Privacy

Who is responsible

Write to this address for anything about your data on this website.

Hosting

This website runs on Vercel (Vercel Inc., USA). Every visit sends the technical data a browser always sends: IP address, time, the page requested, referrer, browser and operating system. Vercel processes it to deliver the website and to keep it secure. The logs we can see are kept for up to one day. Vercel keeps the usage data and log files it generates itself as a separate controller, only as long as it needs them, and then deletes or anonymises them (Vercel's privacy notice). The legal basis is our legitimate interest in running a working, secure website (Art. 6(1)(f) GDPR).

The server functions run in Frankfurt, Germany. Vercel is a US company certified under the EU-US Data Privacy Framework, which covers any access from the USA. See Vercel's privacy notice.

Content and contact requests are stored in a database run by Neon (Neon, LLC, part of Databricks, Inc., USA) on Amazon Web Services in Frankfurt, Germany. Databricks and Neon are certified under the EU-US Data Privacy Framework for any data reaching the USA, and rely on Standard Contractual Clauses where the Framework does not apply.

Visitor statistics and performance

We use Vercel Web Analytics to count page views and Vercel Speed Insights to measure how fast pages load. Neither sets cookies. They record the page, referrer, country, browser, operating system, device type and, for Speed Insights, network speed and loading times. Visitors are told apart by a hash of the request that is discarded after 24 hours, so we only ever see aggregated numbers, never a person. The legal basis is our legitimate interest in knowing which pages are read and keeping them fast (Art. 6(1)(f) GDPR).

Contact form and email

When you send a request through the contact form, we store your name, email address, what the request is about and your message. We use them to answer you and, if something comes of it, for the collaboration that follows. Without them we cannot answer, so the form needs all four. The form sets no cookies and stores nothing on your device.

For a request to play, collaborate, show art or offer a venue, the legal basis is taking steps at your request before a contract (Art. 6(1)(b) GDPR). For press and other requests, it is our legitimate interest in answering messages sent to us (Art. 6(1)(f) GDPR). The same applies when you email us directly.

Only the crew of the association reads requests. They are stored with Vercel and Neon as described under Hosting. We reply by email from our mailboxes, which are hosted by Ledl.net GmbH & Co. KG in Austria. Neon and Ledl.net process the data on our behalf under data processing agreements (Art. 28 GDPR). Vercel processes the hosting data under its own terms, as described under Hosting.

We keep a request as long as we need it to answer you and for any collaboration that follows, then delete it. Requests we do not follow up on are deleted within four weeks of arriving, together with any copies in our mailboxes. Where a collaboration leads to a contract or invoice, we keep the records we are required to keep under tax law (7 years, § 132 BAO).

Bot protection

To keep out automated spam and abuse, the forms on this website are protected by Vercel BotID (Vercel Inc., see Hosting). Only when you send one of these forms, your browser loads a script from Vercel through this website. It solves a challenge on your device and sends the encrypted result along with your request; Vercel checks it together with the technical data described under Hosting and tells us whether the request came from a person or a program. A request that fails the check is rejected. The legal basis is our legitimate interest in protecting these forms from automated abuse (Art. 6(1)(f) GDPR).

Your rights

You have the right to access your data (Art. 15 GDPR), to have it corrected (Art. 16) or deleted (Art. 17), to restrict its processing (Art. 18) and to receive it in a portable format (Art. 20). Write to team@tohuwabohu.wien; we answer without undue delay and in any case within one month. In complex cases this can be extended by up to two further months, and we will let you know if so.

Your right to object: Where we process your data based on our legitimate interest (Art. 6(1)(f) GDPR), you can object at any time on grounds relating to your particular situation (Art. 21 GDPR). We then stop unless we have compelling legitimate grounds or need the data to establish, exercise or defend legal claims.

You can also complain to the Austrian Data Protection Authority (Datenschutzbehörde), Barichgasse 40–42, 1030 Vienna, dsb.gv.at.

We make no automated decisions with legal or similarly significant effects on you (Art. 22 GDPR) and build no profiles.