Privacy Policy

As of October 2026

The protection of your personal data is important to us. In this Privacy Policy, we inform you about what personal data we process in connection with our website, our events, our contact options, and our other services; for what purposes this is done; the legal basis for the processing; and what rights you have.

1. Data Controller

The data controller responsible for the processing of personal data within the context of the General Data Protection Regulation (GDPR) is:

Österreichische Studentenmission - Christen an der Uni (ÖSM)
Sobieskigasse 35/2/2
1090 Vienna
ZVR Number: 286541861

Email: web@oesm.at

2. What data do we process?

Depending on how you use our website and our services, the following personal data may be processed:

Name and contact information
Email address
Mailing address
Phone number
Information regarding your studies, education, or profession
Information regarding events and their organization
Information regarding newsletter and mailing list subscriptions
Profile data
Technical Data and Server Log Data
Data that you voluntarily provide to us in messages or forms
where applicable, information regarding dietary needs, allergies, or other health-related needs
where applicable, photos and videos
where applicable, data regarding accompanying individuals, particularly children
when using our digital work environments, where applicable, files, documents, comments, and communication data.

We process only the data that is necessary for the specific purpose or that you voluntarily provide to us.

3. Website and Hosting

Our website is hosted on Netlify. We use the Sanity content management system to manage and publish content.

When you visit our website, technically necessary data is processed. This may include, in particular:

IP address
Date and time of access
URL or file accessed
Amount of data transferred
Status of the request
Browser type and version
Operating system and device
Referrer information, if applicable

Data processing is carried out for the purposes of technical provision, ensuring security, defending against attacks, and ensuring the proper operation of our website.

Legal basis: Art. 6(1)(f) of the GDPR. Our legitimate interest lies in the secure and functional operation of our website.

In the event of a hacking attack, the server logs will be shared with law enforcement authorities. Any further disclosure to third parties does not occur.

For more information on the provider's data protection practices, please refer to their current privacy policies (Netlify or Sanity).

4. Email Communication

We use the services of ALL-INKL.COM – Neue Medien Münnich for our email communication.

When you contact us via email or communicate with us via email, we process the following information in particular:

Email address
Name and, if applicable, signature data
Content of the email communication
Attachments
Technical communication data.

Your data is processed to handle and respond to your inquiry and to carry out the relevant communication.

Legal basis: Depending on the content of the communication, Article 6(1)(b) of the GDPR or Article 6(1)(f) of the GDPR.

Email correspondence may be stored beyond the time of the actual communication due to statutory retention requirements or to safeguard legal claims.

5. Cookies and Similar Technologies

Cookies are small text files that the ÖSM website stores on your computer to recognize it and may contain information about your use of the website. The information contained in the cookies is used to determine whether you are logged in or what data you have already entered.

The cookies used are necessary to provide the website’s services. No tracking or analytics cookies are set.

Cookies Set:

Session Cookies: Last for the duration of the session. These are required to manage your visit to the website and, where applicable, to manage the identification of logged-in users.

Most web browsers automatically accept cookies. You can prevent this by changing your browser settings. You can remove cookies stored on your computer at any time by deleting your temporary Internet files.

6. User Account and Profile Information

You can create a user account on our website.

To create and manage your user account, we process the following information in particular:

Email address
Password or authentication data derived from it using technical means
Name and, if applicable, other profile information you voluntarily provide.

The following information, in particular, may be provided on an optional basis:

Gender
Salutation
Title
Last Name
Date of Birth
Address
Organization
Field of Study
Phone Number

This data is used, in particular, to manage your user account, to communicate with you, and—if you have opted in—to manage your newsletter and mailing list subscriptions.

Legal basis: Article 6(1)(b) of the GDPR, to the extent that processing is necessary to provide the user account, and, where applicable, Article 6(1)(a) of the GDPR for additional services that users voluntarily choose.

