1. Name and contact details of the data controller
The data controllers jointly responsible for processing your data within the scope of this data processing pursuant to Art. 26 GDPR are:
VERBUND AG, Am Hof 6a, 1010 Vienna and VERBUND Energy4Customers GmbH, Erdberger Lände 26A, 1030 Vienna ("VERBUND", "we" or "us"). VERBUND AG has concluded an agreement with Energy4Customers GmbH pursuant to Art. 26 GDPR ("Joint Controller Agreement"), which regulates the tasks and obligations under data protection law. You have the right to assert your claims to the data controller, regardless of the Joint Controller Agreement.
The contact details of the data protection officer: datenschutz@verbund.com.
2. Data processing by processors and other recipients
2.1. Processor
Where service providers commissioned for subsequent data processing are involved ("processors" pursuant to Art. 4(8) GDPR, such as IT service providers, service providers for marketing services, payment service providers), they may also have access to personal data in accordance with our instructions. VERBUND works only with processors who provide sufficient guarantees that appropriate technical and organisational measures are implemented in such a way that processing is carried out in accordance with the requirements of the Austrian Data Protection Act ("DSG") and the General Data Processing Regulation ("GDPR") as amended. The processing performed by a processor is always done on the basis of a contract that binds the processor to the obligations under data protection law. VERBUND uses processors outside the European Union only if an adequacy decision has been taken by the European Commission for the third country concerned or if we have agreed on other appropriate guarantees pursuant to Art. 46 GDPR.
2.2. Other recipients
For the following forms of data processing, personal data will only be forwarded to other recipients where required for the fulfilment of (pre-)contractual or statutory obligations, where justified for the maintenance of our legitimate interests or those of a third party, or where permitted within the scope of voluntarily granted consent. In addition to processors pursuant to point 2.1, the categories of recipients of personal data can include:
- Sales partners: If the conclusion of your contract with VERBUND is brokered via one of our sales partners and/or a sales partner (jointly) supports your contract with VERBUND, the sales partner will collect the personal data necessary to conclude the contract and transmit these to VERBUND. We will also transmit your personal data to the sales partner to the extent necessary for any support you require from the sales partner.
- VERBUND group company: We can forward individual data processing activities to specialist departments, divisions or companies within the VERBUND group and transmit the personal data necessary for this purpose. This is done primarily to be able to administer your data centrally and/or to be able to offer you a better service.
- Market players in the gas or electricity market: In the course of initiating and processing the contract, it may be necessary for us to transmit your personal data to market players in the gas or electricity market (e.g. grid operators or energy suppliers) in order to fulfil (pre-)contractual and/or statutory obligations.
- Authorities, courts and public bodies: Statutory obligations exist that VERBUND is only able to fulfil when we transmit your personal data in the necessary scope to authorities and public bodies (e.g. financial authorities, law enforcement agencies) as well as to courts.
- Companies for credit and creditworthiness information: VERBUND may transmit your personal data to companies for credit and creditworthiness information (e.g. CRIF GmbH and Kreditschutzverband) within the scope of creditworthiness checks and to request information about your creditworthiness from them.
- Other recipients: Within the scope of the contractual relationship and in particular in connection with our service obligations, it may be necessary, on a case by case basis, to transmit your personal data to other recipients (e.g. lawyers, notaries, insolvency administrators, debt collection agencies, experts, tax consultants, auditors, stakeholder representatives, banks, financial service providers, mail/courier services and logistics partners, installation partners, contract and cooperation partners for services linked to your contract).
3. Data processing in the context of "consulting and information for interested parties"
3.1. Scope of the processing of personal data and their source
Parties with an interest in the products and services of VERBUND can use various channels to make contact with VERBUND (e.g. by phone or email). If you make use of one of these options, the following data provided by you – depending on the chosen manner of making contact – will be processed: information about your person such as gender, title, name, address, type of interest or information about your enquiry, information on how you can be reached (phone number and/or email address), information on energy consumption, grid operator and current energy supplier. The specific scope of the data collected from you will depend on the nature of your inquiry.
These data are provided by you on a voluntary basis; they are neither legally nor contractually prescribed, nor are they required in order to enter into a contract with us. However, if you do not provide these data, VERBUND will not be able to process your enquiry accordingly.
