Data Protection & Privacy Policy

• § 1 Information about the ascertainment of personal data
• § 2 Person responsible according to Article 4, line 7 of the GDPR and contact details of the Data Protection Commissioner
• § 3 Ascertainment of personal data when visiting our homepage
• § 4 Ascertainment of personal data on making contact
• § 5 Newsletter
• § 6 Online presence in social networks and on platforms
• § 7 Integration of third-party services and content
• § 8 Cookies
• § 9 Learning platform (moodle)
• § 10 University library
• § 11 Picture, sound and video recordings
• § 12 Ticket management & event planning
• § 13 Social media marketing management tool
• § 14 Video surveillance
• § 15 Implementation of Whistleblower Protection Act
• § 16 Relationship Management
• § 17 Video Conferencing/Distance Learning
• § 18 Rights of persons concerned
• § 19 Accessing the statement on data protection
• § 20 Miscellaneous

§ 1 Information about the ascertainment of personal data

We inform you below about the ascertainment of personal data when using the homepage of the Universität Mozarteum Salzburg. Personal data are all data that clearly identify a natural person or make an inference, e.g. name, address, email address, usage behaviour.

§ 2 Person responsible according to Article 4, line 7 of the GDPR and contact details of the Data Protection Commissioner

According to Article 4, line 7 of the relevant EU regulation on data protection (EU-GDPR) the responsible institution is the

Universität Mozarteum Salzburg
Mirabellplatz 1
5020 Salzburg, Austria

Tel.: +43 676 88122 188
Email: info@moz.ac.at
(Please see the information provided about the site of the Universität Mozarteum Salzburg’s homepage) represented by the Chancellor’s office of the Universität Mozarteum Salzburg.

Contact details of the Data Protection Commissioner:

Univ.-Ass. Dr. Johannes Warter
Paris-Lodron Universität Salzburg
Fachbereich Arbeits- und Wirtschaftsrecht
Churfürststraße 1
5020 Salzburg, Austria
E-Mail: datenschutz@moz.ac.at

§ 3 Ascertainment of personal data when visiting our homepage

If you use our homepage merely to gain information, i.e. if you do not register or transfer information to us elsewhere, we ascertain only the personal data which your browser transfers to our server. If you want to see our homepage, on the basis of Article 6, para.1, section 1, f, of the GDPR, we ascertain the following data which are technically necessary for us so that we can show you our homepage and guarantee stability and security:

• IP-Address
• Date and time of the request
• Time zone difference to Greenwich Mean Time (GMT)
• Content of the request (specific page)
• Access status (http-status code)
• The relevant amount of data transferred
• Homepage from which the request comes
• Browser
• Operational system and its surface
• Language and version of the browser software

The above-mentioned data will be deleted when it is no longer necessary to achieve the purpose of data collection, whereby this will take place after 30 days at the latest.

§ 4 Ascertainment of personal data on making contact

(1) When you make contact with the Universität Mozarteum Salzburg via email or via a contact form, the data you provide us with (in particular your email address, your name and possibly your telephone number) are stored by us so that we can answer your questions. If you make contact by means of a form or email in the context of a task of the university, the legal basis lies according to the relevant matter in Article 6, para.1, c or e of the GDPR. If contact is made in the context of concluding a contract, the legal basis lies in Article 6, paragraph 1, section 1, b, of the GDPR. In other cases the processing is based during the course of making contact on your permission according to Article, 6, para. 1, a, of the GDPR.

(2) The data ascertained in this context are erased by us when storage is no longer necessary, unless legal storage obligations contravene erasure.

§ 5 Newsletter

(1) The Universität Mozarteum Salzburg offers various newsletters which inform you in particular about current performances or newsworthy items concerning the activities of the university.

(2) If you would like to receive the newsletter, we require from you a valid email address as well as information which allows us to check that you are the holder of the email address stated, or that its owner agrees to receiving the newsletter. Other personal data are not ascertained. These data are used explicitly for sending the newsletter and are not forwarded to third parties. In this respect your permission serves according to Article 6, para. 1, a, of the GDPR as the legal basis.

