for the future according to point 6.
We process your data until you withdraw your consent, but no longer than necessary to fulfil the purpose pursued with the processing, or if the storage is or becomes unlawful for other legal reasons.
For the purpose of career tracking and quality management in connection with the optimal use of IST Austria’s funds and to determine the effects of measures in the field of science and research, we collect and process, if available and used by us for this purpose, the following qualitative and quantitative data of you if you either were or are active in the context of teaching and research at IST Austria, or applied for an position in the academic field at IST Austria (see point 4.6) and rejected our offer for admission: address data, education data, career path, income, employment status and extent (full-time/part-time; permanent/temporary), data on the role of the data subject (e.g. job title), e-mail data, identification data, contact data, proof of performance/grading (including review letters), nationality, date of birth, name, qualitative data concerning the relevance of the studies for the job, professional advancement and satisfaction, as well as perception of the quality and relevance of your education and training experience, geographic and/or sectoral mobility, academic functions, publications, external funding and activities concerning technology transfer.
In regards of data that was not obtained from you, data is received from other processing activities at IST Austria or publicly accessible sources like publicly available websites, registries, or from generally accessible contents in social media networks like LinkedIn or XING.
Your data for the purpose of career tracking and quality management is processed for the duration of the existence of the institute, but no longer than necessary to fulfil the purpose pursued with the processing, or if the storage is or becomes unlawful for other legal reasons, and will be deleted when you object, on grounds relating to your particular situation, to processing at any time with effect for the future according to point 7. However, data subjects may not object to processing if the purpose of processing (career tracking and quality management) is likely to be made impossible or seriously impaired. We process your data for the purposes above on the basis of a public interest according to Art 6 (1) point (e) and Art 9 (2) point (g) GDPR in connection with Sec 2e and 2h Austrian Research Organisation Act (Forschungsorganisationsgesetz – FOG).
For the purpose of public relations, IST Austria publishes names, photos and publication lists of our currently employed researchers as well as names and publication lists of formerly employed researchers on the IST Austria websites or in publicly accessible reports. We process your data for this purpose on the basis of a public interest pursuant to Art 6 (1) point (e) in connection with Sec 2e and 2h of the Austrian Research Organisation Act (Forschungsorganisationsgesetz – FOG). Additional data (such as customary and in general publicly available resume data and research group affiliation of current or former employed researchers, as well as photos of former researchers at IST Austria) will be processed for this purpose on the basis of your consent pursuant to Art 6 (1) point (a) GDPR or our legitimate interest pursuant to Art 6 (1) point (f) GDPR, which consists of the necessary transparency in the area of science and research and/or for reasons of public relations.
You can revoke your consent for processing at any time with effect for the future in accordance with point 6 or, if your particular situation gives rise to reasons for this, you can object to processing in accordance with point 7 at any time. Your data for the purpose of public relations is processed for the duration of the existence of the institute, but no longer than necessary to fulfil the purpose pursued with the processing, or if the storage is or becomes unlawful for other legal reasons, and will be deleted when you object, on grounds relating to your particular situation, to processing or withdraw your consent at any time with effect for the future.
IST Austria processes personal data that you as a contractual partner or supplier provide to IST Austria, for example by sending an inquiry or registration or for the conclusion of a contract. The data processing takes place for the purpose of communication with the contractual partner or supplier or the performance of the contract. This includes the initiation, conclusion, performance, guarantees as well as rescinding of contract.
For this purpose, the following personal data of data subjects of the contractual partner, supplier or subcontractor will be processed: name and contact data of contact persons as well as electronically created and archived documents (such as correspondence). If you take part in our courses, personal data required for course registration and processing will be stored by us (your name, contact data, information on course participation, performance record and grading). As an external instructor, we collect and process personal data required for the course (name, contact details, course details, and course evaluation by course participants).
The legal basis for the data processing is the contract initiation and performance of contract according to Art 6 (1) point (b) GDPR.
We store your data until the end of the business relationship or until the expiry of the guarantee, warranty, statute of limitations and statutory retention periods applicable to IST Austria and beyond that until the end of any legal disputes, in which the data is required as evidence.
