Data protection

The protection of your data is of great importance to us. In order to fully inform you about the use of personal data, we ask you to take note of the following data protection information.

1. Legal basis (EU General Data Protection Regulation and Austrian Data Protection Act 2018).

The EU General Data Protection Regulation protects the fundamental rights and freedoms of natural persons, in particular their right to the protection of personal data. Personal data is any information relating to an identified or identifiable natural person. In this privacy statement, we inform you about the most important aspects of data processing in the context of our activities, namely:

• Client and supplier administration,
• Public relations and marketing for its own purposes,
• Image processing at events,
• functionalities of our website, and
• our newsletter.

2. Website operator and responsible body for data processing

Two Next GmbH Am Belvedere 1, 1100 Wien 1100 Wien, Österreich Phone: +43 664 8574848 Email: hello@two-next.com No data protection officer has been appointed, as the appointment is not provided for by law. By using our website, you agree that we may collect certain data. In return, we undertake to protect your data in accordance with the current state of technology.

3. Purposes of the processing operations:

We perform the following processing operations on your behalf. as a project partner, client, cooperation partner as a person involved with our project partners, clients and cooperation partners, as natural persons (contact persons) of project partners, clients and cooperation partners, as suppliers and contractors, as marketing contact, newsletter subscriber or website visitor are essential, namely:

• Administration of material and non-material funding
• Project management and execution
• Issuing publications
• Vendor and client management (to handle our sales/purchasing as well as our back office).
• Contact forms on our website (to answer questions)
• Contact database (from public sources or business cards)
• Public relations (to present the activities of Two Next GmbH)
• Marketing (for informing customers, interested parties as well as customer acquisition)
• Information on events via electronic mail to existing contacts
• Newsletter (to support and inform existing contacts)
• Website tracking & cookies & social media sharing (to improve our web presence, to make our content accessible on social media channels, to ensure IT security)

4. Categories of recipients

In the course of processing operations, we transfer data to the following categories of recipients, where the recipients are acting on our behalf or the transfer is necessary to fulfill contractual or legal obligations; for special processing operations, we list the special recipients here:

• 
Contractors in the context of IT and communication services (software support, maintenance of our network, server and clients, e-mail service providers and telephone service providers)
• Website (public)

It is not intended to transfer the data to international organizations and recipients in third countries. If a transfer to recipients in third countries should be necessary, this will take place on the basis of sufficient guarantees, e.g. standard data protection clauses or within the framework of an adequacy decision.

5. Purposes of use, storage period, provision of data

a. Purpose of use We receive the data from you as an interested party or contact or client or supplier. You approach us to initiate a contract (e.g. via the Internet, by e-mail, via other clients) or we conclude contracts with you via various channels. The personal data we process is necessary for the fulfillment of the contract and is also processed for the fulfillment of legal obligations (e.g. tax retention obligations or warranty and compensation obligations). If you are a contact person of our contractual partner who is not a natural person, then it is our legitimate interest to process your personal data for smooth communication and documentation. b. Storage period We store the data during the entire contractual relationship and beyond that for a period of 7 years after the termination of the same in order to be able to fulfill tax retention obligations, as well as 30 years after the termination of the same in order to have the necessary documentation in case of warranty claims and claims for damages, since claims are subject to the 30-year limitation period of the ABGB. If official proceedings are in progress, we store the data for the duration of the proceedings. c. Obligation to provide data You are not obligated to provide us with data; however, if you do not provide the data, then we cannot provide the service.

6. Use of image data (events, workshops,…)

Pictures will be taken at various events, in particular at any workshops, press conferences and other events organized by us. This is also applicable to persons that give lectures or appear who work on our premises or for us or with our support. Invitations and events will indicate in advance that photographs will be taken. Unless the media privilege (§ 9 DSG) is applicable, the photographer will be instructed to obtain consent for small groups that will be photographed. If larger groups are photographed at the events, the pictures serve to make our organization better known and to promote the image of our organization and we publish these pictures on the Internet and in printed information about our organizations (legitimate interest). If you are being photographed in a small group, then the photographer will ask if consent is given to the processing before taking the picture, and you will have the opportunity to step aside and not be in the picture. Unless the media privilege (§ 9 DSG) is applicable, you have the right to revoke the consent at any time with effect for the future (see also point 14). In the event of revocation, the recordings will be removed if technically possible and an attempt will be made to have them removed from any other media. Print brochures will not be destroyed after a revocation. Upon receipt of the revocation, the data will then no longer be processed for the purpose. If costs are incurred as a result of the revocation and any prohibition of further use (changes to the website, destruction of printed information) and there is no legitimate interest in revocation, the costs of the changes shall be borne by the data subject. There is a right to object (see point 14) within the framework of the legal provisions, provided that the processing is based on the legitimate interest. Since you have entered a public space at these events for an event that our organization has an interest in marketing, this expectation must also be included in the consideration when objecting. The data, if published on our own website, will be deleted after 3 years or if consent is revoked. If this data is published on social networks, then this data will only be deleted if consent is revoked.

