The Austrian Agency for Health and Food Safety GmbH (AGES) handles your personal data very carefully and the following data protection information is intended to give you an overview of how your data is processed in connection with your visit to our website, in the performance of the tasks assigned to us, as well as when you use our services. We process your data exclusively on an existing legal basis and in compliance with the legal provisions.

The data controller is the Austrian Agency for Health and Food Safety GmbH, Spargelfeldstraße 191, 1220 Vienna.

The AGES data protection officer can be contacted at datenschutz@ages.at.

1. categories of data processed

Personal data are data and information that are traceable to an identified or identifiable individual. Examples: Name, address, telephone number, e-mail, profession, education, health data, hobbies, IP address, etc.

Depending on the specific processing purpose, in particular inventory data, customer data, contact data, order data, health data, communication data and image data are processed.

In the course of your visit to this website and the processing of your inquiries via this website, we collect the categories of personal data listed in the Annex. We collect this data by you providing it to us through your use of this website as well as in the course of your inquiries themselves. There is no obligation to provide us with this personal data. However, you will not be able to use all the features of this website or we will not be able to respond to your inquiries if you do not provide your personal data.

Should the provision of your data be legally obligatory in some cases, we will inform you of this separately.

We do not make any automated individual decisions that would have legal effects for you or would significantly affect you in a similar way.

2 Legal basis and purposes of data processing

The processing of your personal data is based on the following legal bases:

a. legal obligation and public interest.

The tasks of AGES are defined in Section 8 of the Health and Food Safety Act (GESG), Federal Law Gazette I No. 63/2002 as amended. In the performance of these tasks, AGES is entitled to process personal data pursuant to Section 9 (7) GESG.

In addition, personal data are processed on the basis of legal obligations resulting in particular from relevant material laws, labor and social law as well as financial and tax law provisions.

Legal basis: Art. 6 para 1 lit c and lit e. as well as Art. 9 para 2 lit b DSGVO.

b. Fulfillment of a (preliminary) contract

Personal data is processed for the purpose of fulfilling (pre)contractual obligations. The personal data disclosed by you in this context are essential for the fulfillment of the contract, such as the performance of a contract analysis, a drinking water analysis, a soil analysis, a consulting service or any other service.

Legal basis: Art. 6 para 1 lit b DSGVO

c. Consent

The processing of personal data is also lawful if there is a legally valid consent of the data subject. On the basis of your granted consents, we process personal data, among other things, for sending newsletters or process your contact requests. Consents granted can be revoked informally at any time. The revocation of consent does not affect the lawfulness of the processing carried out on the basis of the consent until the revocation.

Legal basis: Art. 6 para 1 lit a and Art. 9 para 2 lit a DSGVO.

d. Legitimate interest

On the basis of the overriding legitimate interest, AGES processes, among other things, personal data for the purpose of direct advertising, to improve and further develop this website, to be able to detect, prevent and investigate attacks on our website, as well as to be able to ensure smooth IT operation and IT security.

Legal basis: Art. 6 para 1 lit f DSGVO.

e. Public interest in the area of public health

AGES is required by law to perform tasks in the area of public health in the interest of the general welfare. In this context, personal data may be lawfully processed for reasons of public interest in the area of public health, such as protection against serious cross-border health threats or to ensure high standards of quality and safety in health care and medicinal products and medical devices.

Legal basis: Art. 9 para 2 lit i DSGVO.

f. For scientific or historical research purposes.

AGES must conduct the research necessary to fulfill its tasks and provide relevant scientific knowledge. If personal data are further processed for this purpose, this is lawful pursuant to Art. 9 (9) GESG. In principle, further processing must be carried out in pseudonymous form if the purposes can also be achieved in this way.

Legal basis: § 9 Abs 9 GESG as well as Art. 89 DSGVO.

3. transfer of your personal data

Personal data may be transferred to authorities and international organizations in particular on the basis of relevant legal obligations, as well as to service providers for the performance of contracts. In all cases, we ensure that a consistent level of data protection is guaranteed.

To the extent necessary for the above purposes, we will transfer your personal data to the following categories of recipients:

• IT service providers used by us;
• Social security institutions;
• hospitals
• Ministries
• Authorities (tax office, labor market service, etc.);
• Court of Auditors;

If one of the above recipients is located outside your country or your personal data is processed there, we assure you that we will only transfer your personal data to countries for which the EU Commission has decided that they have an adequate level of data protection or we take measures to ensure that all recipients have an adequate level of data protection.

4 Data security/technical and organizational measures

AGES provides for the following technical and organizational measures: Access control, system access control, data access control, data transmission control, ensuring availability and resilience of the system, control procedures to ensure security of processing, and personnel (training) measures.

