Data Protection Policy of UNIQA IT Services LLC

as of 02. January 2025 

General Information

1. Who is responsible for handling your data?

The UNIQA IT Services GmbH (‘UITS’, ‘we’, ‘us’), Untere Donaustraße 21, 1029 Vienna, telephone: +43 50677 670, e-mail address: info@uniqa.at, is committed to protecting your personal data. We therefore comply with the applicable legal provisions on the protection, lawful handling and confidentiality of personal data and on data security, in particular the Data Protection Act (‘DPA’), the Telecommunications Act (‘TCA’) and the General Data Protection Regulation (‘GDPR’). Below you will find out what information we may collect, process and use when you visit and use our website.

As we develop our website and services, we are constantly adapting this privacy policy. We recommend that you regularly inform yourself about these current data protection provisions.

2. How is your data protected?

We take appropriate technical and organizational measures in accordance with Art. 32 ff GDPR to protect your personal data against accidental or unlawful destruction, loss or alteration and against unauthorized disclosure or access. In addition, we and our employees are obliged to maintain data secrecy and confidentiality.

We would like to point out that, in view of the existing risks on the Internet, we cannot guarantee complete security for the confidentiality of your data collected online and any unauthorized access by third parties.

3. What rights do you have?

In accordance with Art. 12 ff GDPR, you have the right to information, rectification, erasure, restriction of processing and data portability as well as a right to object if the processing relates to the legitimate interest. You can also revoke your consent at any time and without reason in order to prevent the further use of your personal data that was collected and used on the basis of a declaration of consent. If you have any questions, you can contact our data protection officer at uits-datenschutz@uniqa.at at any time.

You can also lodge a complaint with the Austrian Data Protection Authority (Barichgasse 40-42, 1030 Vienna or online at www.dsb.gv.at).

4. Your right to object

As the data subject, you can object to the use of your data at any time if the processing is for direct marketing purposes. If we process your data in the interests of UNIQA or a third party, you also have the right to object at any time if there are reasons for this arising from your particular situation.

5. Questions and further information

For questions and further information about data processing via our website, please use the following e-mail address: uits-datenschutz@uniqa.at.

Website

1. What is personal data?

Personal data is information about data subjects, whose identity is determined or at least determinable. This includes for example your name, your e-mail address and your IP address.

2. Which personal data do we use and for what purpose?

2.1. Traffic and usage data

When you visit our website, we process the following usage data (log files) for technical reasons:

• IP address and IP location
• Date and time of the user's visit to the website
• Number, duration and time of visits (user interaction with the website)
• Referrer URLs (the previously and subsequently visited website)
• Browser type and operating system

We process this data solely for the purpose of hosting our website and for the purpose of data security. Both we and you have an interest in the secure use of the website. This processing is therefore based on our legitimate interests in accordance with Article 6(1)(f) GDPR and include logging of system usage and evaluation of server logs for problem analysis.

2.2. Contact Service

Our website displays our contact details. If you contact us via this form, we will process your personal data such as:

• The type of interest or information relating to the request
• Information about your person such as gender, title, name
• Information about your availability such as telephone number and/or e-mail address

In accordance with Art 6 para 1 lit b and f GDPR, we will use this information to quickly process and respond to your request. We will store this data for a maximum of three years after your last contact with us

3. To whom do we provide your data?

The security and confidentiality of your data is particularly important to us. We therefore minimize the number of recipients of your data. To the extent necessary, we transfer personal data to the following external service providers (processors):

• IT service providers and/or providers of data hosting or data processing or similar services
• Other service providers, providers of tools and software solutions that also support us in the provision of our services and act on our behalf
• UNIQA Österreich Versicherungen AG for the processing of your application with us

All our processors process your personal data only on our behalf and on the basis of our instructions for the provision of the above-mentioned services. If personal data is transferred to recipients in third countries outside the EU and there is no adequacy decision by the EU Commission for the country in question in accordance with Art. 45 GDPR, the transfer will take place in individual cases subject to suitable guarantees in accordance with Art. 46 GDPR or, if necessary, by consent for specific purposes.