(3) You are free to revoke at any time your consent to the storage of the data, the e-mail address as well as its usage for mailing the newsletter. Revocation can be made via a link in the newsletters themselves or via an email sent to the contact addresses stated above.

§ 6 Online presence in social networks and on platforms

University Mozarteum Salzburg has online presences in social networks and on platforms in order to communicate with the users and interested parties represented there and to inform them about the tasks and activities of the University (Art. 6 para. 1 lit e of the GDPR in conjunction with § 3 Z 11 of the University Act – (UG)). Please note that if you decide to use the respective service by accessing it, the terms of use and privacy policy of the respective provider apply.

For information on the integration of services and third-party content on the University's website, please refer to §§ 7-8 of this privacy policy.

§ 7 Integration of third-party services and content

Social media plug-ins - online presences

(1) No social media plug-ins are used on the website of University Mozarteum Salzburg. Only image links in the footer to various social media platforms (in particular Facebook, Instagram) are used without any plug-in functionality. If the icon button of a social media platform (of a service provider) is clicked, the requested page opens in a new window and a data exchange with the respective social media service takes place. The legal basis for the transmission of your personal data in connection with accessing the respective service provider is your consent (Art. 6 para. 1 lit. a of the GDPR).

(2) University Mozarteum Salzburg has no influence on the type and scope of the transmitted/stored data and therefore assumes no liability. The data protection provisions of the respective service provider apply.

(3) Please note that if you choose to use the service providers mentioned in this paragraph, personal data collected through cookies by the service providers mentioned here may also be transferred to third countries that do not have a level of data protection adequate to European data protection law. By opting to use the link to the service provider, you also expressly consent to the transmission of your data (Art. 49 para. 1 lit. a GDPR).

Since July 2023, the European Commission has had in place an adequacy decision regarding the transfer of data to the United States ("Trans Atlantic Data Privacy Framework - TA-DPF"). The EU Commission recognises an adequate level of data protection for companies that participate in the TA-DPF. Any data transfers by these service providers to the United States are therefore based on the TA-DPF. For more information on the data protection of the social media platform used in each case, please refer to the privacy policy of the selected service. See also:

Meta Platforms Inc. (previously Facebook Inc.)
Meta Platforms Inc., 4 Grand Canal Square, Grand Canal Harbour, Dublin 2, Ireland
Privacy policy: https://de-de.facebook.com/privacy/policy/

Instagram (Meta Platforms Inc.)
Meta Platforms Inc., 4 Grand Canal Square, Grand Canal Harbour, Dublin 2, Ireland
Privacy policy: https://help.instagram.com/519522125107875

Youtube (Google LLC)
Google LLC, 1600 Amphitheatre Parkway, Mountain View, California 94103, USA: Privacy policy: https://policies.google.com/privacy/partners

Vimeo.com, Inc.
Vimeo.com Inc, 555 West 18th Street, New York, New York 10011, USA
Privacy policy: https://vimeo.com/privacy

Livestream (Vimeo.com Inc.)
Vimeo.com Inc., 555 West 18th Street, New York, New York 10011, USA
Privacy policy: https://livestream.com/terms/privacy

Video embedding

(4) University Mozarteum Salzburg has integrated its own and third-party videos into its online offering, which are stored with the respective service provider and can be played directly from our website. These are the following providers:

Youtube (Google LLC)
Google LLC, 1600 Amphitheatre Parkway, Mountain View, California 94103, USA: Privacy policy: https://policies.google.com/privacy/partners

Vimeo.com, Inc.
Vimeo.com Inc, 555 West 18th Street, New York, New York 10011, USA
Privacy policy: https://vimeo.com/privacy

Livestream (Vimeo.com Inc.)
Vimeo.com Inc., 555 West 18th Street, New York, New York 10011, USA
Privacy policy: https://livestream.com/terms/privacy

When accessing our website, no user data is transmitted to the respective service provider. Only a note about your individual cookie settings will appear. Only when you have actively decided to use all or individual video platforms through individual selection in your cookie settings will the respective video be loaded and played. The legal basis for the transmission of your personal data in connection with the playing of the videos with the respective service provider is therefore your consent (Art. 6 para. 1 lit. a of the GDPR).

