Privacy policy

The protection of your personal data is of particular concern to Bundestheater-Holding GmbH, Goethegase 1, 1010 Vienna. Bundestheater-Holding GmbH complies with the applicable legal provisions for the protection, lawful handling and confidentiality of personal data and for data security, in particular the Austrian Data Protection Act (DSG), the EU General Data Protection Regulation (GDPR) and the Telecommunications Act (TKG).

In the following, we would like to inform you about the type, scope and purpose of the collection and use of your personal data and about your rights.

For information on the processing of personal data through the use of our website, please refer to our cookie statement below, which should be read in conjunction with this privacy policy.

Data processing, purposes and legal bases

According to the GDPR, personal data is any information relating to an identified or identifiable natural person, such as name, email address, customer number, etc. 
Bundestheater-Holding GmbH processes the personal data of employees, partners, representatives of authorities, interested parties, customers, suppliers and service providers for the purpose of performing its business activities and fulfilling the associated legal and contractual requirements:

• Communication with representatives of authorities, interested parties, business partners in the context of services, cooperations and projects, e.g. processing inquiries, applicant selection procedures
• Initiating, processing and managing (contractual) business relationships and maintaining business relationships, e.g. to process services or payments
• Conducting customer surveys and market analyses
• Maintaining and protecting the security of services and websites, preventing and detecting security risks, fraudulent activities or other criminal or malicious acts
• Compliance with legal requirements (e.g. obligations based on the Federal Theatres Organization Act or retention obligations under tax, company and corporate law) and guidelines of the Bundestheater Group
• Settlement of legal disputes, enforcement of existing contracts and assertion, exercise and defense of legal claims
• Communication with the representatives of the Group companies and the members of the Group bodies (e.g. managing directors, supervisory board members) as well as coordination within the scope of the statutory holding function (e.g. organization of supervisory board and shareholders' meetings, documentation including taking minutes)
• Together with the stage companies of the Bundestheater Group (Vienna State Opera, Burgtheater and Volksoper Wien GmbH), Bundestheater-Holding GmbH processes customer data in a joint database. This serves, among other things, to process cross-stage offers (e.g. mixed cycles) between the stage companies and to ensure that data can be kept correct, up-to-date and standardized in order to offer appropriate convenience when purchasing tickets. Together with Wiener Staatsoper GmbH, Burgtheater GmbH and Volksoper Wien GmbH, Bundestheater-Holding GmbH is therefore the joint controller within the meaning of Art. 26 GDPR and is equally responsible for compliance with the legal provisions, in particular for the lawfulness of data processing. Customers can address questions about data processing in connection with ticket purchases to any of the joint controllers. In addition to this joint responsibility, Bundestheater-Holding GmbH also has access to the payment and sales data for internal administrative purposes (e.g. for the control of internal group requirements).

The following categories of personal data may be processed to achieve the aforementioned purposes:

• professional contact information, such as name, contact address, telephone number or e-mail address
• Payment data, such as information required for processing payment transactions or fraud prevention
• information collected from publicly available sources and information databases, such as the Austrian Business Register (ANKÖ)
• other personal data whose processing is necessary for the initiation, processing and administration of (contractual) business relationships as well as for the maintenance of business relationships or which you provide voluntarily, such as orders placed, order details, inquiries made or project details, correspondence, other data on cooperation

The legal basis for data processing is:

• Art. 6 para. 1 lit. a GDPR: The data subject has given their consent to the processing of their personal data for one or more specific purposes.
• or Art. 6 para. 1 lit. b GDPR: Processing is necessary for the performance of a contract to which the data subject is party or in order to take steps at the request of the data subject prior to entering into a contract.
• Art. 6 para. 1 lit. f GDPR: Processing is necessary for the purposes of the legitimate interests pursued by the controller or by a third party, except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject which require protection of personal data, in particular where the data subject is a child.

Contact us

If you contact us by e-mail, fax, telephone or other means of communication, your personal data and information that you provide to us when contacting us will be used exclusively to process your request or any resulting pre-contractual measures. You are free to decide whether you wish to provide us with this data. Corresponding information regarding data protection is provided directly on the respective website/application - e.g. in the “Careers” section.

