Data protection information

for users and visitors of the Austrian National Library, as well as for those interested in the services offered (including marketing).

The Austrian National Library, Josefsplatz 1, 1015 Vienna, a federal scientific institution under public law with company registration number 221029v of the Commercial Court of Vienna, P.O. Box 25, Tel.: +43 1 534 10, Fax: +43 1 534 10-280, Mail: onb[at]onb.ac.at, respects and protects the rights to data protection and privacy of its users, visitors and interested parties and takes all measures required by law to protect their personal data. The Austrian National Library is the "controller" under data protection law with regard to the processing activities of personal data described below. The Data Protection Officer of the Austrian National Library can be contacted at datenschutz@onb.ac.at and by post at Österreichische Nationalbibliothek, Josefsplatz 1, 1015 Vienna, Attn: Data Protection Officer.

In the following, this data protection information will give you a quick and easy overview of which personal data of you as a user, visitor and/or interested party of the services (both online and offline) of the Austrian National Library are processed for which purposes and on which legal basis. Furthermore, we inform you about the (possible) recipients of your data and your rights under data protection law, the so-called data subject rights.

1. administration of visitors to museum facilities and users of library facilities (Library at Heldenplatz and Collections) of the Austrian National Library, including ticket store, reading room ordering, local lending, interlibrary loan, WLAN registration and special authorizations

1.1 Interested parties and then visitors/users can register to visit or use the museum and library facilities of the Austrian National Library. According to the Library and Museum Regulations of the Austrian National Library based on the Federal Museums Act 2002 and the Library Regulations of the Austrian National Library, special authorizations are required for the use of certain services, e.g. for the use of the Researchers' Reading Room or for the authorization for local lending.

1.2. The Austrian National Library processes the data provided by users / visitors (for library users including photo, proof of registration and photo ID, proof of graduation and research project) and their change history, the user ID (generated in the administration system), in the area of the library at Heldenplatz and special area researcher reading room also entry and exit (turnstile), special permits, order and borrowing data (for the loan of valuable objects possibly also the signature), including deposit and related payment data (bank details and voucher data including any reminder data) and any proof of necessity, as well as other billing data, for the fulfillment of contractual obligations and/or to carry out pre-contractual measures, which take place at the request of the data subject, namely registration (Art. 6 para. 1 lit. b DSGVO iVm Library and Museum Regulations of the Austrian National Library). The provision of the data is necessary for the conclusion of the contract and if it is not provided, neither registration nor use or ordering can be carried out.

1.3 In order to provide the service, the Austrian National Library uses the IT service providers Amepheas GmbH, SER Solutions Österreich GmbH, each based in Vienna, the company Gantner Electronic GmbH Deutschland, based in Bochum, and picturemaxx AG, based in Munich, for user/visitor administration, which receive access to the above-mentioned data within the scope of maintenance services. If payment is made by credit card, the user's personal data will be collected via the web store and transmitted to the payment service provider Payone GmbH, based in Vienna and Frankfurt/Main, for payment processing. The data protection information of Payone GmbH is available at https://www.payone.com/DE-de/dsgvo. In the library area, user data is also transferred via interface from the master data management in Amepheas to the library system Alma, operated by the IT service provider ExLibris GmbH, based in Germany, in the course of registration for the purpose of online stock ordering. The Austrian National Library has concluded appropriate data protection agreements with all service providers so that the users' data is processed lawfully and securely.

1.4 The personal data of users will be stored for three years after the expiration of the user authorization (annual pass) and for seven years in the case of visitors / users in connection with payment and thus tax-relevant data (Art 6 para 1 lit c DSGVO in conjunction with § 132 BAO and also the accounting guideline for federal museums). Access to the library is automatically deleted after 8 weeks at the latest.

2. online orders of reproductions

2.1 Interested parties and then users can register online to order reproductions of holdings of the Austrian National Library (picture archive, other reproductions).

2.2 The Austrian National Library processes the data provided by users and the billing data and related payment data (bank details and voucher data including any reminder data) and any correspondence data in this context for contractual performance or for the implementation of pre-contractual measures, which take place at the request of users, namely registration (Art. 6 para. 1 lit. b DSGVO in conjunction with the Library and Museum Regulations of the Austrian National Library). The provision of the data is necessary in connection with the conclusion or execution of the contract, and if it is not provided, neither registration nor an order or the contract can be executed.

