Privacy Notice according to Art. 13, 14 GDPR

Where we choose, or assess whether to choose, to enter a business relationship with a client or other interested party, we are the controller of any personal data that you give to us for the purpose of enabling that business relationship. This means that we are responsible for deciding how we collect, use and store information about you regarding our relationship.

Within the scope of the business relationship, we may collect the following personal data about our clients or interested parties:

• Personal Identification Information: First name, last name, title
• Contact Information: Email address (business), telephone number (business), Company postal address (business)
• Payment Information:Bank account number, Credit/debit card details, billing address, tax identification numbers and business registration details, purpose and other information relating to financial transactions, maturity of receivables, amount of receivables
• Professional Information: Company name, department, industry, job title
• Photo and Video: photos (optionally, if you provide it), screenshots, video recordings of online meetings, photos or video recordings of meetings or workshops.
• Unincorporated Business Status: For sole traders or partnerships, including details of the business and its operations.
• Contracts and Agreement Details: Documentation of the terms of our financial arrangements with you.
• Legal Claims or Proceedings: Information related to any legal actions involving you that might affect our relationship.
• Compliance Documentation: Data necessary for anti-money laundering (AML) checks, know your customer (KYC) processes, and other regulatory requirements.
• Credit Scores and History: Obtained from credit reference agencies to assess your creditworthiness.
• Account Transactions: Detailed records of transactions including dates, amounts, and descriptions.
• Invoices and Statements: Copies of billing documents sent to or received from you.
• Correspondence: Copies of communications between you and us, including emails, letters, and notes from phone calls.
• Customer Service Records: Details of interactions with our customer service teams, including inquiries, complaints, and feedback.
• All other personal data: provided to us during communication.

We only process your personal data when we have a lawful basis and a legitimate purpose for doing so. We may process your personal data for the following purposes and under the following legal bases:

Most of the personal data that we process is sourced directly from our clients or interested parties in the course of communication and contractual relationships.

We collect data from clients or interested parties in the following manners:

• Requests and data sent via the contact form on our website
• Requests and data sent via messages to our employees, e.g. via email, LinkedIn messages and other communication channels
• Requests at trade fairs or other events where data is passed on to our employees with the aim of establishing contact
• Individual registration for events on our website
• Individual research about potential interested parties in business directories, contact information on websites, and professional networks
• Querying of the personal data after concluding a contract with us from the persons themselves, or receipt of personal data via an employee of the client company. This could also concern employees of service providers used by a client’s company.
• Entry of employees’ personal data by an administrative assistant of the client in project management, collaboration and communication platforms.

In addition, in some circumstances we will collect personal data from third-party agencies or publicly available sources like business directories or websites to fulfil the purposes for processing your personal data outlined in this Chapter of this Privacy Notice.

We only transfer your personal data to external recipients if you have consented or if this is permitted by law.

Service providers

As with most organisations, we use service providers which help us to manage our relationship with you and provide value to you in our projects. When we use these service providers, it is necessary for us to share your personal data with them. If we use a service provider for data processing, we remain responsible for the protection of your data. We have concluded agreements with all our service providers to whom we make your data available, obliging them to treat your data confidentially and to process it only in the context of providing the service.

External recipients of your personal data may be in particular:

• Freelancers
• Data processors
• Data destruction providers
• Potential business partners in the context of a (future) due diligence review
• Regulatory Authorities e.g. courts, trade supervisory office, Data protection supervisory authority, BAFA (Federal Office of Economics and Export Control) and law enforcement
• Settlement partners
• Banks, payment providers and other financial or credit institutions
• Credit reference agencies
• Debt Collection agencies
• Legal, professional and tax consultants
• Accounting Offices
• Insolvency practitioners
• Parcel and postal service providers
• Logistics and warehouse providers
• Auditors
• Other creditors

Additionally, we use the following service providers:

We would like to point out that we have no influence on the data collection and its further use by the providers of the professional and social networks. Further information on objection and removal options towards the providers of social networks can be obtained directly from these providers.

Affiliated Group Entities

In addition to service providers, we may share your personal data with affiliated entities within our corporate group for internal administrative purposes, including for centralised IT, HR management, accounting and business operations.