3.2. What is our legal basis for processing personal data?
The legal basis for the processing of the data mentioned under point 3.1. is our legitimate interest in accordance with Art. 6(1)(f) GDPR, which consists of handling your enquiry as well as possible. If the reason for making contact is to conclude a contract, the fulfilment of (pre-)contractual measures pursuant to Art. 6(1)(b) GDPR is the legal basis.
3.3. Purposes for which we process data
The personal data listed under point 3.1. will be processed by VERBUND for the purpose of handling your enquiry.
3.4. Retention period
We will process your data in order to handle your enquiry and beyond that for a period of three months. A longer storage period will apply only to the extent this is required to fully process your concerns and beyond that only until the end of the relevant limitation periods, statutory retention periods or any legal disputes.
The option exists to render the data anonymous instead of erasing them. In this case, any personal reference will be irretrievably removed, which shall also remove any obligation to erase the data under data protection law.
3.5. Data recipients
The data may be transmitted to commissioned service providers for order processing (order processor) or to other recipients pursuant to point 2.
4. Data processing in the context of "placing an order in the online shop"
4.1. Scope of the processing of personal data and their source
In order to initiate the conclusion of a contract when placing your order in the online shop on our website, you will provide us with the following data, depending on the product selection/contract type: title, gender, first name, last name, address, date of birth, email address, phone number, billing address, customer number, ordered products, payment methods, bank details, billing data, data on your energy consumption as well as data about your facility (grid operator, meter point designation, meter number, meter reading), any name, address and customer number of an advertiser. Depending on the contract type, further data listed under point 5.1 may be collected from you when you place an order in the online shop.
If you also register for the VERBUND online services after placing your first order in the online shop, we will additionally ask you to enter a user name and password.
4.2. What is our legal basis for processing personal data?
The legal basis for the processing of data pursuant to point 4.1. is Art. 6(1)(b) GDPR and therefore the processing for the fulfilment of a contract and for the implementation of pre-contractual measures.
The provision of data by you is voluntary; however, if you do not provide these data, VERBUND will not be able to process your order in the online shop for the contract conclusion accordingly or only to a limited extent.
4.3. Purposes for which we process data
The personal data listed under point 4.1. will be processed by VERBUND for the purpose of processing the order and subsequently to fulfil the respective contractual obligations arising from placing the order in the online shop.
4.4. Retention period
We will process your data for orders placed in the online shop for as long as necessary to handle the order and thereafter to the extent that statutory retention periods exist or warranty and limitation periods are still in force.
4.5. Data recipients
The data may be transmitted to commissioned service providers for order processing (order processor) or to other recipients pursuant to point 2.
5. Data processing in the context of "processing energy contracts of VERBUND AG"
5.1. Scope of the processing of personal data and their source
You can procure a range of different products and services from us. Depending on the product choice/contract type, personal data will be collected from you or from other sources for the purpose of processing energy contracts with you.
Collection of personal data from the data subject (Art. 13 GDPR):
If you conclude an energy supply contract for the supply of electricity or gas, the following personal data, which you provided us upon conclusion of the contract or were collected during ongoing contract fulfilment, will be processed:
- Master data, such as title, gender, first name, last name, address, date of birth, email address, phone number, billing address, customer number;
- Contractual data, such as contract type, products, tariff model, commitment period, delivery time, payment methods, bank details, billing data;
- Facility data, such as grid operator, meter point designation, meter number;
- Consumption data, such as the level of energy consumption, consumption period, meter readings;
- Any other data, such as the name, address and customer number of an advertiser, upon registration for the VERBUND online account a user name and password or for customers who are also members of the jö Bonus Club the web ID, refresh token as well as the number of Ö points claimed/voucher.
If you also conclude a photovoltaic supply for electrical energy from photovoltaic systems, VERBUND will, in additional to the energy supply contract, process the following data provided by you at the time of concluding the contract: data of the photovoltaic system (output in kWpeak, feed-in in kWh, date of initial operation, current electricity consumer, reference number, certificate of recognition as a green electricity facility), any VAT Reg. No.
If you conclude a rental or purchase agreement for a photovoltaic system, wallbox or other moveable property, VERBUND will process the following personal data, which you provided us upon conclusion of the contract or were collected during ongoing contract fulfilment, will be processed:
- Master data, such as title, gender, first name, last name, address, date of birth, email address, phone number, billing address, customer number;
- Data on your property, such as owner, type of property, age of property, roof shape, roof slope, type of roof covering, number of floors, installation location, address, photos of the property (general view, roof, meter box);
- Contractual data, such as contract type, products, commitment period, payment methods, bank details, billing data;
- Facility data, such as grid operator, meter point designation, meter number;
- Consumption data, such as the level of energy consumption, consumption period, meter readings;
- Any other data, such as the name, address and customer number of an advertiser, upon registration for the VERBUND online account a user name and password.
