Requests concerning Art. 15 GDPR
Data Subject Rights from Art. 16-21 GDPR
Version dated: December 2023
Data privacy is a matter of trust, and your trust matters to us. We respect your private and personal domain. The protection, as well as the legally-compliant collection, processing and use of your personal data, is therefore of great importance to us. When processing your personal data, we ensure strict compliance with the statutory rules (GDPR, Austrian Data Protection Act (Datenschutzgesetz, DSG), Austrian Telecommunications Act 2021 (Telekommunikationsgesetz 2021, TKG 2021)). We set out below the key aspects of the way in which we undertake data processing.
The data controller (responsible for data processing) is:
KELAG-Kärntner Elektrizitäts-Aktiengesellschaft
Arnulfplatz 2
9020 Klagenfurt am Wörthersee
FN 99133i, UID-Nr.: ATU 25274100
Telefonnummer: +43 463 525 5555
E-Mail: datenschutzauskunft@kelag.at
KELAG-Kärntner Elektrizitäts-Aktiengesellschaft (hereinafter referred to as "KELAG") processes the following personal data, which we receive from you within the framework of our business relationship, e.g. title, first name, surname, address, date of birth, telephone number, email address, authentication data, plus information collected during the course of the business relationship. In addition, contract data (e.g. standing orders or direct debit instructions), bank details, data arising from fulfilment of our contractual obligation (e.g. consumption, contractual, and invoicing data), data relating to creditworthiness, payment terms, data concerning your installation (e.g. meter point designation, meter number, meter reading, consumption, date of commissioning/decommissioning), advertising and sales data, data from customer loyalty programmes (e.g. PlusClub), advice logs, information, disclosures arising from customer surveys and competitions, information from your electronic interactions with our company (Self Service Portal, apps, cookies) as well as data for the purpose of fulfilling statutory requirements, may also be processed.
The data provided by you are required for the purpose of contractual fulfilment and to take pre-contractual steps. Without these data, we cannot conclude a contract with you.
Furthermore, particularly in the case of business customers, KELAG processes data from publicly-accessible sources, such as commercial registers, business reports, association registers, the land register, VAT reference numbers, sector affiliation, publicly-available commercial data, as well as data from address publishers, direct marketing companies and credit agencies, which data we have received on a legitimate basis.
KELAG processes your personal data in accordance with data protection rules:
Use of your data for advertising purposes and external sales
We inform you that KELAG processes your personal data, which was collected during the contractual relationship, for the purpose of sending individual offers, information about innovations, products and additional services by mail during the ongoing business relationship, as well as within three years after termination of the contract. Occasionally, your data will be transmitted to our external sales department Peak Energy GmbH, Schachterlstraße 16, 9065 Ebenthal, company registration number FN 566023m and processed by them for marketing purposes for KELAG, in particular through electronic or postal contact. The data processing is based on the legal provisions of Art 6 para 1 lit f (legitimate interest of the person responsible) of the GDPR. You can object to the processing of your personal data at any time. Please send your objection by e-mail to datenschutzauskunft@kelag.at .
For other forms of direct advertising (e.g. competitions, newsletters etc.) KELAG will only process your personal data if you have given your explicit consent. You can revoke your consent at any time without giving reasons with effect for the future, without affecting the legality of the processing carried out by KELAG on the basis of your consent until the revocation. Please contact KELAG-Kärntner Elektrizitäts-Aktiengesellschaft, Arnulfplatz 2, 9020 Klagenfurt am Wörthersee or by e-mail at datenschutzauskunft@kelag.at to exercise the revocation.
Autostrom
Your data is only received by those employees of Kelag who need it to fulfil their contractual obligations. For customer authentication at charging points of Kelag roaming partners and for billing, Kelag transmits the Contract-ID, the RFID-Unique-ID when using RFID cards and the respective contract certificate when authenticating via Plug & Charge to its roaming partners and to roaming platforms in which Kelag participates. Kelag roaming partners and roaming platforms do not have access to the personal data stored by Kelag. KELAG processes your personal data, as far as necessary, for the duration of the entire business relationship as well as beyond for the duration of legal retention and documentation periods.
Energy Consulting Photovoltaics, Heat Pump, Tenant Electricity and Connect Fiber Optic Connection
For the use of the service (such as receiving information documents, sending individual offers, contacting, reconciling missing technical data, heat pump consulting, heat pump installation and billing, use of the heating cost calculator, registration for photovoltaic and e-mobility consulting, use of the photovoltaic calculator, sending of the photovoltaic and e-mobility promotion guide) within the scope of energy consulting for photovoltaics and heat pumps, the provision of your data is required. The provision of your data is also required for the operation, administration and billing of joint generation plants (tenant electricity). The data is provided to those Kelag employees who need it to fulfill the service. This information is stored and managed on the servers of our partners, e.g. HubSpot. Furthermore, we provide the data to the following companies.