5. your rights in connection with personal data

Under applicable law, you are entitled to (if the respective requirements of the applicable law are met),

• request confirmation as to whether and which of your personal data we are processing and to receive copies of such data;
• To request the rectification or erasure of your personal data;
• To request us to restrict the processing of your personal data;
• Object to the processing of your personal data;
• Revoke consent previously given for processing, if any (revocation of your consent will not affect the lawfulness of processing carried out on the basis of your consent prior to its revocation);
• request data portability; and
• To lodge a complaint with the data protection authority.

The following restriction of data subject rights are provided for by law:

In the performance of the tasks pursuant to Section 8 GESG, the rights and obligations pursuant to Articles 13, 14, 18 and 21 of the General Data Protection Regulation are excluded by law with regard to the processing of personal data pursuant to Section 8 (7).

Insofar as the personal reference is indispensable for the achievement of the purpose in the case of further processing of personal data for scientific or historical research purposes, the rights of the data subjects pursuant to Article 15 (right to information), Article 16 (right to rectification), Article 18 (right to restriction of processing) and Article 21 (right to object) may be excluded by AGES, insofar as these rights would make the achievement of the specific purposes impossible or seriously impair them.

6. storage period

We store your personal data (i) for the duration of a contractual relationship. Longer storage will only take place (ii) as long as there are legal obligations to retain data or (iii) as long as any legal claims have not yet become time-barred, for the assertion of which or the defense against which the personal data are required, or (iv) you have given us your express consent for this.

Personal data will generally be deleted or anonymized in accordance with a deletion concept after the purpose has been fulfilled or the legal retention period has ended.

If you contact us by form on the website or by e-mail, the data you provide will be stored for the duration of processing your request and in case of follow-up questions. After that, they will be deleted. We do not pass on data without your consent.

The storage period of the cookies can be found in the cookie settings under point 8.

There is no obligation to delete data if processing is necessary for the following purposes:

• To exercise the right to freedom of expression and information,
• To fulfill a legal obligation
• For reasons of public interest in the area of public health according to Art 9 (2) (h) and (i) and Art 9 (3) DSGVO.
• For archival, scientific or historical research purposes in the public interest or for statistical purposes pursuant to Art 89 (1) DSGVO, to the extent that the right referred to in (1) is likely to render impossible or seriously prejudice the achievement of the objectives of this Agreement, or
• For the assertion, exercise or defense of legal claims.

7. contact possibility

If you have any questions regarding the processing of your personal data, these can be directed to the Data Protection Officer or the AGES Data Protection Board via datenschutz@ages.at.

8. cookies

Our website uses so-called cookies. These are small text files that are stored on your end device with the help of the browser. They do not cause any damage. We use cookies to make our offer user-friendly. Some cookies remain stored on your end device until you delete them. They enable us to recognize your browser on your next visit.

It is possible to object to the collection, processing and use of the aforementioned data for the aforementioned purposes by clicking on the link below. This will cause "webstatistik.ages.at" to set a cookie called "piwik_ignore". As long as the data storage is objected to, this may not be deleted. If you use a different computer or a different web browser, you must complete the deactivation procedure again.

If you do not wish to do this, you can set up your browser so that it informs you about the setting of cookies and you only allow this in individual cases.

When deactivating cookies, the functionality of our website may be limited.

9. web analysis

Our website uses functions of the Matomo web analysis tool. Cookies are used for this purpose, which enables an analysis of the use of the website by your users. The information generated by this is transferred to the provider's server and stored there.

You can prevent this by setting your browser to not store cookies or by clicking on the link below.

10. newsletter

You have the possibility to subscribe to our newsletters via our website. The product warnings and product recalls newsletter is sent out depending on the publication of a product warning or product recall. Our AGES newsletter is published monthly.

For this purpose, we need your e-mail address and your consent that you agree to receive the newsletter. The legal basis for the aforementioned processing of your personal data is the consent you have given, which you can revoke at any time with immediate effect The consent is ensured by registering for the newsletter dispatch by means of the double-opt-in procedure and is logged for evidence purposes. The data you provide will only be processed for the purpose of sending the newsletter.

As soon as you have registered for the newsletter, we will send you a confirmation e-mail with a link to confirm your registration.

You can cancel your subscription to the newsletter at any time and thus revoke your consent. e.g. at the end of each newsletter by clicking on the link located there (https://www.ages.at/ages/presse/newsletter), or by informally unsubscribing at https://www.ages.at/ages/presse/newsletter . The revocation of consent does not affect the lawfulness of the processing carried out on the basis of the consent until the revocation.

11 Profiling

AGES does not engage in active profiling for automated decision-making.