Data transfer

Your personal data will not be passed on to third parties unless we are legally obliged to do so or the data transfer is necessary to fulfill our obligations. To carry out certain tasks, we use selected service providers who work for us as processors and may be granted access to your data to the extent necessary. This applies, for example, to software solutions, services as part of an IT support contract or services in the area of payroll accounting and financial accounting. All our processors only process your data on our behalf and on the basis of our instructions for the purposes described above. Furthermore, we ensure through contractual obligations that our processors comply with the legal regulations on data protection in the same way as we do.

Data security

In addition to compliance with the principles of data protection and the obligation of our employees to maintain data secrecy, we take appropriate technical and organizational measures to ensure the security of data processing, i.e. the confidentiality, integrity, availability, resilience and rapid recoverability of the systems and services used, on a permanent basis.

Retention period

We store your data in accordance with the legal provisions. As a rule, this is the duration of the customer relationship. A longer retention period may result in particular from legal retention obligations or for the assertion of legal claims. We retain data that we process with your consent until you withdraw your consent.

Matomo

As part of our Internet service, through which we want to further improve the online presence of the Bundestheater-Holding Wien and adapt it to the needs of users, we analyze access to our website using Matomo. No cookies are set for this analysis, Matomo only analyzes the log files of our website.
We have configured the web server so that your IP address is only recorded in abbreviated form. We therefore do not process any personal usage data. It is not possible for us to draw any conclusions about your person. You can find further information on Matomo's terms of use and data protection regulations at: https://matomo.org/privacy-policy/

Your rights

Right to information
You have the right to information about the personal data we process about you.

Right to rectification
You have the right to rectification of your personal data that is out of date, incomplete or inaccurate.

Right to erasure (“right to be forgotten”)
You have the right to erasure of your personal data, unless there are legal or legitimate reasons (such as retention obligations under tax or commercial law or the assertion, exercise or defense of legal claims) to retain it.

Right to restriction of data processing
You have the right to request the restriction of the processing of your personal data if one of the conditions listed in Art. 18 GDPR is met.

Right to data portability
You have the right to receive the personal data you have provided to us in a structured, commonly used and machine-readable format.

Right to object
If we process your personal data on the basis of a legitimate interest, you have the right to object to this processing at any time on grounds relating to your particular situation. However, compelling legitimate grounds of Bundestheater-Holding GmbH may prevail, which may allow us to continue processing your personal data. In addition, you have the right to object to the processing of your data at any time if the processing is for the purpose of direct marketing.

Right to withdraw consent
You have the right to withdraw your consent to the processing of personal data with effect for the future if the processing is based on your consent.

Questions and complaints
f you have any questions regarding your personal data, please contact us at datenschutz@bundestheater.at. You can reach the Data Protection Officer of the Austrian Federal Theaters, Silvia Schauer, MSc MBA, at this e-mail address or by post at Data Protection Officer of the Austrian Federal Theaters, Goethegasse 1, 1010 Vienna. You also have the option of lodging a complaint with a data protection supervisory authority. The data protection supervisory authority responsible for us is the Austrian Data Protection Authority. Datenschutzbehörde.

Whistleblower system

Data processing within the framework of the whistleblower system serves the purpose of implementing the Whistleblower Protection Act (HSchG), which came into force on February 25, 2023, in the Austrian Federal Theatres and thus fulfilling the legal obligation. The purpose of the law is to uncover misconduct within the meaning of the HSchG and thus ensure compliance with the law.

Legal basis: Art. 6 para. 1 lit c GDPR (fulfillment of a legal obligation)

Type of data processed:

• Contact details of the whistleblower (optional)
• Notification of the whistleblower
• Personal data contained in the report (e.g. in continuous text or in documents)
• The provision or processing of this data is required by law.
  

The data will be forwarded to the following recipients:

• Sage GmbH (data processor)
• Jank Weiler Operenyi Rechtsanwälte GmbH
  

Rights of data subjects in the whistleblower system: Please note that the exercise of some of the rights of data subjects under the GDPR could hinder the effectiveness of the Whistleblower Protection Act, in particular the submission of reports, the setting of follow-up measures and the guarantee of anonymity of a whistleblower. Against this background, the Austrian legislator has taken measures to restrict the exercise of certain data protection rights of data subjects.

You can access the whistleblower systm here

Final provisions

Please note that Bundestheater-Holding GmbH will continue to adapt this privacy policy (e.g. due to changes in legal regulations, the use of new technologies or the expansion of our offers and services). We therefore recommend that you consult this privacy policy regularly.

Stand: August 2023