For organizational purposes we may share data with our subsidiaries:

Virtual Identity GmbH
Schönbrunner Straße 213-215
A-1120 Wien

Virtual Identity Sociedade Unipessoal Lda
Rua do Pinheiro Manso 34
4100-304 Porto

International Data Transfers

If your data is transferred to recipients outside the EU, we ensure that this is done in the most data protection-friendly way possible. We make sure your data is given the same level of protection, either because that country has a comparable data protection standard (Adequacy), or by using appropriate safeguards like EU Standard Contractual Clauses (EU SCCs) in accordance with Art. 46 (2) (c) GDPR.

We do not store your personal data longer than it is necessary for the purpose for which it was collected. We will delete your personal data as soon as the purposes for storing no longer apply, you object to the use of your personal data, or you revoke your previously given consent. However, your personal data may also be stored beyond this, in the following cases:

• If there are outstanding obligations from the contractual relationship
• If a deletion conflicts with contractual, legal or statutory retention periods
• For the assertion, exercise or defence of legal claims
• If this is required for the fulfilment of a legal obligation to which we are subject.

For a (planned) conclusion as well as the execution of the contract with you, you must provide those personal data which are necessary for the establishment and execution of the contractual relationship and the fulfilment of the associated contractual obligations or which we are legally obliged to collect. This obligation also arises from the law, e.g. § 14 UstG or other regulatory and legal obligations. Without this data, we will generally not be able to conclude and execute the contract with you.

When we process your personal data for purposes related to our events, we are the controller of any personal data that you give to us. This means that we are responsible for deciding how we collect, use and store information about you.

If you sign up to participate in an event or webinar organised by us, we ask you to provide certain information so that we can process your interest in the event, provide you with relevant updates, and facilitate and confirm your attendance.

Specifically, we may collect the following information:

• Personal Identification Information: First name, last name, title
• Contact information: Email address, phone number, postal address
• Professional Information: Job title, affiliated organisation, industry
• Accessibility requirements: Information on disabilities or any special assistance needed
• Interest in our products and services: Information regarding your interests in relation to the products, services, or topics related to the event.

During events and webinars, we may collect the following information:

• Photographs and recordings: Photos, video, screenshots or livestream recordings captured during the event

Following events and webinars, we offer the opportunity to provide feedback:

• Opinions and feedback: Responses to post-event surveys or feedback forms, including satisfaction ratings, suggestions for improvement, and descriptions of personal experiences.
• Interest in related products and services: A record of whether you would like to receive communications regarding future events and products or services related to the event topic.

We only process your personal data when we have a lawful basis and a legitimate purpose for doing so. In particular, we process your personal data for the following purposes and under the following legal bases:

We only transfer your personal data to external parties if you have consented or if this is permitted by law.

Service providers

As with most organisations, we use service providers to support the delivery of our events. When we use these service providers, it is necessary for us to share your personal data with them. If we use a service provider for data processing, we remain responsible for the protection of your data. We have concluded agreements with all our service providers to whom we make your data available, obliging them to treat your data confidentially and to process it only in the context of providing the service.

We use the following service providers:

We would like to point out that we have no influence on the data collection and its further use by the providers of the professional and social networks. Further information on objection and removal options towards the providers of social networks can be obtained directly from these providers.

We also may share event content like photographs, audio and video recordings on a password-protected website with all registered participants of the particular event.

Affiliated Group entities

In addition to service providers, we may share your personal data with affiliated entities within our corporate group for internal administrative purposes, including for centralised IT, HR management, accounting and business operations.

For organizational purposes we may share data with our subsidiaries:

Virtual Identity GmbH
Schönbrunner Straße 213-215
A-1120 Wien

Virtual Identity Sociedade Unipessoal Lda
Rua do Pinheiro Manso 34
4100-304 Porto

International Data Transfers

If your data is transferred to recipients outside the EU, we ensure that this is done in the most data protection-friendly way possible. We make sure your data is given the same level of protection, either because that country has a comparable data protection standard (Adequacy), or by using appropriate safeguards like EU Standard Contractual Clauses (EU SCCs) in accordance with Art. 46 (2) (c) GDPR.

We do not store your personal data longer than it is necessary for the purpose for which it was collected. We will delete your personal data as soon as the purposes for storing no longer apply, you object to the use of your personal data, or you revoke your previously given consent. However, your personal data may also be stored beyond this, in the following cases:

• if there are outstanding obligations from the contractual relationship
• if a deletion conflicts with contractual, legal or statutory retention periods.
• for the assertion, exercise or defence of legal claims
• if this is required under European or national law for the fulfilment of a legal obligation to which we are subject.