Automated data processing
KELAG uses automated data processing procedures in order to analyse user and consumption behaviour for the purposes of optimum customer service provision. The personal data processed and collected within the framework of the contractual relationship (also via the Self Service Portal and apps) for the purpose of fulfilling your contract, as well as your response data to marketing measures, are used by way of integration with aggregated data and statistical methods for purposes of customer segmentation and analysis.
KELAG Self Service Portal
As an existing customer, you have the option of registering for our Self Service Portaland setting up your customer account via password-protected access. The functions available via the Portal including management of personal data and additional services, and the Portal also allows you to view and download your account statements.
The data provided by you are required for the purpose of providing online services. Without these data, we cannot offer you this service. No data will be transferred to third parties.
You must keep your personal access data confidential and not render it accessible to any unauthorised third party. If you close your customer account, your access data will be immediately deleted. If you have terminated your contract with KELAG, at the same time, your customer account and access data in the Self Service Portal will also be deleted.
KELAG MyShop
To simplify the purchasing process and for subsequent contract processing, KELAG, as a webshop operator, stores subscriber IP data in the context of cookies. In addition, for the purpose of contract processing, we store the following data: title, first name and surname, date of birth, address, telephone number, email address, plus bank details/credit card number of the purchaser. Moreover, we process your personal data in order to generate and maintain your webshop user account, if you register for such an account.
The data provided by you are required for the purpose of contractual fulfilment and to take pre-contractual steps. Without these data, we cannot conclude a contract with you. No data will be transferred to third parties, with the exception of transfer of bank details/credit card details to the processing banking institutions/payment service providers for the purpose of debiting the purchase price, as well as to the transport/shipping company instructed by us for the purpose of delivering the goods.
If the purchasing process is interrupted, the data stored by us will be automatically deleted after a period of 24 hours. Where a contract is concluded, all personal data associated with the contractual relationship shall be stored until expiry of the statutoryretention period for tax purposes (7 years). The data first name and surname, address, items purchased and purchase data will additionally be stored until expiry of the product liability period (10 years).
PlusClub portal
As an active Kelag customer, you can register directly in the PlusClub portal and set up your password-protected customer account. This allows you to view current PlusClub vouchers, save them as favorites and redeem vouchers digitally or print them out. As a Kelag customer, you can also take part in current competitions via the PlusClub portal and provide Kelag with your personal customer feedback.
The customer data transmitted during registration and in the course of using the PlusClub portal will be processed by Kelag. This data includes Business partner number, title, first name, last name, e-mail address, address, telephone number, password, date of birth, IP address, host and browser information, login data, and customer feedback. The data is processed for voucher management (personalization, redemption, etc.), internal statistical evaluations and optimal user experience. The following information is transmitted to the respective PlusClub partner for statistical purposes: Time and date of voucher activation (for the selected partner voucher), voucher code and store.
The data will be deleted after the statutory retention period of 7 years if the delivery contract is terminated.
Applications (Apps)
For the use of the apps provided by Kelag, personal data such as user data (name, e-mail address, password, telephone number) are required and processed.
Push notifications
Our apps can inform you about certain events or topics with push notifications, even if you are not actively using the app at the time. Push notifications are messages that are sent to your mobile device even when you are not using our mobile apps. If you do not want this to happen, you can disable push notifications in your mobile device settings at any time. When you activate push notifications, a unique identifier (device ID) is sent to the service of the respective operating system provider (which provides this push function) (iOS: "Apple Push Notification Center", Android: "Google Cloud Messaging"). This service returns the "Push Notification Identifier", which no longer allows any conclusions to be drawn about the device ID and thus the user. Communication is always based on this identifier, thus ensuring that the device ID is not reused. The storage period is the duration of the use of the push service.
Location-based services.
The features of some of our apps use the location services of your device to collect location data. This is done for the purpose of offering you app-based services and other content tailored to your current location. For example, an app may show you "coupons and events" near you. This location-based service can be disabled or enabled by the user in the app settings at any time. The storage period is the usage of the respective location-based service.
Access to local media on the end device
To use the mobile apps in offline mode, it is necessary to have access to local media on the end device. This is so that the user's own content, such as photos, can be stored temporarily on the mobile device and is thus also available when there is no Internet connection. The user's photos are not accessed. The user can deactivate or activate this sharing in the app settings at any time.