IST Austria reserves the right to record images (photos and videos including acoustic information) of participants and speakers at lectures and events (especially public lectures, Open Campus, “Lange Nacht der Forschung”) and to publish them on the IST Austria websites, in media reports and social media portals of IST Austria. Publication is for reporting on lectures and events of the institute as well as for information purposes and not for commercial purposes.
The legal basis for the processing of your personal data is either your consent pursuant to Art 6 (1) point (a) GDPR or our overriding legitimate interest pursuant to Art 6 (1) point (f) GDPR in conjunction with Sec 12 Austrian Data Protection Act to comply with our obligation to inform the public about lectures and events organised by the institute.
Images will only be used for other purposes (e.g. for marketing purposes to promote other events) with your consent.
You may withdraw your consent to processing at any time with effect for the future in accordance with point 6 or object, on grounds relating to your particular situation, to processing at any time with effect for the future in accordance with point 7. If images are created for marketing purposes based on your consent (e.g. for posters, flyers for events), you can revoke your consent until the print order is placed.
We process your data up to your revocation or objection, at the latest, however, until the data is no longer necessary to fulfil the purpose pursued with the storage, or if the storage is or becomes inadmissible for other legal reasons.
In particular, the storage period depends on the following criteria:
In addition, images and/or videos (including audio recordings) will be stored until the end of any legal disputes that arise during which they are required as evidence.
Images and/or videos (including audio recordings) are published for the above purposes – i.e. made available to everyone. If necessary, the image and/or video material (including audio recordings) will be transferred to third parties (e.g. agencies, printing companies) for the purposes of advertising.
Within IST Austria, only the responsible organizational entities and persons process your data.
Except as explicitly mentioned in our processing activities (see point 4), we do not transmit your personal data to other recipients, unless it is required to fulfil our contractual obligations or to comply with mandatory laws/authority requests.
However, your personal data is being processed also by our processors on our behalf. These processors are in particular providers of marketing tools, IT service providers, providers of other tools and software solutions, and IT maintenance services. Our processors process your data solely on our behalf and on the basis of our instructions.
You can withdraw your consent at any time with effect for the future and without stating a reason in order to hinder further processing of your personal data that has been collected and used based on this consent.
If you want to withdraw your consent to processing activities of IST Austria, please send an e-mail to dataprotection(at)ist.ac.at or a letter to Institute of Science and Technology – Austria, c/o Legal Affairs, Am Campus 1, A-3400 Klosterneuburg, Austria.
As a data subject of our data processing you have the following rights and legal remedies:
According to Art 15 GDPR you have the right to access the personal data concerning you that is being processed by IST Austria. Without prejudice to other statutory restrictions, this right does normally not exist if the provision of this information would jeopardize a business or trade secret of IST Austria or third parties.
You also have the right to rectification of inaccurate or incomplete personal data according to Art 16 GDPR, the right to erasure (‘right to be forgotten’) of your personal data according to Art 17 GDPR, and the right to restriction of processing according to Art 18 GDPR. According to Art 20 GDPR you have the right to receive the data you have provided in a structured, commonly used and machine-readable format and the right that those data is transmitted without hindrance or restriction to another controller.
In accordance with Article 21 GDPR, you also have the right to object, on grounds relating to your particular situation, at any time with effect for the future to the processing of personal data concerning you, which we process on the basis of a public or legitimate interest (Art 6 (1) point (e) and (f) GDPR); this also applies to profiling based on those provisions. We do no longer process your personal data after you object to processing, unless there are compelling legitimate grounds for the processing which override your interests, rights and freedoms or processing is necessary for the establishment, exercise or defence of legal claims.
You can object to processing for direct marketing purposes (see point 4.3) at any time with effect for the future.
For processing activities carried out based on the Austrian Research Organisation Act (see career tracking and quality management under point 4.8), you may exercise your rights as a data subject only within the scope of Sec 2d (6) Austrian Research Organisation Act.
In order to exercise your rights as a data subject, please send an e-mail to dataprotection(at)ist.ac.at or a letter to: Institute of Science and Technology – Austria, c/o Legal Affairs, Am Campus 1, 3400 Klosterneuburg, Austria.
For questions concerning the processing of your personal data, please also contact our data protection officer (see point 2 for contact details).
You are also entitled to lodge a complaint with a data protection supervisory authority. In Austria, this is the data protection authority (Österreichische Datenschutzbehörde, www.dsb.gv.at).