Privacy Statement

Your personal data is of paramount importance to us at ENERGIEALLIANZ Austria GmbH. We take the protection of your personal data very seriously and fully comply with the applicable framework of legal provisions and standards. With this Privacy Statement, we wish to inform you in detail about the processing of your data in our company and the claims and rights to which you are entitled under data protection law.

We reserve the right to change, adjust or modify this Privacy Statement due to legal or technical developments at any time. The last updated version published on this website http://www.energieallianz.at/ applies.  

The terms “user”, “user”, “visitor”, “participant”, “data subject” or “data protection officer” used in the privacy policy always also refer to a “user”, “visitor”, “participant”, “data subject” or “data protection officer” or to various/non-binary persons. For reasons of readability, the distinction could not be made throughout.

Last update: 05.08.2024

1. Who is responsible for processing your data?

Responsible for data processing:
ENERGIEALLIANZ Austria GmbH
Wienerbergstrasse 11, 1100 Vienna 

Contact details of our data protection officer:
ENERGIEALLIANZ Austria GmbH
Data protection officer
Wienerbergstrasse 11, 1100 Vienna
datenschutz@energieallianz.at

2. Which data is processed and where does this data come from?

We process the personal data that we receive from you as part of our business relationship or which we generate for the performance of contractual obligations. In addition, we process data that we have legitimately received from credit agencies (Section 152 Trade Act (GewO), Section 31 Federal Data Protection Act (BDSG)), address publishers (Section 151 Trade Act (GewO)) and from publicly available sources (e.g., business register, association register, land register or media). We understand “personal data” as any information directly or indirectly relating to natural persons.   

The personal data we process relating to you includes your personal details and contact information (e.g., name, address, other contact details, customer number), your contract details (e.g., tariff, supply period, commitment period), plant data (e.g., meter number, meter point designation), settlement date (e.g., invoice details, account information) as well as consumption data (e.g., consumption period, meter readings).     

In addition, we may process information on your financial status (e.g., creditworthiness), advertising data (e.g., product offers), documentation data (e.g., notes and email conversations), marketing-related group membership and analysis data as well as data on the compliance with legal and regulatory requirements.  

3. For which purposes and on which legal basis is your data processed?
We process your personal data for the following purposes and in compliance with the following legal basis:   

within the scope of your consent (Article 6(1)(a) GDPR):
If you have given us your consent to the processing of your personal data for specific purposes, processing will only take place in accordance with the scope and for the purpose as set out in and agreed in the consent form. You may revoke your consent at any time, free of charge, and with effect for the future. In this case, the revocation does not affect the legality of the data processing that has been performed on the basis of the consent prior to the revocation. Find out more in Section 6.

for the purpose of fulfilling contractual obligations (Article 6(1)(b) GDPR):
The processing of your personal data is necessary for the fulfilment of a contract with you or for implementing pre-contractual measures. The purposes of data processing are first and foremost based on the actual product. Find out more about the details on data processing in the respective contract documents and our General Terms and Conditions.    

for the purpose of fulfilling legal obligations (Article 6(1)(c) GDPR):
We are subject to certain legal obligations that may require us to process personal data. Such obligations may result, amongst others, from the following legal bases: 

• Electricity Act (Elektrizitätswirtschafts- und -organisationsgesetz)
• Natural Gas Act (Gaswirtschaftsgesetz)
• Switching Ordinance (Wechselverordnung)
• Other market regulations on electricity and natural gas (published on the website of E Control Austria www.e-control.at)
• Federal Energy Efficiency Act (Bundes-Energieeffizienzgesetz)
• Electricty and Gas Supply Act (Gesetz über die Elektrizitäts- und Gasversorgung)
• Renewable Energies Act (Gesetz für den Ausbau erneuerbarer Energien)
• Business processes for supplying customers with electricity (GPKE)
• Business processes for switching gas supplier (GeLi Gas)

for the purpose of safeguarding legitimate interests (Article 6(1)(f) GDPR):

We process your data for the following purposes arising from our legitimate interests:

• Marketing in connection with own products and services
• Classification of customers into groups for marketing purposes (incl. development of new products and services)
• Establishing contact and exchanging data with and using data from credit agencies to determine creditworthiness and default risks
• Processing and contacting for quality assurance and improvement of our offers and services

You have the right to object to the processing of your data in accordance with Article 21 GDPR. Find out more on this in Section 6. 