By opting to use the link to the service provider, you also expressly agree that your data may also be transferred to third countries that do not have an adequate level of data protection comparable to that under European data protection law. (Art. 49 para. 1 lit. a GDPR). For more detailed information, in particular on your options for revocation, see § 8 para. 4. 

Since July 2023, the European Commission has had an adequacy decision regarding the transfer of data to the United States ("Trans Atlantic Data Privacy Framework") in place. Thus, when using service providers that are active members of the Data Privacy Framework Programme, the basis used for any transfer of data to the United States is that of this adequacy decision.

§ 8 Cookies

(1) What are cookies?
Cookies are small text files that are stored on your computer or smartphone in such a way that they can be assigned to the browser you are using. Through this process, certain information is transmitted to the entity that sets the cookie. Please refer to the following paragraphs to find out which cookies are used on the website of Mozarteum University Salzburg.

(2) Functional cookies (required cookies)
The cookies listed in this paragraph are necessary for the functionality of the website as well as the applications for various competitions or courses (in particular the International Summer Academy of University Mozarteum Salzburg, etc.). University Mozarteum Salzburg uses these cookies to provide you with the full functionality of the website (Art. 6 para. 1 lit f of the GDPR). The consent of the users is not required.

Usage on the website: When you use our website we use the following cookies:

• PHPSESSID: This cookie ensures that the user's settings are retained for all page requests on the current domain. Storage duration: Session

Usage in applications (e.g. registration tools for competitions)

• Language cookie: This cookie registers and stores the language you choose during your session for user interface customization. Storage period: 1 year.

(3) Cookies for web analysis (Matomo)
The web analysis tool Matomo (InnoCraft Ltd“, 7 Waterloo Quay PO625, 6140 Wellington, New Zealand) is used by the University Mozarteum Salzburg to optimise our website and to further develop the fulfilment of university tasks.
By opting to use Matomo, Matomo sets cookies and in particular collects data about the website from which a data subject has come to a website (so-called referrer), which subpages of the website are accessed or how often and for how long a subpage is viewed.

The legal basis for data processing lies in your consent in accordance with Art. 6 para. 1 lit a of the GDPR, which you expressly grant based on your selected cookie settings. The selection can be changed at any time, see Footer of the website "Cookie settings". Please note, however, that the legality of the data processing operations carried out up to the revocation remains unaffected by the revocation.

Matomo uses the following cookies:

• _pk_id
  This cookie is used by the web analytics platform Matomo to store some details about the user, such as the unique visitor ID. Storage duration: 13 months
• _pk_ses
  This cookie is used by the web analytics platform Matomo to store a unique session ID. Storage duration: Session
• _pc_vis/_pc_tvs/_pc_tss
  These cookies are used by the web analytics platform Matomo to store a unique session ID. Storage duration: 30 minutes

Further information and the applicable data protection provisions of Matomo can be found at https://matomo.org/matomo-cloud-privacy-policy/

(4) Third-party cookies
University Mozarteum Salzburg has integrated its own videos into its online offering, which are stored with the respective service provider (for a list, see § 7 para. 4) and can be played directly from our website. These are offers from third-party providers. The University therefore has no influence on the type and scope of the transmitted and/or stored data and therefore assumes no liability.

When accessing the website of University Mozarteum Salzburg, no personal data of the users is transmitted to the respective service provider. This is only the case if you have actively opted to use all or individual services by making your individual selection in the cookie settings (Art. 6 para. 1 lit. a of the GDPR). Changing the selection is possible at any time, see: footer of the website “Cookie settings”. Please note, however, that the legality of the data processing operations carried out until the revocation remains unaffected by the revocation.

Furthermore, you can delete already stored cookies at any time via the settings of your web browser. In addition, cookies can be generally deactivated via the respective browser settings, although in some cases this may restrict the use of the University Mozarteum Salzburg website. For more information, please refer to the browser settings of your provider.

Please note that if you decide to use the service providers mentioned under § 7 para. 4, personal data collected by these third-party providers through cookies may also be transferred to third countries that do not have an adequate level of data protection comparable to that under European data protection law. By opting to use the link to the service provider, you also expressly consent to the transmission of your data (Art. 49 para. 1 lit. a GDPR).

