The controller responsible for data processing is:

KELAG-Kärntner Elektrizitäts-Aktiengesellschaft
Arnulfplatz 2
9020 Klagenfurt am Wörthersee
Commercial Register No. FN 99133i, VAT No.: ATU 25274100
Telephone: +43 463 525 5555
Email: datenschutz@kelag.at

Data Protection Officer: You may contact our Data Protection Officer using the contact details provided above, in particular via email at datenschutz@kelag.at.

KELAG Kärntner Elektrizitäts-Aktiengesellschaft (“KELAG”) processes personal data of customers in accordance with Article 4(1) and Article 6(1)(b) and (c) GDPR, which are necessary for the initiation, performance, and management of the business relationship, as well as for compliance with legal obligations, in particular under the Electricity Industry and Organization Act (ElWG).

This includes, in particular:
master and contact data (e.g. title, first and last name, address, date of birth, telephone number, email address), authentication data, order and payment data (e.g. standing orders or direct debit mandates, bank details, payment terms), data arising from the performance of contractual obligations (e.g. consumption, contract, and billing data), creditworthiness data, installation- and metering point-related data (e.g. metering point identifier, meter number, meter readings, consumption, commissioning and decommissioning dates), marketing and sales data, data from customer loyalty programs (e.g. PlusClub), consultation records, information provided, data from customer surveys and competitions, information from electronic interactions with KELAG (e.g. self-service portals, apps, cookies), as well as other data required to comply with statutory obligations regarding documentation, retention, and reporting.

The provision of this data is necessary for the conclusion and performance of the contract as well as for pre-contractual measures; without these data, a contract cannot be concluded.

Furthermore, KELAG processes - particularly in the case of business customers - personal data obtained from publicly accessible sources (e.g. commercial register, register of associations, land register, annual reports, VAT register) as well as from address publishers, direct marketing companies, and credit agencies, provided that such data have been lawfully obtained and their processing is permissible for the protection of legitimate interests or for the fulfillment of legal and contractual obligations.

 

Obligation to Provide Data (Article 13(2)(e) GDPR)
The provision of the aforementioned data is partly required by law (in particular master data, installation, and metering data under ElWG, as well as tax- and commercial law-relevant data under BAO/UGB), partly contractually necessary (in particular contract, consumption, billing, and payment data for the provision of services), and partly voluntary (in particular data for customer loyalty programs such as PlusClub, newsletters, competitions, and marketing consents).
If the data required by law or contract are not provided, the conclusion or performance of the contract is not possible. Failure to provide voluntary data has no effect on the existing contractual relationship; however, the respective additional service cannot be provided without such data.

Sources of Data
Where personal data are not collected directly from you, they originate in particular from publicly accessible sources (commercial register, register of associations, land register, VAT register, annual reports), from address publishers and direct marketing companies, from credit agencies for creditworthiness assessments, and from the respective network operator within the framework of market communication pursuant to ElWG.

Creditworthiness Assessment
For the purpose of assessing the risk of payment default and preventing such defaults, KELAG transfers personal data to credit agencies (in particular Kreditschutzverband von 1870, Wagenseilgasse 7, 1120 Vienna, and CRIF GmBH Rothschildplatz 3/Top 3.06.B, A-1020 Vienna, Austria) and receives creditworthiness information from them.
The legal basis for this processing is Article 6(1)(f) GDPR in conjunction with Section 25 of the Austrian Data Protection Act (DSG). No automated decision-making within the meaning of Article 22 GDPR takes place in this context.

KELAG processes your personal data in accordance with applicable data protection laws as follows:

 

1. In order to fulfil contractual duties (Art. 6(1)(b) GDPR)
   KELAG, or processors engaged by us, process your personal data for the performance of the contract. This includes, in particular, the billing of services, the dispatch of invoices and, where applicable, reminders, as well as communication for the execution of the contract, the determination of your consumption, and the processing of payments. The legal basis for the processing and provision of your personal data is therefore the necessity for the performance and execution of the contract.
    
2. In order to fulfil legal obligations (Art. 6(1)(c) GDPR and under ElWG)
   The processing of personal data may be necessary for the purpose of fulfilling various legal obligations. Examples include the preparation of annual financial statements, ongoing tax obligations (in particular under the Austrian Federal Fiscal Code — BAO and the Value Added Tax Act — UStG), corporate retention and accounting obligations (in particular Sections 190 et seq. of the Austrian Commercial Code — UGB), obligations under anti-money laundering laws (GwG), sector-specific obligations under the Electricity Industry and Organization Act (in particular Sections 53—60 ElWG, including smart metering and market communication obligations), as well as audits by the Court of Audit.
   Furthermore, we process personal data to the extent necessary to fulfill statutory duties and powers under the Electricity Industry and Organization Act (ElWG), in particular for the determination and collection of metering data, the processing of data from intelligent metering systems (“smart meters”), the provision of consumption and billing information, and market communication (in particular Sections 53—60 ElWG).
    
3. Based on your consent(Art. 6(1)(a) GDPR)
   Where you have given consent to the processing of your personal data, such processing is carried out solely for the purposes specified in the consent declaration.
   You may withdraw your consent at any time with effect for the future. The withdrawal does not affect the lawfulness of processing carried out on the basis of your consent before its withdrawal (e.g. you may withdraw your consent to the processing of your personal data for marketing and advertising purposes if you no longer agree to such processing in the future).
    
4. For the purposes of legitimate interests (Art. 6 (1)(f) GDPR)
   Where necessary, personal data may be processed beyond the scope of contract performance on the basis of a balancing of interests in favour of KELAG or a third party, for the purposes of safeguarding legitimate interests. This applies in particular to measures relating to business management, the further development of services and products, customer acquisition, as well as advertising and market research, provided that you have not objected to such processing pursuant to Article 21 GDPR.

Use of your data for advertising purposes and external sales 

We inform you that KELAG processes your personal data collected in the context of the contractual relationship for the purpose of sending individual offers, information on new developments, products, and additional services by post during the ongoing business relationship and for a period of up to three years after termination of the contract.
Notice of your right to object:
You may object at any time, without providing reasons, to the processing of your personal data for direct marketing purposes pursuant to Article 21(2) GDPR. In the event of such an objection, your data will no longer be processed for these purposes. You may submit your objection informally, in particular by email to datenschutz@kelag.at.

