B&C Private Foundation

Privacy Notice for Funding and Grants

1. Controller

The controller within the meaning of the EU General Data Protection Regulation (hereinafter “GDPR”) is:
B&C Private Foundation
Company register number 203482p (Vienna Commercial Court)
Universitätsring 14
1010 Vienna
Email: datenschutz@bcholding.at

2. Processing of personal data

The controller processes personal data that is transmitted to it in the course of the Houska Prize application procedure or any other funding process. Typically, these include personal data such as name, title, date of birth, position in the applying institution or company, work and mobile phone number, email address, company information (company, company register number, associations register number, year of establishment), and/or data concerning the university or teacher training institution including VAT number, address/place of residence/place of business, website, bank account details or contact person at a partner company, university or teacher training institution. Other personal data that are transferred voluntarily by the applicant may also be processed.

If the applicant is nominated for the Houska Prize and/or takes part in the awards ceremony, or receives funding in any other way, photographs may be taken and videos recorded in which the applicant is recognizable, and these will also be processed.

If statutory reporting obligations become effective as a result of nomination for the Houska Prize or any other funding (e.g. pursuant to the Wirtschaftliche Eigentümer Registergesetz [Register of Beneficial Owners Act]), the controller collects and processes the personal data required in this regard (e.g. nationality, date of birth, place of birth, place of residence, tax domicile, in some cases number and form of official identification, form and scope of the commercial interest in the nominated or funded company, and in some cases the tax ID number).

3. Data processing in the application process, purposes and legal bases

Data is processed for the purposes of contacting the applicant (hereinafter “the data subject”) and carrying out the application process. The legal basis for processing is the data subject’s consent (Art. 6(1)(a) GDPR), taking steps prior to entering into a contract (Art. 6(1)(b) GDPR), and the controller’s legitimate interests (Art. 6(1)(f) GDPR).

Processing personal data as defined in section 2 above is not required by law, but is necessary in order to carry out the selection process and award the Houska Prize or any other funding. If these data are not provided, or not provided in full, it is possible that the data subject cannot be included in the selection process.

The data subject’s personal data as defined in section 2 above are shared with B&C Industrieholding GmbH, Universitätsring 14, 1010 Vienna, a direct subsidiary of B&C Privatstiftung. The data subject’s personal data are also transferred to service providers (processors), such as IT service providers.

Data are not transferred to third countries.

By submitting a separate declaration (for example, by ticking the relevant checkbox), the data subject consents to processing of their personal data by the controller for the purposes set out above, as described under point 2.

Consent may be withdrawn at any time, by sending an email to datenschutz@bcholding.at. If consent is withdrawn, the controller will no longer use these data for the stated purposes. With regard to the transfer of data to third parties, upon withdrawal of consent the controller will ensure that third parties also no longer use the data.

4. Data processing in the case of nomination for the Houska Prize or any other funding, purposes and legal bases

If an individual, company or institution is nominated for the Houska Prize or is granted funding in any other way, the personal data as defined in section 2 above will also be processed for the purpose of providing the funding (award of the prize) and raising the profile of the award winner or funding recipient and of B&C Private Foundation. The legal basis for processing is the data subject’s consent (Art. 6(1)(a) GDPR), performance of the contract (Art. 6(1)(b) GDPR), and the controller’s legitimate interests (Art. 6(1)(f) GDPR). If funding (award of the prize) is associated with statutory obligations such as reporting obligations, processing is also carried out in order to comply with legal obligations to which the controller is subject (Art. 6(1)(c) GDPR).

The controller will, if necessary, share the funding applicant’s personal data as defined in section 2 above, in addition to sharing data in the course of the application process (as described above), with members of the expert jury, the advisory committee and external experts, as well as – if necessary for organizing the awards ceremony – with external service providers (processors) such as event organizers or event agencies and printers. If funding (award of the prize) is associated with statutory obligations such as reporting obligations, the data may also be transferred to consultants including, for example, tax and legal consultants. The prizewinner’s or funding applicant’s personal data may also be transferred to courts and other authorities if required (for example, to the register of beneficial owners).

Provision of the data is not required by law, but is necessary for awarding the prize and/or granting funding. If these data are not provided, or are not provided in full, the data subject may not be awarded the Houska Prize, may not receive other funding, or may be unable to take part in the award ceremony. If funding (award of the prize) is associated with statutory obligations, provision of the data is required by law.