Since July 2023, the European Commission has had in place an adequacy decision regarding the transfer of data to the United States ("Trans Atlantic Data Privacy Framework"). Thus, when using service providers that are active members of the Data Privacy Famework Programme, the basis for any transfer of data to the United States is this adequacy decision. The data protection provisions of the respective service provider apply.

§ 9 Learning platform (moodle)

(1) The moodle platform is used by University Mozarteum Salzburg to support the teaching activities at the University through e-learning offerings (Art 6 para. 1 lit e of the GDPR in conjunction with §§ 1-3 of the University Act (UG)). The following categories of data are processed in this context:

• User profile data: login data, first name, last name, e-mail address
  Optional or depending on the input of the respective user: visible e-mail address, information on the location (city/country), information on the time zone
• when used by the respective user: exam data incl. assessment (when taking an online exam), assignment data (incl. uploaded documents)
• Log data (technically necessary):
  Log data (moodle): time, full name, user, event name and context, component, description, origin IP address; Log data (server): see § 3.

(2) The storage period is 3 years from the last activity of the user. Personal data in the context of uploaded teaching content will be stored for a maximum of 5 semesters.

(3)The disclosure of your data is mandatory for the fulfillment of the above purposes. Without disclosure, the above-mentioned service cannot be used by the users.

(4) Generally, the processing of the data listed above is carried out exclusively by employees of University Mozarteum Salzburg. If necessary, data will - depending on the respective context – also be passed on to third parties (e.g. technical support by IT companies) based on your consent (Art. 6 para. 1 lit. a of the GDPR), the fulfillment of a task that is in the public interest (Art. 6 para. 1 lit. e of the GDPR in conjunction with §§ 1-3 of the University Act (UG)), for the purpose of fulfilling a contract (Art. 6 para. 1 lit. b of the GDPR), or for legitimate interest (Art. 6 para. 1 lit. f of the GDPR).

§ 10 University library

(1) University Mozarteum Salzburg processes the following personal data in order to provide a loan authorization or access to electronic resources:
[standard contact data (title/gender, first and last name, address, telephone number, e-mail), lending data, payment and reminder data in case of exceeding the lending period, etc.]

(2) The legal basis for data processing is – depending on the facts of the case – the implementation of a pre-contractual measure or the fulfillment of a contract (Art. 6 para. 1 lit b of the GDPR), the fulfillment of a task that is in the public interest (Art. 6 para. 1 lit e of the GDPR in conjunction with §§ 1-3 of the University Act (UG)), the user regulations, and the fee regulations of University Mozarteum Salzburg.

(3) The disclosure of your data is voluntary, but it is mandatory for the fulfillment of the above purposes. Without disclosure, the above-mentioned services cannot be provided.

(4) Your personal data will be stored until two years after the last activity, while your payment-related data will be stored until 7 years after the last relevant fee transaction.

(5) Data processing is carried out by employees of the University Library Department, whereby access only takes place to the extent that is specifically required for the respective task fulfillment. Within the framework of the library management system, your data will be transferred to Österreichische Bibliothekenverbund und Service GmbH (OBVSG). Any further transfer to third parties will only take place if this is necessary for the purpose of processing the contract or is in the public interest.

§ 11 Picture, sound and video recordings

(1) The Universität Mozarteum Salzburg produces and publishes picture, sound and video recordings relevant to the individual made in the context of university performances and projects so as to document the activities of the Universität Mozarteum Salzburg and in particular of its students and teachers, and to present these to the public.

(2) The processing of picture, sound and video recordings is based, according to the relevant matter, on the approval of each person illustrated / recorded according to Article 6, para.1, a, of the GDPR, or on public interest according to Article 6, para.1, e, of the GDPR in connection with §§ 1,2,3 Z11 University Law. If the Universität Mozarteum Salzburg is not active in the fulfilment of its public and legal obligations, the processing can be founded also on the justified interest of those responsible according to Article 6, para. 1, f, of the GDPR. Moreover, according to the relevant presentation of the matter in question, the processing of pictorial, sound and video recordings can be based on a contract between the persons concerned (in particular in their role as artists) and the university (Article 6, para. 1, b, GDPR).