7. Cloud

We use Nextcloud for the shared storage, management, and editing of documents and other files. Our Nextcloud instance is hosted on servers provided by Hetzner Online GmbH.

Depending on usage, the following personal data in particular may be processed:

Name
Username
Email address
Contact information
Files and documents
Comments and other content
Sharing and permissions
Access and modification information
Technical log data.

Nextcloud is used primarily for internal collaboration, the joint editing and storage of documents, and the secure exchange of files.

Legal basis: Art. 6(1)(f) of the GDPR. Our legitimate interest lies in efficient and secure digital collaboration. To the extent that the use of Nextcloud is necessary to fulfill a specific agreement or organizational task, the processing may also be based on Art. 6(1)(b) of the GDPR.

The technical infrastructure for our Nextcloud is provided by Hetzner Online GmbH.

Data processing takes place on servers located within the European Union or the European Economic Area.

To the extent that Hetzner acts as a data processor on our behalf, processing is carried out on the basis of a data processing agreement in accordance with Article 28 of the GDPR.

Further information on data processing by Hetzner can be found in the provider’s current privacy policy.

8. Newsletters and Mailings

We offer various newsletters and mailings. We use CleverReach for newsletters.

The following data, in particular, may be processed for registration:

Name
Email address
Mailing address
Selection of desired newsletters or circulars.

Electronic newsletters are generally sent based on your consent.

Legal basis: Art. 6(1)(a) GDPR.

Registration is carried out via a double opt-in process whenever possible. In this process, registration is verified and documented by confirming the email address provided.

You may revoke your consent at any time, effective for the future. To do so, you can use the unsubscribe link in the newsletter or contact us directly.

9. Registration for Events

When you register for events, we process the data necessary for organizing and conducting the respective event.

This may include, in particular:

Name
Date of birth
Email address
Mailing address
Phone number
Field of study, training, or occupation
Accommodation details
Meal details
Financial support details
Other information required for the specific event.

Legal basis: Article 6(1)(b) of the GDPR, to the extent that the processing is necessary for registration and the conduct of the event.

The data will be stored only as long as necessary for the conduct of the event or as long as statutory retention requirements or legitimate interests justify further storage.

10. Health-Related Information and Allergies

For certain events, information regarding allergies, intolerances, special dietary needs, or other health-related circumstances may be required. Such information may constitute health data within the meaning of Article 9 of the GDPR.

We collect such data only to the extent necessary to ensure the safe and appropriate conduct of an event.

Legal basis under Article 6 of the GDPR: Paragraph 1, subparagraphs (a) and (d).

Access to this information is restricted to individuals who need it for the organization or safe conduct of the event.

Health-related information will be deleted after the event concludes, unless there is a legal obligation to retain it or another valid legal basis for further storage.

11. Data of Children and Co-Registered Individuals

During events, personal data of co-registered individuals—and in particular, children—may be processed.

The person submitting the registration must ensure that they are authorized to provide the data.

We process children’s data only for the purposes required in each case and limit the processing to the extent necessary.

Special categories of personal data relating to children are processed only if there is an appropriate legal basis for doing so under Articles 6 and 9 of the GDPR.

12. Photography and Videography

Photographs and videos may be taken during our events.

Images in which individuals are recognizable will only be published if there is an appropriate legal basis for doing so.

Where consent is required, it will be obtained separately and voluntarily.

Publication may involve the following media in particular:

ÖSM Website
ÖSM Social Media Accounts
Flyers and Other Printed Materials
Other ÖSM Public Relations Activities.

We take special care to protect children and adolescents and, when necessary, obtain consent from their legal guardians.

Consent that has been granted may be revoked at any time with future effect.

Such a revocation does not affect the lawfulness of the processing carried out prior to the revocation.

13. Online Meetings

We use Zoom for online meetings, digital events, and discussions.

In particular, the following data may be processed:

Name or display name
Email address, if provided
Audio and video data
Chat messages
Technical connection data
Files or other content shared during the meeting, if applicable.