7. Supplier and client management (for the processing of our purchasing as well as our back office).

We receive the data from you in the context of the relationship as a supplier and/or contractor of our company. This data is necessary for the fulfillment of the contract and is also processed for the fulfillment of legal obligations (e.g. tax retention obligations or warranty and compensation obligations). If you are a contact person of our contractual partner who is not a natural person, then it is our legitimate interest to process your personal data for smooth communication and documentation. We store the data during the entire business relationship and beyond that for a period of 7 years after the termination of the same, in particular in order to be able to fulfill tax retention obligations as well as for as long as warranty and compensation claims (max. 30 years in the case of services for immovable property) make it necessary for the data to be processed, whereby these are then processed in an archive. You are not obliged to provide us with data; however, if you do not provide the data, then we cannot provide the service.

8. Marketing and public relations (to inform customers, interested parties as well as customer acquisition).

We conduct marketing and public relations to inform you and the public about our services and projects, and to provide you with general information. This is based on the legitimate interest that we present our services and inform you about them (when sending by mail) and consent (when sending information by e-mail). You have the right to object or revoke your consent (see point 14) at any time within the framework of the legal provisions. We store the data for a period of 3 years after the last contact. You are not obliged to provide the data. If you do not provide the data, then we cannot send you any information.

9. Contact database (from public sources or business cards).

We process personal data on persons with whom we or our employees have been in personal contact (e.g. at events, trade fairs, invitations, etc…), namely when business cards are handed over,

• for the purpose of establishing contact in specific projects as well as
• to build up a contact database as well as
• for customer acquisition (legitimate interest).

We supplement the data obtained from the business cards with data obtained from public sources (e.g. company register, company website). There is a right of objection (see point 14) within the framework of the legal provisions. The data will be deleted – unless a contractual relationship arises – 3 years after the last contact.

10. Contact forms on the website (to answer questions or otherwise contact our team members).

You can send us inquiries about our services or general inquiries through the contact forms on the website; this data will then be used to document and respond to your inquiry (legitimate interest). If you are a contact person of our cooperation partner who is not a natural person, then it is our legitimate interest to process your personal data for smooth communication and documentation. You have the right to object within the framework of the legal provisions (see point 14). We store the data for a period of 12 months, unless a longer storage is required for legal reasons. You are not obliged to provide the data specified in the contact form. If you do not provide the data, then we cannot process the request.

11. Information by electronic mail to existing contacts.

Within the framework of existing relationships, we take the liberty of providing information about events by electronic mail (including SMS) in application of § 107 (3) of the Telecommunications Act – whereby a separate reference to the possibility of refusal is made when the data is collected. You have the possibility at any time to refuse the use of the data collected within the framework of the customer relationship for this purpose (both at the time of collection and at each use). In this case, the processing of their data is based on the legitimate interest, namely customer service and customer acquisition, and they have the right to object to this processing within the framework of the legal provisions (see point 14). We store the data for a period of 3 years after the last contact. You are not obliged to provide the data. If you do not provide the data, then we cannot send you any information.

12. Newsletter (for customer acquisition and information of existing customers).

You have the possibility, among other things, to register for a newsletter via the website. Which personal data is transmitted to the controller when you subscribe to the newsletter results from the input mask used for this purpose. We then process this data for the purpose of customer information (public relations and presentation of Two Next GmbH’s activities) and customer acquisition. In principle, our newsletter can only be received by the data subject if a) the data subject has a valid e-mail address and b) the data subject registers to receive the newsletter. For legal reasons, a confirmation e-mail will be sent to the e-mail address entered by a data subject for the first time for newsletter dispatch using the double opt-in procedure. This confirmation e-mail serves to verify whether the owner of the e-mail address as the data subject has authorized the receipt of the newsletter. You have the possibility to revoke the consent (legal basis for the processing) at any time within the framework of the legal provisions (see point 14). We store the data for a period of 3 years after the last contact. You are not obliged to provide the data. If you do not provide the data, then we cannot send you any information. For the purpose of revoking consent, there is a corresponding link in each newsletter. Furthermore, it is also possible to unsubscribe from the newsletter mailing at any time directly on the website of the controller or to inform the controller of this in another way. For the newsletter dispatch, functions of the MailChimp service are implemented. These functions are provided by The Rocket Science Group LLC, 675 Ponce de Leon Ave NE, Suite 5000, Atlanta, Georgia 30308. Adequate data protection is achieved through the so-called “Privacy Shield”. The privacy policy published by MailChimp, which can be accessed at https://mailchimp.com/legal/privacy/ , provides information about the collection, processing and use of personal data. Further information about MailChimp can be found at https://mailchimp.com/legal/.

13. Website tracking

Cookies are used on our two-next.com website to make our website more user-friendly and to deliver tailored content to you as a user of our website legitimate interest). None of the cookies used on our website collect information that can personally identify you. Cookies are necessary for the use of two-next.com. Cookies are small text files that enable user recognition and analysis of your use of our website. When you visit our websites, we only set cookies that are absolutely necessary to operate our erstestiftung.org website or to provide a service that you have expressly requested. Furthermore, optionally selected settings of a previous visit to the website (e.g. language, interest, etc.) are stored by means of cookies. Otherwise, we collect and store data in personal form by setting cookies only after your express consent. Data processing is based on the user’s consent (through the setting of the web browser and query at the first call), which can be revoked at any time within the framework of the legal provisions (see point 14) and legitimate interest (improvement of the offer and the website), whereby there is a right of objection within the framework of the legal provisions (see point 14). We store the data for a period of 6 (12) months.