Newsletter
Our customers have the option of subscribing to our Newsletter via our website. For this purpose, we require your email address and a declaration from you to the effect that you are in agreement with receiving the Newsletter. In connection with sending the Newsletter, we use the so-called double opt-in method, which means that we will only send you a Newsletter via email once you have expressly confirmed to us in advance that we should activate the Newsletter service. We will then send you a notification email and ask you to confirm to us by clicking on a link in the email that you wish to receive our Newsletter. By registering for the Newsletter, you agree that your emailaddress may be used by KELAG for the purpose of sending the Newsletter. If you no longer wish to receive any Newsletters from us, you can cancel your subscription at any time via the unsubscribe link in the Newsletter. We will then immediately delete your data linked to Newsletter subscription. This shall be without prejudice to the lawfulness of sending you Newsletters prior to receiving your notice of cancellation.
The data provided by you are required in order to send you the Newsletter. Without the said data, we cannot send you the Newsletter. No data will be transferred to third parties.
Websites
When you visit KELAG websites, occasionally information will be collected automatically (i.e. not through registration) which is not attributed to a particular person, such as web browsers and operating systems used, domain name of website from which you accessed the KELAG website, number of visits, average time spent on the site, and pages accessed. KELAG uses this information in order to establish the attractiveness of its websites and in order to optimise their content on an ongoing basis.
The KELAG websites contain links to other websites. KELAG is not responsible for the data protection measures or content of such other websites. We recommend that users familiarise themselves with the data privacy notices of the websites in question.
Payment method "Cash payment"
If you select the payment method "Cash payment", for purposes of payment processing, we will pass on your personal data (customer number, email address, telephone number and address (apartment/house number, street name, town/city, postcode/zip code, country) only to the payment services provider Cash Payment Solutions GmbH, Wallstr. 14a, 10179 Berlin, in order that Cash Payment Solutions GmbH can provide you with an individually-generated numeric code/barcode (so-called "payment form") for the transaction in question. This payment form will enable you to pay the relevant transaction costs in cash at Cash Payment Solutions GmbH's business partners. Such business partners will then forward payment confirmation in real time. The business partners will neither store your data nor process your data in any manner which could affect your data privacy rights. Cash Payment Solutions GmbH uses your personal data exclusively for the purpose of implementing the payment method "Cash payment".
KELAG Connect fibreoptic connection
Your personal data as stated on your order form (such as name, address, contact details, bank details, etc.) will be processed by us in order to set up and operate the fibreoptic infrastructure for the purpose of fulfilling your order, and for the same purpose, will be passed on to contract data processors as well as to contract and businesspartners involved in contractual fulfilment (such as construction firms, internet service providers, etc.).
The personal data provided by you when expressing your interest (such as name, address, etc.) will be used by us to collate expressions of interest, in order to implement expansion in your region as soon as a predefined take-up rate has been reached. These data are stored for three years following collection, or one year following abandonment of the fibreoptic project in your region.
Oracle Service
KELAG customer service uses the Oracle Service in order to respond to customer enquiries via email.When you communicate with the following email addresses, your data will be forwarded to the Oracle data processing centres in Munich and Frankfurt and be processed there.
The purpose of processing is to respond to customer enquiries via an email management system, so as to structure the processing of such enquiries more efficiently. The data recipient consists of the KELAG companies. The data are stored at the Oracle data processing centres in Munich and Frankfurt. Data are not forwarded to third countries outside the EU. Your data will be stored for the duration of the contractual relationship.
What are cookies?
Cookies are small text files which are stored on your end device with the help of your browser, that store particular settings and data which are shared with our system via your browser. There are basically two types of cookie: so-called session cookies, which are deleted as soon as you close your browser, and temporary cookies, which are stored on your device for a longer period, or indefinitely. Cookies enable us to adapt a website to your interests, to present offers in a user-friendly manner, or to store your password so that you do not have to enter it every time you visit a site. Thus, when you visit our KELAG websites, we place information in the form of cookies in your computer, which will automatically identify you on your next visit to the site. The cookies used by KELAG do not store any personal data. The cookies we use can therefore not be attributed to a particular person and can thus not be traced to you. When a cookie is activated, it is allocated an identification number. This identification number can never and will never be linked to your personal data. Your name, your IP address or similar data which would enable attribution of cookies to you, are never recorded.
We use cookies for the purpose of implementing message transfers and providing the services requested by you. The data processing activities resulting from the use of cookies are based on our legitimate interests in providing a fully-functional website and the services requested by you (Art. 6(1)(f) GDPR, Section 96(3) of the Austrian Telecommunications Act).