2.3 In order to provide the service, the Austrian National Library uses in particular the IT service providers Mesonic Datenverarbeitung Ges.mbH, based in Mauerbach, Lower Austria, and picturemaxx AG, based in Munich, which may receive access to the above data in the course of maintenance services. If payment is made by credit card, the user's personal data will be collected via the webshop and transmitted to the payment service provider Payone GmbH, based in Vienna and Frankfurt/Main, for payment processing. The data protection information of Payone GmbH is available at www.payone.com/DE-de/dsgvo. The Austrian National Library has concluded corresponding data protection agreements with all service providers so that the users' data is processed lawfully and securely.

2.4 The personal data of the users are stored in connection with the registration in the system and in connection with the order contract for the duration of the contract and seven years thereafter (Art 6 para 1 lit c DSGVO in conjunction with § 132 BAO and also the accounting guidelines for federal museums).

3. website of the Austrian National Library, including cookie management, information services ("LibraryH3lp", "OTRS") and WebApp.

3.1 Interested parties and visitors/users can access information from and about the Austrian National Library on its website at www.onb.ac.at. The Austrian National Library uses various cookies for this purpose. Different cookies are used for this purpose, whereby you can decide for yourself at any time on the scope of their use or change the corresponding selections within the framework of the cookie settings, where these cookies are listed in detail according to the respective purpose of use of the cookies. Functionally, a distinction must be made between session cookies and persistent cookies:

Session Cookies:In order to enable you to use our web offer, we use so-called session cookies, which are stored in the RAM of your computer. A randomly generated identification number (session ID) is stored in a session cookie, and it also contains information about its origin and storage period. However, session cookies cannot store any other data.
   
Session cookies are required by our server to keep the requests of different visitors apart. Blocking these cookies may prevent various features of our website from working properly. Session cookies do not allow us to view files on your computer. They are also automatically deleted after your session ends, i.e., after you close the browser window.

Persistent Cookies:

Persistent (permanent) cookies are not deleted after you close your browser, but remain stored on your computer. These cookies also cannot be used to read data from your computer. A persistent cookie is used by our website to retain settings you have made once (e.g. regarding your screen display) the next time you access the site. We do not use this cookie for evaluation or tracking purposes. Other persistent cookies are set by various other providers (exlibrisgroup.com, wikipedia.org, google.com, obvsg.at) when you use their additional services that are offered on our websites. We have no influence on these providers and do not use these cookies for our own purposes.

Your IP (Internet Protocol) address is transmitted every time you connect to our website or mobile app. It is mandatory to indicate to the server where to send its responses.
When connecting to our website, all IP addresses and the associated requests are logged with us in order to be able to investigate attacks on our website in the event of an incident. The accesses are also evaluated for statistical purposes. These logs are deleted after four weeks at the latest.

Recorded are:
- IP address
- date and time of the request
- Web browser and operating system used
- access method
- requested URL
- page from which the file was requested
- access status (file transferred, file not found, etc.)
- amount of data transferred

We use data from registrations and inquiries to better tailor our content and websites to the needs of our visitors / users. The data is summarized and anonymized using statistical methods. No individual user profiles are formed or personal data forwarded to third parties. The data is processed on the basis of the legitimate interests of the Austrian National Library, whereby the interests or fundamental rights and freedoms of the visitors/users - already due to the aggregated or anonymized further processing - do not prevail (Art. 6 para. 1 lit. f DSGVO), whereby in the case of a predominant interest of the visitors/users, they have the right to object (see below on the rights of data subjects).

3.2 The Austrian National Library also offers a chat ("LibraryH3lp") and request forms ("OTRS") as an information service. In the context of this, the data provided by the requester, as well as the IP address and website of the access, guest number, time and duration are processed for the contractual fulfillment of the service (Art. 6 para. 1 lit. b DSGVO). The provision of the data is necessary for the service provision and if not provided, the service cannot be used.