How do we use cookies?

As most of the online services, our website uses cookies first-party and third-party cookies for a number of purposes. The first-party cookies are mostly necessary for the website to function the right way, and they do not collect any of your personally identifiable data. The third-party cookies used on our websites are used mainly for understanding how the website performs, how you interact with our website, keeping our services secure, providing advertisements that are relevant to you, and all in all providing you with a better and improved user experience and help speed up your future interactions with our website.

What types of cookies do we use?

Essential: Some cookies are essential for you to be able to experience the full functionality of our site. They allow us to maintain user sessions and prevent any security threats. They do not collect or store any personal information. Statistics: These cookies store information like the number of visitors to the website, the number of unique visitors, which pages of the website have been visited, the source of the visit etc. These data help us understand and analyze how well the website performs and where it needs improvement. Functional: These are the cookies that help certain non-essential functionalities on our website. These functionalities include embedding content like videos or sharing contents on the website on social media platforms. Preferences: These cookies help us store your settings and browsing preferences like language preferences so that you have a better and efficient experience on future visits to the website.

a. Collection of anonymous data and information

Every time a user accesses our website, i.e. every time a file on this server is retrieved or attempted to be retrieved, data about this process is stored in a log file (log file). This data is not personal; we can therefore not trace which user has retrieved which data. We also do not attempt to collect this information. In detail, the following data record is stored about each retrieval:

• Name of the retrieved file
• date and time of the retrieval
• amount of data transferred
• Message as to whether the retrieval was successful
• message, why a retrieval failed, if applicable
• the name of your Internet service provider that you used to access our website
• if applicable, operating system and browser software of your computer as well as
•  the website from which you are visiting us.

All of the above-mentioned data is only evaluated for statistical purposes by us and by processors commissioned by us. We use this data to make our website even better for you. To avoid the setting of cookies in general, you must set your browser so that they are only created or rejected with your consent. The procedures for managing and deleting cookies vary depending on which browser you use. To find out how to do this in a particular browser, you can use its built-in help function or, alternatively, visit http://www.aboutcookies.org , which explains step-by-step how to manage and delete cookies in most popular browsers. The following websites provide detailed explanations of the various choices available to you, as well as how to opt out of or object to usage-based online advertising directly and how to opt out of the automatic setting of cookies: http://www.aboutads.info/choices  and http://www.youronlinechoices.eu/ . By giving your explicit consent, you agree to the use of the following cookies & plugins:

b. To include paragraph about MATOMO

c. Google Maps

This website uses the online map service Google Maps of Google Inc, 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA (“Google”) for the display of map information. When using Google Maps, Google also collects, processes and uses data about the use of the Maps functions by visitors to the websites. For more information on data processing by Google, please refer to Google’s privacy policy at https://policies.google.com/privacy/ . There you can also change your settings in the privacy center so that you can manage and protect your data.

d) Social Media

We are using social Media platforms. If you are visiting one of our profiles or share content via a sharing button, you may be tracked by one of these services:

• Facebook
• LinkedIn

e) Involve.me

Processing of personal data We use involve.me as our platform for interactive content and forms. By submitting you acknowledge that the information you provide will be transferred to involve.me for processing in accordance with their Privacy Policy and Terms.

14. Rights as a data subject

a. We do not profile data subjects or other individuals and do not engage in profiling and there is no automated decision making as part of our operations. b. As a data subject, you are generally entitled to the right to information, correction, deletion, restriction and data portability, in each case within the framework of the statutory provisions. However, we would like to point out that these rights may be restricted if the provision of information would jeopardize a business or trade secret of the data controller or a third party (Section 4 (6) of the Data Protection Act). c. If you have given us consent to process your data, you have the right to revoke this consent at any time. This does not affect the lawfulness of the processing of the data until the revocation. After revocation, the data will no longer be used for the purpose to which you have consented (e.g. sending an email newsletter). d. If the processing of the data is based on a legitimate interest, you have the right to object to it. If you object to the processing for direct marketing purposes, the personal data will no longer be processed for these purposes. If data is processed by us for other purposes based on the legitimate interest, then we will no longer process the personal data unless we have compelling legitimate grounds for the processing which override your interests, rights and freedoms, or the processing is for the purpose of asserting, exercising or defending legal claims. e. To exercise your rights, please contact us, whereby you are welcome to do so by email to hello@two-next.com, by phone: +43 664 8574848 or also by mail to the address: Am Belvedere 1, 1100 Wien. It would be desirable if you could provide us with the necessary information to clearly identify you when making a request. f. If you believe that the processing of your personal data violates data protection law or that your data protection rights have otherwise been violated in any way, you are free to lodge a complaint with the Austrian Data Protection Authority. You can find the website of the data protection authority at www.dsb.gv.at.