Information obligations under the GDPR
Privacy Policy
In the following privacy policy we inform you about the most important aspects of data processing on our website. We collect and process personal data only on the basis of the statutory provisions (General Data Protection Regulation, Austrian Telecommunications Act 2021).
The Stadtgemeinde Kitzbühel runs the Organ Academy not in the exercise of official authority but as a holder of private-law rights (private-sector administration, Art 116 (2) of the Austrian Federal Constitutional Act).
Where we base processing on our legitimate interest (Art 6 (1) (f) GDPR), this is therefore not processing carried out by a public authority in the performance of its tasks within the meaning of the second subparagraph of Art 6 (1) GDPR.
When you open our website, the web server of our hosting provider processes technical access data, including your IP address; details are set out in the section “Server log files”. The legal basis is our legitimate interest in the secure and uninterrupted operation of the website (Art 6 (1) (f) GDPR).
Beyond that we collect nothing when you merely view our pages. No analytics and no tracking take place, and no content is loaded from third-party servers.
Contacting us
If you contact us informally by e-mail or by telephone, we process the data you send us in order to deal with your enquiry and any follow-up questions (Art 6 (1) (f) GDPR — our legitimate interest in answering enquiries; Art 6 (1) (b) GDPR for enquiries concerning registration).
We delete such enquiries once they have been dealt with, and no later than six months after the last message, unless a statutory retention obligation applies.
Registrations submitted through the registration form are subject exclusively to the periods set out in the following section.
We do not pass your data on to third parties without your consent unless otherwise stated in this policy.
For the operation, maintenance and further development of the website and the registration administration we use an IT service provider (Info-Consult, David Zott); it manages the accounts for the registration administration and has an account of its own for this purpose, through which it can access the stored data.
It is a processor under Art 28 GDPR and bound by our instructions.
With our authorisation, our IT service provider has the website, the database and the CVs, the academy’s e-mail mailboxes and the sending of e-mail run by World4You Internet Services GmbH, Wolfgang-Pauli-Straße 2, BT3, 4020 Linz, Austria (“our hosting provider”).
As a further processor (Art 28(2) and (4) GDPR) it is bound by the same data protection obligations and stores the data on servers within the European Union.
Registration form
Via the registration form you send us
- your first and last name
- date of birth
- sex
- e-mail address
- international dialling code and telephone number
- postal address and country
- the name of your current teacher (lecturer or professor)
- the type of participation chosen
- your prepared programme
- for active participation the link to a video of your playing
- any further remarks and a curriculum vitae as a PDF file of no more than 10 MB.
We also ask how you heard about us. In addition we record the language in which you completed the form and which version of the general terms you agreed to, together with a technical identifier for your submission by which we recognise a registration sent twice as one and the same.
For the video of your playing we store only the link you provide. The video itself is held by the provider you have chosen (for example YouTube, Vimeo, Google Drive or Dropbox); the privacy terms of that provider apply to the storage there. We open the link in order to assess your application and delete it together with your application.
Unless stated otherwise below, we process this data to handle your registration and to run the Organ Academy (Art 6 (1) (b) GDPR). The application is stored in a database, the CV as a file in an area that cannot be reached from the internet.
In addition, the secretariat receives an e-mail containing the details you entered; the CV is attached to that e-mail, and for very large files the e-mail contains a reference to the protected administration area instead.
If our administration system cannot confirm receipt of a registration, for example because of a technical fault, the web server sends a copy of the details you entered, together with the CV (up to 8 MB), by e-mail to info@orgelakademie-kitzbuehel.at so that your registration is not lost (Art 6 (1) (b) GDPR).
This copy is deleted within the same periods as the other e-mails in the academy’s mailbox.
To avoid duplicate copies the server records only points in time and salted checksums for this purpose, never your details in clear text; they are disregarded after 24 hours and removed at the next operation.
After sending the form you will normally receive an automatic confirmation of receipt at the e-mail address provided. This confirmation does not constitute an acceptance of participation. If your submission is classified as possibly automated (see below), no confirmation of receipt is sent; the form tells you so in that case.
Your registration is processed in an administration system secured by password and two-factor authentication, to which only staff of the Organ Academy and our IT service provider (see “Contacting us”) have access.
We inform you of the outcome of the selection by e-mail and may add a personal note; a decision already communicated can be put right by a clearly marked correction message.
To organise the academy we compile internal lists from the registrations, for example lists of participants as a PDF or spreadsheet.