Where KELAG has obtained your email address in connection with the sale of a product or service, it may use this address in accordance with Section 174(4) of the Austrian Telecommunications Act 2021 (TKG 2021) for electronic direct marketing of its own similar products and services, provided that you have not objected to such use.
You have the right to object to the use of your email address for marketing purposes at any time, free of charge and without providing reasons—both at the time of collection and with each individual marketing communication. A notice of this right of objection will be included in every marketing message. You may exercise your objection, in particular, by email to datenschutz@kelag.at.
For all other forms of electronic direct marketing (in particular towards non-existing customers or via telephone calls without prior consent), we obtain your prior consent in accordance with Section 174(1) TKG 2021 in conjunction with Article 6(1)(a) GDPR.

In certain cases, your data are transmitted to our external sales partner Peak Energy GmbH, Schachterlstraße 16, 9065 Ebenthal, Commercial Register No. FN 566023m, and processed by them for marketing purposes on behalf of KELAG, in particular through electronic or postal contact.
The processing is carried out on the basis of Article 6(1)(f) GDPR (legitimate interests of the controller). You may object to the processing of your personal data at any time. Please address your objection by email to datenschutz@kelag.at.
Peak Energy GmbH acts as a processor for KELAG within the meaning of Article 28 GDPR on the basis of a data processing agreement. KELAG remains the controller for data protection purposes.

For other forms of direct marketing (e.g. competitions, newsletters, etc.), KELAG will process your personal data only if you have given your explicit consent.
You may withdraw your consent at any time, without providing reasons and with effect for the future. The withdrawal does not affect the lawfulness of processing carried out on the basis of your consent prior to its withdrawal.
To exercise your right of withdrawal, please contact KELAG-Kärntner Elektrizitäts-Aktiengesellschaft, Arnulfplatz 2, 9020 Klagenfurt am Wörthersee, by post or via email at datenschutz@kelag.at.

 

Autostrom
Your personal data will only be accessed by those KELAG employees who require such data for the performance of contractual obligations.
For the purpose of customer authentication at charging points of KELAG’s roaming partners and for the execution of billing, KELAG transmits to its roaming partners and to roaming platforms in which it participates the Contract ID, as well as - where RFID cards are used - the RFID Unique ID, and in the case of authentication via Plug & Charge, the respective contract certificate.
The roaming partners and roaming platforms generally act as independent controllers within the meaning of the GDPR; they do not receive access to any additional personal data stored by KELAG. Where roaming partners act as processors on behalf of KELAG, this is based on a data processing agreement in accordance with Article 28 GDPR.
KELAG processes your personal data for the duration of the entire business relationship and thereafter for the duration of statutory retention and documentation periods.

 

Energy Consulting (General and with regard to Photovoltaics, Heat Pumps, Tenant Electricity Models, and Connect Fiber Optic Connections)
For the use of services (such as receiving information materials, obtaining individual offers, contact and coordination of missing technical data, energy consultations, heat pump consultations, heat pump installation and invoicing, use of the heating cost calculator, registration for photovoltaic and e-mobility consultations, use of the photovoltaic calculator, and receiving photovoltaic, heat pump and/or e-mobility funding guides), the provision of your data is required.
The provision of your data is also necessary for the operation, administration, and billing of joint generation facilities (tenant electricity models).
Your data will be made available to those KELAG employees who require them for the provision of the respective services. These data are stored and managed on the servers of our partners, for example HubSpot.
In addition, we share the data with the following companies:
The partner companies listed below (including HubSpot as well as installation and consulting partners) act as processors for KELAG within the meaning of Article 28 GDPR on the basis of appropriate data processing agreements.
Where data transfers to third countries take place, such transfers are based, in the case of Switzerland, on an adequacy decision of the European Commission pursuant to Article 45 GDPR, and in the case of the United States, on the EU-U.S. Data Privacy Framework (Article 45 GDPR) and/or on standard contractual clauses pursuant to Article 46(2)(c) GDPR, including supplementary safeguards.
A copy of the appropriate safeguards can be requested from KELAG at datenschutz@kelag.at.

 

• Photovoltaic consulting
  • Elektrotechnik Liebhart (Burgstall, Pölling 5, 9433 St. Andrä im Lavanttal) 
    MS Elektrotechnik GmbH (Seitenberg 1, 9560 Feldkirchen in Kärnten)
    Conversio GmbH (Koschatstraße 24, 9800 Spittal an der Drau)
    EET-Knees GmbH & Co KG (Görtschitztal Straße 108, 9064 Lassendorf)
    AGEtech GmbH (Schillerstraße 5, 9900 Lienz)
    Vivatro GmbH (Blintendorf 20, 9300 St. Veit/Glan
    MFR Solution GmbH (Trebesing-Bad 34, 9852 Trebesing)
    MSG MySolar GmbH (Viktringerstraße 7, 9020 Klagenfurt)
    EAP-Tech GmbH (Lausingerstraße 11, 9411 St. Michael)
     
• Photovoltaic calculator
  • Eturnity AG (Reichsgasse 3, 7000 Chur, Switzerland)
     
• Heat pump consulting
  • Glen Dimplex Austria GmbH, Am Goldenen Feld 18, 95326 Kulmbach
    STIEBEL ELTRON GmbH, Margaritenstrasse 4A, 4063 Hörsching
    Vaillant Group Austria GmbH, Clemens-Holzmeister-Straße 6, 1100 Wien 
    Bosch/Buderus, Robert Bosch AG, Göllnergasse 15-17, 1030 Wien
    Viessmann GmbH, Viessmannstraße 1, 4641 Steinhaus bei Wels
    Pirker-Frühauf Heizung & Bad GmbH, Kras 2, 9851 Lieserbrücke
    Peak Energy GmbH, Schachterlstraße 16, 9065 Ebenthal
    Heizma Group FlexCo, Marxergasse 24, 1030 Wien
    Walter Bösch GmbH & Co KG, Industrie Nord 12, 6890 Lustenau
    iDM Energiesysteme GmbH, Seblas 16-18, 9971 Matrei in Osttirol
     
• Mieterstrom
  • Exnaton AG, Zeughausstraße 31, 8004 Zürich
    
     
• Connect fiber optic connection
  • Sales partner
  • Construction companies
  • Internet Service Provider
    etc.

