The controller in the meaning of the EU General Data Protection Regulation (hereinafter “GDPR”) is:
B&C Innovation Investments GmbH
Company register number 429066f (Vienna Commercial Court)
2. Processing of personal data
The controller processes personal data transferred to it by the applicant (hereinafter the “data subject”) in the course of the application process for a startup-investment. Typically, these include personal data such as title, first and last name, date of birth, address, contact information (telephone numbers, e-mail-adresses), position in the applying company, company information, information on the shareholder structure of the applying company, website, bank account details and VAT number. Other personal data that are transferred voluntarily by the applicant may also be processed.
If statutory reporting obligations become effective as a result of an investment of the controller into the applying company, the controller collects and processes the personal data required in this regard.
3. Data processing in the application process, purposes and legal bases
Data is processed for the purposes of contacting the applicant, the assessment of the respective projects and potential investments and for carrying out the application process. The legal basis for processing is the data subject’s consent (Art. 6(1)(a) GDPR), taking steps prior to entering into a contract (Art. 6(1)(b) GDPR), and the controller’s legitimate interests (Art. 6(1)(f) GDPR).
The data subject’s personal data are shared with the controller’s direct and indirect shareholders, meaning B&C Holding Österreich GmbH and B&C Privatstiftung as well as the controller’s sister company B&C Industrieholding GmbH (all with seat at Universitätsring 14, 1010 Vienna). The data subject’s data are also transferred to service providers (processors), such as IT service providers.
Data are not transferred to third countries.
Processing personal data is not required by law, but is necessary in order to carry out the selection process and a potential investment into the applying company. If these data are not provided, or not provided in full, it is possible that the data subject cannot be included in the selection process.
4. Data processing in the case of eligibility for an investment, purposes and legal bases
If a company is found elegible for an investment, additional personal data may be collected by the controller and an agreement on an investment or participation may be entered into. In such a case, the personal data will also be processed for the purpose of implementing the investment or business relationship and for raising the profile of the startup company and of the controller. The legal basis for processing is the data subject’s consent (Art. 6(1)(a) GDPR), performance of the contract (Art. 6(1)(b) GDPR), and the controller’s legitimate interests (Art. 6(1)(f) GDPR). If an investment is associated with statutory obligations such as reporting obligations, processing is also carried out in order to comply with legal obligations to which the controller is subject (Art. 6(1)(c) GDPR).
The data subject’s personal data are shared with the controller’s direct and indirect shareholders, meaning B&C Holding Österreich GmbH and B&C Privatstiftung as well as the controller’s sister company B&C Industrieholding GmbH (all with seat at Universitätsring 14, 1010 Vienna). Data will also be shared with consultants including, for example, tax and legal consultants as well as technical consultans (in particular university professors) which advise the controller in the course of the financial and technical assessment of the investment case as well as in the course of drafting the legal documentation. The personal data may also be transferred to banks, courts and other authorities if required. The data subject’s data are also transferred to service providers (processors), such as IT service providers.
Data are not transferred to third countries.
The processing of personal data is – subject to the following paragraph – not prescribed by law, but is necessary for the purposes specified above. If these data are not provided, or not provided in full, an investment into the applying company might not be possible.
If, however, an agreement is entered into or respective steps prior to entering into such agreement are taken, it is necessary to process the aforementioned data for performance of the contract or to take steps prior to entering into a contract, and to fulfill the controller’s statutory obligations. If in this case the data are not provided or not provided in full, the controller might not be able to completely fulfill its contractual obligations to the data subject or its statutory obligations, and might not be able to conclude a contract with the data subject.
5. Storage period
If a company is not deemed eligible for an investment, the personal data will be erased at the latest two years after notification of rejection, as long as other legitimate interests of the controller do not preclude erasure. The data are stored for this period for the purpose of identifying repeat applications.
If the controller decides to invest into a company, personal data will be erased when the purpose of processing no longer applies, unless a legitimate interest of the controller precludes this (e.g. retention of the data for purposes of evidence, such as for enforcement of or defense against legal claims, subject always to the applicable limitation periods).
6. Information on the rights of the data subject
Right of access: The data subject has the right to obtain a confirmation as to whether or not personal data concerning him or her are being processed.
Right to rectification: If personal data are processed that are incorrect or incomplete, the data subject has the right to have the data corrected or completed.
Right to erasure: The data subject has the right to erasure of the data without delay, on any of the following grounds:
- the personal data are no longer required for the purpose for which they were originally collected or otherwise processed;
- the data subject withdraws his or her consent and there is no other legal basis for processing;
- the data subject objects to the processing and there are no overriding legitimate grounds for the processing, or the data subject objects to processing for direct marketing purposes;
- the personal data have been unlawfully processed;
- erasure is necessary in order to fulfill a legal obligation, or
- the personal data were collected from a child in relation to the offer of information society services.
As outlined above, there may be grounds that preclude immediate erasure, for example where the controller is subject to a statutory retention obligation.
Right to restriction of processing: The data subject has the right to obtain restriction of processing where one of the following applies:
- the accuracy of the personal data is contested by the data subject, for a period enabling the controller to verify the accuracy of the data;
- the processing is unlawful and the data subject opposes the erasure of the personal data and requests the restriction of their use instead;
- the controller no longer needs the personal data for the purposes of the processing, but they are required by the data subject for the establishment or defense of legal claims;
- the data subject has objected to processing, pending the verification whether the legitimate grounds of the controller override those of the data subject.
Right to data portabilit: The data subject has the right to receive the personal data concerning him or her, which he or she has provided, in a structured, commonly used and machine-readable format, where:
- the processing is based on the data subject’s consent or on a contract, and
- the processing is carried out by automated means.
Right to object: The data subject has the right to object to processing of personal data concerning him or her, if the controller carries out processing for performance of a task carried out in the public interest, or in the exercise of official authority vested in the controller, or for the purposes of an overriding legitimate interest. The controller will no longer process the personal data unless the controller demonstrates compelling legitimate grounds for the processing which override the interests, rights and freedoms of the data subject or for the establishment, exercise or defense of legal claims. The data subject has the right to object at any time to processing for direct marketing purposes.
Exercising rights: The data subject can exercise their aforementioned rights at any time and free of charge. The controller can be contacted at the following e-mail address: firstname.lastname@example.org.
Right to lodge a complaint: If the data subject considers that the controller is in infringement of the GDPR, the data subject has the right to lodge a complaint with the competent supervisory authority (in Austria, the Austrian Data Protection Authority).
The controller does not make any use of automated decision-making, including profiling.
9. Web analytics
Our website uses functions of the Google Analytics web analytics service and Google Tag Manager. Cookies are also used to help analyse how visitors use the website. The information generated is transmitted to the provider’s server and stored there. You can block this by configuring your browser settings so that no cookies are saved. We have concluded a data processing agreement with the provider. Your IP address will be recorded, but immediately anonymised. This means that only approximate localisation is possible.