Necessary cookies
Necessary cookies help to make a website useable by enabling basic functions such as page navigation and access to secure areas of the website. The website is not able to function properly without such cookies.
Preference cookies
Preference cookies enable a website to recall information which influences the behaviour or appearance of a website, including factors such as your preferred language, or your particular region.
Statistical cookies
Statistical cookies help website owners to understand how visitors interact with websites by collecting and reporting information anonymously.
Marketing cookies
Marketing cookies are used in order to track visitors to websites. The aim is to show ads that are relevant and appealing to the individual user and which are therefore more valuable to the publisher and third party advertisers.
Use of Facebook remarketing
Remarketing tags of the social network Facebook, 1601 South California Avenue, Palo Alto, CA 94304, USA are integrated into KELAG websites. When you visit our sites, a direct link is established between your browser and the Facebook service via the remarketing tags. As a result, Facebook is informed that you have visited our site using your IP address. This enables Facebook to attribute your visit to our site to your user account. We can use the information thereby obtained in order to display Facebook ads. We would point out that, as provider of the sites, we are given no knowledge of the content of data transmitted or of use of such data by Facebook. The data collected via the remarketing tags are "hashed" (anonymised) and, unless you give your separate consent, will not be used to identify you personally as a visitor to our website, nor will such data be combined with personal data via the anonymised user profile. Further information in this regard can be found in Facebook's privacy policy at https://www.facebook.com/about/privacy/. If you wish to reject data collection via Custom Audience, you can deactivate Custom Audiences at any time here: https://www.facebook.com/ads/website_custom_audiences/.
LinkedIn Insight Tag
Subject to your express consent pursuant to Art.6 para.1 p.1lit.a DSGVO, our website uses a tracking tool that records and analyzes LinkedIN members on a website. The so-called Insight Tag is offered by LinkedIn Corporation, 2029 Stierlin Court, Mountain View, CA 94043, USA.
What data is collected?
This LinkedIn Insight Tag sets a cookie in your browser. Via this, LinkedIn collects data such as URL, referrer URL, device properties, browser properties and IP address, among other things.
How long is the data retained?
LinkedIn anonymizes the data within 7 days, or deletes the data within 90 days. Kelag, as the site operator using the LinkedIn Insight Tag, does not receive any personal data. Kelag only receives summarized reports about the demographics of its target audience and the performance of its ads. In the process, Kelag receives information on criteria such as
By using the services listed above, KELAG receives valuable information about the interaction and navigation behavior of users with this website and is thus able to make the website faster and more user-friendly.
more user-friendly. If you have allowed the use of LinkedIn cookies, you can disable these cookies at any time by updating your
Cookie settings. For more information about LinkedIn Insight Tag and the services offered, please visit https://www.linkedin.com/.
Matomo
If you have given your consent by accepting marketing cookies or all cookies, Matomo will be used on our website for analytical purposes. Matomo is web analysis software provided by InnoCraft Ltd., 150 Willis St, 6011 Wellington, New Zealand. Cookie technology enables analysis of use of our websites. In the context of use of Matomo, cookies are generated and stored on the user's end device for a maximum period of 13 months. The information on use of our website collected using the cookies is only stored on servers in Austria based on our legitimate interests in the statistical analysis of user behaviour, for optimisation and marketing purposes, in accordance with Art. 6(1)(f) GDPR. Since we attach particular importance to the protection of your data, the data will not be shared with third parties, and we have in addition configured Matomo such that your IP address is only recorded in abbreviated form. We therefore process your personal usage data in anonymised form, and it is therefore not possible to trace such data back to you personally. Further information on Matomo's terms of use and data privacy policies can be found at: https://matomo.org/privacy/.
HubSpot subscription service
HubSpot subscription service
We use the subscription service of HubSpot Inc. for purposes of marketing and for generating leads. With the help of this subscription service, website visitors can find out more about our company, download content and input their contact details or other demographic information. This information is stored and administered on HubSpot's servers in the USA. Based on this information, visitors can be contacted and interact with us in relation to their interest in our goods or services. Information on how HubSpot handles your personal data may be found at the following link: https://legal.hubspot.com/de/privacy-policy. The data stored by HubSpot may include the following: your IP address, browser type, domain name, internet service provider (ISP), the files viewed on our website (e.g. HTML pages, graphics, etc.), the operating system, clickstream data, access times and addresses of websites from which you accessed our website. If we hold your personal data (name, address, date of birth, PlusClub membership, consumption and product information, etc.) because you have notified such data to us, these data will be linked with log data (device and activity data).