Automated data processing

KELAG uses automated data processing procedures to analyze user and consumption behavior for the purpose of optimal customer support. The personal data processed and collected within the contractual relationship (including via self-service portals and apps) for the purpose of contract performance, as well as your response data to marketing measures, are used—enriched with aggregated data and statistical methods—for purposes of customer segmentation and analysis.
KELAG does not make any decisions based solely on automated processing—including profiling—that produce legal effects concerning you or similarly significantly affect you (Article 22 GDPR).

KELAG Self Service Portal

As an existing customer, you have the option to register in our customer portal and set up your customer account via a password-protected login. Within the portal, you can, among other things, manage your personal data as well as our additional services and offerings, and view and download your invoices.
KELAG processes the customer data provided during registration and in the course of using the customer portal, namely: business partner number, title, first name, last name, email address, address, telephone number, customer name and password, date of birth, IP address, host, browser, and the time of data entry.
No data will be transferred to third parties.

You are required to treat your personal access credentials confidentially and must not make them accessible to any unauthorized third party.
If you delete your customer account, your access data will be deleted immediately. If you terminate your contractual relationship with KELAG, your customer account, including access data in the customer portal, will be deleted simultaneously.

 

PlusClub portal

As an active KELAG customer, you have the option to register directly in the PlusClub portal and create a password-protected customer account. This allows you to view current PlusClub vouchers, save them as favorites, and redeem vouchers digitally or print them. In addition, as a KELAG customer, you can participate in current prize draws via the PlusClub portal and provide KELAG with your personal customer feedback.
KELAG processes the customer data transmitted during registration and in the course of using the PlusClub portal. This data includes: business partner number, title, first name, last name, email address, address, telephone number, password, date of birth, IP address, host and browser information, login data, and customer feedback.
The data are processed for voucher management (e.g. personalization, redemption), internal statistical analyses, and to ensure an optimal user experience. For statistical purposes, the following information is transmitted to the respective PlusClub partner: time and date of voucher activation (for the selected partner voucher), voucher code, and branch location.
The data are deleted, in the event of termination of the supply contract, after expiry of the statutory retention period of seven (7) years. This period begins, in accordance with Section 132 of the Austrian Federal Fiscal Code (BAO), at the end of the calendar year in which the respective tax claim arose.

 

Applications (Apps)
For the use of apps provided by KELAG, personal data such as user data (name, email address, password, telephone number) are required and processed.

Kelag Mobility App

For the execution and billing of charging processes, authentication and billing data as well as technical data of the vehicle are required. These include in particular:

• Contract ID
• RFID Unique ID
• Contract certificate (for Plug & Charge)
• Charging point identification number
• Authentication method
• Address and geocoordinates of the charging point
• Time of charging start and time of vehicle disconnection
• Meter number of the meter installed at the charging point
• Meter readings at the beginning and end of the charging process, as well as control meter readings at 15-minute intervals
• Signature data for the secure and verifiable transmission of billing data
• Consumption data
• Charging power
• Minimum and maximum charging power of the vehicle
• For AC charging: number of phases used by the vehicle
• Battery charging status (SOC — State of Charge)
• Charging plan registered by the vehicle
• Charging plan specified by the charging infrastructure
• Customer’s requested time for full charge
• Charging session number
• Charging connector type

The detailed data collected in the context of the Mobility App and charging processes (in particular geocoordinates, SOC values, and charging timestamps) are stored in a personal form only for as long as necessary for contract performance, billing, and dispute resolution.
After completion of the billing purpose, these data are pseudonymized or anonymized. Billing-relevant records are retained in accordance with the statutory retention period of seven (7) years pursuant to Section 132 of the Austrian Federal Fiscal Code (BAO).
No analysis is carried out for the purpose of creating movement profiles.

 

Push notifications
Our apps may use push notifications to inform you about certain events or topics, even when you are not actively using the app. Push notifications are messages sent to your mobile device even if you are not currently using our mobile applications.
If you do not wish to receive such notifications, you can deactivate push notifications at any time in the settings of your mobile device.
If you enable push notifications, a unique identifier (device ID) is transmitted to the service of the respective operating system provider (which provides the push functionality) (iOS: “Apple Push Notification Center”, Android: “Google Cloud Messaging”).
This service returns a “push notification identifier,” which no longer allows any conclusions to be drawn about the device ID and thus the user. Communication is carried out exclusively using this identifier, ensuring that the device ID is not further used.
The storage period corresponds to the duration of your use of the push notification service.

Location-based services
Some functions of our apps use the location services of your device to collect location data. This is done in order to provide you with app-based services and content tailored to your current location (e.g. display of “vouchers and events” near you).
The legal basis for this processing is your consent pursuant to Article 6(1)(a) GDPR in conjunction with Section 165 of the Austrian Telecommunications Act 2021 (TKG 2021), which you provide by enabling location access in the settings of your device or the app.
You may deactivate location access at any time in the app settings with effect for the future. Location data are processed exclusively for the duration of the use of the respective location-based service and are deleted thereafter; no movement profiles are created.

Access to local media on the end deviceFor the use of the mobile apps in offline mode, it is necessary to access local media on your device. This allows your own content (e.g. photos) to be stored temporarily on your mobile device so that it remains available even when no internet connection is present.
No access is made to users’ photos.
You may enable or disable this permission at any time in the app settings.

