The Austrian Agency for Health and Food Safety (AGES) handles your personal data very carefully and the following data protection information is intended to give you an overview of how your data is processed in connection with your visit to our website, in the fulfilment of the tasks assigned to us and when you make use of our services. We process your data exclusively on an existing legal basis and in compliance with the statutory provisions.

The controller for data processing is the Austrian Agency for Health and Food Safety GmbH, Spargelfeldstraße 191, 1220 Vienna.

The data protection officer of AGES can be contacted at datenschutz@ages.at.

1 Categories of data processed

Personal data are data and information that can be traced back to an identified or identifiable person. Examples: Name, address, telephone number, e-mail, profession, education, health data, hobbies, IP address, etc.

Depending on the specific processing purpose, in particular inventory data, customer data, contact data, order data, health data, communication data and image data are processed.

In the course of your visit to this website and the processing of your enquiries via this website, we collect the categories of personal data listed in the Annex. We collect this data when you provide it to us through your use of this website and as part of your enquiries. There is no obligation to provide us with this personal data. However, you will not be able to use all the functions of this website or we will not be able to answer your enquiries if you do not provide your personal data.

If the provision of your data is required by law in some cases, we will inform you of this separately.

We do not make any automated individual decisions that would have legal consequences for you or would significantly affect you in a similar way.

2 Legal basis and purposes of data processing

The processing of your personal data is based on the following legal bases

a. Legal obligation and public interest

The tasks of AGES are defined in § 8 of the Health and Food Safety Act (GESG), Federal Law Gazette I No. 63/2002 as amended. In fulfilment of these tasks, AGES is authorised to process personal data in accordance with Section 9 (7) GESG.

In addition, personal data is processed on the basis of legal obligations, which result in particular from relevant material laws, labour and social law as well as financial and tax regulations.

Legal basis: Art. 6 para. 1 lit c and lit e as well as Art. 9 para. 2 lit b GDPR.

b. Fulfilment of a (preliminary) contract

Personal data is processed for the purpose of fulfilling (pre)contractual obligations. The personal data disclosed by you in this context is essential for the fulfilment of the contract, such as the performance of a contract analysis, a drinking water analysis, a soil analysis, a consulting service or any other service.

Legal basis: Art. 6 para. 1 lit b GDPR.

c. Consent

The processing of personal data is also lawful if legally valid consent has been given by the data subject(s). On the basis of your consent, we process personal data for purposes such as sending newsletters or processing your contact enquiries. Consent given can be revoked informally at any time. The withdrawal of consent does not affect the lawfulness of processing based on consent before its withdrawal.

Legal basis: Art. 6 para. 1 lit a and Art. 9 para. 2 lit a GDPR.

d. Legitimate interest

On the basis of the overriding legitimate interest, AGES processes personal data for the purpose of direct advertising, to improve and further develop this website, to recognise, prevent and investigate attacks on our website and to ensure smooth IT operation and IT security.

Legal basis: Art. 6 para. 1 lit f GDPR.

e. Public interest in the area of public health

AGES is required by law to carry out tasks in the area of public health in the interest of the general good. In this context, personal data may be lawfully processed for reasons of public interest in the area of public health, such as protection against serious cross-border threats to health or to ensure high standards of quality and safety in healthcare and in medicinal products and medical devices.

Legal basis: Art. 9 para. 2 lit i GDPR.

f. For scientific or historical research purposes

AGES must conduct the research required to fulfil its tasks and impart relevant scientific knowledge. If personal data are further processed for this purpose, this is lawful pursuant to Section 9 (9) GESG. Further processing must always take place in pseudonymised form if the purposes can also be achieved in this way.

Legal basis: Section 9 (9) GESG and Art. 89 GDPR.

3. transfer of your personal data

Personal data may be passed on to authorities and international organisations, in particular on the basis of relevant legal obligations, as well as to service providers for the fulfilment of contracts. In all cases, we ensure that a standardised level of data protection is guaranteed.