(3) The finished picture, sound and video material is stored by the Universität Mozarteum Salzburg only as long as is necessary for the processing purposes according to § 8, para. 1. The storage duration is thereby determined in particular according to the following criteria:

• Suitability for documenting the history of the Universität Mozarteum Salzburg; the material is worthy of being archived;
• Suitability for usage in the context of anniversaries and festive publications;
• Suitability for usage on the website and in printed matter as well as in the social media channels of the university (e.g. Facebook);
• The kind of performance at which the recording was made;
• The kind of illustration (number of persons, the surroundings shown, situation);
• The degree of intrusion into the interests of secrecy of the persons concerned; further interests of the persons concerned.

If the picture, sound and video recording is based on your consent, it will be stored until your consent is revoked.

(4) Generally, the processing of picture, sound and video recordings is carried out exclusively by employees of University Mozarteum Salzburg. If necessary, relevant data will also be passed on to third parties (e.g. print shops and agencies) for the purpose of fulfilling public relation measures (such as event announcements)

§ 12 Ticket management & event planning

(1) The systems Eventjet (of Datascroll Eventsupport GmbH, Eggerthgasse 9, 1060 Vienna) and EVIS (More Dimensions GmbH, Beatrixgasse 19a/2, 1030 Vienna) are used by the Mozarteum University Salzburg for the administration of ticket purchases (Art. 6 para. 1 lit b GDPR) and to optimise the planning of future university events. In this way, university events can be made more easily accessible to the public (Art. 6 para. 1 lit. e GDPR in conjunction with §§ 1-3, in particular 3 no. 11 UG).

(2) The following data categories are required for the creation of event tickets of the Mozarteum University Salzburg and are therefore processed by ticket purchasers using the Eventjet application:

1. Master and contact details of the ticket purchaser [in particular first and last name, e-mail address, etc.].
2. Contract and billing data of the ticket purchaser
3. Planning and control data [in particular order delivery status of an order]
4. Other evaluation data [in particular information on ticket revenue, information on the use of various discount codes, information on expenses for Eventjet]
5. Payment data [depending on the selected payment method/payment service provider, see details in the privacy policy of the respective payment service provider]:
   1. Unzer E-Com GmbH, Vangerowstraße 18, 69115 Heidelberg, Germany
      https://www.unzer.com/de/datenschutz/ and https://a.storyblok.com/f/118211/x/1277ee81d8/datenschutz-unzer-e-com-gmbh-endkunde-03_2023.pdf
   2. Ingenico GmbH, Daniel-Goldbach-Straße 17-19, 40880 Ratingen, Germany
      https://ingenico.com/de/legal/Datenschutzerkl%C3%A4rung
   3. Klarna Bank AB (publ) [formerly Sofort GmbH], Sveavägen 46, 111 34 Stockholm, Sweden
      https://cdn.klarna.com/1.0/shared/content/legal/terms/0/de_de/privacy

(3) The following data categories are required for the administration of ticket purchases and the planning of future university events of the Mozarteum University Salzburg and are therefore processed by ticket purchasers using the EVIS application, in particular:

• Master and contact details of the ticket purchaser [in particular first and last name, e-mail address, etc.].
• Order and payment data (e.g. amount, order number, etc.)
• Contract data of the ticket purchaser

(4) The personal data of ticket purchasers mentioned in para. 2 no. 1 - no. 4 and para. 3 will be stored in personal form until the assertion of claims in connection with the contract is excluded due to the statute of limitations and retention periods, in particular retention periods under commercial and tax law, have expired and there is no archival value. After this time, the personal data of ticket purchasers will be verifiably deleted.

The personal data referred to in paragraph 2(5) will be stored by the payment service provider selected by you. For more information, please refer to the data protection information of your chosen payment service provider. 

(5) There is no legal obligation to disclose the personal data listed under para. 2 or para. 3. However, non-disclosure means that the Universität Mozarteum Salzburg will not be able to fulfil its obligations towards you or that it will not be possible to conclude a contract.

(6) Access to the data mentioned in paragraph 2 is generally only granted to employees of the Mozarteum University Salzburg who are entrusted with event administration, planning and documentation tasks, whereby access is only granted to the extent that is specifically required for the fulfilment of the respective task. 