If you procure a complete VERBUND-eCharging package from VERBUND, in addition to the purchase contract for a wallbox and to the electricity supply agreement within the scope of the VERBUND-eCharging service agreement, VERBUND will process the following personal data, which you provided us upon conclusion of the contract or were collected during ongoing contract fulfilment either from you or from a readout via the wallbox:
Data about your property, such as the installation location of the wallbox, power connection available, wall breakthroughs, cable run, photos of the property;
Data of the wallbox, such as designation of the wallbox, max. power output in kW, operating data of the wallbox, address, charging procedures (e.g. start date, time, duration, energy consumption data), session ID of the charging procedure, card number of the charging card.
Collection of personal data from other sources (Art. 14 GDPR):
Should it be necessary to verify your creditworthiness prior to the conclusion of a contract with us or during an ongoing contractual relationship, we will transmit the data required for this purpose and disclosed by you during contact initiation (title, gender, first name, last name, address, date of birth, any VAT and company register numbers) to the credit agency CRIF GmbH, Rothschildplatz 3/Top 3.06.B, 1020 Vienna, which processes the transmitted data as an independent data controller for its own purposes as a credit agency and address publisher, as described under https://www.crif.at/datenschutz/.
5.2. What is our legal basis for processing personal data?
The legal basis for the processing of data under point 5.1. is Art. 6(1)(b) GDPR and therefore processing for the fulfilment of a contract and for the execution of pre-contractual measures as well as Art. 6(1)(c) GDPR for the fulfilment of legal obligations. Such obligations can arise in particular from: the Electricity Industry and Organisation Act (ElWOG), the Natural Gas Management Act (GWG), the Switching Ordinance, the Payments by Instalment Ordinance, the Industrial Code (GewO), the Green Electricity Act (ÖSG), the Renewable Energy Expansion Act (EAG), the Federal Energy Efficiency Act (EEffG), the Corporate Code (UGB), and the Federal Tax Code (BAO).
We will also process your data to protect the legitimate interests of us or third parties (Art. 6(1)(f) GDPR). VERBUND has a legitimate interest in learning more about your creditworthiness as required and thus preventing payment defaults. To this end, VERBUND can obtain creditworthiness information about your from companies that provide credit and creditworthiness information. In the interest of VERBUND or third parties, your data may also be processed for preparing statistics, analyses and reports, for business management and further development of processes, for developing new products and services, for customer support and marketing pursuant to point 6, for contract administration, for ensuring IT security and IT operation including tests, for compliance purposes and for internal audit measures as well as for optimising processing, delivery and communication processes. Our particular objective for doing so is also to continuously improve processes and services in order to be able to offer you excellent service quality.
The provision of data by you is voluntary; however, if you do not provide these data, VERBUND will not be able to process your application to conclude a contract accordingly or to render the contractual services during an ongoing contractual relationship accordingly or only with restriction.
A transmission of quarter-hourly values by smart meters of our grid operator and processing of these quarter-hourly values by VERBUND is done pursuant to Sec. 84a ElWOG only on the basis of voluntary consent (Art. 6(1)(a) GDPR) or for fulfilment of obligations arising from an energy supply contract that you have chosen and which is based on quarter-hourly values (Art. 6(1)(b) GDPR).
5.3. Purposes for which we process data
The personal data listed under point 5.1. will be processed by VERBUND for the purpose of concluding, executing, modifying and terminating the contract with you as well as for settling payments to you. This also includes, in particular, the following activities:
- Creditworthiness check on the customer as required
- Carrying out a change of supplier pursuant to the Switching Ordinance in the case of an contract for the supply of electricity or gas.
- Customer administration and billing (invoices are sent either by post or by email)
- Optional use of the VERBUND online services via the VERBUND online account
- Customer support and marketing for internal purposes (see point 6)
5.4. Retention period
These data will be erased after the termination of the contractual relationship with the customer, unless the data have to be retained beyond the statutory retention obligation (e.g. those according to Art. 212 Corporate Code (UGB) or Art. 124 et seq. Federal Tax Code (BAO), or for as long as claims arising from the contractual relationship can be asserted.
