Privacy Statement

1. Name and Contact Information for the Controller and the Data Protection Officer

The controller for processing your data for the website www.verbundx.com (“website”) is VERBUND AG, Am Hof 6a, 1010 Vienna (hereinafter “VERBUND”, “we”, “us”).

You can contact our Data Protection Officer at: datenschutz@verbund.com.

2. Processing in the context of the “Website”

2.1. Data source and Data categories

During your visit to our website, we will automatically collect the following personal data:

• Date and time of access to a page of our website
• Data about your device (device ID)
• IP address
• Name and version of your internet browser
• Session ID

We are not using cookies on our website.

2.2. Legal basis and purpose of data processing

Where the data of your visit to our website are concerned, we justify the processing on the basis of our legitimate interest in accordance with Art. 6 (1) (f) GDPR, which consists of giving our website a user-friendly design and protecting our website against attacks.

We process your data relating to the visit to our website for the following purposes:

• in order to make our website and its functions available to you, and to improve and develop this website further;
• in order to be able to compile statistics on the use of our website;
• in order to be able to identify, prevent and investigate attacks on our website.

2.3. Recipients

We will not forward personal data collected on the basis of your use of the website to third parties, unless this is required for the fulfilment of our obligations or is mandatory for legal or official reasons. However, in order to operate and administer the website, we regularly use IT service providers which, in accordance with our orders and instructions, may under certain circumstances also have access to personal data in order to be able to render the commissioned IT services.

2.4. Storage period

We will generally store your data relating to the visit to our website for a period of three months. A longer storage period will apply only to the extent this is required to investigate identified attacks on our website and beyond that only until the end of the relevant limitation periods, statutory retention periods or any legal disputes.

1. Name and Contact Information for the Controller and the Data Protection Officer

The controller for processing your data in matters affecting questions/enquiries the VERBUND X Accelerator is VERBUND AG, Am Hof 6a, 1010 Vienna; the controller for processing your data in matters affecting VERBUND X Ventures is VERBUND Ventures GmbH, Am Hof 6a, 1010 Vienna (hereinafter “VERBUND”, “we”, “us”).

You can contact our Data Protection Officer at: datenschutz@verbund.com.

2. Processing in the context of “Making contact/enquiries”

2.1. Data source and Data categories

When you contact us by email or telephone, we will process the personal data you give us (email, name, telephone number, as well your enquiry or the associated documents) for the purposes of processing your enquiry and respond to you accordingly. In case you contact a cooperation partner of VERBUND within the VERBUND X Accelerator directly, your provided data will be processed by the cooperation partner as an independent controller.

2.2. Legal basis and purpose of the data processing

The legal basis for the processing of your personal data is our legitimate interest in accordance with Art. 6(1)(f) GDPR. If the reason for the enquiry/making contact is to conclude a contract, the legal basis for the processing is Art. 6(1)(b) GDPR. The personal data will be processed for the purpose of making contact and providing information or handling your enquiry. The provision of data by you is voluntary; however, if you do not provide these data, VERBUND will not be able to process your enquiry accordingly.

2.3. Recipients

In order to process the personal data, we use service providers (e.g. IT service providers) which, in accordance with our orders and instructions, may under certain circumstances also have access to personal data in order to be able to render the commissioned services. The data may further be forwarded to third parties only where required for the fulfilment of (pre-)contractual or statutory obligations, or where justified for the maintenance of our legitimate interests. For example, as required, we will transfer your personal data to the external parties, e.g. auditors, insurers or legal representatives, or to affiliated VERBUND companies, to the extent necessary.

2.4. Storage Period

We process your data in order to handle your enquiry and beyond that for a period of three months, so that we can respond appropriately to subsequent questions. A longer retention period will be applied only on the basis of statutory retention periods or for defence purposes in any legal disputes.

1. Name and contact details of the controller and Data Protection Officer

The data controller responsible for processing your data in connection with VERBUND events is the organiser specified and is either VERBUND AG, Am Hof 6a, 1010 Vienna, or VERBUND Ventures GmbH, Am Hof 6a, 1010 Vienna (hereinafter “VERBUND”, “we”, “us”).

VERBUND may also hold an event together with another VERBUND company or one or more cooperation partners. In this scenario, the organisers listed in the invitation are joint controllers and have concluded a corresponding agreement in accordance with Art. 26 GDPR (Joint Controller Agreement). You are entitled to assert your claims against any of the controllers independently of the Joint Controller Agreement.

You can contact our Data Protection Officer at: datenschutz@verbund.com.