 

KELAG Webshop
For the purpose of facilitating the shopping process and for subsequent contract processing, KELAG, as the webshop operator, stores the IP data of the subscriber within the framework of cookies.
In addition, the following data are stored by us for the purpose of contract processing: title, first and last name, date of birth, delivery and billing address, telephone number, email address, company, department, VAT identification number, as well as the buyer’s bank details or credit card number.
Furthermore, we process your personal data to create and provide your webshop user account, provided that you register for such an account.
The data provided by you are required for the performance of the contract or for the implementation of pre-contractual measures. Without these data, we cannot conclude a contract with you.

Data Protection Role of Partner Companies
The partner companies named in the context of webshop order processing (e.g. SUNBOOSTER GmbH, go-e GmbH, installation and specialist partners for wallbox installation, transport and shipping companies) generally act as independent controllers within the meaning of the GDPR with regard to their own contract processing with you after your order data have been transmitted.
The respective data processing carried out by these companies is governed by their own privacy notices. Where a partner acts exclusively on behalf of KELAG, such processing is carried out on the basis of a data processing agreement pursuant to Article 28 GDPR.
Some items from the KELAG webshop are delivered directly by our partner companies. For this purpose, your order data are transmitted to the partner companies for order processing. These partners will contact you directly for contract performance, for example for shipping the product or arranging an installation appointment.
The order data provided during the purchasing process are transmitted to our partner companies for the purpose of order fulfillment.

When purchasing an energy storage system, order data are transmitted to:

• SUNBOOSTER GmbH, Grazer Straße 27, 8045 Graz

When purchasing a wallbox and a go-e controller, order data are transmitted to:

• go-e GmbH, Satellitenstraße 1, 9560 Feldkirchen in Kärnten, Austria

If an installation service for wallboxes is requested, personal data (order data) are transmitted to the following KELAG specialist partners for the purpose of arranging installation:

• MS Elektro GmbH, Seitenberg 1, 9560 Feldkirchen in Kärnten
• Vivatro GmbH, Blintendorf 20, 9300 St. Veit an der Glan
• Conversio Energie GmbH, Koschatstraße 24, 9800 Spittal an der Drau
• EET-Knees GmbH & Co KG, Görtschitztal Straße 108, 9064 Lassendorf
• MFR Solution GmbH, Trebesing Bad 34, 9852 Trebesing
• EAP-Tech GmbH, Lausingerstraße 11, 9411 St. Michael
• MSG MySolar GmbH, Viktringer Straße 7, 9020 Klagenfurt
• Elektrotechnik Liebhart, Burgstall, Pölling 5, 9433 St. Andrä im Lavanttal
• AGEtech GmbH, Schillerstraße 5, 9900 Lienz

In addition, bank details/credit card data are transmitted to the responsible banking institutions/payment service providers for the purpose of debiting the purchase price, as well as to the transport/shipping companies engaged by us or our partner companies for the delivery of goods.

 

The aforementioned banking institutions, payment service providers, and transport companies act as processors for KELAG within the meaning of Article 28 GDPR on the basis of appropriate data processing agreements.
Where recipients are located outside the EEA or data are transferred to third countries, such transfers are based on an adequacy decision pursuant to Article 45 GDPR or on standard contractual clauses pursuant to Article 46(2)(c) GDPR, including supplementary safeguards.

If the purchasing process is aborted, the data stored by us are automatically deleted after 24 hours.
In the event of a contract being concluded, all personal data from the contractual relationship are stored until the expiry of the tax retention period (7 years). This period begins, in accordance with Section 132 of the Austrian Federal Fiscal Code (BAO), at the end of the calendar year in which the respective tax claim arose.
In addition, the data (first and last name, address, purchased goods, and date of purchase) are stored until the expiry of product liability limitation periods (10 years from the date the product was placed on the market).

 

 

HubSpot
KELAG processes the following personal data that we receive from you in the context of your online registration, such as salutation, first name, last name, email address, and telephone number.
For the purpose of documenting the consent given, we additionally store, in accordance with Article 6(1)(f) GDPR, the IP address used for the registration and confirmation of the double opt-in procedure, as well as the respective timestamps. The legitimate interest lies in documenting consent pursuant to Article 7(1) GDPR.
The provision of your data is required in order to use the service (such as receiving information materials, obtaining individual offers, contacting you, coordinating missing technical data, heat pump consultation, heat pump installation and invoicing, use of the heating cost calculator, registration for photovoltaic, heat pump and e-mobility consultations, use of the photovoltaic calculator, and receiving photovoltaic, heat pump and e-mobility funding guides).
There is no legal obligation to provide these data; however, without them, we are unable to provide the service.

 

Newsletter
Our customers have the opportunity to subscribe to our newsletter via our website. For this purpose, we require your email address and your confirmation that you agree to receive the newsletter.
We use the so-called double opt-in procedure to send the newsletter. This means that we will only send you a newsletter by email once you have explicitly confirmed that you wish us to activate the newsletter service. We will then send you a confirmation email asking you to confirm, by clicking on a link contained in that email, that you wish to receive our newsletter.
The legal basis for this processing is your consent pursuant to Article 6(1)(a) GDPR. Your email address will be stored for the duration of your newsletter subscription and will be deleted immediately upon withdrawal of your consent, unless statutory retention obligations require otherwise. To document the consent given, we also store the time of registration and confirmation.
If you no longer wish to receive our newsletter, you may withdraw your consent at any time via the unsubscribe link included in each newsletter. The lawfulness of the newsletter distribution up to the time of withdrawal remains unaffected.
The data provided by you are required for the delivery of the newsletter. Without these data, we are unable to send you the newsletter. No data will be transferred to third parties.

 

Websites
When you access KELAG websites, information that is not assigned to a specific individual is occasionally collected automatically (i.e. not via registration), such as the internet browser and operating system used, the domain name of the website from which you accessed our site, the number of visits, the average time spent on the site, and the pages viewed.
KELAG uses this information to determine the attractiveness of its websites and to continuously optimize their content.
KELAG websites contain links to other websites. KELAG is not responsible for the data protection policies or the content of these other websites. We recommend that you familiarize yourself with the privacy policies of the respective websites.