Outgoing e-mails are stored with their full text in a delivery queue so that they are neither lost nor sent twice in the event of a technical fault. These copies are deleted together with your application.
Please include in your CV only such information as is required to assess your musical qualifications.
We do not need special categories of personal data within the meaning of Art 9 GDPR — such as religion or belief, health or ethnic origin — for the selection process, nor do we need a photograph.
Where you nevertheless choose to provide such information, we process it solely in the context of your application on the basis of the explicit consent you thereby give (Art 9 (2) (a) GDPR) and delete it together with your application.
Complete application records are normally deleted three months after the end of the relevant academy season.
Data of accepted participants may be kept for longer only as a minimal record (name, country, participation type, season and acceptance date) where the purpose and legal basis have been documented and approved; such an archive is currently not in operation.
Otherwise these data are deleted after the same period. Earlier erasure can be requested at any time.
The registration fee and the course fee are transferred to an account of the Stadtgemeinde Kitzbühel. Through our bank we receive the name and account details of the person making the payment, the amount, the date and the payment reference.
We match the payment to your registration (Art 6 (1) (b) GDPR) and keep the accounting records for as long as the budgetary rules applicable to the municipality require (Art 6 (1) (c) GDPR); the deletion period stated above does not apply to these records, and earlier erasure is not possible in that respect.
When your application is deleted we remove the database record, the CV and the stored copies of the e-mails. Copies in the academy’s mailbox, files already downloaded and paper documents are deleted as an organisational task within the same periods; an automatic check of those copies is technically not possible.
So that the data can be restored after an incident (Art 32(1)(c) GDPR), we rely on the backups made by our hosting provider.
Every few days it backs up the website including the registration administration, the CVs and the error log, the database and the academy’s e-mail mailboxes, and it deletes each of these backups automatically after no more than 14 days.
In addition, before every technical intervention — for example an update of the registration administration or a deletion run — our IT service provider makes a complete backup of the database and the CVs and keeps it encrypted and separate from the server; it deletes each such backup as soon as the intervention has been completed successfully, and no later than one month afterwards.
We also take one export of the registration data per season, without the CVs, and keep it protected and separate from the server; it is deleted no later than together with the applications of that season.
An application or e-mail erased early may therefore still be contained in such a backup or in the export until those points in time; in live operation it is removed immediately.
To protect against abusive and automated submissions we process your IP address exclusively in pseudonymised form, as a hash value generated with a secret key from which the address cannot be determined without that key, together with the time (Art 6 (1) (f) GDPR — our legitimate interest in preventing misuse).
This happens at two points: as soon as you click into a field of the form and your browser requests a one-time key for it, and when you submit the form. The IP address itself is not stored in clear text.
For the same purpose our application evaluates technical characteristics of the submission when it is sent: whether the form’s markers were transmitted, how long it took to complete the form and how many fields were edited, whether the free-text fields contain links or formatting code or are identical to another application of this season, the size of the CV, whether the e-mail address or the video link is on a reserved test domain, and whether several registrations were received from the same internet connection within one day (Art 6 (1) (f) GDPR).
If the markers that every browser sends when the form is filled in are missing and further indications are present, the submission is not stored.
Where there is merely a suspicion, the application is stored but kept separately: you do not receive a confirmation of receipt, the secretariat receives the application with a note on the suspicion, and staff review it and can return it to normal processing at any time.
If a member of staff reports a stored submission as automated, it is likewise kept separately; e-mails to you that have not yet been sent are cancelled, those already sent are not affected.
Unless it is returned to normal processing, an application kept separately in this way is finally deleted from our administration system, together with the CV and the stored copies of e-mails, 30 days after it was classified; we delete the related e-mails to the secretariat from the mailbox no later than that date.
No decision on admission to the academy is taken in this process.
The one-time key expires two hours after it was issued; the values used to limit submission frequency are no longer needed after 24 hours. Both are removed by the next clean-up run, which takes place whenever a one-time key is issued.
Logins to the administration area, downloads of CVs, exports and all changes are logged without the content of the application; these logs are deleted after 24 months.
The deletion periods for applications, the separate archive, the logs of the administration area and the error log are implemented by an automatic maintenance run, which takes place at most once a day, is triggered by use of the registration form or of the administration area and deletes no more than 50 applications per run; deletion therefore takes place in the first maintenance runs after the relevant period has expired.
We implement the other periods stated in this policy as an organisational task.