We also transfer your personal data to the extent necessary to the following recipients:

• to any third parties involved in the fulfilment of our obligations to you (such as parcel service providers);
• to other external third parties to the extent necessary on the basis of our legitimate interests (e.g. legal representatives in the event of a dispute, auditors, etc.)
• to authorities and other public bodies to the extent required by law (e.g. tax authorities, etc.)

4. Social Media and Cookies

4.1. Social Media

You can interact with us on our social media platforms by commenting on, reacting to or sharing our posts or sending them to other users. We process your interaction and your respective username. We use the following platforms:

• LinkedIn account of the UITS: https://www.linkedin.com/company/uniqa-it-services/

Your personal data may also be processed by the respective platform operators. Further information on data processing by the platform operators can be found in the respective data protection provisions:

• LinkedIn privacy policy: https://www.linkedin.com/legal/privacy-policy?trk=d_org_guest_company_overview_footer-privacy-policy

We process your personal data in order to answer your questions, respond to your opinions and feedback and to give you the opportunity to comment. Data processing is carried out on the basis of our legitimate interests pursuant to Art. 6 para. 1 lit. f GDPR in the management of our social media profiles or to fulfil our (pre-)contractual obligations pursuant to Art. 6 para. 1 lit. b GDPR. We store your personal data from the interaction with our social media profiles for as long as our content is online, unless you delete it beforehand or request that we delete it.

4.2. Cookies

Like most websites, we also use cookies. Cookies are small text modules that are stored on the device of the website visitor. Every time you visit our website, the cookie and the website communicate with each other so that your device can be recognized. Cookies allow us to make our website more convenient, expand the functionality of the website and better understand the user behavior of visitors based on their activities with the website.

There are cookies that require your consent before they can be stored on your device (‘cookies requiring consent’) and cookies that can be set without your consent because they are technically necessary for us to provide our services (‘technical cookies’). We only use consent-requiring cookies after obtaining your consent in accordance with Art. 6 para. 1 lit a GDPR in conjunction with § 165 para. 3 TKG via the cookie banner. You can give your consent at the start of using the website by clicking the colored button ‘Accept cookies’ in general or separately for each individual cookie type by activating the slider and clicking on ‘Allow selection’. If you click on ‘Reject all’, no cookies requiring consent will be set.

The UITS website respects the ‘Do Not Track’ (DNT) setting of your browser. If you activate the ‘Do Not Track’ request in your browser, cookies that are not necessary will not be executed.

Regarding the storage period, a distinction is made between ‘session cookies’ and ‘persistent cookies’: session cookies are automatically deleted when you leave our website. Persistent cookies remain on your device until the cookies either reach an expiry date specified by us or are manually deleted by you in the browser. We store data from cookies that require consent until you withdraw your consent, provided this is done before the expiry date of the respective cookie.

Cookie Overview

Technical cookies

These cookies are necessary for the website to function and cannot be deactivated in your systems. As a rule, these cookies are only set in response to actions you take that correspond to a service request, such as setting your privacy preferences, logging in or filling out forms. You can set your browser to block these cookies or to notify you about these cookies. However, some areas of the website will then not work.

Lawyers, Consultants and Other Third Parties

1. What interest does UITS have in your data and for what reason and for what purpose may UITS process it?

1.1. We process your data as part of the fulfilment of the contract concluded between you as an external service provider, freelance lawyer, external consultant or other third party and UNIQA for the settlement of wages and compliance with performance recording obligations, including automatically created and archived text documents (such as correspondence) in these matters.

1.2. This is therefore done to fulfil the contract in accordance with Art. 6 para. 1 lit b GDPR.

2. Project management

2.1. We process your data in the management of work processes in projects and tasks, for resource planning and effort estimation of projects and tasks, including correspondence, for example by e-mail or project tools, and the storage and archiving of records generated in these matters. The documentation created during projects may also contain personal data of external service providers, freelance lawyers, external consultants or other third parties involved. Personal data may also be processed for documentation and knowledge transfer purposes, for example when naming contact persons, authors or knowledge carriers.