The University works with the processors Datascroll Eventsupport GmbH and More Dimensions GmbH insofar as this is necessary to fulfil the processing purposes. These were contractually obliged to comply with data protection regulations and to take technical and organisational protective measures.

For more information on the data protection of the Eventjet system (of Datascroll Eventsupport GmbH), please refer to their data protection information at: https://about.eventjet.at/app/uploads/2019/07/privacy.pdf

For more information on the data protection of the EVIS system (of More Dimensions GmbH), please refer to their data protection information at: https://www.evis-solutions.de/

In individual cases - depending on the respective context - data will also be passed on to third parties (e.g. technical support by IT companies) based on your consent (Art. 6 para. 1 lit. a GDPR), the fulfilment of a task in the public interest (Art. 6 para. 1 lit. e GDPR in conjunction with §§ 1-3 UG), for the purpose of contract fulfilment (Art. 6 para. 1 lit. b GDPR) or for legitimate interest (Art. 6 para. 1 lit. f GDPR), if this is necessary.

§ 13 Social media marketing management tool

(1) The system Hootsuite Inc., Vancouver HQ, East 5th Avenue, Vancouver, Canada, BC V5T 1 4L1 (hereinafter referred to as "Hootsuite") is used by the University Mozarteum Salzburg for the administration and provision of social media content of Department 12. In this way, social media activities of Department 12 can be carried out in a more structured manner and thus the public can be informed more easily about the fulfilment of the university's tasks (Art. 6 para. 1 lit. e GDPR in conjunction with §§ 1-3, in particular 3 Z 11 UG). 

(2) The following data categories in particular are required to operate the tool or to enable the Hootsuite service and are therefore processed in this context:

1. Master and contact data of the user of the tool [in particular first and last name, e-mail address, telephone number, social media identifier, profile information, etc.].Content generated by the user of the tool
2.  Content generated by third parties on social media
3. Messages from social media users that have been voluntarily disclosed by them
4. Social media metadata of social media users (e.g. number of followers, number of posts, number of tweets, etc.)
5. Other personal content voluntarily disclosed by social media users (e.g. age, gender, place of residence, etc.)
6. Inputs and outputs of the user of the tool
7. Other content, correspondence, etc. that is sent or received via the tool;
8. Device and browser data (e.g. IP address, number of visits to the website, etc.)

(3) There is no legal or contractual obligation to disclose the personal data listed in point A lit a - lit i. to Hootsuite or the respective social media applications. The information you provide is voluntary.

(4)  Department 12 of the Mozarteum University Salzburg uses the social media management tool Hootsuite. Hootsuite has been contractually obliged to comply with data protection regulations and to take technical and organisational protective measures. For more information on the data protection of the system, please refer to their data protection information at: https://www.hootsuite.com/de/legal/privacy?locale=legal&slug=privacy.

(5) No content from Hootsuite social media services is generally stored permanently. Rather, data is retrieved from the social media networks in real time when you log in to the respective social media service in order to enable a display during the session. Content created by users is stored (e.g. content drafts for publication in social media networks, etc.).

Hootsuite will only retain personal data for as long as necessary to provide the services requested by users, for record-keeping purposes, to fulfil legal obligations, to resolve disputes, etc. If these purposes no longer exist, or at the customer's request, they will be securely destroyed or anonymised. For further information, please refer to the data protection information at: https://www.hootsuite.com/de/legal/privacy?locale=legal&slug=privacy

§ 14 Video surveillance

(1) The Mozarteum University Salzburg uses video surveillance at appropriately labelled locations on the basis of overriding legitimate interests (Art. 6 para. 1 lit f GDPR). This is done to protect the University's property and infrastructure from damage, burglary, theft and other damaging behaviour and to ensure the safety of staff, students and guests. 

(2) The following data categories are processed in the course of video recording:

• Personal image data of persons who are in the area of the video surveillance systems.
• Date and time of the recording
• Camera location

Only general areas (entry and exit areas, etc.) that are labelled accordingly are monitored. 

(3) Any evaluation of the video recording will be carried out exclusively to secure evidence in the context of investigations based on justified suspicions of criminal offences and, if necessary, passed on to the authorities and courts.