4. Who receives your data?
We only pass on your personal data to third parties, if it is necessary for the fulfilment of (pre-)contractual or legal obligations, for safeguarding our legitimate interests, or permissible within the scope of your consent. In such a case, your data is transmitted to the following receivers:   

• Businesses in accordance with your consent
• Service providers commissioned to process orders (e.g., mail delivery, collection of debts, IT services, credit agencies, address publishers)
• Other participants in the electricity and natural gas market if legally required (e.g., distribution system operators and energy suppliers when switching supplier)
• Public authorities and agencies if legally required (e.g., financial authorities, regulatory authorities)  

Whenever your data is transmitted to recipients inside or outside our company, we always make sure to comply with the required legal basis and to protect your data and privacy.    

5. How long is your data stored?
We generally retain your data for the duration of the entire business relationship as well as in accordance with the diverse range of storage and documentation obligations to retain data concerning your person, third parties, your business cases, and our contractual relationship even beyond its termination or conclusion of the business case, as applies, for example, to retention obligations under corporate law.   

Moreover, we retain your data for as long as it is possible to assert legal claims arising from our contractual and business relationship to you and/or to safeguard our legitimate interests in accordance with Article 6(1)(f) GDPR.     

6. What are your data protection rights?
You may request information about the origin, the categories, the storage period, the recipients, the purpose of the processing of the data concerning you and your business case as processed by us, and the nature of the processing.

If we process personal data of you which is incorrect or incomplete, you may request the rectification or completion of such data. You may also request the erasure of unlawfully processed data. However, please note that this does only apply for data that is incorrect, incomplete or unlawful. If it is unclear whether your personal data is processed incorrectly, incompletely or unlawfully, you may request the limitation of the processing of your data until the final clarification of this question. Please note that the rights set out above complement each other so that you can either request the rectification or completion of your data or their deletion.

Even if your personal data is correct and complete and has been processed correctly by us, you may still object to the processing of such data in specific and duly justified cases. You may also object without any specified reason, if you receive direct advertising from us and do not wish to receive it in the future. 

You may receive your personal data that we have processed and that we have obtained by yourself in a specific, machine-readable format or on your request for such data to be transmitted directly to a third party selected by you provided that the recipient facilitates this from a technical perspective and the transmission of data does neither constitute a disproportionate effort nor conflict with a statutory confidentiality obligation or confidentiality considerations on our part or from a third party.

If we have received your data and process this data on the basis of consent provided by you, you can revoke this consent at any time, with the result that, upon receipt of your revocation of consent, we will no longer process your data for the purposes stated in the consent. The revocation does not affect the legality of the data processing that has taken place up until the revocation.

In all matters of concern, please contact us at datenschutz@energieallianz.at or ENERGIEALLIANZ Austria GmbH, Datenschutzbeauftragter (Data Protection Officer), Wienerbergstrasse 11, 1100 Vienna. If there is justifiable doubt as to your identity, we might ask you for proof of your identity such as an electronic copy of your identification document.

Even if we make the best efforts to ensure the protection and integrity of your data, differences of opinion over our use of your data cannot be ruled out. If you are of the opinion that we use your data in a manner that is not permissible, you have the right to file a complaint with the competent data protection supervisory authority (especially in the Member State constituting your place of residence and work).  

7. Are you obliged to provide data?
The processing of your data as well as the data of third parties you make known to us is required for the establishment of your contractual relationship with us and/or for processing your business cases. If you do not provide us with these data, we may be unable to establish your desired contractual relationship or process your business cases. Please note that this would not constitute a failure to fulfil our contractual obligations.     

8. Do you apply automated decision-making processes including profiling?
We do not apply any automated decision-making processes pursuant to Article 22 GDPR for the purpose of making a decision on the development, conclusion and performance of business relationships.  

9. Data security
The security of your data is very important to us. Our goal is to manage your data with the utmost care and to take all necessary technical and organisational security measures to protect your personal data from being access by unauthorised third parties. We consequently use state-of-the-art security software as well as coding and classification systems to correspond to the highest international standards of security.  

10. Websites (EAA-Homepage, Customer portal) 
10.1. Provision of websites and creation of log files
Aside from the use of cookies, our system automatically collects data and information in form of log files from the device accessing the site for technical reasons (operational safety and performance of online presence) whenever you access our website. Each log entry includes the following data and information:

• the website which you use to reach our website (so-called referrer information)
• your public IP address
• date and time of access
• the browser request (requested website name including optional request parameters)
• our server’s response code
• the volume of transferred data
• information on the used browser and operating system 

This data is not stored together with other personal data of the user. Data is stored in log files to ensure the functionality of the website. In this context, the data is not analysed for marketing purposes. Data processing for these purposes is in our legitimate interests in accordance with Article 6(1)(f) GDPR.

The data stored in log files is deleted at regular intervals and no later than after six months. The user cannot object to the collection of data for the provision of websites or the storage of data in log files as such data is absolutely required for the operation of the website. 