2. Data processing in relation to "registering for events"

2.1. Data source and categories of data

When you register for a VERBUND event or an event held by VERBUND together with one or more organisers, personal information such as your salutation, title, name, address, contact details such as phone number and/or email address, and, under certain circumstances, information on your company and your position, and other event-related information may be processed. The above data is provided on a voluntary basis. However, if you do not provide the data marked as mandatory, we will not be able to process your registration.

2.2. Legal basis and purpose of data processing

The legal basis for processing your personal data is Art. 6 (1)(b) GDPR and thus the fulfilment of a contract. The personal data provided during registration will be processed for the purpose of processing your registration and administering the event, including related communication (e.g. sending registration confirmation, reserving seats, answering questions, etc.).

As far as the processing of your voluntarily provided optional data is concerned, we base this processing on our legitimate interest pursuant to Art. 6(1)(f) GDPR, which primarily lies in being able to interact with you on the basis of your voluntarily provided information.

As far as the processing of your voluntarily provided sensitive data (e.g. health data such as food intolerances) is concerned, we base this processing on your voluntary consent pursuant to Art. 6(1)(a) GDPR in conjunction with Art. 9(2)(a) GDPR. You can withdraw your consent at any time with future effect free of charge by contacting the address specified in the declaration of consent. Withdrawing your consent does not affect the lawfulness of the processing carried out on the basis of your consent prior to its withdrawal.

2.3. Data recipients

For joint events, the data is shared between the joint controllers who hold the event. The data is only passed on to other third parties if this is necessary to fulfil (pre)contractual or legal obligations, is justified to protect our legitimate interests or is permitted within the scope of your granted consent. Your data may be transferred to contracted service providers for order processing (responsible for organising and running the event) or to companies on the basis of your granted consent. Our service processors include, in particular, IT service providers and other providers of tools and software solutions that also assist us in providing our services and work on our behalf (e.g. service providers for event management).

2.4. Retention period

Your data will be stored for as long as is necessary for the fulfilment of the purpose, and only as long as they have to be processed within the scope of statutory retention obligations. If you have given your consent to the processing of certain data, we will delete your data earlier if you withdraw your consent.

3. Data processing in relation to visual recording (photos/videos)

3.1. Data source and categories of data

If images are taken at VERBUND events, they will be stored and used for subsequent reporting (e.g. on social media or the controller’s website).

3.2. Legal basis and purpose of data processing

This processing takes place on the legal basis of Art. 6(1)(f) GDPR and thus the legitimate interest of VERBUND and, in the case of a joint event, also of the joint organiser(s). Visual recordings are processed and stored in the VERBUND archive for the purpose of documenting and presenting events, activities and occurrences that are related to the work or the tasks of VERBUND. Furthermore, the visual recordings are processed for internal purposes and for the purpose of VERBUND’s public and press relations work, and may be made available to participants and published in printed and electronic media, in particular on social media platforms (Facebook, YouTube, etc.). If we are unable to base the corresponding data processing on legitimate interests, we will obtain separate consent from you for the processing in accordance with Art. 6(1)(a) GDPR. You can withdraw your voluntarily granted consent at any time with effect for the future, e.g. by sending an email to datenschutz@verbund.com.

3.4. Data recipients

At joint events, photos are taken in the common interest and used by all joint controllers who hold the event for the purposes described. The images will only be passed on to third parties where justified in order to protect our legitimate interests and permissible within the scope of the processing purpose. The images may be sent to contracted service providers for order processing.

3.5. Retention period

The images will be stored as long as the purpose behind the documentation exists and no objection is lodged regarding this processing. In addition, we will store your data for as long as we are required to do so under statutory retention obligations. If the processing is based on your voluntary consent, we will store the data until you withdraw your consent.

3.6. Data processing after the event ends

If an event is held by joint controllers, the processing of the data required for this purpose is carried out under joint responsibility as described above. Any data processing that takes place after the end of the event and is no longer related to the event (e.g. advertising or similar) is the sole responsibility of the respective company. Please note the corresponding privacy statement from VERBUND or the respective cooperation partner.

4. Data processing in the context of “AI transcription”

4.1. Scope of the processing of personal data

If you take part in an event organised by VERBUND, or an event held by VERBUND together with one or more co-organisers, and give a presentation or make a comment during the event, your contribution may be automatically transcribed using AI-supported systems for the purposes of documenting the event. To improve the accuracy of the minutes, speaker identification may be used to attribute contributions to the respective speakers. To this end, we process the audio recording, the content of the conversation contained therein and data on the participants (e.g. name, organisation, role) in transcribed form, as well as metadata relating to the event (e.g. date, time, location).