 

 

Payment Method “Barzahlen” (Cash Payment)
If you choose the payment method “Barzahlen” (cash payment), we will transmit your personal data (customer number, email address, telephone number, and address (country, city, postal code, street, house number, staircase)) exclusively to the payment service provider Cash Payment Solutions GmbH, Wallstr. 14a, 0179 Berlin, for the purpose of processing the payment.
This is necessary so that Cash Payment Solutions GmbH can provide you with an individually generated numeric or barcode (so-called “payment slip”) for the respective transaction. Using this payment slip, you can settle the transaction amount in cash at the business premises of partner companies of Cash Payment Solutions GmbH.
The Barzahlen partner company transmits the payment confirmation in real time. Your data are neither stored nor processed in any other data protection-relevant manner by the partner companies.
Cash Payment Solutions GmbH uses your personal data exclusively for the purpose of providing the “Barzahlen” payment method.

 

KELAG Connect Fiber Optic Connection
The personal data you provide in the context of the order form (such as name, address, contact details, bank details, etc.) are processed by us for the establishment and operation of the fiber optic infrastructure in order to fulfill your order. For these purposes, the data are transmitted to data processors as well as to contractual and business partners involved in the performance of the contract (such as construction companies, internet service providers, etc.).
Personal data provided by you in the context of an expression of interest (such as name, address, etc.) are processed by us for the purpose of collecting expressions of interest in order to implement the network expansion in your region once a predefined take-up rate has been reached.
The data are stored for three (3) years after collection or for one (1) year after the cancellation of the fiber optic project in your region.

 

Oracle Service Cloud
KELAG Customer Service uses the Oracle Service Cloud to respond to customer inquiries via email.
If you communicate with the following email addresses, your data will be transferred to and processed in Oracle data centers located in Munich and Frankfurt:

• kundenservice@kelag.at
• kundenservice@kaerntennetz.at
• kundenservice@kew.at
• kundenservice@kelmin.at
• versorgerwechsel@kelag.at

In addition, there are email addresses that are forwarded to one of the above service email addresses:

• kundenservice@naturstrom.at → kundenservice@kelag.at
• cm@kelag.at → kundenservice@kelag.at
• webservice_k@dkelag.local → kundenservice@kelag.at

Video Surveillance at Protected Locations
At selected KELAG locations (in particular critical infrastructure, operational facilities, building access points, as well as cash desk and service areas), video recordings are carried out for the protection of legitimate interests.
The purpose of processing is the protection of persons and property, the prevention and investigation of criminal offenses, and the protection of critical infrastructure.
The legal basis is Article 6(1)(f) GDPR in conjunction with Sections 12 and 13 of the Austrian Data Protection Act (DSG).
Recordings are generally deleted after 72 hours; longer storage only takes place where necessary for the assertion of legal claims or within the framework of official investigations. Monitored areas are marked by appropriate signage.
 

Applicant Data
In the context of applications, KELAG processes the personal data you provide (in particular master and contact data, CV, certificates, and other application-related documents) exclusively for the purpose of assessing your suitability for the advertised position and for conducting the application procedure.
The legal basis is Article 6(1)(b) GDPR (steps prior to entering into an employment relationship) and—where required by law—Article 6(1)(c) GDPR.
If an application is rejected, applicant data are deleted six (6) months after completion of the application process, unless you have expressly consented to a longer storage period in our applicant pool.
No data are transferred to third parties outside the KELAG Group.

Purpose of Processing (Email Management System)
The purpose of processing is to respond to customer inquiries using an email management system in order to handle such inquiries more efficiently.
Recipients of the data are the KELAG group companies. The data are stored in Oracle data centers in Munich and Frankfurt.
No transfer to third countries outside the European Union takes place.
Your data are stored for the duration of the customer relationship.

 

 

Meter Data Processing and Intelligent Metering Systems (Smart Meters) under ElWG
Meter data collection (e.g. meter readings or other forms of measurement data acquisition) is carried out by the respective responsible network operator in accordance with the applicable legal requirements.
In the case of intelligent metering systems (“smart meters”), measurement data—where legally provided for—are collected, stored, and transmitted to authorized market participants, including values recorded at intervals of up to 15 minutes.
Household customers generally have the right to object to the storage and transmission of daily and 15-minute interval data (opt-out). However, the law provides for narrowly defined exceptions (e.g. in the case of dynamic energy tariffs, certain prepayment arrangements, or other legally specified special cases).
The permissible purposes of processing, data minimization, and purpose limitation (including a prohibition on use for purposes other than those provided for by law) are governed in particular by Section 57 of the Electricity Industry and Organization Act (ElWG).
Note: For detailed information on meter data processing, the exercise of your opt-out rights, and the network operator’s web portal, please refer to the privacy information provided by your respective network operator.

Cookies are small text files that are stored on your device with the help of your browser and that save certain settings and data for exchange with our system via your browser.
In principle, a distinction is made between two types of cookies: so-called session cookies, which are deleted as soon as you close your browser, and temporary cookies, which are stored on your device for a longer period or indefinitely.
Cookies enable us to tailor a website to your interests, to make offers more user-friendly, or to store your password so that you do not have to re-enter it each time. When you visit our KELAG websites, we place information in the form of a cookie on your device in order to recognize you on your next visit.
Cookie identifiers and related information such as the IP address may constitute personal data within the meaning of the GDPR according to the case law of the Court of Justice of the European Union (judgment of 19 October 2016, C‑582/14, Breyer). We therefore process such data in accordance with the provisions of the GDPR and only use cookies that are not technically necessary on the basis of your consent.

For the transmission of a message and the provision of the services requested by you, we use technically necessary cookies. The legal basis for this is Section 165(3) TKG 2021 in conjunction with our legitimate interest in providing a fully functional website (Article 6(1)(f) GDPR).
For all other cookies (preference, statistics, and marketing cookies), we obtain your consent prior to their use in accordance with Section 165(1) and (2) TKG 2021 in conjunction with Article 6(1)(a) GDPR via our consent management tool (Cookiebot).
You may withdraw your consent at any time with effect for the future via the cookie settings.

 

Necessary cookies

Necessary cookies help to make a website useable by enabling basic functions such as page navigation and access to secure areas of the website. The website is not able to function properly without such cookies.