5.5. Data recipients
The data may be transmitted to commissioned service providers for order processing (order processor) or to other recipients pursuant to point 2.
6. Data processing in the context of "customer support and marketing for internal purposes"
6.1. Scope of the processing of personal data and their source
Collection of personal data from the data subject (Art. 13 GDPR):
For this type of data processing, the data will be collected from you at the same time as the contract is concluded and data used that originates from the data processing in the context of "placing an order in the online shop" (point 4.1) and "processing of energy contracts of VERBUND AG" (point 5.1).
In addition, for example, the following documentation data will be collected by VERBUND from the transactions and service enquiries performed by you: date of enquiry/transaction, conversation notes, email correspondence.
Various data will also be collected directly from you via multiple sources, such as through voluntary customer surveys (point 9), data on your living situation, such as type of housing, household size, living space, heating system, which in themselves make no personal reference and produce personal data at VERBUND only when combined with other data and analyses, or, for example, through a power meter installed in your premises by VERBUND on the basis of a rental or purchase contract of a PV system incl. battery store or electric car charging station (point 8).
6.2. What is our legal basis for processing personal data?
VERBUND processes your personal data for customer support and marketing purposes on the basis of the legitimate interest of VERBUND (Art. 6(1)(f) GDPR), in order achieve interested parties and customers as well as possible and to align the marketing strategies accordingly. You do not have to actively seek information on our special offers or new products and services; instead, this will be provided to you by us. The data processing carried out on the legal basis of our legitimate interest is done with minimal intervention: you will not be subjected either to automated decision-making pursuant to Art. 22 GDPR that has a legal effect on you or significantly affects you in a similar way, nor will you be subject to profile with increased intervention intensity. Essentially, only such data that clearly meet your areas of interest in terms of the content of purchases and enquiries will be collected, stored and used.
When sending out direct marketing, VERBUND complies with the provisions under communication law in accordance with Art. 174 TKG 2021 (Telecommunications Act). The sending of direct advertising by electronic channels takes place solely on the basis of your voluntary consent.
VERBUND also uses your data on the basis of legitimate interests to allocate you to internal customer segments, in order to be able to offer you products and services with additional benefits for you that are tailored specifically for you and based on your consumption behaviour in the case of direct advertising measures, for the analysis of our marketing activities, in order to invite you to participate in competitions (see point 7), for customer relationship management as well as for customer satisfaction analyses and/or market and opinion surveys (see point 6.3).
The legal basis for the processing of the data for expanded, needs-based marketing is Art. 6(1)(a) GDPR. The processing of the data for this purpose therefore takes place only with your express consent, which you can voluntarily declare when placing an order in the online shop, when concluding the contract or via the VERBUND online services. Consent to process your data for this purpose is not required for concluding or executing a contract.
6.3. Purposes for which we process data
The personal data pursuant to point 6.1 are processed on the legal basis of the legitimate interest of VERBUND (Art. 6(1)(f) GDPR) for the following purposes:
- Direct advertising, in order to send interested parties, customers and former customers general information and offers in connection with the products and services of VERBUND and cooperation partners as well as future product innovations (such as, in particular, also in the areas of mobile wireless, internet, TV, etc.) by post and – if consent is available pursuant to Sec. 174 TKG as amended – by email or SMS or to share communicate it over the phone.
- Customer relationship management, in order to contact you to send you greetings on special occasions, e.g. at Christmas or on your birthday.
- Customer segmenting and statistical analyses, in order to categorise our customers into segments in a minimally invasive way with the goal of being able to offer you products and services with additional benefit specifically tailored to you and your consumption behaviour for measure of direct advertising and customer relationship management. For the purpose of customer segmentation, the data received from the data processing in the context of "placing an order in the online shop" and "processing energy contracts of VERBUND AG" (see points 4 and 5) will be analysed using various statistical methods and enriching them with aggregated socio-demographic data. Analysing means that various probability are calculated on the basis of the data merged in this way and with the help of automated analytical models, e.g. interest in gas products, which are used to select appropriate recommendations and offers for you. Moreover, these results are used to create personalised customer segments that are used to gain long-term findings about the needs and interests of our customers.
