In accordance with the provisions of the General Data Protection Regulation (GDPR) and the Datenschutzgesetz (Austrian Data Protection Act, DSG), this declaration is intended to explain to you what personal data (now “data”) the Natural History Museum Vienna, Scientific Institution under Public Law, Burgring 7, 1010 Vienna, as the controller (“we”), collects from you or about you, how the data is used and the rights you have in this regard.

The protection of your data is important to us; thus, we comply with the legal requirements and process personal data only in accordance with the legal provisions.

We have taken appropriate technical and organisational measures to ensure that all legal requirements under applicable data protection law are observed both by us and by our service providers whom we require in some areas to process your data (processors).

The permanent technical development of the Internet as well as possible changes in the legal framework may make it necessary to adapt our privacy notice from time to time. We therefore reserve the right to adapt this notice accordingly. All changes apply from the time of publication on our website.

Technical partners

In order to operate our website, we use technical partners who support us in the creation and operation of the website. In some cases, these partners need access to data in order to carry out their activities; however, they will not process the data unless necessary.

Automatic data storage

To enable correct operation of the website it is technically necessary to process certain information. These data are processed to optimize the website, to correct errors, and to protect the website against attacks; therefore, processing is based on the legitimate interest of the controller in accordance with Art. 6 para. 1 lit. f GDPR.

The data collected are:

• your browser and browser version
• your operating system
• the referring URL
• date and time of your visit
• the quantity of data sent (upload/download volume).

Log files containing these data are stored for 7 days and are then automatically deleted. We access data only if necessary for the integrity of our website or in case of suspicion of illegal behaviour. In this case, the data may be passed on to the relevant authorities.

TLS encryption with https

In order to secure online transmission of data in accordance with the principles of privacy by design and privacy by default, we use TLS (Transport Layer Security), an encryption protocol that strengthens the protection of data. This protection is recognizable by the lock symbol left to the web address and the use of the https scheme (instead of http) or you can find this in the settings left to the web address.

Cookies

Our website uses so-called cookies. These are small text files that are stored on your end device through the browser. They do not cause any damage, no personal data such as your name or address is stored and we cannot identify you on the basis of this information.

There are different types of cookies: first-party cookies are created by our website; third-party cookies are created by other websites.

Cookies are also classified according to their category, e.g. essential cookies to ensure basic website functions or targeted cookies to improve the user experience.

When you visit our website, we generally ask for your consent in accordance with Art. 6 para. 1 lit. a GDPR to set non-necessary cookies. Please note that the functionality of our website may be impaired if you do not give your consent for the non-necessary cookies.

The necessary cookies will be set by us on the basis of the legitimate interest in accordance with Art. 6 para. 1 lit. f GDPR, whereby the legitimate interest is to secure and optimise the web presence.

We set the following necessary cookies:

• kulturpool-cookie-consent (saves settings for cookies)

Integrated services

Regarding the integrated services (Sketchfab, OpenStreetMap, Marker.io and bunny.net), your data will be transmitted on the basis of your cookie consent in accordance with Art. 6 para. 1 lit. a GDPR, which you provide through the click in our cookie banner.

We would like to point out that the US is a non-secure third country in terms of data protection law and that you do not have the same rights with regard to your data as in Europe. In the US, there are no suitable guarantees with regard to data transfer. By accepting the setting of cookies, you accept in accordance with Art. 49 para. 1 lit. a GDPR that this transmission will nevertheless be carried out. With your consent, the data will be processed by the respective service provider as controller and will not fall within the control or influence of the NHM Vienna.

Sketchfab

The integration of 3D models on our website is done through embedding an iframe from Sketchfab, a service from Sketchfab, Inc 9th Ave, Suite 1700, New York, NY 10001, USA, with their European establishment Sketchfab, 3 Rue d’Uzès, 75002, Paris, France. Sketchfab processes data when you access 3D models from Sketchfab on our website. If you have a Sketchfab account, the generated data can be associated with your personal account.

For more information on data processing from Sketchfab, please visit
https://sketchfab.com/privacy

Sketchfab sets the following cookies, if you have permitted them:

• sb_csrftoken

OpenStreetMap

In order to show you locations of content in Kulturpool, maps provided by OpenStreetMap are displayed on some pages. OpenStreetMap is a mapping tool from the OpenStreetMap Foundation, St. John’s Innovation Centre, Cowley Road, Cambridge, CB4 0WS, Großbritannien.

OpenStreetMap is integrated into Kulturpool via an iframe to display the map images.

If you have given your consent, personal data (including your IP address, browser and device type, the referring website, date and time of access and the pages accessed on OpenStreetMap) will be collected by OpenStreetMap.