If this is necessary for the above-mentioned purposes, we will transfer your personal data to the following categories of recipients

• IT service providers used by us;
• Social insurance organisations;
• Hospitals;
• Ministries;
• Authorities (tax office, labour market service, etc.);
• Court of Auditors.

If one of the above recipients is located outside your country or your personal data is processed there, we assure you that we will only transfer your personal data to countries for which the EU Commission has decided that they have an adequate level of data protection, or we will take measures to ensure that all recipients have an adequate level of data protection.

4 Data security/technical and organisational measures

AGES provides the following technical and organisational measures: Access control, system access control, data access control, data transfer control, ensuring system availability and resilience, control procedures to ensure the security of processing and personnel (training) measures.

5 Your rights in connection with personal data

Under applicable law, you are entitled to (if the relevant requirements of applicable law are met)

• request confirmation as to whether and which of your personal data we process and to receive copies of this data
• request the rectification or erasure of your personal data;
• request that we restrict the processing of your personal data;
• object to the processing of your personal data;
• withdraw any consent previously given for processing (the withdrawal of your consent will not affect the lawfulness of processing based on your consent before its withdrawal)
• to request data portability; and
• lodge a complaint with the data protection authority.

The following restrictions on the rights of data subjects are provided for by law:

Pursuant to Section 9 (8) GESG, the rights and obligations pursuant to Articles 13, 14, 18 and 21 of the General Data Protection Regulation are excluded by law in the fulfilment of the tasks pursuant to Section 8 GESG with regard to the processing of personal data.

Insofar as the personal reference is indispensable for the realisation of the purpose of further processing of personal data for scientific or historical research purposes, the rights of the data subjects pursuant to Article 15 (right of access), Article 16 (right to rectification), Article 18 (right to restriction of processing) and Article 21 (right to object) may be excluded by AGES if these rights would make it impossible or seriously impair the realisation of the specific purposes (§ 9 para. 9 GESG).

6 Storage period

We store your personal data (i) for the duration of a contractual relationship. Longer storage will only take place (ii) as long as statutory retention obligations exist or (iii) as long as any legal claims for the assertion or defence of which the personal data is required are not yet time-barred, or (iv) you have given us your express consent to do so.

Personal data is always deleted or anonymised in accordance with a deletion concept after the purpose has been fulfilled or the statutory retention period has expired.

If you contact us using the form on the website or by e-mail, the data you provide will be stored for the duration of the processing of your enquiry and in the event of follow-up questions. It will then be deleted. We do not pass on data without your consent.

The storage duration of cookies can be found in the cookie settings under point 8.

There is no deletion obligation if processing is necessary for the following purposes

• To exercise the right to freedom of expression and information,
• To fulfil a legal obligation,
• For reasons of public interest in the area of public health pursuant to Art. 9 (2) (h) and (i) and Art. 9 (3) GDPR,
• For archiving purposes in the public interest, scientific or historical research purposes or statistical purposes in accordance with Art 89 para. 1 GDPR, insofar as the right referred to in para. 1 is likely to render impossible or seriously impair the achievement of the objectives of this agreement, or
• For the establishment, exercise or defence of legal claims.

7. possibility to contact us

If you have any questions about the processing of your personal data, these can be directed to the Data Protection Officer or the Data Protection Committee of AGES via datenschutz@ages.at.

8. cookies

Our website uses so-called cookies. These are small text files that are stored on your end device with the help of the browser. They do not cause any damage.
We use cookies to make our website more user-friendly. Some cookies remain stored on your end device until you delete them. They enable us to recognise your browser on your next visit.

It is possible to object to the collection, processing and use of the data listed for the purposes mentioned by clicking on the link below. This will cause "webstatistik.ages.at" to set a cookie called "piwik_ignore". As long as the data storage is objected to, this cookie may not be deleted. If you use a different computer or a different web browser, you must complete the deactivation procedure again.

If you do not wish to do this, you can set up your browser so that it informs you about the setting of cookies and you only allow this in individual cases.

If you deactivate cookies, the functionality of our website may be restricted.