(4) In principle, the video recordings are stored for a maximum period of 72 hours. In the context of investigations based on well-founded suspicions, the corresponding video data of the monitored areas may be retained by the University for the duration of the investigation or any proceedings.

§15 Implementation of Whistleblower Protection Act

(1) The Mozarteum University Salzburg, of Mirabellplatz 1, 5020 Salzburg (which is the data manager as per Article 4, clause 7, GDPR and § 8, paragraph 4, clause 2, HSchG (Whistleblower protection Act)) has set up an in-house whistleblower protection system. For this purpose, the University makes use of the whistleblower portal of Vispato GmbH, Hansaallee 2999, 40549 Düsseldorf, Germany.

In cases which are qualified as legally relevant, any individuals who have an ongoing or a previous professional connection with the University may, if they suspect any illicit actions or unfair conduct, submit reports via the University’s whistleblower portal.

(2) Whistleblowers are under no obligation to disclose their personal details to the internal reporting centre. They have the option of posting their reports anonymously and – in particular – without indicating any name or any other identifying details.

(3) The legal basis for this is the Fulfilment of legal obligations (refer Article 6, paragraph 1, (c), GDPR in conjunction with HSchG (Whistleblower protection Act).

(4) In this context, the following categories of data are processed:

Details of persons/other involved parties relating to the whistleblower:

• Information contained in the respective report
• any additional information (if disclosed voluntarily): Name, contact details and other personally related information.
• Information which is included in a report may also include particular categories of personally related details corresponding to Article 9, GDPR (“sensitive information”) and/or details of crimes corresponding to Article 10, GDPR.

The following categories of information are also systematically logged:

• Language
• Record of actions
• Scope of rights
•  Assigned category of topics in the report

A report to the Whistleblower system may also contain the details of individuals who are involved in the illegal activity, specifically (and in particular):

• Name(s)
• Other personally related details of individuals who are mentioned in the report or who are identified by any and all attached documents.

(5) Under § 8, paragraph 11 HSchG (Whistleblower protection Act) personally related details connected with any whistleblower report are stored for 5 years as from the latest processing or reporting, and thereafter stored for as long as is required for the completion of any already instituted proceedings conducted by governmental or judiciary authorities or for the completion of any investigative procedure under criminal process regulations.

(6) Personally related data relating to any whistleblower report is processed on the database of Vispato GmbH (subcontracted processor) in an ISO-certified computing centre in Germany, whereby technical and organisational measures are instituted in order to make certain that no access – particularly access on the part of the subcontracted or contracted processor – can be had to the whistleblower report. With regard to the processing of data, there is a contract processing arrangement in place with ACOmarket GmbH, Wollzeile 11, 1010 Vienna.

(7) As a rule, access to personally related details of the whistleblower report is available exclusively to such individuals as have been acquainted – by the University’s heads – with the processing of the whistleblower report, whereby access will be possible only to the extent specifically necessary for the fulfilment of the respective task(s).

Where appropriate, relevant personally related details will be forwarded, for purposes of investigation and for measures in response, to external consultants (e.g. lawyers, forensic consultants, auditors etc), and to public authorities and/or Courts.

(8) Where a whistleblower report has been filed, there are particular requirements relating to subjects’ rights under the data protection Act (i.e. right of information, right of access, right of rectification, right of erasure, right of restriction of processing, right of contestation, and right to receive notification in the event of the infringement of the protection of data subjects’ personal data). Accordingly, the above-mentioned data subjects’ rights are not implemented in the scope of application of the Whistleblower protection Act if, for example, such non-implementation is required in order to protect the whistleblower’s identity or in order to ensure that the correct processing of information and measures in response will not be impeded (refer (§ 8, paragraph 9, HSchG). In general, please refer to § 16: Data subjects’ rights.

§ 16 Relationship Management

(1) Mozarteum University Salzburg engages in relationship management in order to be able to better carry out the development and opening up of the arts and teaching of the arts in particular, or to implement certain projects with the support of donors/sponsors.

