Because your privacy is important to us, this Privacy Policy informs you about how personal data is processed when using our website. We process your data exclusively on the basis of the applicable legal provisions of the General Data Protection Regulation (GDPR). The purpose of this Privacy Policy is to provide a transparent overview of which personal data we collect, for what purposes it is processed, and which rights you are entitled to in this context. Where this Privacy Policy refers to “we”, this always means the entity responsible for the specific processing purpose in question. VivaFert e.U. operates an information and comparison platform in the field of reproductive medicine. VivaFert e.U. does not itself provide any medical services, does not make diagnoses, and does not carry out any treatments. Depending on the content of the inquiry or the context of use, the processing of personal data is carried out either by VivaFert e.U. or by VivaFert Commerce e.U. On this website, only editorial content and technical references (hyperlinks) to external medical service providers (e.g., IVF clinics) are provided. By clicking such a link, the user leaves the website of VivaFert e.U. and enters directly into the area of responsibility of the respective third-party provider, who is solely responsible for the processing of personal data there as well as for all medical services. When processing personal data, we adhere to the following principles: i) lawfulness, fairness and transparency; ii) purpose limitation of processing; iii) data minimization; iv) accuracy of data; v) storage limitation; vi) integrity and confidentiality; and vii) accountability for processing. This Privacy Policy contains information on how VivaFert e.U. processes, stores, and protects personal data in accordance with the General Data Protection Regulation (GDPR) as well as the applicable Austrian data protection provisions. It also explains your rights in relation to your personal data, including the rights of access, rectification, erasure, restriction of processing, and objection.
Name and address of the controller
Controllers within the meaning of the General Data Protection Regulation (GDPR)
This website is operated by two legally independent sole proprietorships. Responsibility under data protection law depends on the respective business and processing purpose: VivaFert e.U. Simmeringer Hauptstraße 16/4/6 1110 Vienna, Austria Telephone: +43 667 767 2210 Email: office@vivafert.at Responsible for all data processing in connection with:
- operation of the information and comparison platform,
- editorial content,
- general contact inquiries, and
- non-commercial communication.
VivaFert Commerce e.U. Simmeringer Hauptstraße 16/4/6 A-1110 Vienna, Austria Company Register Number: FN 665965 Company Register: Commercial Court of Vienna VAT ID: VAT-exempt pursuant to § 6 para. 1 item 27 Austrian VAT Act (UStG) (small business regulation) Responsible for all data processing in connection with:
- commercial services,
- contract processing,
- invoicing, and
- payment-related transactions.
The respective full company details can be found in the legal notice (imprint) of this website. There is no joint controllership pursuant to Art. 26 GDPR unless expressly stated otherwise.
1. General information on data processing
1.1 Scope of the processing of personal data
This Privacy Policy applies to the processing of personal data collected when visiting the VivaFert e.U. website. VivaFert e.U. collects and uses personal data of its users only to the extent necessary to provide a functional website and the informational content offered on it. VivaFert e.U. does not process any health-related data and does not carry out any medical data processing. Any processing of medical or health-related data is carried out exclusively by the external medical providers linked via this website under their own responsibility.
1.2 Legal basis for the processing of personal data
Insofar as consent of the data subject is obtained for specific processing operations, Art. 6(1)(a) GDPR serves as the legal basis. Insofar as the processing of personal data is necessary for providing the website or for responding to inquiries, Art. 6(1)(f) GDPR (legitimate interest) serves as the legal basis. Insofar as processing is necessary to comply with legal obligations, it is carried out on the basis of Art. 6(1)(c) GDPR. If the processing is necessary to safeguard a legitimate interest of our company or a third party and the interests, fundamental rights, and freedoms of the data subject do not override the aforementioned interest, Art. 6(1)(f) GDPR serves as the legal basis.
1.3 Data deletion and storage period
The personal data of the data subject will be deleted or blocked as soon as the purpose of storage no longer applies. Storage may also take place beyond this if it has been provided for by the European or national legislator in Union law regulations, laws, or other provisions to which the controller is subject. Data will also be blocked or deleted when a retention period prescribed by the aforementioned provisions expires, unless there is a necessity to continue storing the data for the conclusion of a contract or for the performance of a contract.
2. Provision of the website and creation of log files
2.1 Description and scope of data processing
Each time the VivaFert e.U. website is accessed, the web server automatically collects data and information from the system of the accessing user. The following data are collected in particular: a) the user’s operating system b) the internet service provider c) the IP address d) the date and time of access e) the referrer URL f) the subpages accessed g) the browser type and version h) the HTTP status code i) this data is stored in the web server log files.
2.2 Legal basis for data processing
The legal basis for the temporary storage of this data is Art. 6(1)(f) GDPR (legitimate interest).
2.3 Purpose of data processing
The processing of the IP address is necessary to enable delivery of the website to the user’s device. Storage in log files serves to ensure the functionality, stability, and security of the website. No evaluation for marketing purposes takes place.
2.4 Duration of storage
The log files are deleted or anonymized as soon as they are no longer necessary for the purposes mentioned. This is generally the case after no later than seven days.
2.5 Right to object and possibility of removal
The collection of the above data is strictly necessary for operating the website; an objection is therefore not possible.
3. Use of cookies
3.1 Description and scope of data processing
The VivaFert e.U. website uses cookies. Cookies are small text files that are stored in the user’s internet browser. When the website is accessed, a cookie may be stored on the user’s device that enables recognition of the browser. VivaFert e.U. uses only technically necessary cookies that are required for the operation and basic functionality of the website. In particular, the following information is stored in the cookies:
- date and time of a page view
- anonymous session ID
Legal basis for data processing
The processing of personal data using technically necessary cookies is carried out on the basis of Art. 6(1)(f) GDPR (legitimate interest).
3.2 Purpose of data processing
The purpose of using technically necessary cookies is to enable the proper provision and use of the website. Without these cookies, certain functions of the website cannot be provided or can only be provided to a limited extent. No user profiles are created.
3.3 Duration of storage, right to object and possibility of removal
Cookies are stored on the user’s device and transmitted by the user to the website. Users have the option at any time to disable or delete cookies via the settings of their internet browser. If cookies are disabled, the functionality of the website may be restricted.
4.1 Use of Google Analytics
This website uses – provided that appropriate consent has been given – Google Analytics, a web analytics service of Google LLC, 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA. Google Analytics uses cookies that enable an analysis of how the website is used. The information generated by the cookies about your use of this website is generally transmitted to Google servers and stored there. This may also involve the transfer of data to the USA. On this website, IP anonymization is activated. As a result, your IP address is shortened by Google within the European Union or the European Economic Area prior to transmission. The processing of your personal data is carried out exclusively on the basis of your explicit consent pursuant to Art. 6(1)(a) GDPR, which you can provide via the cookie banner displayed when you access the website. A data processing agreement pursuant to Art. 28 GDPR has been concluded with Google. In addition, the data transfer to the USA is based on the EU–US Data Privacy Framework. You can withdraw your consent at any time with effect for the future by accessing the cookie banner again or deleting the cookies in your browser. In addition, you can prevent Google Analytics from collecting your data by installing the following browser add-on: https://tools.google.com/dlpage/gaoptout/ Further information on data protection at Google can be found at: https://policies.google.com/privacy?hl=de
4.2 Use of Facebook / Meta
This website uses – provided that appropriate consent has been given – social media plugins of the social network Facebook, operated by Meta Platforms, Inc., 1601 S. California Ave, Palo Alto, CA 94304, USA. By integrating the Facebook plugins, a direct connection between your browser and Meta’s servers may be established when you visit the website. Meta thereby receives the information that you visited this website with your IP address. If you are logged in to Facebook, Meta can associate the visit to this website with your user account. If you do not want Meta to associate the visit to this website with your Facebook user account, please log out of Facebook before visiting this website and delete the relevant cookies. The processing of personal data is carried out exclusively on the basis of your consent pursuant to Art. 6(1)(a) GDPR, which can be given via the cookie banner. Meta is independently responsible for data processing in connection with Facebook. Any joint controllership is limited exclusively to the data processed by Meta itself within the scope of the plugin functionality. Meta has submitted to the EU–US Data Privacy Framework. You can withdraw your consent at any time via the cookie banner or prevent it through the corresponding cookie settings in your browser. In addition, there is an opt-out option via the European Interactive Digital Advertising Alliance at: http://www.youronlinechoices.com/de/praferenzmanagement Further information on data protection at Facebook can be found at: https://www.facebook.com/privacy/center/
4.3 Use of X (formerly Twitter)
This website uses – provided that appropriate consent has been given – social media plugins of the service X, operated by X Corp., 1355 Market St, Suite 900, San Francisco, CA 94103, USA. By integrating the X plugins, a direct connection between your browser and the servers of X Corp. may be established when you visit the website. In doing so, cookies may be set that enable an analysis of your usage behavior. If you have a user account with X and are logged in there at the time you visit the website, X can associate the visit to this website with your user account. If you do not want X to associate the visit to this website with your user account, please log out of X before visiting this website and delete the relevant cookies. The processing of personal data is carried out exclusively on the basis of your consent pursuant to Art. 6(1)(a) GDPR. You can withdraw your consent at any time with effect for the future by accessing the cookie banner again or deleting the cookies in your browser. In addition, there is an opt-out option at: https://optout.aboutads.info/
5. Rights of the data subject
If your personal data are processed, you are a data subject within the meaning of the General Data Protection Regulation (GDPR). You have the following rights vis-à-vis VivaFert e.U.:
- Right of access (Art. 15 GDPR)
- Right to rectification (Art. 16 GDPR)
- Right to erasure (Art. 17 GDPR)
- Right to restriction of processing (Art. 18 GDPR)
- Right to data portability (Art. 20 GDPR)
- Right to object to processing (Art. 21 GDPR)
- Right to withdraw a consent under data protection law
- Right to lodge a complaint with a supervisory authority
5.1 Right of access
You may request from the controller confirmation as to whether personal data concerning you are being processed by us. If such processing exists, you may request from the controller access to the following information: 1.the purposes for which the personal data are processed; 2.the categories of personal data that are processed; 3.the recipients or categories of recipients to whom the personal data concerning you have been disclosed or will be disclosed; 4.the planned duration for which the personal data concerning you will be stored or, if specific information on this is not possible, the criteria used to determine the storage period; 5.the existence of a right to rectification or erasure of the personal data concerning you, a right to restriction of processing by the controller, or a right to object to such processing; 6.the existence of a right to lodge a complaint with a supervisory authority; 7.all available information as to the source of the data, where the personal data are not collected from the data subject; 8.the existence of automated decision-making, including profiling, pursuant to Art. 22(1) and (4) GDPR and – at least in these cases – meaningful information about the logic involved, as well as the significance and the envisaged consequences of such processing for the data subject. You also have the right to request information as to whether personal data concerning you are transferred to a third country or to an international organization. In this connection, you may request to be informed of the appropriate safeguards pursuant to Art. 46 GDPR relating to the transfer.
5.2 Right to rectification
You have the right to request from the controller the rectification without undue delay of inaccurate personal data concerning you. Taking into account the purposes of the processing, you also have the right to request the completion of incomplete personal data. The controller must carry out the rectification without undue delay.
5.3 Right to restriction of processing
Under the following conditions, you may request the restriction of processing of the personal data concerning you: 1.if you contest the accuracy of the personal data concerning you for a period enabling the controller to verify the accuracy of the personal data; 2.if the processing is unlawful and you oppose the erasure of the personal data and request the restriction of the use of the personal data instead; 3.if the controller no longer needs the personal data for the purposes of the processing, but you require them for the establishment, exercise, or defense of legal claims; 4.if you have objected to processing pursuant to Art. 21(1) GDPR and it has not yet been determined whether the legitimate grounds of the controller override your grounds. Where processing has been restricted, such personal data – apart from being stored – may be processed only with your consent or for the establishment, exercise, or defense of legal claims, or for the protection of the rights of another natural or legal person, or for reasons of important public interest of the Union or of a Member State. You will be informed by the controller before the restriction is lifted.
5.4 Right to erasure
a) Obligation to erase You may request from the controller that personal data concerning you be erased without undue delay, and the controller is obliged to erase such data without undue delay where one of the following grounds applies: 1.the personal data are no longer necessary in relation to the purposes for which they were collected or otherwise processed. 2.you withdraw your consent on which the processing was based pursuant to Art. 6(1)(a) or Art. 9(2)(a) GDPR, and there is no other legal ground for the processing. 3.you object to the processing pursuant to Art. 21(1) GDPR and there are no overriding legitimate grounds for the processing, or you object to the processing pursuant to Art. 21(2) GDPR. 4.the personal data have been processed unlawfully. 5.erasure is necessary for compliance with a legal obligation in Union law or the law of the Member States to which the controller is subject. 6.the personal data have been collected in relation to the offer of information society services pursuant to Art. 8(1) GDPR. b) Information to third parties If the controller has made the personal data public and is obliged to erase them pursuant to Art. 17(1) GDPR, the controller shall, taking account of available technology and the cost of implementation, take reasonable steps to inform other controllers that you have requested the erasure of all links to, or copies or replications of, those personal data. c) Exceptions The right to erasure does not apply insofar as processing is necessary: 1.for exercising the right of freedom of expression and information; 2.for compliance with a legal obligation or for the performance of a task carried out in the public interest or in the exercise of official authority; 3.for reasons of public interest in the area of public health pursuant to Art. 9(2)(h) and (i) as well as Art. 9(3) GDPR; 4.for archiving purposes in the public interest, scientific or historical research purposes, or statistical purposes pursuant to Art. 89(1) GDPR; 5.for the establishment, exercise, or defense of legal claims.
5.5 Right to be informed
If you have asserted your right to rectification, erasure, or restriction of processing, the controller is obliged to notify all recipients to whom the personal data have been disclosed of these changes, unless this proves impossible or involves disproportionate effort. You have the right to be informed about these recipients.
5.6 Right to data portability
You have the right to receive the personal data concerning you in a structured, commonly used, and machine-readable format. You also have the right to transmit those data to another controller, provided that: 1.the processing is based on consent or on a contract pursuant to Art. 6(1)(a) or (b) GDPR, and 2.the processing is carried out by automated means. The right to data portability does not apply to processing that is necessary for the performance of a task carried out in the public interest or in the exercise of official authority.
5.7 Right to object
You have the right to object at any time to the processing of your personal data, insofar as it is based on Art. 6(1)(e) or (f) GDPR. If personal data are processed for the purpose of direct advertising, you have the right to object at any time to such processing.
5.8 Right to withdraw consent under data protection law
You have the right to withdraw your consent under data protection law at any time. The withdrawal does not affect the lawfulness of processing carried out up to the time of withdrawal.
5.9 Automated decision-making in individual cases, including profiling
You have the right not to be subject to a decision based solely on automated processing that produces legal effects concerning you or similarly significantly affects you, except in the cases provided for by law pursuant to Art. 22 GDPR.
5.10 Right to lodge a complaint with a supervisory authority
You have the right to lodge a complaint with a supervisory authority if you believe that the processing of your personal data violates the GDPR. The competent supervisory authority in Austria is: Austrian Data Protection Authority Barichsgasse 40–42 1030 Vienna Email: dsb@dsb.gv.at Website: https://www.dsb.gv.at/ The supervisory authority shall inform the complainant of the status and results of the complaint, including the possibility of a judicial remedy pursuant to Art. 78 GDPR.
6. Right to lodge a complaint with a supervisory authority
Without prejudice to any other administrative or judicial remedy, you have the right to lodge a complaint with a supervisory authority if you believe that the processing of personal data concerning you infringes the GDPR. The supervisory authority responsible for Austria is: Austrian Data Protection Authority Barichgasse 40–42 1030 Vienna Email: dsb@dsb.gv.at Website: https://www.dsb.gv.at/ The supervisory authority shall inform the complainant of the status and results of the complaint, including the possibility of a judicial remedy pursuant to Art. 78 GDPR.