4.2. Legal basis and purpose for processing personal data

The legal basis for the processing of the data referred to in Section 4.1 is the legitimate interests of VERBUND or the joint organiser(s) in accordance with Article 6(1)(f) GDPR. The data is transcribed for the purposes of documenting and assigning contributions, internal knowledge retention, follow-up and quality assurance of events. Subsequently, these transcripts are used to produce minutes or summaries, which may be made available to participants and other interested parties. The transcripts will not be published.

The purpose of live translation is to enable participants who speak different languages or have different language skills to participate in and contribute to the event. This removes language barriers and promotes dialogue.

Our legitimate interest in this processing lies in the comprehensive and high-quality documentation and interaction at events. The use of AI-supported transcription and translation systems enables more efficient processing compared to manual methods.

If you wish to object to the processing of your data, please inform us directly before the event.

4.3. Retention period

Once the audio recording has been transcribed or translated, it is deleted. As soon as we no longer require your personal data for the purposes outlined above, we will delete it, provided that no further statutory retention obligations apply.

4.4. Data recipients

Processing is carried out using automated transcription and translation software. To this end, the audio recording is transmitted to the AI processor. In the case of jointly organised events, the transcripts produced are also made available to the respective co-organisers.

VERBUND X Accelerator. (the “Program”), was developed and is organised by VERBUND AG, Am Hof 6a, 1010 Vienna (“VERBUND”, “we”). Start-ups, SMEs and other entrepreneurs (“applicants”, “you”) can apply to the Program and “pitch” innovative ideas. Applicants can then profit from the Program’s numerous benefits and the broad VERBUND network. The applicant’s personal data will be collected during this process. Therefore, in what follows, we inform you how to contact the controller, where we obtain your personal data and how we handle it.

1. Name and Contact Information for the Controller and the Data Protection Officer

The controller for processing your data for the Program’s purposes is VERBUND AG, Am Hof 6a, 1010 Vienna. The following contact information can be used to reach us: team-innovation@verbund.com.

You can contact our Data Protection Officer at: datenschutz@verbund.com.

2. The Program – Processing Activities, Purpose of Processing, Legal Basis and Recipients

2.1. Applying for and implementing the Program

a) Data source and Data categories

We process the personal data you provide on the application form (“platform”), such as company name, e-mail address, telephone number, first and last name, further information about your company (such as website URL, LinkedIn URL, country of origin, founding date, team composition, information about your product or service, company stage, team size, pitch deck, company logo), any additional information you voluntarily provide and logfiles (e.g. IP address, time of login).

b) Legal basis and purpose of data processing

We process the personal data for the purpose of evaluating and selecting your application and organising and executing the Program. Depending on the batch we distinguish among different search fields or use cases, which are stated in detail on the Program-website www.verbundx.com.

The legal basis for processing your data within the context of applying for and implementing the Program is Art. 6(1) (b) GDPR (Taking steps prior to entering into a contract or performing a contract).

Concerning the use of the platform we justify the processing on the basis of our legitimate interest in accordance Art. 6(1) (f) GDPR for the purposes of making the platform and its functions available to you and to be able to identify, prevent and investigate attacks on the platform.

The provision of data by you is voluntary; however, if you do not provide these data, VERBUND will not be able to process your application accordingly.

c) Recipients

In order to process the personal data, we use service providers (e.g. IT service providers) which, in accordance with our orders and instructions, may under certain circumstances also have access to personal data in order to be able to render the commissioned services.

In case the IT service provider as data processor is a company located outside the European Union (EU), the data are still stored within the European Union (EU). Your personal data however may be transferred to countries outside the European Union (EU) or the European Economic Area (EEA) that offer an adequate level of data protection, as determined by adequacy decisions of the European Commission (https://commission.europa.eu/law/law-topic/data-protection/international-dimension-data-protection/adequacy-decisions_en).

The transfer of your personal data to countries that are not members of the EU/EEA and do not guarantee an adequate level of protection will only take place if the controller and the recipients of the data have concluded the European Commission's standard contractual clauses (SCCs) as adequate safeguards for the protection of your personal data and have implemented supplementary security measures.