Further information on data processing by OpenStreetMap can be found at:
https://osmfoundation.org/wiki/Privacy_Policy

Marker.io

For the continuous improvement of Kulturpool, we use the tool Marker.io, from Marker.io SRL, Quai Paul Verlaine 2 – box 2, 6000 Charleroi, Belgium, to collect your feedback or bug reports.

Marker.io allows you to provide detailed feedback, including visual annotations. If you have given your consent, Marker.io may collect certain information from your screen. Your name and e-mail address are required for the transmission, which you provide by entering in the form.

By using Marker.io to submit feedback or bug reports, you acknowledge and consent to the collection and processing of the aforementioned data.

Further information on data processing by Marker.io can be found at:
https://marker.io/privacy

Bunny.net

Videos are integrated on our website by means of iframe via the bunny.net service of BunnyWay d.o.o. Dunjaska cesta 165, 1000 Ljubljana, Slovenia.

When you access a website with an embedded video, information about your IP address, browser and device type, operating system and interaction with the video is passed on to bunny.net.

Information about quality, error messages, buffering metrics, etc. is also sent back to bunny.net to ensure good performance.

You can find more information about bunny.net's data processing at:
https://bunny.net/privacy/

Data you transmit electronically in order to contact us, such as name, e-mail address, address or other personal details to the extent relevant for the processing of the enquiry, as well as data contained in the transmission of an e-mail, will only be used by us for the purpose stated in each case, in particular to answer your enquiry.

We use your personal data only to process your communication on the basis of your enquiry (legitimate interest according to Art. 6 para. 1 lit. f GDPR whereby the legitimate interest is communication with customers). We will not pass on your personal data without your consent, except if this is necessary for the processing of your inquiry. Furthermore, in the event of illegal behaviour, the data may be made available for inspection. Your data may be passed on to transporters (e.g. the Austrian Post) if this is necessary for the fulfilment of the contract with you.

In a (pre-)contractual relationship with the Natural History Museum, e.g. for individual events, the data of contact persons and contractual partners are processed. For this purpose, we process name, address, e-mail address and telephone number, on the basis of Art. 6 para. 1 lit. b GDPR for the fulfilment of the contract or, after completion of the contract in accordance with Art. 6 para. 1 lit. c GDPR on the basis of the compliance with legal provisions such as storage obligations.

The data from the contractual relationship are processed until the fulfilment of the contract and beyond this until the expiry of the statutory retention period.

We would like to point out that the transmission of information via the Internet involves risks which we cannot influence or reduce. If you send us data by e-mail, we cannot guarantee secure transmission and the protection of your data. We recommend that you never send confidential data by e-mail without encryption. You are aware of this risk and we are not liable for any loss or unauthorized access outside our sphere.

This website uses the open-source software for web analysis Matomo (www.matomo.org) to collect data for the purpose of marketing and optimization.

Using the collected data, a user profile is generated under a pseudonym. Cookies are used for this process (for more details see Point 1, “Cookies”) and usage information is sent, whereby your IP address is immediately anonymized. Therefore, no personalized data is stored for statistical analysis.

The collected data (including your anonymized IP address) are solely transferred to our server and stored for the purpose of usage analysis, which helps us optimize our website. You can find information on the cookies that are used by Matomo here: https://matomo.org/privacy-policy/.

The legal basis for the processing of personal data of the users is Art. 6 para. 1 lit. c GDPR.

Data are deleted as soon as they are not used anymore for record-keeping purposes.

Cookies are stored on your end device and from there transmitted to us. Therefore, you have full control over the use of your cookies. Through changing the settings in your browser, you can deactivate or restrict the transmission of cookies. This can also be done automatically. If cookies are deactivated for our website, you might no longer be able to use all the features to their full extent on our website.

In accordance with Articles 15-18, 20, and 21 GDPR, you have the right of access, rectification, erasure, restriction of processing, portability and objection against the processing of your data. However, these rights are excluded in accordance with Sec. 2d para. 6 of the Austrian Research Organization Act if the processing is carried out for purposes in accordance with Art. 89 para. 1 GDPR (processing for archiving purposes in the public interest, scientific or historical research purposes, or statistical purposes) and if this purpose is rendered impossible or seriously impaired by the exercise of your rights.

If you have questions on the processing of your data by the NHM Vienna or wish to exercise one or more of the listed rights, please contact us

via email at datenschutz@nhm-wien.ac.at
or by mail to: Natural History Museum Vienna, attn. Data Protection Officer, Burgring 7, 1010 Vienna.

If you believe that the processing of your data violates applicable law or that your rights/interests have been infringed, you can launch a complaint with the Austrian Data Protection Authority.