Privacy policy

1. Controller

TEDxTUWien - Verein zur Unterstützung innovativer Ideen, Theresianumgasse 27, 1040 Wien, Österreich
Email: [email protected]
Data protection contact: Reinhard Kletter

No data protection officer has been appointed because Art. 37 GDPR does not require one.

2. Visiting the website, hosting and domain

The static pages are delivered via GitHub Pages (GitHub, Inc., 88 Colin P. Kelly Jr. Street, San Francisco, CA 94107, USA; part of Microsoft). When you open a page, the provider processes, as technically necessary, your IP address, date and time, the requested address and browser details (server logs) to deliver the page, keep it stable and prevent abuse. We ourselves have no access to these logs. Legal basis: legitimate interest in secure and stable operation (Art. 6(1)(f) GDPR). Transfers to the USA rely on the EU-US Data Privacy Framework or standard contractual clauses.

Traffic to the website additionally runs through the network of Cloudflare (Cloudflare, Inc., 101 Townsend St., San Francisco, CA 94107, USA), which acts as a reverse proxy: it delivers pages, provides the security certificate (HTTPS) and repels attacks. Cloudflare processes, as technically necessary, your IP address, date and time, the requested address and browser details. Legal basis: legitimate interest in secure, encrypted and stable delivery (Art. 6(1)(f) GDPR). Cloudflare processes the data on our behalf under its data processing addendum (DPA) including the EU standard contractual clauses; Cloudflare is also certified under the EU-US Data Privacy Framework.

The domain tedxtuwien.at is registered at one.com (Denmark); name resolution (DNS) is provided by Cloudflare.

Fonts and all content of the website are hosted locally; no content is loaded from third-party servers. A connection to third parties only arises when you click an external link (see “External links”).

3. Newsletter

Signing up: The “Subscribe” button opens your email program with a prepared message to [email protected]. Nothing is sent to us until you send that message. By sending it we receive your email address (and your name if it is part of the sender) and your consent to receive the newsletter. Providing it is voluntary, but without it we cannot send you the newsletter. Legal basis: consent (Art. 6(1)(a) GDPR; § 174 TKG 2021).

Processing: The message is stored in the association’s mailbox (see “Contact by email”). We add your address to our mailing list by hand and send the newsletter from that mailbox. You can unsubscribe at any time by writing to [email protected]; we then delete your address from the list. We keep the sign-up message only as long as needed to document your consent.

4. Contact by email

When you write to us (e.g. at [email protected]), we process your details (sender, content, time) to answer your request. Legal basis: pre-contractual or contractual steps (Art. 6(1)(b) GDPR) or our legitimate interest in handling enquiries (Art. 6(1)(f) GDPR). The association’s mailboxes run on Microsoft 365 (Microsoft Ireland Operations Ltd. / Microsoft Corporation) under the Microsoft data protection addendum; transfers outside the EU/EEA rely on standard contractual clauses and/or the EU-US Data Privacy Framework.

5. Speaker and team area

Speakers and team members can open a password-protected page with internal information (e.g. the schedule). The password is checked in your browser; it is not sent to us and we do not store any data about your login.

6. Cookies and similar technologies

This website sets no cookies and stores no information on your device (§ 165(3) TKG 2021). A cookie banner is therefore not needed.

7. External links

The website contains links to ticketing (Universe), YouTube, LinkedIn, Instagram, Facebook, X and Flickr. Data is only transferred to those providers once you click such a link; they are then themselves responsible for the processing and their privacy policies apply. This also applies to buying tickets at Universe.

8. Recipients and transfers to third countries

Recipients of your data are exclusively the service providers named above (GitHub for hosting, Cloudflare for delivery and name resolution, Microsoft for our email mailboxes) within their processing on our behalf and, where legally required, authorities. There is no passing on for advertising purposes. Where providers process data in the USA, the transfer relies on the EU-US Data Privacy Framework and/or the EU standard contractual clauses (Art. 44 et seq. GDPR).

9. Retention

The hosting provider keeps server logs according to its own periods. Newsletter data is stored until you withdraw consent or ask for deletion. We delete email correspondence once the request is handled and no statutory retention duty applies. Team member data is deleted once access is no longer needed.

10. Your rights

You have the right of access (Art. 15 GDPR), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20) and objection to processing based on legitimate interests (Art. 21), and the right to withdraw consent at any time with effect for the future (Art. 7(3)) without affecting the lawfulness of earlier processing. Write to [email protected]; we answer within one month.

If you believe the processing of your data violates data protection law, you can lodge a complaint with the supervisory authority (Art. 77 GDPR): Österreichische Datenschutzbehörde, Barichgasse 40–42, 1030 Vienna.

11. Obligation to provide data, automated decisions, security

Providing your data is neither legally nor contractually required; without an email address, however, we cannot send you a newsletter or answer your enquiry. There is no automated decision-making including profiling. The connection between your browser and the website is encrypted with HTTPS.

12. Changes

We update this policy when features of the website or the legal situation change. The version published here applies.