In order to provide the "LibraryH3lp" service, the Austrian National Library uses the IT service provider Nub Games, Inc, based in the USA, which may have access to the above-mentioned data in the course of maintenance services. In the absence of a data protection adequacy decision by the European Commission for the USA, the Austrian National Library has concluded appropriate individual data protection agreements with the service provider (so-called "Standard Contractual Clauses - SCC" adopted by the European Commission), which ensure suitable and appropriate data protection guarantees so that the users' data is processed lawfully and securely. A copy of the SCC concluded with the service provider can be requested at datenschutz[at]onb.ac.at.

3.3 In order to provide the "OTRS" service, the Austrian National Library uses the IT service provider graz4u, based in Graz, which may have access to the above-mentioned data in the course of maintenance services. The Austrian National Library has concluded appropriate data protection agreements with the service provider so that the data of interested parties is processed lawfully and securely. The data will be stored until revoked, in any case for a maximum of seven years.

The data of the requesters of the "LibraryH3lp" service will be stored until one month after the chat on the basis of the legitimate interests of the Austrian National Library to make chats traceable in retrospect under certain circumstances, whereby the interests or fundamental rights and freedoms of the requesters do not prevail (Art. 6 para. 1 lit. f DSGVO), whereby in the event of a prevailing interest of the requesters, they have a right of objection (see below on the rights of data subjects).

4. marketing and PR of the Austrian National Library, including information and events, e-newsletters, social media plug-ins and integrated services.

4.1 The Austrian National Library provides interested parties and stakeholders with information on its services and events and processes their data in this context, namely name and contact details, categories of interested parties and stakeholders and information history, on the legal basis of the legitimate interests of the Austrian National Library, whereby the interests or fundamental rights and freedoms of the interested parties and stakeholders are not affected (Art. 6 para. 1 lit. f DSGVO), otherwise the data subjects have a right to object - see below on data subject rights. Any provision of data by interested parties and stakeholders may be necessary in order to target the information accordingly. In order to send the information, the Austrian National Library uses a service provider who has access to sending data. The Austrian National Library has concluded corresponding data protection agreements so that the data of interested parties and stakeholders are processed lawfully and securely. The data is stored until the objection is made or until three years after the last contact.

4.2 Interested parties can register with the Austrian National Library for newsletters by providing their data, namely name and contact details, i.e. by giving their consent (Art. 6 para. 1 lit. a DSGVO) to receive corresponding newsletters from the Austrian National Library, whereby the corresponding newsletter selection, dispatch history and any incorrect deliveries are also processed. The provision of the data is required and if not provided, the corresponding newsletters cannot be received. As part of the consent, the subscribers are also informed about the process for revocation, which is possible at any time, and a link to unsubscribe is also included in each newsletter. For the administration and sending of the newsletters, the Austrian National Library uses the IT service provider eyepin GmbH, based in Vienna, which may have access to the above-mentioned data in the course of maintenance services. The Austrian National Library has concluded corresponding data protection agreements so that the data of the interested parties are processed lawfully and securely. The data will be stored until revoked.

4.3 Interested parties may follow, comment on, subscribe to or "like" the Austrian National Library on its social media sites Facebook and Instagram. Accordingly, the data provided or shared by interested parties on Facebook or Instagram will be generally accessible. The legal basis is the consent of the interested party (Art. 6 para. 1 lit. a DSGVO). The provision of personal data is not required to merely follow the presence of the Austrian National Library. For these websites (Facebook and Instagram), the Austrian National Library uses the service provider Meta Platforms Ireland Limited, based in Ireland, which has access to the above-mentioned data.

Third-party services are also integrated on the website of the Austrian National Library (YouTube, Vimeo and Google Maps). By making a corresponding selection in the cookie settings, interested parties have the option of using these services, whereby data from interested parties may be transmitted to the third party providers on the basis of their consent pursuant to Art. 6 Para. 1 lit. a, which is granted by clicking on the corresponding button in the cookie settings.