10.2. Cookies

Cookies are small files that enable our websites to store specific user-related information on the visitor's computer while our websites are being visited. Cookies help us to determine the frequency of use and the number of users of our websites and to make our offers convenient and efficient for you. We use session cookies, which are only stored temporarily for the duration of your use of our websites, and permanent cookies to store information about visitors who repeatedly access our websites. The purpose of using these cookies is to be able to offer optimal user guidance and to recognize visitors and to be able to present the most attractive websites and interesting content possible in the event of repeated use. The content of a permanent cookie is limited to an identification number. Name, IP address etc. are not stored. An individual profile of your usage behavior is not created. 

The legal basis for the processing of personal data using cookies is your consent pursuant to Art. 6 (1) lit. a GDPR for analysis purposes or the protection of our legitimate interests pursuant to Art. 6 (1) lit. f GDPR for system and functional cookies that serve your convenience (e.g. saving the language setting). You have the right to withdraw your consent at any time and to use our services without cookies, e.g. by deactivating the storage of cookies in your browser, restricting them to certain websites, blocking them from certain websites or setting your web browser (e.g. Chrome, IE, Firefox) to notify you as soon as a cookie is sent. You can also delete cookies from your computer's hard disk at any time. Please note, however, that in this case you must expect a limited display of the site and limited user guidance.

The following cookies are set:

Cookie	Websites	Description	Storage duration
_pk_ses.<appID>.<domainHash> (Piwik PRO Analytics)	www.energieallianz.com	Shows an active session of a visitor.	30 minutes
_pk_id.<appID>.<domainHash> (Piwik PRO Analytics)	www.energieallianz.com	Used to recognize visitors and store their various characteristics, e.g. the number of visits, average time spent on the website and which pages have been read.	13 months
acceptCookies:	www.energieallianz.com	Stores whether the use of cookies was acknowledged.	1 year
fe_typo_user:	www.energieallianz.com	Ensures that settings selected while using the website are retrievable.	1 year
COOKIE_SUPPORT	meine.energieallianz.com	Saves the decision as to which cookies have been accepted.	1 year
GUEST_LANGUAGE_ID	meine.energieallianz.com	Saves the language setting.	1 year
JSESSIONID	meine.energieallianz.com	Saves internal technical statuses during the visit in order to realize the functionality of the customer portal.	Session
LB_STICKY_SESSION	meine.energieallianz.com	Saves internal technical statuses during the visit in order to realize the functionality of the customer portal.	Session
LFR_SESSION_STATE_xxx	meine.energieallianz.com	Saves internal technical statuses during the visit in order to realize the functionality of the customer portal.	Session
SAML_SP_SESSION_KEY	meine.energieallianz.com	Login information for accessing portal pages and data.	Session

10.2. Piwik PRO Analytics

We use Piwik PRO Analytics, an analytics software. Piwik PRO collects data on the basis of cookies, which are stored on your computer and enable your use of our EAA website to be analyzed, as well as IP numbers and browser fingerprints. By anonymizing your IP address, no conclusions can be drawn about you as a user. The data is processed on the basis of your consent in accordance with Art. 6 (1) lit. a GDPR. You have the right to withdraw your consent at any time. Further information on withdrawing your consent can be found under point 10.2.

The information generated about your use of our EAA homepage (including your anonymized IP address) is transferred to data centers in Germany and stored there. 

Piwik PRO will use this information for the purpose of evaluating your use of our EAA website, compiling reports on website activity for us as website operators and providing other services relating to website activity and internet usage. Piwik PRO is obliged to treat your data confidentially and to process it only in the context of providing the service; it will not be passed on to third parties. You can find Piwik PRO's privacy policy at piwikpro.de/datenschutz/. 

10.3. Integration of services and third-party content
Third-party content such as YouTube videos, map material from Google Maps, RSS feeds or graphics from other websites may be integrated within this online offer, which always presumes that these content providers (in the following referred to as “third-party providers”) are able to perceive the user’s IP address since, without the IP address, content could not be sent to the user’s browser. Thus, the IP address is required for displaying content. We strive to only use content whose respective providers exclusively use IP addresses for delivering content. However, we have no influence on the saving of IP addresses by third-party providers, e.g. for statistical purposes. In this matter, we will inform users to the best of our knowledge.

10.4. Contact form
On our EAA-Homepage, offer users the option of using online forms to contact us electronically. If you use such an online form, the data you enter will be transmitted to us and stored.

Alternatively, you may also contact us by writing an email to the provided address. In this case, your personal data transmitted in the course of sending the email will be stored. This data will not be transferred to third parties and is exclusively processed for purpose of communication. The legal basis for the processing of such data is Article 6(1)(f) GDPR. If the email contact aims at the conclusion of a contract, then additional legal basis for the processing is Article 6(1)(b) GDPR.       