Moreover, other third parties, who are selectively involved with the Program, may have an interest in observing your pitch, implementing project work, and entering into a separate contract with you after the completion of the Program. Therefore, the application data that we have collected from you may be sent to third parties to the extent stated below on the legal basis stated below:

The data are processed for aforementioned purposes on the basis of the Group companies’ overriding legitimate interests within the meaning of Art. 6(1)(f) GDPR in the evaluation and selection of your application for possible contact and a potential contractual relationship after the completion of the Program. These interests override your interest in data secrecy because you have already stated your willingness to participate in a program open to the public, for which you have applied.

Further your data is sent to and processed by VERBUND Ventures GmbH, a 100% affiliated company of VERBUND AG, for the purpose of evaluating a possible investment after the completion of the Program and getting in contact with you for that purpose. We justify the processing of your personal data for the above mentioned purpose on the basis of the Group companies’ overriding legitimate interests within the meaning of Art. 6(1) (f) GDPR.

VERBUND’s cooperation partners:

In addition, various cooperation partners of VERBUND receive your data in connection with the Program in regard to different use cases. These cooperation partners can be identified on the Program-website www.verbundx.com. They process your data in the selection process and the team-building processes as well as for preparatory meetings, project work and scouting, so that they can better evaluate potential subsequent cooperation with you in their own interests and contact you. They therefore act in a forward-looking manner within the context of implementing the Program, taking their own interests into account. The basis for this is their overriding legitimate interests within the meaning of Art. 6(1) (f) GDPR. These interests override your interest in data secrecy because you have already stated your willingness to participate in a program open to the public, for which you have applied.

2.2. Recorded images/videos

a) Data source and data categories

In the course of implementing the Program, we may record images/videos of you and publish them in print or electronic form on our websites, other relevant websites in regard to start–up programs and on social-media channels, such as Twitter, Facebook, LinkedIn etc.

b) Legal basis and purposes of data processing

The data is processed for the purpose of documenting and presenting the Program as well as your innovative ideas, pitches and other contributions to the Program. This is to make the Program – and your company – known.

The data processing activities are primarily based on our legitimate interest within the meaning of Art. 6(1) (f) GDPR in continuing a sustainable business. This interest overrides any interest you may have in data secrecy. Processing activities are not only expected but rather desirable and common in start-up programs. If, in an individual case, data processing cannot be justified by our legitimate interests, we will obtain your consent within the meaning of Art. 6(1) (a) GDPR.

c) Recipients

In the course of recording images/videos of you, processors and other third parties may receive access to your data and process the data for their own purposes. We also send your images/videos to the third parties identified in Subsection 2.1 c), which may also publish your data on their websites and social-media channels. They do this to support and advertise your company and strengthen the potential future cooperative relationship with you. Therefore, these data processing activities are also based on legitimate interests within the meaning of Art. 6(1) (f) GDPR. If, in an individual case, data processing cannot be justified by their legitimate interests, these third parties will obtain your consent within the meaning of Art. 6(1) (a) GDPR.

3. Storage period

Your data will be processed for the purposes of executing and implementing the Program and then for a period of seven years based on corporate law and tax law retention periods.

If specific claims are threatened, we will process your personal data for an additional 3 to 30 years in individual cases. In case of the platform data are stored to the extent this is required to investigate identified attacks and beyond that only until the end of the relevant limitation periods, statutory retention periods or any legal disputes. We process recorded images/videos as long as we have a legitimate interest in doing so. That is generally for the duration of the Program and as long thereafter as the images/videos are connected with the Program or profit from the benefits of VERBUND, and we have an interest in advertising with older contributions to animate future applications. We take the principles of data minimisation and purpose limitation into account in all such cases.

Our Group companies and cooperation partners, which receive your personal data for their own purposes, may also process this data for the aforementioned periods.

1. Name and Contact Information for the Controller and the Data Protection Officer

The controller for processing your data for the VERBUND X Venture’s purposes is VERBUND Ventures GmbH, Am Hof 6a, 1010 Vienna.

You can contact our Data Protection Officer at: datenschutz@verbund.com.

2. Processing in the context of “interest in an investment”

2.1. Data source and Data categories

We process the personal data you provide on the application form (“platform”) regarding an interest in an investment by VERBUND X Ventures, such as company name, country, e-mail address, contact name, website URL, information about your company, amount of your next fundraising round, further any additional information you voluntarily provide and logfiles (e.g. IP address, time of login).

2.2. Legal basis and purpose of data processing

We process the personal data for the purpose of evaluating a possible investment in you and getting in contact with you for that purpose.

The legal basis for processing your data for the above mentioned purpose is Art. 6(1) (b) GDPR (Taking steps prior to entering into a contract or performing a contract).