(2) Data processing in this context is therefore carried out for the purposes of maintaining contact with existing and/or future supporters/donors/sponsors and for the contractual processing of a donation/support/sponsorship (Art. 6 para. 1 lit. b GDPR) as well as to meet tax obligations [Art. 6 para. 1 lit. c GDPR in conjunction with § 18 para. 8 EStG and Sonderausgaben-DÜV].

(3) The following personal data is processed:

• Contact details (e.g. address, e-mail address)
• Identity data (e.g. first and last name, title, date of birth)
• Communication content data

Additionally, for sponsors/donors:

• Bank data (e.g. bank details)
• Donation information (e.g. donation amount, project, donation date, etc.)

(4) Under statutory provisions, it may be necessary to disclose/transfer personal data to external consultants (e.g. accountants and auditors, etc.) and the Court of Auditors.

(5) For tax deductibility of donations by tax residents, the respective personal data (first and last name, date of birth) must also be set to the responsible tax office.

(6) The disclosure of the above-mentioned data is voluntary, although it is mandatory for the above-mentioned purposes. Without disclosure, the above-mentioned purposes cannot be fulfilled.

(7) All personal data relevant to payment and/or contract will be stored in personalised form until claims pertaining to the contract are excluded by prescription, as well as due to retention periods, in particular retention periods under commercial and tax law, which have expired and have no archival value. Personal data that we process based on consent will remain stored until that consent is withdrawn.

§ 17 Video Conferencing/Distance Learning

(1) Mozarteum University Salzburg uses the Zoom and MS Teams video-conferencing systems to enable virtual teaching and learning and also electronic meetings and teamwork. In this way, the university can carry out its functions efficiently and independently of location ("WFH"), especially with regard to the development and opening up of the arts as well as teaching of the arts and related administrative processes.

(2) The legal basis for data processing, which includes, in particular, the implementation of the University's guiding principles and functions in the public interest, is Art. 6 para. 1 lit. e GDPR in conjunction with §§ 2 Z 8, Z 13, Z 14 UG as well as § 3 Z 6, Z 7 UG, § 13 para. 2 lit. f UG, § 59 para. 1 Z 12 UG and § 76 para. 3 UG.

(3) When using Zoom and MS Teams, it cannot be ruled out that your data (see Privacy Data Sheet/Data Protection Information of the Provider) will be sent to recipients in the United States; whereby these recipients have a contractual obligation to comply with data protection provisions and to take appropriate protective, technical and organisational measures. Data transfers take place based on an adequacy decision by the European Commission ("Trans-Atlantic Data Privacy Framework").

(4) For more detailed information on the collection and processing of your data when using the video conferencing system, e.g. on the categories of data processed, please refer to the provider’s Terms of Use/Privacy Data Sheets.

See also: Zoom Video Communications, Inc., 55 Almaden Blvd, Suite 600, San Jose, CA 95113, USA: https://explore.zoom.us/de/privacy/

See also: Microsoft Corporation, One Microsoft Way, Redmond, WA 98052-6399 USA: https://learn.microsoft.com/de-de/microsoftteams/teams-privacy

§ 18 Rights of persons concerned

(1) On the basis of the GDPR, each person has the right of information according to article 15 of the GDPR, the right to rectification according to article 16 of the GDPR, the right to erasure according to article 17 of the GDPR, the right to the restriction of processing according to article 18 of the GDPR, as well as the right to data transferability according to article 20 of the GDPR and the right to object according to article 21 of the GDPR. Where applicable these rights of persons concerned are to be asserted towards the Universität Mozarteum Salzburg (responsible institution according to article 4, line 7 of the GDPR, Mirabellplatz 1, 5020 Salzburg, Austria, datenschutz@moz.ac.at.

(2) Each person has the right to make a complaint to the Austrian Data Protection Authority, if the person takes the view that the processing of the personal data contravenes the GDPR or the Data Protection Law.

§ 19 Accessing the statement on data protection

This statement on data protection can be accessed under https://www.moz.ac.at/en/privacy-policy and printed out.

§ 20 Miscellaneous

(1) In the case of deviations between the German and the English version of the statement on data protection of the Universität Mozarteum Salzburg, it is hereby explicitly stated that the German language version is binding.

(2) The Universität Mozarteum Salzburg reserves the right to change the statement on data protection at any time; therefore the relevant current version of the data protection statement is valid.