In addition, the data subject gives their consent for the controller to publish the data subject’s name, title, company name if applicable, and place of business, as well as, possibly, information about the data subject’s career history and their position at the applying institution/company, possibly photographs that have been taken (e.g. at the awards ceremony) or transferred, and a video about the submitted project and/or of the awards ceremony, on its website, in B&C company releases and on social media platforms (Facebook, LinkedIn, and X [formerly Twitter] and YouTube), for the purpose of raising the profile of the data subject and of B&C Private Foundation and/or the B&C Group. Publication on social media platforms may entail the transfer of data to the USA. The European Commission has adopted an adequacy decision in respect of the USA as a recipient state (the EU-U.S. Data Privacy Framework); Facebook Inc., LinkedIn Corporation, X Corp. and Google LLC (the parent company of YouTube LLC) each have corresponding certification. These data are also shared with print and online media for publication, via a PR agency.

The data subject may withdraw their consent at any time, by sending an email to datenschutz@bcholding.at. If consent is withdrawn, the controller will no longer use these data for the stated purposes. With regard to the transfer of data to third parties, upon withdrawal of consent the controller will ensure that third parties also no longer use the data.

5. Storage period

If an individual, company or institution is not nominated for the Houska Prize or a funding application is not approved, the personal data will be erased at the latest seven years after notification of rejection, as long as other legitimate interests of the controller do not preclude erasure. The data are stored for this period for the purpose of identifying repeat applications.

If an individual, company or institution is nominated for the Houska Prize and therefore receives prize money, or otherwise receives funding from the controller, the personal data in general will be deleted 30 years after award of the prize or payment of the funding, so that nominated projects from previous years and other funding activities can be presented if required.

6. Information on the rights of the data subject

Right of access: The data subject has the right to obtain a confirmation as to whether or not personal data concerning him or her are being processed.

Right to rectification: If personal data are processed that are incorrect or incomplete, the data subject has the right to have the data corrected or completed.

Right to erasure: The data subject has the right to erasure of the data without delay, on any of the following grounds:

the personal data are no longer required for the purpose for which they were originally collected or otherwise processed;
the data subject withdraws his or her consent and there is no other legal basis for processing;
the data subject objects to the processing and there are no overriding legitimate grounds for the processing, or the data subject objects to processing for direct marketing purposes;
the personal data have been unlawfully processed;
erasure is necessary in order to fulfill a legal obligation, or
the personal data were collected from a child in relation to the offer of information society services.

As outlined above, there may be grounds that preclude immediate erasure, for example where the controller is subject to a statutory retention obligation.

Right to restriction of processing: The data subject has the right to obtain restriction of processing where one of the following applies:

the accuracy of the personal data is contested by the data subject, for a period enabling the controller to verify the accuracy of the data;
the processing is unlawful and the data subject opposes the erasure of the personal data and requests the restriction of their use instead;
the controller no longer needs the personal data for the purposes of the processing, but they are required by the data subject for the establishment or defense of legal claims;
the data subject has objected to processing, pending the verification as to whether the legitimate grounds of the controller override those of the data subject.

Right to data portability: The data subject has the right to receive the personal data concerning him or her, which he or she has provided, in a structured, commonly used and machine-readable format, where:

the processing is based on the data subject’s consent or on a contract, and
the processing is carried out by automated means.

Right to object: The data subject has the right to object to processing of personal data concerning him or her, if the controller carries out processing for performance of a task carried out in the public interest, or in the exercise of official authority vested in the controller, or for the purposes of an overriding legitimate interest. The controller will no longer process the personal data unless the controller demonstrates compelling legitimate grounds for the processing which override the interests, rights and freedoms of the data subject or for the establishment, exercise or defense of legal claims. The data subject has the right to object at any time to processing for direct marketing purposes.

Exercising rights: The data subject can exercise their aforementioned rights at any time and free of charge. The controller can be contacted at: datenschutz@bcholding.at.

Right to lodge a complaint: If the data subject considers that the controller is in infringement of the GDPR, the data subject has the right to lodge a complaint with the competent supervisory authority (in Austria, the Austrian Data Protection Authority).

7. Profiling

The controller does not make any use of automated decision-making, including profiling.

8. Cookies

The controller uses cookies on the website. These are small text files that are stored on the visitor’s device by the browser. They are used to make the website offering more user‑friendly. Some cookies remain stored on devices until users delete them. Storing these cookies makes it possible to recognize the browser again on the user’s next visit to the website. If this is not desired, users can configure their browser so that they are informed about the setting of cookies and allow them on a case-by-case basis.

9. Web analytics

The controller uses Google Analytics and Google Tag Manager for the website. Cookies are also used to help analyze how visitors use the website. The information generated is transmitted to the provider’s server and stored there. The user can block this by configuring their browser settings so that no cookies are saved. The controller has concluded a data processing agreement with the provider. The user’s IP address will be recorded, but immediately anonymized. This means that only approximate localization is possible.