The details marked as mandatory in the form, together with the CV, are necessary in order to process your registration; without them we cannot process your application. The entry for sex and the question of how you heard about us are voluntary.
For active participation the link to the video of your playing is one of those necessary details; for passive participation it is voluntary.
The prepared programme is technically not a mandatory field; for active participation, however, we need it for the selection and for planning the lessons, and if it is missing we will ask you for it.
The other details marked “(optional)” and the consent to the messenger group are voluntary and have no bearing on the selection decision.
We process your sex and your answer on how you heard about us on the basis of the consent you give by providing them (Art 6 (1) (a) GDPR): your sex for organising the academy, and your answer on how you heard about us in order to plan our call for applications better.
You may withdraw this consent at any time; we will then delete the detail in our administration system together with the stored copy of the e-mail, remove the e-mail to the secretariat from the mailbox and remove the detail from lists already produced.
It remains in exports and backups (see above) until they are deleted and is no longer used. We process voluntary remarks, like the rest of the registration, in order to handle it (Art 6 (1) (b) GDPR).
Admission is decided by the artistic direction on the basis of substantive criteria, in particular your CV and — for active participation — your video. No automated decision-making, including profiling, within the meaning of Art 22 GDPR takes place.
If you have given your consent, we add your telephone number to a messenger group through which students receive current information during the master classes (Art 6 (1) (a) GDPR).
Your number and the name stored in your messenger account are visible there to all group members; the provider of the messenger service also processes the data. We remove participants from the group after the end of the academy.
Consent is voluntary and can be withdrawn at any time by e-mail to info@orgelakademie-kitzbuehel.at; we will then remove your number from the group.
The concerts and the competition rounds of the academy are open to the public.
We announce the names of the prize winners of the Maria Hofer Organ Competition together with their country and placing and list them on our website among the prize winners (Art 6 (1) (f) GDPR — legitimate interest in presenting the competition); you may object to this at any time, in which case we remove your entry from the website.
During the academy, photographs and videos of lessons, the competition and concerts are made, which we publish on our website and on our Instagram and Facebook accounts.
We publish recordings in which you can be recognised only with your consent, which we obtain on site (Art 6 (1) (a) GDPR); you may withdraw it at any time by e-mail to info@orgelakademie-kitzbuehel.at, and we will then remove the recording from our website and from our posts.
Cookies
In the publicly accessible part of our website we do not set any cookies and use neither tracking nor analytics.
When you submit the registration, your browser stores a randomly generated identifier in the session storage of the browser tab. It contains no information about you and serves solely to ensure that accidentally reloading the page does not create a second registration.
For that purpose the identifier is transmitted to us together with the registration and stored with it.
Storing the identifier in your browser is strictly necessary for sending the registration you have requested and is therefore permitted without consent (§ 165 (3) of the Austrian Telecommunications Act 2021); storing it on our side is based on Art 6 (1) (b) GDPR.
Once the registration has been sent successfully your browser removes the identifier again, at the latest when you close the tab; the identifier stored on our side is deleted together with your application. No analysis of your behaviour takes place.
In the password-protected administration area at /verwaltung/, which is open only to staff of the Organ Academy and our IT service provider, a technically necessary session cookie is set.
It serves solely to maintain the login and expires when you log out or when the session ends. The legal basis is § 165 (3) of the Austrian Telecommunications Act 2021 (strictly necessary).
Only if you actively load the map in the contact section may the provider Google set cookies (see “Google Maps”). This happens solely on the basis of your consent.
Google Maps
In the contact section our website offers a map from the web mapping service “Google Maps”. The provider of this function is: Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. Tel: +353 1 543 1000
The map is only loaded once you click “Load map”. The legal basis is your consent (Art 6 (1) (a) GDPR in conjunction with § 165 (3) of the Austrian Telecommunications Act 2021). Without your click the map is not loaded and no data is transferred to Google.
Your consent applies only to the current page view and is not stored; if you reload the page, the map is disabled again.
When the map is loaded, your IP address and further technical data are transferred to Google, and Google may also set cookies on your device.
Google usually transfers data to a server in the USA and stores it there; Google LLC is certified under the EU-US Data Privacy Framework.
Further information on how the service provider “Google” handles user data can be found in its privacy policy: https://policies.google.com/privacy?hl=en
Fonts
The fonts used on this website are served locally from our own server. No connections to third-party servers (e.g. Google Fonts) are established for this purpose.
Instagram content on this website
The images shown in the “Instagram” section of our home page are copies of our own Instagram posts. They are stored on and served from our own server. Viewing our website therefore establishes no connection to Instagram or Meta and transfers no data to them.