 

Preference cookies

Preference cookies enable a website to recall information which influences the behaviour or appearance of a website, including factors such as your preferred language, or your particular region.

 

Statistical cookies 

Statistical cookies help website owners to understand how visitors interact with websites by collecting and reporting information anonymously.

 

Marketing cookies

Marketing cookies are used in order to track visitors to websites. The aim is to show ads that are relevant and appealing to the individual user and which are therefore more valuable to the publisher and third party advertisers.

Use of Facebook remarketing

Remarketing tags from the social network Facebook are used on KELAG websites exclusively after consent has been obtained. These services are provided by Meta Platforms Ireland Limited, Merrion Road, Dublin 4, D04 X2K5, Ireland (“Meta”), and for users outside the EEA by Meta Platforms, Inc., 1 Hacker Way, Menlo Park, CA 94025, USA.
When you visit our pages, the remarketing tags establish a direct connection between your browser and Meta’s server. Meta thereby receives the information that you have visited our website with your IP address and may associate this visit with your user account. The information obtained in this way may be used by us to display Facebook Ads.
The legal basis for this processing is your consent pursuant to Article 6(1)(a) GDPR in conjunction with Section 165(1) and (2) TKG 2021.
With regard to the collection and transmission of data to Meta, KELAG and Meta act as joint controllers within the meaning of Article 26 GDPR, in accordance with the case law of the Court of Justice of the European Union (in particular Cases C‑210/16, “Wirtschaftsakademie”, and C‑40/17, “Fashion ID”). The essential terms of the relevant agreement (Page Controller Addendum) can be accessed at:
www.facebook.com/legal/controller_addendum
As the processing may also involve the transfer of data to the United States, such transfer is based on the EU—US Data Privacy Framework (adequacy decision pursuant to Article 45 GDPR), insofar as Meta is certified, and additionally on standard contractual clauses pursuant to Article 46(2)(c) GDPR.
You may withdraw your consent at any time via our cookie settings. In addition, you can disable Custom Audiences directly with Meta at: www.facebook.com/ads/website_custom_audiences/
Further information can be found in Meta’s privacy policy at: www.facebook.com/about/privacy

LinkedIn Insight Tag

Subject to your explicit consent pursuant to Article 6(1) sentence 1 lit. a GDPR, our website uses a tracking tool that captures and analyzes LinkedIn members on a website. The so-called Insight Tag is provided by LinkedIn Corporation, 2029 Stierlin Court, Mountain View, CA 94043, USA.
When using the LinkedIn Insight Tag, personal data are transmitted to LinkedIn Corporation, 1000 W Maude Avenue, Sunnyvale, CA 94085, USA. Such transfers are based on the EU—US Data Privacy Framework (adequacy decision pursuant to Article 45 GDPR), insofar as LinkedIn is certified, and additionally on standard contractual clauses pursuant to Article 46(2)(c) GDPR.
The legal basis for the use of the Insight Tag is your consent pursuant to Article 6(1)(a) GDPR in conjunction with Section 165(1) and (2) TKG 2021.
The LinkedIn Insight Tag places a cookie in your browser. Through this, LinkedIn collects, among other things, the following data:

• URL
• Referrer URL
• Device characteristics
• Browser characteristics
• IP address

LinkedIn anonymizes the data within seven (7) days or deletes the data within ninety (90) days.
KELAG, as the website operator using the LinkedIn Insight Tag, does not receive any personal data. KELAG only receives aggregated reports on the demographics of its audience and the performance of its advertisements.
These reports include, in particular, information on criteria such as:

• Industry
• Job title
• Company size
• Career level
• Location of website visitors

By using the above-mentioned services, KELAG obtains valuable insights into user interaction and navigation behavior on this website and is thereby able to make the website faster and more user-friendly.
If you have consented to the use of LinkedIn cookies, you may withdraw your consent at any time by updating your cookie settings.
Further information on the LinkedIn Insight Tag and the services offered can be found at:
https://www.linkedin.com

 

MatomoWhere you have given your consent by accepting marketing cookies or all cookies, our website uses Matomo for web analytics. This is a web analytics software provided by InnoCraft Ltd., 150 Willis St, 6011 Wellington, New Zealand. Using cookie technology, an analysis of the use of our websites is made possible. Within the framework of using Matomo, cookies are set and stored on the user’s device for a maximum period of 13 months.
The information collected via cookies about the use of our website is stored exclusively on servers in Austria on the basis of our legitimate interest in the statistical analysis of user behavior for optimization and marketing purposes in accordance with Article 6(1)(f) GDPR.
As the protection of your data is particularly important to us, the data are not shared with third parties. In addition, we have configured Matomo so that your IP address is recorded only in a truncated form.
Your personal usage data are therefore processed in an anonymized form, meaning that it is not possible for us to draw any conclusions about your identity. Further information on Matomo’s terms of use and data protection provisions can be found at: https://matomo.org/privacy/

 

HubSpot subscription service
We use the subscription service of HubSpot Inc. for marketing purposes and for lead generation. This subscription service enables visitors to obtain more detailed information about our company, download content, and provide their contact details or other demographic information.
This information is stored and managed on servers operated by HubSpot in the United States or by affiliated companies (e.g. HubSpot Germany GmbH).
The transfer of data to HubSpot Inc. in the United States is based on the EU—US Data Privacy Framework (adequacy decision pursuant to Article 45 GDPR), provided that the respective recipient is certified, and additionally on standard contractual clauses pursuant to Article 46(2)(c) GDPR.
KELAG has furthermore implemented supplementary technical and organizational safeguards and conducts transfer impact assessments (TIA) to adequately address risks associated with processing by U.S. authorities for control and surveillance purposes. A copy of the safeguards can be requested from KELAG at datenschutz@kelag.at.
Based on the contact data provided by you, we may contact you in connection with our goods or services and interact with you.
Information on how HubSpot processes your personal data can be found at: https://legal.hubspot.com/de/privacy-policy
The data stored in HubSpot may include: your IP address, browser type, domain name, internet service provider (ISP), the files viewed on our website (e.g. HTML pages, graphics, etc.), operating system, clickstream data, access times, and the addresses of websites from which you accessed our site.
Where we have your personal data (e.g. name, address, date of birth, PlusClub membership, consumption and product information, etc.) because you have provided them to us, these data are linked with log data (device and activity data).

 

Hotjar
Subject to your consent, our website uses web analytics services provided by Hotjar Ltd., Level 2, St. Julians Business Centre, 3 Elia Zammit Street, St. Julians STJ 1000, Malta (“Hotjar”).
Hotjar enables the tracking of activities on this website in the form of so-called “heatmaps.” By using Hotjar’s heatmap service, KELAG can, for example, determine how far users scroll, how they navigate the website, which links they click on, and how frequently those links are clicked.
This website also uses Hotjar’s recording functionality (“Recordings”). This service records certain data about how users move within a session on the website. This includes, for example, HTML changes occurring during use, mouse movements, mouse clicks, scrolling behavior, or changes to the browser window size. In certain selected input fields, keystrokes may also be recorded.

In addition, this website uses the “Forms by Hotjar” service. This service records how users interact with input fields on the website, for example whether fields are completed and submitted, the average interaction time with a field, and whether fields are left empty or the form is abandoned at a particular point.
By using the above-listed Hotjar services, KELAG obtains valuable insights into user interaction and navigation behavior on this website and is thereby able to improve the speed and user-friendliness of the website.
In addition to information on user interaction and navigation (e.g. clicked links, mouse movements, etc.), Hotjar also collects the screen size of the device, device type, operating system and browser information, the preferred language for displaying the website, and the device’s IP address. The IP address is collected and stored exclusively in anonymized form.

Hotjar does not record any content or information entered into fields or transmitted via this website. Hotjar uses its own tracking code to monitor the use of the website via a Hotjar cookie.
Further information about Hotjar and its services can be found at: https://www.hotjar.com
Hotjar’s privacy policy is available at: https://www.hotjar.com/privacy

The legal basis for activating Hotjar cookies is your consent pursuant to Article 6(1)(a) GDPR. We use Hotjar cookies only if you have expressly permitted this. If you have consented, you may withdraw your consent at any time by updating your cookie settings.
The legal basis for the subsequent processing of data collected via Hotjar (such as use, analysis, and storage) is Article 6(1)(f) GDPR. The legitimate interest pursued by KELAG is the improvement and optimization of the website for the benefit of its users

 

Event Registrations via Microsoft Dynamics (365)
n the course of registering for KELAG events (e.g. Business Circle, Kunst im Kraftwerk, Renewable Energy Conference, etc.), we process the personal data you provide (in particular name, contact details such as email/telephone, organization/company, position, and, where applicable, event-related information such as participation options or special requirements).
These data are collected and stored in our customer and event management system Microsoft Dynamics (Dynamics 365) for the purpose of organizing and managing the respective event (e.g. participant administration, admission/attendance lists, communication of organizational information).
The purpose and scope of processing are limited to the conduct of the event and—where applicable—to the sending of information material relating to the respective event or closely related follow-up events.
The legal basis is Article 6(1)(b) GDPR (performance of pre-contractual/contractual measures in connection with your registration) and - where necessary - Article 6(1)(f) GDPR (our legitimate interest in efficient event organization). Where you provide optional consents (e.g. for additional communications), processing is based on Article 6(1)(a) GDPR and such consent may be withdrawn at any time with effect for the future.
Processing within Microsoft Dynamics is carried out on the basis of a data processing agreement. Data are transferred to third parties only to the extent necessary for the organization of the event (e.g. event service providers/venues), and only to the extent required.
Your data will be stored only for as long as necessary for the organization and follow-up of the event, after which they will be deleted or anonymized, unless statutory retention obligations or the assertion/defense of legal claims require longer storage. Information on your data subject rights (access, rectification, erasure, restriction, data portability, objection) can be found in the general sections of this privacy policy.

Your data will only be accessed by those KELAG employees who require them for the performance of contractual and legal obligations, the protection of legitimate interests, and the provision of the respective services.
For the provision of services, KELAG transfers the above-mentioned data to our partner HubSpot (Headquarters: 25 First Street, 2nd Floor, Cambridge, MA 02141, United States).
In addition, processors engaged by us (in particular IT, telecommunications, hosting, printing and scanning service providers, consent management providers, marketing service providers, debt collection agencies, as well as authorities within the scope of statutory disclosure obligations), and affiliated companies within the group (in particular KNG-Kärnten Netz GmbH and KELAG Energie & Wärme GmbH, which themselves act as processors within the meaning of Article 28 GDPR on the basis of reciprocal data processing agreements), receive your data insofar as this is necessary for the performance of their respective services.
KELAG obliges its processors, on the basis of data processing agreements, to treat the transmitted personal data confidentially and to process them only for the agreed purpose and for a specified duration.
An up-to-date list of the processors used can be requested from KELAG at datenschutz@kelag.at.
Within the KELAG Group, data are transferred exclusively to the aforementioned group companies (KNG-Kärnten Netz GmbH and KELAG Energie & Wärme GmbH); no transfer to other group companies takes place.

 

Overview of Third Country Transfers and Safeguards
Where personal data are transferred to countries outside the EEA, such transfers are based on the following safeguards:

• Switzerland (e.g. Eturnity AG, Exnaton AG): Adequacy decision of the European Commission pursuant to Article 45 GDPR.
• United States (e.g. HubSpot Inc., Apple Inc., Google LLC, Meta Platforms Inc., LinkedIn Corporation, Microsoft Corporation): EU—US Data Privacy Framework (Article 45 GDPR), insofar as the respective recipient is certified; otherwise, standard contractual clauses pursuant to Article 46(2)(c) GDPR, including supplementary technical and organizational safeguards.
• New Zealand (InnoCraft Ltd., provider of Matomo): Processing takes place on servers in Austria; no transfer to third countries occurs.
• EU/EEA recipients (e.g. Hotjar Ltd., Malta): No transfer to third countries required.