Please note that the use of Facebook, Instagram and third-party services may result in data transfer to the USA and that the USA is not considered a safe third country under data protection law. The USA is not subject to an adequacy decision of the European Commission and does not have a level of data protection equivalent to the standards of the EU. For example, intelligence services in the USA can access data without the data subjects being informed or being able to take legal action against this. If interested parties use our Facebook/Instagram offers or accept cookies from our third-party providers, they accept (Art. 49 para.1 lit.a DSGVO) that this transfer will be carried out anyway. The Austrian National Library points out that, where applicable, the data is processed by the respective service provider as the responsible party, and that this processing is beyond the control of the Austrian National Library. Further information on the data processing of these service providers can be found at:

Facebook: https://www.facebook.com/privacy/policy/

Instagram: https://privacycenter.instagram.com/policy/

YouTube: https://www.google.com/intl/de/policies/privacy/

Vimeo: https://vimeo.com/privacy

Google: https://policies.google.com/privacy

4.4 Apart from the offers of third parties (see point 4.3), our website partly references externally hosted content. For technical reasons, it is not possible to avoid, with reasonable effort, the external referencing that takes place when the pages in question are called up. This affects the virtual representations of our museums ("Museen Digital"), which enables a virtual tour of the State Hall of the Austrian National Library and our museums. This content was developed by BEKO Engineering & Informatik GmbH, Nöhagen, Austria ("BEKO Solutions") in cooperation with the company Matterport Inc., Sunnyvale, California, in the USA. When visiting pages on our website that provide this content, an external referencing to BEKO Solutions takes place, i.e. the content is transmitted by BEKO Solutions directly to your browser and BEKO Solutions thereby receives the information that you have accessed the corresponding page of our web content. As this transmission is direct, we have no influence on the transmitted data, for the processing of which BEKO Solutions is the controller within the meaning of the GDPR. Information on data processing by BEKO Solutions can be found at https://www.beko-solutions.at/datenschutz/.

For information on the rights of data subjects (information, data correction, data deletion, restriction of processing or objection to processing, data portability, right of complaint), please see point 6 below.

In accordance with its legal obligation under the Whistleblower Protection Act (HSchG), the Austrian National Library has established a reporting office in certain legally defined legal areas (e.g., public procurement law, data protection, criminal law relating to corruption) (Imprint). This internal reporting channel is operated externally by Sage GmbH. Reports via this channel are forwarded to the Austrian National Library exclusively in anonymized form and only if they fall within the scope of the HSchG. Data subject rights under data protection law, in particular the right to information or the right to delete reports submitted via this reporting channel, must therefore be asserted against the operator of this reporting office (Sage GmbH).

5. contractual partners and cooperations, including internal reporting channel according to the Whistleblower Protection Act (HSchG).

Personal data of our contractual partners and interested parties are processed by the Austrian National Library on the legal basis of Art. 6 (1) lit b DSGVO for the purpose of providing the contractual or pre-contractual services or for the exercise of legitimate interests (archive and documentation purposes). The type and scope of the processed data depend on the purpose and necessity of their processing as well as the underlying contractual relationship. The deletion of processed data takes place when they are no longer necessary for the pursuit of these purposes and for the fulfillment of contractual or legal obligations.

Data is only transferred to third parties if such transfer is required within the framework of a contract or is permitted by law. If the Austrian National Library uses service providers who work with personal data, it concludes commissioned data processing agreements in accordance with Art 28 DSGVO to ensure the confidential treatment of the data.

6. Information on the rights of data subjects under data protection law

6.1 Right to revoke consent: If the processing of your data by the Austrian National Library is based on your consent, you have the right to revoke your consent at any time without affecting the lawfulness of the processing carried out on the basis of the consent until revocation. Processes for declaring revocation are indicated in your individual declarations of consent to the Austrian National Library. You can also declare the revocation of the individual consents to the Austrian National Library as follows: by e-mail to datenschutz[at]onb.ac.at or by post with a letter to Österreichische Nationalbibliothek, Josefsplatz 1, 1015 Vienna, Attn: Data Protection Officer.

6.2.     Right of access: You have the right to request confirmation from the Austrian National Library as to whether personal data concerning you are being processed; if this is the case, you have the right to be informed of this personal data (copy of the personal data which are the subject of the processing) and to receive the following information from the Austrian National Library: (a) the purposes of the processing; (b) the categories of personal data processed; (c) the recipients or categories of recipients to whom the personal data have been or will be disclosed; (d) if possible, the planned duration for which the personal data will be stored or, if this is not possible, the criteria for determining this duration; (e) the existence of a right to rectification or erasure of personal data concerning them or to restriction of processing by the Austrian National Library or a right to object to such processing; (f) the existence of a right to lodge a complaint with a supervisory authority; (g) if the personal data are not collected from you, any available information on the origin of the data; (h) the (non-)existence of automated decision-making, including profiling. 