Where we choose, or assess whether to choose, to enter a business relationship with a supplier, we are the controller of any personal data that you give to us for the purpose of enabling that business relationship. This means that we are responsible for deciding how we collect, use and store information about you regarding our relationship.

We process personal data from suppliers and service providers. This is necessary for business operations. The following data is processed in this context:

• Personal Identification Information: First name, last name, title
• Contact Information: Email address (business), telephone number (business), Company postal address (business)
• Professional Information: Company name, department, industry, job title
• Photo and Video: portrait photo (optionally, if you provide it yourself), video recordings of online meetings, photos and video recordings of meetings or workshops.
• Payment Information: Bank account number and/or Credit/debit card details, billing address, tax identification numbers and other business registration details, purpose and other information relating to financial transactions, maturity of receivables, amount of receivables
• Service Delivery Information: Service descriptions, contractual agreements, delivery schedules, service preferences
• Quality Assurance and Feedback: Opinions, feedback on services provided, complaints, suggestions for improvement
• Compliance and Due Diligence Information: Information related to compliance with laws and regulations
• All other personal data: provided to us during communication

We only process your personal data when we have a lawful basis and a legitimate purpose for doing so. We may process your personal data for the following purposes and under the following legal bases:

Most of the supplier personal data that we process is sourced directly from our suppliers.
We collect data from suppliers or service providers in the following manners:

• Receipt of personal data directly from the data subject via establishment of contact by suppliers or service provider
• Receipt of personal data directly from the data subject via establishment of contact by Virtual Identity

In addition, in some circumstances we will collect supplier personal data from third-party agencies or publicly available sources like business directories or websites for the purpose of supplier due diligence and evaluation.

We only transfer your personal data to external recipients if you have consented or if this is permitted by law.

Service providers

As with most organisations, we use service providers which help us to manage our relationship with you and provide value to you in our projects. When we use these service providers, it is necessary for us to share your personal data with them. If we use a service provider for data processing, we remain responsible for the protection of your data. We have concluded agreements with all our service providers to whom we make your data available, obliging them to treat your data confidentially and to process it only in the context of providing the service.

External recipients of your personal data may be in particular:

• Freelancers
• Data processors
• Data destruction providers
• Potential business partners in the context of a (future) due diligence review
• Regulatory Authorities e.g. courts, trade supervisory office, Data protection supervisory authority, BAFA (Federal Office of Economics and Export Control) and law enforcement
• Settlement partners
• Banks, payment providers and other financial or credit institutions
• Credit reference agencies
• Debt Collection agencies
• Legal, professional and tax consultants
• Accounting Offices
• Insolvency practitioners
• Parcel and postal service providers
• Logistics and warehouse providers
• Auditors
• Other creditors

Additionally, we use the following service providers:

Affiliated Group Entities
In addition to service providers, we may share your personal data with affiliated entities within our corporate group for internal administrative purposes, including for centralised IT, HR management, accounting and business operations.

For organizational purposes we may share data with our subsidiaries:

Virtual Identity GmbH
Schönbrunner Straße 213-215
A-1120 Wien

Virtual Identity Sociedade Unipessoal Lda
Rua do Pinheiro Manso 34
4100-304 Porto

International Data Transfers

If your data is transferred to recipients outside the EU, we ensure that this is done in the most data protection-friendly way possible. We make sure your data is given the same level of protection, either because that country has a comparable data protection standard (Adequacy), or by using appropriate safeguards like EU Standard Contractual Clauses (EU SCCs) in accordance with Art. 46 (2) (c) GDPR.

We do not store your personal data longer than it is necessary for the purpose for which it was collected. We will delete your personal data as soon as the purposes for storing no longer apply, you object to the use of your personal data, or you revoke your previously given consent. However, your personal data may also be stored beyond this, in the following cases:

• If there are outstanding obligations from the contractual relationship
• If a deletion conflicts with contractual, legal or statutory retention periods
• For the assertion, exercise or defence of legal claims
• If this is required for the fulfilment of a legal obligation to which we are subject.

For a (planned) conclusion as well as the execution of the contract with you, you must provide those personal data which are necessary for the establishment and execution of the contractual relationship and the fulfilment of the associated contractual obligations or which we are legally obliged to collect. This obligation also arises from the law, e.g. § 14 UstG or other regulatory and legal obligations. Without this data, we will generally not be able to conclude and execute the contract with you.