Concerning the use of the platform we justify the processing on the basis of our legitimate interest in accordance Art. 6(1) (f) GDPR for the purposes of making the platform and its functions available to you and to be able to identify, prevent and investigate attacks on the platform.

The provision of data by you is voluntary; however, if you do not provide these data, VERBUND will not be able to process your application accordingly.

2.3. Recipients

In order to process the personal data, we use service providers (e.g. IT service providers) which, in accordance with our orders and instructions, may under certain circumstances also have access to personal data in order to be able to render the commissioned services.

Moreover your data may be forwarded to specialist departments, divisions or companies within the VERBUND group and transmit the personal data necessary for this purpose for fulfilment of (pre)contractual obligations, or where justified for the maintenance of our legitimate interests.

2.4. Storage period

Your data will be processed for the fulfilment of the purposes mentioned above and then for a period of seven years based on corporate law and tax law retention periods. If specific claims are threatened, we will process your personal data for an additional 3 to 30 years in individual cases. In case of the platform data are stored to the extent this is required to investigate identified attacks and beyond that only until the end of the relevant limitation periods, statutory retention periods or any legal disputes.

2.5 Transfer of data to countries outside the EU/EEA

In case the IT service provider as data processor is a company located outside the European Union (EU), the data are still stored within the European Union (EU). Your personal data however still may be transferred to countries outside the European Union (EU) or the European Economic Area (EEA) that offer an adequate level of data protection, as determined by adequacy decisions of the European Commission (https://commission.europa.eu/law/law-topic/data-protection/international-dimension-data-protection/adequacy-decisions_en).

The transfer of your personal data to countries that are not members of the EU/EEA and do not guarantee an adequate level of protection will only take place if the controller and the recipients of the data have concluded the European Commission's standard contractual clauses (SCCs) as adequate safeguards for the protection of your personal data and have implemented supplementary security measures.

1. Name and Contact Information of the Data Controller and the Data Protection Officer

Responsible for the processing of your data in the context of "Newsletter/information by email" is VERBUND AG, Am Hof 6a, 1010 Vienna or VERBUND Ventures GmbH, Am Hof, 6a, 1010 Vienna ("VERBUND", "we", "us").

You can contact our Data Protection Officer at: datenschutz@verbund.com.

2. Processing in the context of “Newsletter/information by email”

2.1. Data source and Data categories

If you subscribe to a newsletter of VERBUND or request information from VERBUND by email, we will process, in particular, the following data: information about your person such as title, name, email address, as well as information about your company and position. The provision of these data by you is voluntary. However, if you do not provide the data, it will not be possible to send any newsletters or information to you by email.

2.2. Legal basis and purpose of the data processing

The legal basis for the processing of data is Art. 6(1) (a) GDPR and therefore your voluntary consent to receive the newsletter or information by email. You have the right to withdraw your voluntary consent at any time without giving reason and with effect for the future by clicking on the link contained in the email or by sending an email to datenschutz@verbund.com.

Your data will be processed by VERBUND for the purpose defined in the voluntary declaration of consent, such as, for example, the purpose to send information about activities in the field of innovation, contests or events of VERBUND, and to send invitations to events organized by VERBUND.

2.3. Recipients

The data will be forwarded to third parties only where required for the fulfilment of (pre-) contractual or statutory obligations, or where permitted, within the scope of your voluntarily granted consent. For example, as required, we will transfer your personal data to the external parties, e.g. auditors, insurers or legal representatives, to the extent necessary. Personal data will be rendered anonymous if possible.

Your personal data may be sent to commissioned service providers for order processing.

2.4. Storage period

Your data will be processed for as long as you continue to receive the newsletter/information by email, and for as long as you have not revoked your voluntarily given consent for the purpose in question.

With respect to your processed data, you generally have the rights of access, rectification, erasure, restriction, data portability, withdrawal of consent and objection. To assert these rights, you may contact VERBUND AG or VERBUND Ventures GmbH directly at datenschutz@verbund.com.

If you believe that the processing of your data violates data protection law or that your rights under data protection law have been otherwise violated, you can file a complaint with the national data protection authority where you reside. In Austria, the Austrian Data Protection Authority has jurisdiction (www.dsb.gv.at).

In case of the VERBUND Accelerator Program (point D), you can also assert these rights against third parties (Group companies and cooperation partners), if they process your data for their own purposes. In this case, please utilise the third party’s contact information, which is provided on www.verbundx.com.