In this case, the Austrian National Library will provide a copy of the personal data that is the subject of the processing. For any further copies you request, the Austrian National Library may, under certain circumstances, charge an appropriate fee based on administrative costs. If you make the request electronically, the Austrian National Library shall provide the information in a commonly used electronic format, unless you specify otherwise.

6.3 Right to rectification and deletion: You have the right to demand that the Austrian National Library rectify any inaccurate personal data relating to you without delay. Taking into account the purposes of the processing, you have the right to request the completion of incomplete personal data - also by means of a supplementary declaration. Furthermore, you have the right to demand from the Austrian National Library that personal data concerning you be deleted without delay, and the Austrian National Library is obliged to delete personal data without delay, if one of the following reasons applies: (a) The personal data are no longer necessary for the purposes for which they were collected or otherwise processed. (b) You withdraw your consent on which the processing was based and there is no other legal basis for the processing. (c) They successfully object (see immediately below) to the processing. (d) The personal data have been processed unlawfully. (e) The erasure of the personal data is necessary for compliance with a legal obligation to which the Austrian National Library is subject.

 (f) the personal data was collected in relation to information society services offered (consent of a child). The right to erasure shall not apply in particular where processing is necessary for compliance with a legal obligation by the Austrian National Library and/or for the assertion, exercise or defence of legal claims.

6.4.     Right to restriction of processing: You have the right to request the Austrian National Library to restrict processing if one of the following conditions is met: (a) the accuracy of the personal data is/was contested by you for a period enabling the Austrian National Library to verify the accuracy of the personal data, (b) the processing is unlawful and you have objected to the erasure of the personal data and requested the restriction of the use of the personal data instead; (c) the Austrian National Library no longer needs the personal data for the purposes of the processing, but you need them after your duly substantiated statement for the assertion, exercise or defense of legal claims; or (d) you declare your objection to the processing, in which case the restriction will take place as long as it has not yet been determined whether the legitimate grounds of the Austrian National Library outweigh yours. If processing has been restricted, this personal data may - apart from being stored - only be processed with your consent or for the assertion, exercise or defense of legal claims or for the protection of the rights of another natural or legal person or for reasons of important public interest of the Union or a Member State. If you have obtained a restriction of processing, you will be informed by the Austrian National Library before the restriction is lifted.

6.5 Right to data portability: If the processing is based on consent or on a contract and the processing is carried out with the help of automated procedures, you have the right to receive the personal data concerning you that you have provided to the Austrian National Library in a structured, common and machine-readable format. When exercising your right to data portability, you have the right to obtain that the personal data be transferred directly from the Austrian National Library to another controller, where technically feasible.

6.6 Right to object: You have the right to object at any time, on grounds relating to your particular situation, to the processing of personal data concerning you which is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the Austrian National Library or necessary for the protection of the legitimate interests of the Austrian National Library or a third party. The Austrian National Library shall then no longer process the personal data, unless the Austrian National Library can demonstrate compelling legitimate grounds for the processing which override your interests, rights and freedoms, or for the assertion, exercise or defense of legal claims. If personal data are processed for the purpose of direct marketing, you have the right to object at any time to processing of personal data concerning you for the purpose of such marketing. If you object to processing for direct marketing purposes, the personal data will no longer be processed for these purposes.

6.7 Right of appeal to the supervisory authority: Without prejudice to any other administrative or judicial remedy, you have the right to lodge a complaint with a supervisory authority, in particular in the Member State of your residence, your place of work or the place of the alleged infringement, if you believe that the processing of personal data relating to you is in breach of the law. The Austrian Data Protection Authority can be reached at: Barichgasse 40-42, 1030 Vienna, phone: +43 1 52 152-25 69, e-mail: dsb[at]dsb.gv.at, website: www.dsb.gv.at

Status of information: July 2023