The processing of the personal data is exclusively used for the purpose of processing the contact. You have the right to object to the storage of your data at any time; in such a case, the conversation cannot be continued. 

10.5. Press distribution list
If you have subscribed to our free press distribution list, the data entered into the respective input mask is transmitted to us and processed. The respective data is exclusively used for the purpose of sending out press releases or corporate information. For this we employ the services of Foggensteiner PR GmbH as the data processor.    

The concerned user may discontinue the press distribution list subscription at any time by sending an email to datenschutz@energieallianz.at. Insofar as we obtain the consent of the user for the processing of personal data, Article 6(1)(a) GDPR serves as the legal basis. In the processing of personal data required for the performance of a contract to which the user is a party, Article 6(1)(f) GDPR serves as the legal basis. 

10.6. Newsletter
If you have subscribed to a free newsletter, the data entered into the respective input mask is transmitted to us and processed. The respective data is exclusively used for the purpose of sending out the newsletter. For this we employ the services of high.one Marketing OG as the data processor.    

The concerned user may discontinue the newsletter subscription at any time. A corresponding link will be attached to each newsletter. Insofar as we obtain the consent of the user for the processing of personal data, Article 6(1)(a) GDPR serves as the legal basis. In the processing of personal data required for the performance of a contract to which the user is a party, Article 6(1)(f) GDPR serves as the legal basis.

11. Privacy Policy for webinars and online presentations

With the following Privacy Statement we would like to inform you about the processing of personal data when participating in webinars and online presentations.

11.1. Who is responsible for processing personal data?

ENERGIEALLINAZ Austria GmbH is responsible for the collection and processing of personal data.

Contact information of our Data Protection Officer:
ENERGIEALLIANZ Austria GmbH
Data Protection Officer
Wienerbergstrasse 11, A-1100 Vienna
datenschutz@energieallianz.at

11.2. What personal data is processed?

ENERGIEALLINAZ Austria GmbH collects and processes the following personal data of individuals participating in our webinars and online presentations:

• Information about participants: first name, last name, time of registration
• Metadata: topic, description if applicable, IP addresses of participants, device/hardware information
• Text data: If webinar participants use the chat function, survey function or other tools, their input is saved and processed in order to display and log them. Webinar participants may decide whether or not and how to ask questions or make comments.
• Audio and video data: If webinar participants activate the microphone or camera on their device, their audio and video data will be visible and/or audible to other participants and speakers until it is deactivated. Webinar participants may also decide to “share” their screen, thereby also making their screen content visible to other participants. Participants may activate and deactivate these features at any time. 
• When recording webinars and presentations: If webinars or presentations are to be recorded, the participants will be notified in advance, informed of the purpose of the recording, and asked for their consent if applicable. The resulting data includes all video, audio and presentation recordings as well as chat and text data.

There will be no automated individual decision-making pursuant to Article 22 GDPR.

11. 3. What is the legal basis for processing data?

The processing of personal data in the context of webinars and online presentations is based on legal grounds of legitimate interest pursuant to Article 6(1)(f) GDPR, comprising the organisation, implementation and the follow-up of (e.g. downstream question answering) of webinars and presentations as well as their further development.

11.4. Who processes the data and who receives it?

Personal data processed in connection with webinars or online presentations is exclusively processed by ENERGIEALLIANZ Austria GmbH and is generally not transferred to third parties unless explicitly intended for this purpose.  

11.5. How long is your data stored?

Your personal data is only be stored for as long as necessary for the defined purposes. If a statutory retention period applies, your personal data will be deleted after expiry of this period.

11.6. What are your rights?

Data subjects have the right to obtain information from the controller as to what personal data is being processed as well as the right to obtain the rectification of personal data. If one of the reasons under Article 17 GDPR applies, data subjects have the right to obtain the erasure of personal data. Moreover, they are entitled to obtain the restriction of processing of personal data pursuant to Article 18 GDPR, and they have to receive the personal data concerning them in accordance with Article 20 GDPR. In addition, if data is processed for reasons of legitimate interest, data subjects have the right to object to the processing at any time. In this case, we will no longer process the personal data unless there are demonstrably compelling legitimate grounds for the processing which override the interests, rights and freedoms of the data subject, or the processing serves the purpose of asserting, exercising or defending legal claims.

If you enquire as a data subject, we are obliged to ascertain your identity. In order to provide proof of our legal data processing, we will store this data.

Please direct any enquiries to the Data Protection Officer indicated above.  

11.7. Where can I lodge a complaint?

ENERGIEALLIANZ Austria GmbH is subject to supervision by the Austrian Data Protection Authority. In the event of a breach of data protection law, you have the right to lodge a complaint with the competent supervisory authority.