For all third-country transfers, transfer impact assessments (TIA) are carried out. A copy of the respective safeguards can be requested from KELAG at datenschutz@kelag.at

 

Protection of Minors
This privacy information is generally intended for adults. Persons under the age of 14 must not transmit any personal data to KELAG without the consent of their legal guardians. In the case of consent given by minors, the requirements of Article 8 GDPR and Section 4(4) DSG must be observed.
If we become aware that personal data of persons under the age of 14 have been transmitted to us without the consent of their legal guardians, we will delete such data without undue delay.

 

Data Breach Procedures (Articles 33 and 34 GDPR)
KELAG has implemented technical and organizational procedures to detect, document, and assess data breaches within the meaning of Articles 33 and 34 GDPR.
In the event of a notifiable personal data breach, we will inform the competent supervisory authority without undue delay and, where possible, within 72 hours of becoming aware of it.
If the breach is likely to result in a high risk to your rights and freedoms, we will also inform you without undue delay in clear and plain language.

KELAG processes your personal data, where necessary, for the duration of the entire business relationship and thereafter for the duration of statutory retention and documentation obligations, in particular under the Austrian Federal Fiscal Code (BAO).
Pursuant to Section 132 BAO, records subject to retention must be kept for seven (7) years; this period begins at the end of the calendar year in which the respective tax claim arose.
The following specific retention periods apply to key data categories:

• Contract, consumption, and billing data: duration of the contract plus 7 years (BAO/UGB)
• Marketing and advertising data: up to 3 years after termination of the contract or until withdrawal of consent
• Newsletter subscription data: until withdrawal of consent
• Creditworthiness data: until full settlement of the claim or in accordance with the requirements of credit agencies and Section 25 DSG
• Applicant data: 6 months after completion of the application process; longer if explicit consent to inclusion in the applicant pool has been given
• Smart meter and metering data: in accordance with Section 57 ElWG by the respective network operator
• Mobility app charging data: until billing; thereafter pseudonymization or anonymization; billing-relevant records retained for 7 years (BAO)
• Video recordings: generally 72 hours; longer only if required for the assertion of legal claims
• PlusClub portal data: until termination of PlusClub membership; tax-relevant components retained for 7 years (BAO)
• Cookies: in accordance with the storage periods specified in the respective cookie table
• Webshop order data: until completion of the contract; billing-relevant data retained for 7 years (BAO); product liability-related data retained for 10 years after placing the product on the market
• General inquiries via Oracle Service: for the duration of processing and the customer relationship
• Accounting records, books, and documents relevant for tax purposes must therefore be retained for seven (7) years and are deleted after expiry of this period.

In addition, metering data and the consumption and billing information derived therefrom are stored only for as long as required for the legally permitted purposes under the ElWG and for contract performance; where possible, data are aggregated or anonymized.

KELAG processes your personal data in connection with the use of services involving HubSpot until you withdraw your consent. You may withdraw your consent at any time, without providing reasons, with effect for the future, either in part or in full. The withdrawal of consent does not affect the lawfulness of processing carried out on the basis of consent prior to its withdrawal.

To exercise your right of withdrawal, please contact:
KELAG-Kärntner Elektrizitäts-Aktiengesellschaft,
Arnulfplatz 2, 9020 Klagenfurt am Wörthersee,
or via email at datenschutz@kelag.at.

Data Security
KELAG implements appropriate technical and organizational measures to ensure the protection of your personal data in accordance with Article 32 GDPR.
These measures include, in particular:

• Confidentiality (e.g. access and entry controls, authorization concepts, encryption)
• Integrity (e.g. input and disclosure controls)
• Availability and resilience of processing systems (e.g. backup, recovery, and emergency concepts)
• Regular testing, assessment, and evaluation of the effectiveness of these measures

These measures are continuously adapted in line with the state of the art.

Meter data and the consumption and billing data derived therefrom are processed and stored exclusively for as long as necessary for the performance of contractual obligations, the exercise of statutory duties, and compliance with legal obligations, in particular under the Electricity Industry and Organization Act (ElWG), in accordance with Article 5(1)(e) GDPR.
Further processing takes place only within the scope of legally permissible purposes; where possible, personal data are aggregated or anonymized.

In accordance with Articles 15 to 21 GDPR, data subjects are entitled, in particular, to the following rights:

• right of access
• right to rectification
• right to erasure
• right to restriction of processing
• right to data portability
• right to object to the processing of their personal data

These rights may be exercised at any time, without providing reasons, upon clear identification of the data subject, by written request to:
KELAG-Kärntner Elektrizitäts-Aktiengesellschaft
Arnulfplatz 2
9020 Klagenfurt am Wörthersee
or via email at: datenschutz@kelag.at

In addition, the ElWG grants end customers specific data sovereignty and control rights regarding their metering data. In particular, customers have the possibility to:

authorize the transmission of metering data to authorized third parties via the web portal
withdraw such authorizations at any time
access logs of granted and withdrawn authorizations
request access to metering data via the designated interfaces

Where statutory retention, documentation, or usage obligations prevent deletion, immediate erasure is not permissible. In such cases, information will be provided regarding the applicable legal basis and the respective retention period.
The protection of personal data is ensured in compliance with the GDPR and the relevant national data protection provisions.

If you believe that the processing of your data violates data protection law or that your data protection rights have otherwise been infringed, we kindly ask you to contact us in order to clarify your concerns.
If you consider that your data are being processed unlawfully, you have the right to lodge a complaint with a data protection supervisory authority, in particular in the Member State of your habitual residence, place of work, or the place of the alleged infringement (Article 77 GDPR).

In Austria, the competent supervisory authority is:
Austrian Data Protection Authority
Barichgasse 40—42
1030 Vienna
Email: dsb@dsb.gv.at
Website: www.dsb.gv.at

 

Amendments to this Privacy Notice
We reserve the right to amend this privacy notice in response to legal or technical developments. The version published on our website at www.kelag.at under the section “Data Protection” shall apply.
We will inform you in advance, in an appropriate manner (in particular via email or within the customer portal), of any significant changes that materially affect your rights or the processing of your personal data.