General Data Protection Notice for event participants

In the course of attending events hosted by voestalpine group-IT GmbH, voestalpine-Straße 3, A-4020 Linz (“voestalpine”), it is necessary for us to process your personal data. “Personal data” is any information that relates to an identified or identifiable natural person (e.g. names and addresses).

Please find enclosed a summary of the processing of personal data of participants at events hosted by voestalpine:

1. Categories of personal data processed, purpose of the processing and legal basis

For the purpose of organizing and working on internal and external events, voestalpine processes the following categories of personal data of participants in particular:

• The personal data you disclosed when registering for an event, especially your name, professional and private contact information, employer, voluntarily disclosed allergies/intolerances;
• Information collected from publicly available sources (e.g. public websites);
• Filming and photography: During events, filming and photography regularly takes place to document the event. These films and photos can be published in reports about the event in the media and in voestalpine publications;
• Other personal data that is provided in the course of participating in an event or that results from participating in an event (e.g. dates and times you attended the event), including all text documents (e.g. correspondence) that are automatically stored and archived.

The legal basis for data processing is Article 6 (1) (a) (your consent) or Article 6 (1) (f) (legitimate interests pursued by the controller: organizing and working on internal and external events) of the General Data Protection Regulation (GDPR). Special categories of personal data (e.g. allergies, etc.) are processed exclusively on the basis of your consent.

The processing of personal data is necessary to meet the aforementioned purposes. If aforementioned personal data is not provided or is insufficient or if voestalpine cannot collect the respective personal data participation may not be possible.

2. Transfer of personal data

Without your consent, we will not transfer your personal data to third parties unless it is required to perform our duties or is required by law/authorities.

voestalpine engages processors (service providers) to process personal data (e.g. event agencies). These processors are contractually bound to comply with the applicable data protection regulations.

Recipients of personal data may be located in countries outside of the European Union (“third countries”), in which applicable laws do not offer the same level of data protection as the laws of the respective individual’s home country. In this case, according to the legal requirements personal data is only transferred if the European Commission has adopted an adequacy decision for the third country, if adequate safeguards have been agreed (e.g. EU Standard Contractual Clauses were concluded), the recipient participates in an approved certification system (e.g. EU-US Privacy Shield), binding corporate rules are implemented in accordance with Art. 47 of the General Data Protection Regulation or there is a derogation for specific situations in accordance with Art. 49 of the General Data Protection Regulation. Further information and a copy of the implemented measures can be obtained from the contact listed under 5.

3. Retention periods

If no storage period was expressly stated at the time of the collection of your personal data (e.g. in a declaration of consent) your personal data will be erased or anonymized if the retention of the personal data is no longer necessary to fulfill the purposes for which they were collected and if no statutory retention obligations (such as tax or commercial law) or establishment, exercise or defence of legal claims require us to further retain the data.

4. Right of access to and rectification or erasure of personal data, restriction of processing, Right to object to processing, right to data portability and right to withdraw explicitly granted consent

• In accordance with Art. 15 GDPR, you have the right to obtain from the controller confirmation as to whether or not personal data concerning you are being processed and access to information about this data.
• In accordance with Art. 16 GDPR, you have the right to obtain without undue delay the rectification of inaccurate personal data and to have incomplete personal data completed.
• In accordance with Art. 17 GDPR, you have the right to erasure of your personal data.
• In accordance with Art. 18 GDPR, you have the right to restrict processing
• In accordance with Art. 20 GDPR, you have the right to data portability.
• In accordance with Art. 21 GDPR, you have the right to object to the processing of personal data.
• Finally, you are entitled to file a complaint with the supervisory authority.
• If processing of your personal data is based on your consent, you have the right to withdraw your consent at any time. The withdrawal of consent shall not affect the lawfulness of processing based on consent before its withdrawal.

5. Contact

For any questions related to data protection and asserting the rights as listed, please contact the data protection organization of voestalpine group-IT GmbH at Sabrina.Schmidbauer@voestalpine.com or voestalpine group-IT GmbH, Department Supply & Care (SC), voestalpine-Straße 3, A-4020 Linz. This General Data Protection Notice for event participants will be revised from time to time. The date of the last revision is in the footer.