Hotjar
Subject to your consent, our website uses web analysis services of Hotjar Ltd., Level 2, St. Julians Business Centre, 3 Elia Zammit Street, St. Julians STJ 1000, Malta ("Hotjar").
Hotjar enables the tracking of activities on this website in the form of so-called "heatmaps". By using Hotjar's heatmap service, KELAG can for instance see how far users scroll, how they navigate the website, which links they click on, and how often they do so.
Session recordings as offered by Hotjar are also used on this website. Through this service, particular data are recorded to determine how users navigate during a browsing session. This includes, for instance, HTML changes arising during use of the website, mouse movements, mouse clicks, scrolling movements or changes in browser window size. With some selected input fields, keyboard entries may also be recorded.
In addition, this website uses the form service "Forms by Hotjar". This service records how users interact with input fields on the website, e.g. whether they complete fields and submit information, the average interaction time with a field, plus whether fields are left blank or the form is abandoned at a particular field.
Through the use of Hotjar's above services, KELAG gains valuable information about the interaction and navigation behaviour of website users and as a result is able to make the website faster and more user-friendly. In addition to information on user interaction and navigation (i.e. links clicked, mouse movements, etc., as set out above), device monitor size, device type, operating system and browser information, plus preferred language for the site, as well as device IP address, are also recorded. The latter is recorded and stored exclusively in anonymised form. Hotjar does not record any content or information entered in fields or communicated via this website.
Hotjar generates its own tracking code in order to track use of the website by the user using a Hotjar cookie. Further information on Hotjar and the services offered is available at: https://www.hotjar.com. Hotjar's privacy policy can be found at: https://www.hotjar.com/privacy.
The legal basis underlying activation of Hotjar cookies is your consent under the terms of Art. 6(1)(a) GDPR. We use Hotjar cookies only if you give your express permission. If you have allowed the use of Hotjar cookies, you can also deactivate their use at any time by updating your cookie settings.
The legal basis underlying subsequent processing of the data collected via Hotjar, such as use, analysis and storage of such data, is Art. 6(1)(f) GDPR. KELAG's legitimate interest consists in the improvement and optimisation of the website for the benefit of visitors to the site.
Your data are received by those employees at KELAG who require such data in order to fulfil contractual and statutory duties as well as to serve legitimate interests. In addition, we forward your data to contract processors instructed by us (in particular IT, telecommunications, printing and scanning service providers, as well as official bodies, etc.) plus group affiliates (KELAG-Group) in so far as the data are required for the purpose of rendering the contractual service in question. Within the framework of contract processing agreements, KELAG places its contract processors under a duty to treat as confidential the personal data transferred and only to process such data for the respective agreed purpose and for a specified period. Since the different recipients and contract processors change on a regular basis, it is not possible for them to be specifically named.
KELAG processes your data, in so far as required, for the period of the entire business relationship and for the duration of the statutory retention and documentation periods thereafter, in particular as set out in the Austrian Federal Fiscal Code (Bundesabgabenordnung, BAO). Under Section 132 of the Austrian Federal Fiscal Code, tax claims become statute-barred after 7 years, at the end of the year in whichthe claim arose. Accounts, records and receipts relevant for tax purposes must therefore be retained for seven years and will be deleted upon expiry of this period.
You have at all times the right to access, rectification, erasure or restriction of your processed data, as well as a right to data portability and a right to object to processing. We take the protection of your data very seriously. If you wish to assert your rights, you may do so, without the requirement to indicate reasons, by sending a letter to us, including clear personal identification information, at the following address: KELAG-Kärntner Elektrizitäts-Aktiengesellschaft, Arnulfplatz 2, 9020 Klagenfurt am Wörthersee, or by sending an email to: datenschutzauskunft@kelag.at.
If you believe that processing of your data is in breach of data protection law or that your data protection rights have been infringed in any other manner, please make contact with us in order to resolve your concerns.
If you are of the view that we are making inadmissible use of your data, you have the right to make a complaint to the data protection authority in Austria or the competent data protection authority, particularly in the Member State of your place of residence or work.
Our Data Protection Officer can be contacted at: KELAG-Kärntner Elektrizitäts- Aktiengesellschaft, Attn.: Data Protection Officer (z.H. Datenschutzbeauftragter), Arnulfplatz 2, 9020 Klagenfurt am Wörthersee, or via email, at: datenschutz@kelag.at.
We reserve the right to modify this Data Privacy Notice at any time based on legal or technical changes. The respective valid version of this Notice is published on our website www.kelag.at under the heading "Data Privacy".