2.2. We use this information to fulfil our legal obligations in accordance with Art 6 para 1 lit c GDPR for the verifiability of the provision of services and the basis of invoicing in accordance with BAO and UGB; to fulfil contracts in accordance with Art 6 para 1 lit b GDPR with customers or suppliers, as well as on the basis of our legitimate interests in accordance with Art 6 para 1 lit f GDPR. The legitimate interests lie in the efficient planning, organization and management of resources such as external service providers, freelance lawyers, external consultants or other third parties.

3. Incident and problem management

3.1. We process your data in the administration of work processes in the operation of IT applications, in the processing and administration of (security) incidents and problems that serve to ensure smooth IT operations and to guarantee availability, confidentiality, integrity and resilience. Furthermore, data may be processed by external service providers, freelance lawyers, external consultants or other third parties in the course of processing enquiries in ticket systems.

3.2. We use this information to fulfil our legal obligations pursuant to Art. 6 para. 1 lit c GDPR for the verifiability of the provision of services and the basis of invoicing pursuant to BAO and UGB; for the fulfilment of contracts pursuant to Art. 6 para. 1 lit b GDPR vis-à-vis customers or suppliers, as well as on the basis of our legitimate interests pursuant to Art. 6 para. 1 lit f GDPR. The legitimate interests lie in the efficient planning, organization and management of resources such as external service providers, freelance lawyers, external consultants or other third parties and in the coordination and management of customer concerns/problems within the organization.

4. Performance evaluation

4.1. We also process your data as part of the business relationship to evaluate your performance in order to (i) draw comparisons with other market participants and (ii) with the aim of always achieving the most competent and efficient service for UNIQA.

4.2. This is therefore done for the legitimate interests of UNIQA in accordance with Art 6 para 1 lit f GDPR.

4.3. Before UNIQA processes your data for purposes other than those described in this document, we will inform you separately.

5. To whom may your data be passed on?

5.1. Banks involved in the disbursement

5.2. Legal representatives, auditors and accountants (possibly also in third countries without adequate data protection)

5.3. Courts (possibly also in third countries without adequate data protection)

5.4. Based on the legitimate interests of the employer, data will also be passed on to customers, suppliers and interested parties of the controller (if necessary, also in third countries without adequate data protection) for the purpose of establishing contact.

5.5. External training providers for the organization of training courses

5.6. Travel agencies, hotels, restaurants, transport companies (for business trips)

5.7. Data transfer within the UNIQA Group: We may outsource individual data processing to specialized departments or companies within our Group. This happens in particular when another company in the UNIQA Group has a direct contractual relationship with the respective recipient (see the list of categories above).

5.8. External service providers: We comply with legal and contractual obligations. To this end, we work together with external service providers (processors) and transfer your personal data to them to the extent necessary for the provision of services. Our processors include, in particular, IT service providers, service providers in the context of contract administration and claims processing:

• Software and service providers (provision of IT applications) for e-mail, as well as for administrative activities.
• Data centers, IT operations and hosting
• Scanning and printing service providers and translation agencies
• Security service providers for the protection of physical security and data security
• IT service providers and IT support for the purpose of project management, definition of requirements, introduction, adaptation and development of software as well as the support and maintenance of IT systems and the performance of ongoing IT activities (hotline, problem solving, interface support)
• Processors within the UNIQA Group (such as financial administration, actuarial services and mailroom)

6. How long will your data be stored?

The personal data will be stored until the termination of the respective (consulting) contract and beyond that in any case for a further seven years due to the statutory retention periods or as long as legal claims from the contract can be asserted against UNIQA (maximum 30 years after termination of the contract for work).

Applicants

1. What happens to the applicant data?

Your application to UNIQA IT Services GmbH will be processed by UNIQA Insurance Group AG, Untere Donaustraße 21, 1029 Vienna, as a processor of UITS. Further information regarding the processing of your applicant data can be found in the information sheet provided here.