- Processing together with data from commercially licensed credit agencies pursuant to Sec. 151 GewO. The personal data collected on you by VERBUND according to points 4.1 and 5.1 as well as the customer segments created on this basis of that personal data can also be linked with third-party data (e.g. address publishers and direct marketing companies), which can also be personal (e.g. socio-demographic information per customer) in order to improve the database and analysis of customer behaviour in a minimally invasive way. By linking such personal data, it is possible to include, for example, the current life phase of a customer, the community size and the purchasing power in the analysis.
- Performing of customer satisfaction analyses as well as of market and opinion surveys.
Overall, VERBUND aims to use these measures to be able to provide you with a better offering by:
- aligning the product range to your customer needs, so that we can send you offers individual tailored to you,
- personalising the customer communication, so that you find offers which fit your wishes and allow you to receive altogether less advertising,
- simplifying procedures such as concluding contracts or placing online orders, so that you get to your goal faster.
- improving our service quality and improving or developing new, innovative products and services (e.g. services for optimising your energy consumption).
Expanded marketing measures with personalised (profiled) offers:
Only if you have granted VERBUND your voluntary consent (Art. 6(1)(a) GDPR) to process your data for additional marketing measures will processing of personal data pursuant to point 6.1 be carried out in order to be able to send you differentiated (profiled) product offers on the basis of the created customer profiles. This kind of data processing involves profiling pursuant to Art. 4(4) GDPR with increased intervention intensity. Target group selections are made from the created customer profiles in order to provide you with individualised and differentiated advertising and marketing measures as well as offers and in order to develop product optimisations via aggregated evaluations.
Consent to process your data for this purpose is not required for concluding or executing a contract. You may revoke your consent for this processing voluntarily and you can revoked your consent at any time with effect for the future, free of charge (see point 6.6). Even if you withdraw your consent, the lawfulness of processing operations carried out until you have withdrawn your consent shall not be affected.
6.4. Retention period
VERBUND uses your personal data after the end of the business relationship for processing pursuant to point 6 for up to three years after your last contact with us, unless you object to the use of your data for this purpose beforehand or your granted consent is revoked.
6.5. Data recipients
The data may be transmitted to commissioned service providers for order processing (order processor) or to other recipients pursuant to point 2.
6.6. Objection and revocation of consent
You may object at any time to the processing of these data for the purposes of undertaking customer support measures and for marketing purposes that we base on our legitimate interest (see point 11 below).
A customer may withdraw their voluntarily granted consent at any time without giving reason and with effect for the future by communicating to VERBUND by letter, email or telephone without further costs.
Postal address: VERBUND AG, Am Hof 6a, 1010 Vienna
Email address: datenschutz@verbund.com
Service line: 0800 210 210
7. Processing in the context of "participating in competitions"
7.1. Scope of the processing of personal data and their source
When you participate in competitions of VERBUND AG, we will process the following data collected from you: information about your person such as gender, title, name, address as well as your contact details such as telephone number and/or email address as well as information related to the competition.
These data are provided by you on a voluntary basis; they are neither legally nor contractually prescribed. However, if you do not provide these data, you will not able to participate in the competition.
7.2. What is our legal basis for processing personal data?
The legal basis for the processing of data pursuant to point 7.1. is Art. 6(1)(b) GDPR and therefore the processing for the fulfilment of a contract and for the implementation of pre-contractual measures. The storage and processing of the data is required in order to hold the competition and to inform you about any prizes.
Our legitimate interest pursuant to Art. 6(1)(f) GDPR consists of processing the competition for you to the best of our ability as well as aligning our marketing strategy with this.
Should your data be published in the event of a win, we will obtain your voluntary consent in this regard pursuant to Art. 6(1)(a) GDPR.
When sending out direct marketing, VERBUND complies with the provisions under communication law in accordance with Art. 174 TKG 2021 (Telecommunications Act). If you have given us your voluntary consent to send information regarding the competition to you by email (newsletter), the legal basis of the processing of data for this purpose is Art. 6(1)(a) GDPR.
7.3. Purpose of the data processing
The personal data listed under point 7.1. will be processed by VERBUND for the purpose of holding the competition. If you have given us your consent to the sending of information by email for the purposes of processing your data, then the data listed under point 7.1. will also be processed for this purpose (see point 9).
7.4. Retention period
We process your data for as long as is necessary for holding the competition and will delete them immediately after the end of the competition, unless the data also have to be processed in accordance with statutory retention obligations or you have given us your voluntary consent to the sending of information by email.
7.5. Data recipients
The data may be transmitted to commissioned service providers for order processing (order processor) or to other recipients pursuant to point 2.