Whether and which of these data are processed depends on the specific use and settings of the respective meeting.

Legal basis: Art. 6(1)(b) of the GDPR, to the extent that the use is necessary for the conduct of an event or the provision of an agreed-upon service. In other cases, Art. 6(1)(f) of the GDPR may serve as the legal basis.

We configure Zoom to be as privacy-friendly as possible and enable features such as recordings only when necessary for the specific purpose and when there is an appropriate legal basis for doing so.

For more information on data processing by Zoom, please refer to the provider’s current privacy policy.

14. Internal Communication and Collaboration

We use Slack on the Free Plan for internal communication and collaboration. Slack is used in particular for communication between full-time and volunteer staff, as well as for collaboration in workgroups and projects.

When using Slack, the following personal data in particular may be processed:

Name or Display Name
Email Address
Username
Profile picture, if provided by the individual
Information about role, team, or department
Messages and other communication content
Files and documents shared via Slack
Information about memberships in channels and workgroups
Reactions and other interactions
Technical usage and connection data.

The processing is used for internal communication, the organization of workflows, and collaboration within teams and projects.

Legal basis: Art. 6(1)(f) of the GDPR. Our legitimate interest lies in efficient, modern, and structured internal communication and collaboration.

14.1 User Accounts

When a person leaves ÖSM and no longer has a legitimate reason to use the Slack workspace, their Slack access will be deactivated or deleted.

Messages already sent by that person may—depending on Slack’s settings and technical capabilities—remain in the workspace for the duration of the applicable retention period.

14.2 Liability and Data Processing on Behalf of Others

To the extent that Slack processes personal data on our behalf, such processing is based on a data processing agreement in accordance with Article 28 of the GDPR.

The transfer mechanisms and safeguards applicable to the specific Slack service are set forth in Slack’s current privacy policy and contractual documents.

For more information on data processing by Slack, please refer to the provider's current privacy policy and privacy notice.

15. Recipients of Personal Data

Personal data is only disclosed to recipients if there is a legal basis for doing so.

Depending on the purpose of the processing, recipients may include, in particular:

persons entrusted with organizing events
volunteers, to the extent necessary for them to perform their duties
IT and hosting service providers
ALL-INKL.COM – Neue Medien Münnich
Hetzner Online GmbH
Nextcloud provider or the operators of our Nextcloud instance
Zoom Video Communications, Inc.
Slack Technologies, LLC / Slack
Payment and accounting service providers
Competent legal authorities
Other data processors.

To the extent that external service providers process personal data on our behalf, we enter into data processing agreements in accordance with Article 28 of the GDPR, where necessary.

16. Transfer to Third Countries

To the extent that personal data is transferred to recipients outside the European Union or the European Economic Area, such transfers are made only in compliance with Articles 44 et seq. of the GDPR.

Depending on the specific provider and the nature of the data processing, this may involve, in particular, an adequacy decision by the European Commission or appropriate safeguards such as standard data protection clauses.

17. Data Security

We take appropriate technical and organizational measures to protect personal data from loss, destruction, manipulation, unauthorized access, and other unlawful processing.

These include, in particular:

Access restrictions
User and authorization policies
Secure authentication
Encryption, to the extent technically and organizationally appropriate
Regular updates to the systems in use
Backups and recovery procedures, as needed.

18. Retention Period

As a general rule, we store personal data only for as long as is necessary for the respective purpose.

In addition, statutory retention requirements or legitimate interests may necessitate longer storage.

Once the respective purpose no longer applies and any statutory retention periods have expired, the data will be deleted or anonymized.

The retention periods specified for each individual processing activity apply in particular.

19. Your Rights

Subject to the statutory requirements, you have the following rights in particular:

Right of access
Right to rectification
Right to erasure
Right to restriction of processing
Right to data portability
Right to object to certain processing activities
Right to withdraw consent with future effect.

To exercise your rights, please contact us: