Data privacy statement for the VERBUND supplier portal

The following information describes which personal data we may process if you use the VERBUND supplier portal.

1. Name and address of the controller

VERBUND Services GmbH (LLC), Am Hof 6a, A-1010 Vienna (“VERBUND”) operates for themselves and other companies the VERBUND supplier portal, providing the possibility for you to register as a supplier/provider/interested party (“supplier”) on the VERBUND supplier portal, to present your company and its goods/products and to take part in tenders and purchasing.

The controller of the processing of your personal data is VERBUND together with the following companies:

• VERBUND AG, Am Hof 6a, A-1010 Vienna,
• VERBUND Services GmbH, Am Hof 6a, A-1010 Vienna,
• VERBUND Hydro Power GmbH, Europaplatz 2, A-1150 Vienna,
• VERBUND Energy4Customers GmbH, Am Hof 6a, A-1010 Vienna,
• VERBUND Energy4Business GmbH, Am Hof 6a, A-1010 Vienna,
• VERBUND Tourismus GmbH, Europaplatz 2, A-1150 Vienna,
• VERBUND Thermal Power GmbH & Co KG, Kraftwerkstraße, 8410 Fernitz-Mellach,
• Grenzkraftwerke GmbH, Münchner Straße 48, D-84359 Simbach am Inn,
• VERBUND Energy4Business Germany GmbH, Luise-Ullrich-Straße 20, D-80636 Munich,
• VERBUND Innkraftwerke GmbH, Werkstraße 1 Inn, D-84513 Töging am Inn,
• Innwerk AG, Schulstraße 2, D-84533 Stammham,
• Donaukraftwerk Jochenstein AG, Innstraße 121, D-94036 Passau
• Österreichisch-Bayrische Kraftwerke AG, Münchner Straße 48, D-84359 Simbach am Inn
• VERBUND Wind Power Austria GmbH, Europaplatz 2, A-1150 Vienna
• VERBUND Finanzierungsservice GmbH, Am Hof 6a, A-1010 Vienna
• VERBUND Wind Power Romania S.R.L., Tudor Arghezi street 8, 7th floor, room C, Sector 2, RO-020945 Bucharest,
• VERBUND Green Power Deutschland Photovoltaik GmbH, Brandenburg Airport Center, Willy Brandt Platz 2, 12529 Schönefeld,
• VERBUND Green Power Deutschland GmbH, Energie-Allee 1, D-55286 Wörrstadt,
• VERBUND Green Power GmbH, Am Hof 6a, A-1010 Vienna,
• VERBUND Energy4Future GmbH, Am Hof 6a, A-1010 Vienna,
• VERBUND Energy4Flex GmbH, Am Hof 6a, A-1010 Vienna

The contact details of the data protection officer are as follows: E-mail: datenschutz@verbund.com

2. Data processing “VERBUND supplier portal”

2.1 Extent of the processing of personal data

The following personal data is collected and subsequently processed:

• Data that you have entered as part of the registration for the VERBUND supplier portal: Details of the contact person such as title, gender, name, position, department, telephone, fax, e-mail address, company details such as name and address of the company, bank details, invoice data, tax data (e.g. tax and/or VAT ID), communication details (e.g. e-mail address, telephone); as well as user name (which you receive after registration and approval by VERBUND) and password, along with further data/documents that you have stated or uploaded as part of a tender.
• information we have gathered about you from authorised operators of public registers or authorised credit agencies, furthermore clearance certificates from the tax office and the responsible social security providers, as well as collected, generated and summarised data about the economic situation of your company (creditworthiness), both before admittance to the VERBUND supplier portal and during the ongoing registration on the VERBUND supplier portal.

2.2 Legal basis for the processing of personal data

The legal basis for the processing of your data is Art. 6 par. 1 lit b GDPR and therefore processing for the performance of a contract or for carrying out precontractual measures. By registering on the VERBUND supplier portal, you are sending us a request to process your data as part of admission to the VERBUND supplier portal and subsequently to analyse and evaluate a possible contract and business relationship in connection with tenders.

Furthermore, we have a legitimate interest in accordance with Art. 6 par. 1 lit f GDPR to find out more about your creditworthiness and integrity before admission to the VERBUND supplier portal and during the ongoing registration. In addition, we have a legitimate interest in accordance with Art. 6 par. 1 lit f GDPR to pass on the processed data to the companies stated under point 1.

The provision of data is voluntary on your part; however, if you do not provide this data, the conditions for admission to the VERBUND supplier portal and subsequently possible participation in tenders through the VERBUND supplier portal cannot be met.

2.3 Purpose of the data processing

The VERBUND supplier portal comprises a supplier database for suppliers for the purpose of the organisation and operational performance of the purchase of goods or services for companies according to point 1.

We process your data according to point 2.1. to evaluate your company and your goods and services, your professional authorisation, as well as your technical, economic and financial competence, and to be able to carry out an analysis and evaluation of the possible contractual and business relationship. The stated contact details are needed to make contact with you.

2.4 Duration of retention

Your data is retained as long as you are using or registered on the VERBUND supplier portal and beyond this, as long as legal claims can be made pertaining to the contractual relationship or there are legal retention obligations.

2.5 Recipients of data

We only pass data on to third parties insofar as this is necessary for fulfilling (pre)contractual or legal duties or is justified for safeguarding our legitimate interests.

The VERBUND supplier portal is operated technically by an order processor, who may also have access to personal data on our behalf and according to our instructions, in order to be able to perform the ordered IT services. If services are performed by further order processors, they may also have access to your data. We have concluded suitable contracts with all order processors.

Your data is not passed on without your consent to third parties, nor to other companies outside of the relationship as joint responsible parties, for their own purposes.

3. Rights of the data subject

Regarding the data we process, you in principle have the right to information, rectification, erasure, restriction, data portability, withdrawal and objection. If you are of the opinion that the processing of your data infringes data privacy law or that your data privacy rights have been otherwise contravened, you can complain to us at datenschutz@verbund.com.

Notwithstanding any other legal remedies, one has the right to complain at the national supervisory authority of one’s place of residence if unlawful processing of personal data is carried out. In Austria, the data protection authority in Vienna is responsible.