8. Data processing in the context of "Energy data recording via the Power-Meter and the Power-Meter app"
8.1. Scope of the processing of personal data and their source
Data collected from the data subject (information pursuant to Art. 13 GDPR):
The setup of a battery store and the installation of an electric car charging station ("wallbox") within the scope of a rental or purchase agreement for a photovoltaic system, incl. accessories and expansion components pursuant to point 5, also encompasses the installation of a power meter in your fuse/distribution box. With the installation of a power meter ("meter"), the following personal data are recorded directly by the meter when the energy data transmission feature of the meter is activated or when the VERBUND power meter app ("app") is used, and automatically read by us via a data connection and transferred to our systems:
- Energy and power readings such as total power output, generated and stored energy per meter and activated data interface;
- Metadata per meter and activated data interface such as device serial numbers, hardware version, firmware version, etc.;
- Diagnostic data for operation and troubleshooting such as error codes;
- VERBUND online services login data such as user name and password ("VERBUND ID");User-specific designations such as meter designation;
- Date and time at which the app is accessed.
8.2. What is our legal basis for processing personal data?
The legal basis for the processing of data pursuant to point 8.1. is Art. 6(1)(a) GDPR and therefore your voluntary consent to the meter transmitting energy data.
Where the data processing only concerns the data regarding your use of the app (date and time at which the app is accessed, device ID), we justify the processing on the basis of our legitimate interest in accordance with Art. 6(1)(f) GDPR, which consists of giving our app a user-friendly design, expanding existing features with the customer in mind and protecting our app against errors.
8.3. Purposes for which we process data
The personal data recorded by the meter and listed under point 8.1. will be processed by VERBUND for the purpose of data analysis, visualisation, advice, notification, load control and load optimisation.
In the course of using the app, the energy and power readings of the meter will be accessed in order to be able to show these to the user in the app. The readings are temporarily stored locally in the app for faster presentation until the app is uninstalled. This is necessary in order to display the correct meter in the app or to visualise the correct data. The additional data on the meter are processed in the course of using the app for the correct presentation and for calculations in the app. To maintain the functionality of the app and for continuous improvement of the system, the following tools are used via third-party add-ins:
Firebase Crash Reporting
To receive feedback about errors in the app and the types of end device on which these errors occur, error data are analysed via Firebase Crash Reporting. This involves transmitting Instance IDs and crash traces to Google Inc. which do not reveal any information about the user. This third-party application can be deactivated in the settings at any time. The app also functions fully without your consent.
Google Analytics for Firebase
Google Analytics for Firebase is used to analyse use of the app. The data obtained will be used on the one hand to expand existing features with the customer in mind and on the other to develop new and meaningful functionalities. Google Analytics for Firebase is used solely on the basis of your voluntary consent.
Google is a third-party provider with registered office outside the EU or outside the EEA, namely in the USA. There is currently no adequacy decision for the USA in the sense of Art. 45 GDPR confirming an appropriate level of protection in third countries and no suitable guarantees pursuant to Art. 46 GDPR. Accordingly, data are transferred to the USA solely on the basis of your prior, express and voluntary consent pursuant to Art. 49(1)(a) GDPR in conjunction with Art. 6(1)(a) GDPR. Risks involved with the transmission of data are that US authorities, such as, example, US secret services, access your data for control and monitoring purposes and you are not informed about these activities. There is also a risk that you will not have any effective legal remedy against such access.
This third-party application can be deactivated in the settings at any time. The app also functions fully without this consent.
8.4. Duration of the data processing
The data listed under point 8.1 will be processed until you revoke your consent to the transmission of energy data by the meter. The revocation of your consent does not affect the lawfulness of the processing performed to date. If the data processing concerns only the data regarding your use of the app and legitimate interest is based on the legal justification, this data processing will be performed for the duration of use of the app.
8.5. Data recipients
The data may be transmitted to commissioned service providers for order processing (order processor) or to other recipients pursuant to point 2.
9. Processing in the context of "Customer survey for marketing purposes"
9.1. Scope of the processing of personal data and their source
Should you, as a customer of VERBUND, participate in a voluntary survey for the purposes of market research, we will, depending on the type of customer survey, process key personal and communication data (gender, title, name, address, email address), key product and contract data (products purchased, energy consumption, plant number, customer number, length of the customer relationship, payment modalities), any reaction data to marketing campaigns (customer contact points, participation in promotions, Eco-Club participation, number of customer bonuses), and other survey-specific data.
9.2. What is our legal basis for processing personal data?
The legal basis for the processing of data pursuant to point 9.1. is Art. 6(1)(a) GDPR and therefore your voluntary consent to participate in the customer survey.
9.3. Purposes for which we process data
The personal data listed under point 9.1. will be processed by VERBUND for the purpose of holding the customer survey and carrying out market research.
9.4. Retention period
We process your data for as long as is necessary for holding the customer survey and render it anonymous immediately after the end of the customer survey. In this case, any personal reference will be irretrievably removed, which shall also remove any obligation to erase the data under data protection law.
9.5. Data recipients
The data may be transmitted to commissioned service providers for order processing (order processor) or to other recipients pursuant to point 2.
10. Processing in the context of "newsletter"
10.1. Scope of the processing of personal data and their source
If you subscribe to a newsletter of VERBUND, we will process information about your person such as gender, title, name, address as well as your contact details such as telephone number and/or email address as well as your view and click rates.
The provision of these data by you is voluntary. However, if you do not provide the data, it will not be possible to send you any newsletters.
10.2. What is our legal basis for processing personal data?
The legal basis for the processing of data pursuant to point 10.1. is Art. 6(1)(a) GDPR and therefore your voluntary consent to receive the newsletter. With your consent, we will also evaluate your use of our email newsletter in order to further optimise our email newsletter and our marketing in line with your interests and adapt it to better suit your needs. To this end, we will process whether you have opened our newsletter and which contents you clicked on in particular.
Your consent can be withdrawn at any time without giving reason and with effect for the future by, for example, clicking on the link in the email or by communicating with VERBUND by letter, email or telephone without further costs. This revocation will not affect the lawfulness of any processing done beforehand on the basis of the consent.
Postal address: VERBUND AG, Am Hof 6a, 1010 Vienna
Email address: datenschutz@verbund.com
Service line: 0800 210 210
10.3. Purpose for which we process data
The personal data listed under point 10.1. will be processed by VERBUND for the purpose of sending information about products and services of VERBUND by email.
10.4. Retention periods
Your data will be processed for as long as you continue to receive the newsletter and until you revoke your voluntary consent.
10.5. Data recipients
The data may be transmitted to commissioned service providers for order processing (order processor) or to other recipients pursuant to point 2.
11. Processing in the context of "Application to the VERBUND hardship fund"
11.1. Scope of the processing of personal data and their source
When you apply for funds from the VERBUND hardship fund, we will process the master data we hold about you, such as gender, title, name and customer number as well as your indicated hardship reason and, in particular, all documents uploaded by you as evidence for the hardship reason. The specific scope of the data collected from you will depend on the hardship reason.
These data are provided by you on a voluntary basis; they are neither legally nor contractually prescribed. However, if you do not provide these data, VERBUND will not be able to process your application accordingly.
11.2. What is our legal basis for processing personal data?
The legal basis for the processing of data pursuant to point 11.1. (excluding special categories of personal data) is Art. 6(1)(b) GDPR and therefore processing for the fulfilment of a contract and for the implementation of pre-contractual measures (conclusion and processing of the funds) as well as our legitimate interest pursuant to Art. 6(1)(f) GDPR, which consists of checking your application and handling it in the best way possible.
The legal basis for the processing of any special categories of personal data pursuant to point 9 GDPR (e.g. health-related data) is Art. 6(1)(a) GDPR and therefore your explicit voluntary consent. You may withdraw your consent at any time with effect for the future. Even if you withdraw your consent, the lawfulness of processing operations carried out until you have withdrawn your consent shall not be affected. Please note that for certain hardship reasons, the processing of special categories of personal data can be a key prerequisite for the granting of funds from the VERBUND hardship fund and this could be rendered more difficult or impossible in the case of revocation.
11.3. Purpose of the data processing
The personal data listed under point 11.1. will be processed by VERBUND for the purpose of executing your application, especially for checking the indicated hardship reason and for the granting of funds from the VERBUND hardship fund.
11.4. Retention period
We process your data to execute your application, to check the indicated hardship reason and to grant funds from the VERBUND hardship fund for not longer than a period of six months from the date of application. A longer period of processing will take place only where this is required in individual instances to fully execute your application, as long as the data do not also have to be processed within the scope of statutory retention obligations.
11.5. Data recipients
The data may – where required for the purpose indicated under point 11.3 – be transmitted to commissioned service providers for order processing (order processor) or to other recipients pursuant to point 2.
12. Processing in the context of "VERBUND-charging assistant"
12.1. Scope of the processing of personal data and their sources
Collection of personal data from the data subject (Art. 13 GDPR):
When registering for and using the VERBUND-charging assistant and from the moment of connection of devices used by the customer (e.g. inverter, wallbox, etc.) and ongoing data transmission, the following information – depending on the respectively connected device – will be collected from the customer or read out directly via the VERBUND-charging assistant and transmitted to our systems:
- Registration data of the customers such as email address, first and last name, device-specific data, user name, password;
- Manufacturer-specific information needed to authorise the connection of the device to the VERBUND-charging assistant;
- Metadata per device and activated data interface such as device serial numbers, hardware version, firmware version, etc.;
- Energy and power readings such as total power output, generated and consumed energy;
- Device status (connectivity of charging plug, plug-in and unplug time);
- Information on charging procedures at wallboxes (start and end time of the charging sessions, charging power, energy quantities, number of used charging phases);
- Charge and discharge capacity of a battery store and the current charge status;
- User-specific designation of the device;
- User-specific logs on the behaviour of the device;
- Manufacturer-specific operating data of the device.
The data read from a device may vary depending on the manufacturer-specific interface of the device used. Changes and adjustments can also be made by the manufacturer at any time without the knowledge of VERBUND. You can usually find the current version of the manufacturer-specific data interface on the website of the respective device manufacturer.
12.2. What is our legal basis for processing personal data?
On the basis of your registration for and use of the VERBUND-charging assistant, the legal basis for the processing of data pursuant to point 12.1. is Art. 6(1)(b) GDPR and therefore the processing for the fulfilment of a contract and for the implementation of pre-contractual measures.
Where the data processing only concerns the user-friendly design of the app interface and new functions, we justify the processing on the basis of our legitimate interest in accordance with Art. 6(1)(f) GDPR, which consists of giving the VERBUND-charging assistant a user-friendly design, expanding existing features with the customer in mind and protecting the VERBUND-charging assistant against errors.
12.3. Purpose of the data processing
The data listed under point 12.1 and collected from the customer while registering for the VERBUND-charging assistant are processed by VERBUND for the purpose of checking suitability for using the VERBUND-charging assistant.
The personal data listed under point 12.1. ad collected during use of the VERBUND-charging assistant will be processed by VERBUND for the purpose of fulfilling the contract. The VERBUND-charging assistant is a service for customers, giving them the possibility to connect and administer certain devices (e.g. inverter, wallbox, etc.), in order to be able to control these devices, visualise energy flows or perform calculations of commands for controlling energy flows. Device-specific operating data are also processed for the purpose of error monitoring.
Data are also processed for the purpose of giving the interface of the VERBUND-charging assistant a user-friendly design, adapting functions and features to user behaviour or developing new functions with the greatest possible added value for users and protecting the VERBUND-charging assistant against errors.
12.4. Duration of the data processing
The data listed under point 12.1 and collected from the customer while registering for the VERBUND-charging assistant are processed by VERBUND for the purpose of checking suitability for using the VERBUND-charging assistant will be processed until it can be finally determined whether use and connection of the devices used by the customer is possible or entirely ruled out, subject to a maximum duration of two years from the date of registration.
The data listed under point 12.1 will be processed following successful registration until the end of use of the VERBUND-charging assistant, as long as the data do not also have to be processed within the scope of statutory retention obligations. A termination of use – whether on the basis of your cancellation or a block on our part – does not affect the lawfulness of the processing to date. By breaking the data link between the devices used by the customers or by closing the account, no further energy or other data can be collected via the devices used by the customers.
12.5. Data recipients
The data may be transmitted to commissioned service providers for order processing (order processor) or to other recipients pursuant to point 2.
13. Your rights
In principle, you have the right to information, correction, erasure, restriction, data portability, revocation of a granted consent and objection in respect of your data processed by VERBUND. To exercise these rights, please contact datenschutz@verbund.com. If you believe that the processing of your data violates data protection law or your data protection claims have otherwise been violated in any way, you can submit a complaint to the national supervisory authority where you live. In Austria, this supervisory authority is the Data Protection Authority.
You can find further details on your rights in the section "Data subjects' rights" at https://www.verbund.com/en-at/data-protection.
Version: September 2023