Only when you click an image or a link to our profiles on Instagram or Facebook do you leave our website; from that point the privacy terms of Meta Platforms Ireland Ltd. apply.
For our profiles on Instagram and Facebook we are jointly responsible with Meta Platforms Ireland Ltd. insofar as Meta collects data when these profiles are visited in order to produce statistics (Insights), which are made available to us only in aggregated form (Art 26 GDPR).
For Facebook pages Meta has assumed primary responsibility for this in an agreement and has undertaken to answer your requests: https://www.facebook.com/legal/terms/page_controller_addendum. You may also exercise your rights against us.
Server log files
This website and the associated provider automatically collect information in so-called “server log files” when the website is used. This concerns in particular:
- IP address
- date and time of the request
- the address requested and the status code of the response
- the previously visited page (referrer), where transmitted
- browser and operating system identification (user agent)
This data is personal data. We do not combine it with other data sources and do not use it to identify you as a person or to analyse your behaviour. No analytics or visitor tracking takes place.
The legal basis is our legitimate interest in the secure, stable and uninterrupted operation of the website (Art 6 (1) (f) GDPR). Our hosting provider deletes the access and error logs of the web server automatically after no more than 14 days.
The same period applies to the logs of its mail server on the academy’s e-mail traffic (such as the sender, recipient and time of a message).
If a technical fault occurs while our website is being used, our application writes log lines about it to an error log so that the fault can be detected and resolved.
These lines are not intended to contain personal data; in individual cases, however, a log line may include details from the operation that triggered it. The log is accessible only to technical administration and is deleted after 30 days (Art 6 (1) (f) GDPR).
Where there are concrete indications of unlawful use, we reserve the right to evaluate this data in the individual case and to consider further legal steps.
Your right to object (Art 21 GDPR)
Where we process data on the basis of a legitimate interest (Art 6 (1) (f) GDPR) — server logs, informal enquiries, protection of the registration form against misuse, the error log and the list of prize winners —, you have the right to object at any time on grounds relating to your particular situation.
We will then no longer process the data unless we can demonstrate compelling legitimate grounds which override your interests, rights and freedoms, or the processing serves the establishment, exercise or defence of legal claims. A message to info@orgelakademie-kitzbuehel.at is sufficient.
Your rights as a data subject
With regard to the data stored by us, you have the following rights under Articles 15 to 21 GDPR:
- access to your data (Art 15)
- rectification of inaccurate data (Art 16)
- erasure of your data (Art 17)
- restriction of processing (Art 18)
- portability of the data you provided to us with your registration (Art 20)
- objection to processing (Art 21, see the section above)
- withdrawal of consent given (Art 7 (3))
Where you have given us consent — for example to load the map or to join the messenger group — you may withdraw it at any time with effect for the future (Art 7 (3) GDPR). This does not affect the lawfulness of processing carried out up to that point.
To exercise your rights, a message to info@orgelakademie-kitzbuehel.at is sufficient. We will respond to your request within one month. To protect your data we may confirm your identity by contacting you at the e-mail address we hold.
If you consider that the processing of your data infringes data protection law, you may lodge a complaint with us or directly with the supervisory authority: Österreichische Datenschutzbehörde, Barichgasse 40-42, 1030 Vienna, Austria, telephone +43 1 52 152-0, e-mail dsb@dsb.gv.at, www.dsb.gv.at
You can reach us at the following contact details
The controller within the meaning of the GDPR is the organising body of the academy: Stadtgemeinde Kitzbühel (municipality of Kitzbühel), a corporation under public law
Represented by: Bürgermeister (mayor) Dr. Klaus Winkler
Address: Hinterstadt 20, 6370 Kitzbühel, Austria
Contact of the organising body: telephone +43 5356 62161-0, e-mail stadtamt@kitzbuehel.at
Contact of the Organ Academy (a project of the Stadtgemeinde Kitzbühel): Internationale Orgelakademie Kitzbühel
Telephone: +43-5356-6216131
E-mail: info@orgelakademie-kitzbuehel.at
Data protection officer
As a municipality, the controller is a public body and must designate a data protection officer (Art 37 (1) (a) GDPR). The Stadtgemeinde Kitzbühel has this task performed by an external body. You can reach it at:
Data protection officer: Kufgem GmbH
Address: Fischergries 2, 6330 Kufstein, Austria
E-mail: datenschutz@kufgem.at