Information according to Art. 13 and 14 GDPR

Controller

The controller for data processing on this website is:

Server log files

When you visit the website, the hosting infrastructure processes standard technical access data (for example IP address, date and time, requested page, referrer, browser type). This data is used for operational security, troubleshooting and abuse prevention. No additional analytics pixel or tracking script is currently embedded.

Contact form and email

If you contact us via the contact form or email, we process the data you provide (name, email address, message and optional details) to handle the enquiry. The form is received on the server; there is currently no CRM storage connected.

Membership and payment

When you apply online we process application data (name, email, country, optional phone number and motivation) and payment data via Stripe. Technical membership administration uses the member platform (OpenMember / Supabase). Payment does not automatically create membership; leadership reviews each application.

Purposes of processing

We process data to operate the website, communicate, handle membership applications, collect dues, administer the association and meet legal obligations.

Legal basis

Depending on the process we rely on Art. 6(1)(b) GDPR (membership, payment, pre-contractual requests), Art. 6(1)(c) GDPR (legal obligations) and Art. 6(1)(f) GDPR (legitimate interest in secure website operation). Consents, for example in the join form, rely on Art. 6(1)(a) GDPR.

Processors and recipients

We use service providers for hosting, the membership database, authentication and payments. Currently this includes:

• Supabase (database, authentication and edge functions for the membership catalogue and checkout)
• Stripe (processing of membership payments)
• OpenMember / member portal at openmember.io (membership administration after an application)

TODO: Name the hosting provider (for example Vercel or another host). Only list further tools (newsletter, analytics, CRM) if they are actually used.

Transfers to third countries

Stripe and Supabase may transfer personal data to third countries, in particular the United States.

TODO: Add the applicable transfer mechanism (for example an adequacy decision / EU-US Data Privacy Framework and/or standard contractual clauses) after reviewing the vendor contracts.

Storage period

Data is deleted when it is no longer required for its purpose, unless statutory retention rules apply. Contact enquiries are deleted when the matter is closed. Membership and payment data are kept for association and accounting purposes as required by association and tax law.

Your rights

You have the right at any time to:

• Obtain information about your data stored with us (Art. 15 GDPR)
• Request correction of incorrect data (Art. 16 GDPR)
• Request deletion of your data stored with us (Art. 17 GDPR)
• Request restriction of data processing (Art. 18 GDPR)
• Object to the processing of your data (Art. 21 GDPR)
• Request data portability (Art. 20 GDPR)
• Lodge a complaint with a data protection supervisory authority (Art. 77 GDPR)

Supervisory authority

The competent supervisory authority for the controller established in Austria is the Austrian Data Protection Authority (Österreichische Datenschutzbehörde), Barichgasse 40-42, 1030 Vienna, https://www.dsb.gv.at/.

Data protection officer

No data protection officer is named in the association details currently on file.

TODO: If a data protection officer has been or must be appointed, add the name and contact details here. Otherwise remove this section.

Cookies and device storage

This website sets a strictly necessary cookie for the language preference (name: i18next). It stores only the selected language and is required for multilingual display. Tracking, advertising or analytics cookies are not currently embedded. Details are in the cookie notice.

Cookies