The Privacy Policy of the fit4internet platform

in accordance with Art. 13 of the General Data Protection Regulation (GDPR)

1. General statement

"fit4internet in Austria – Raising Digital Competences " (hereinafter referred to as "fit4internet", "f4i" or "we") takes the protection of personal data very seriously and adheres to the data protection requirements of the EU and the Austrian data protection law.

This privacy statement is aimed at customers (contractual partners under a license agreement, portal users, portal administrator as supervisors) of fit4internet, who obtain or use the portal solutions (f4i portal) or intend to make use of them. This privacy policy is also aimed at users who are invited to use one of the f4i-tools for evaluating their digital competences (agreement between the contractual partner and fit4internet). Furthermore, this privacy policy defines the data protection claims and rights that may arise in the context of a license agreement and during the initiation of business with regard to data collection and analysis, as well as the users’ legal claims and rights.

2. Processing of personal data

Personal data is referred to as any information that relates to an identified or identifiable natural person (“data subject”). A natural person is deemed identifiable if he or she can be identified directly or indirectly, for example, by means of a name or an identification number (e.g. address, email address, social security number)

We collect and process personal data that is voluntarily provided to us, for example, by filling in the registration form "Your portal solution" or by consenting to the use of cookies (see cookies and web analysis point 5). If a user requests the individual short or detailed report by e-mail, this e-mail address will be stored in the system for a period of 7 days after approval. After these 7 days, the e-mail address will be deleted from the system. The personal data is processed in accordance with the applicable provisions of law for the protection of personal data. This data is necessary for the purpose of fulfilling the contract you have entered with us, the services you have commissioned and for processing your inquiries.

2.1 Processing of personal data when in contact with us

If you register as an organisation or company or its authorised representative by using the registration form or directly via portal-verein@fit4internet.at or if you send an inquiry to the fit4internet employees, basic personal information such as, but not limited to the following will be processed:

• Company name
• E-mail as username
• First name of contact person
• Surname of contact person
• Function in the company

Without this data, we cannot process your request. As part of the business initiation, further data can be recorded, such as, but not limited to:

• Phone number
• Postal address
• Company data (e.g. number of employees, departments) in order to determine the appropriate license model
• Etc.

As part of the license agreement, the relevant information and data are documented for a valid contract and for further processing e.g. accounting, of the contractual relationship. This data includes, but is not limited to:

• Name of the contractual partner (organisation, institution etc.) or the authorised representative
• Billing address
• Location address
• Account details or bank details
• Evidence of company registration or trade license
• Passport copies of the authorised representatives
• UID number
• Any other relevant data

After the contract has been concluded, you as the organisation or as the portal administrator commissioned by the organisation, receive the individual access data for the f4i portal.

After the first login, you as the portal administrator are asked to change the password so that you can create codes for your target groups (users) (three code options: promo codes, ticket codes without email addresses, ticket codes with email addresses).

The codes give the respective users access to the CHECKs or other f4i-tools in order to evaluate their digital skills. With the code options "promo code" and "ticket code", the participants’ e-mail addresses are not required. In the case of ticket codes with e-mail address, its allocation is system-generated and never saved on the f4i portal. As the portal administrator, however, the data is available to you as a download in the browser (the hash function ensures that the code and e-mail address can be crosschecked). This also applies if you as the portal administrator crosscheck the codes that have already been redeemed in the f4i portal. In that case, you are acting as the contractual partner for the users as the data controller.

After terminating the contractual relationship, personal data that was recorded in connection with the execution of the contract will be kept for follow-up and subsequent processing for up to one year, provided there are no further statutory retention requirements.

Due to the legitimate commercial interest to publish information about current products and new developments, fit4internet reserves the right to regularly inform contractual partners including portal administrators via newsletters or direct emailing. In that case, fit4internet will process the published contact details. If you object to receiving direct e-mailing and the use of your data, please do so at portal-verein@fit4internet.at. 

2.2 Processing the statistical data of users

People who are invited to use a CHECK or other f4i-tools to evaluate their digital skills receive one or more codes as users to gain access to the f4i-tools via an individual promotional web address.

When starting the f4i-tools, users are asked to provide the following data for statistical surveys:

• Postcode
• Year of birth
• Sex

As part of the license agreement, you may be requested to provide additional data, which define you as the licensee. This may include, but is not limited to:

• Highest educational qualification e.g. apprenticeship, high school certificate, university degree, etc.
• Industry
• Location
• Field of activity
• Etc.

In principle, it is not possible to extrapolate results specific to an individual from the statistical data, as a group evaluation and analysis of the data in the standard process is only planned for 10 or more participants per individual statistical feature (see 2.4).

2.3 Processing of the results from the f4i-tools (user perspective)

After completing the individual CHECKs or other f4i-tools, the result is made available only to the users in the form of an individual skills profile as a PDF download (skills profile short version). This individual skills profile is not saved on the f4i platform and can be downloaded and saved by the user in their own browser window respectively. Interested users can download a detailed version of their skills profile. Depending on the portal admin's default settings, this may require an eID. The downloading process for the detailed version is not carried out via the fit4internet platform or the fit4internet portal solution, but directly via the eID provider. 

2.4 Processing of the results from the f4i-tools (portal administrator perspective)

As a portal administrator or licence holder, you will not receive individual skills profiles in the standard procedure that can be traced back to one person. These profiles are only available to the individual users (see 2.3.). Therefore, it is generally not possible for you to have an insight into the answers given by individuals and the results. As portal administrator group reports for 10 or more people per individual statistical feature are visible. This group analysis includes, but is not limited to:

• Cumulative results per competence area as defined by the Digital Competence Framework for Austria – DigComp 2.2.
• Cumulative results per region
• Cumulative results per age groups (e.g. 16-34 years, 35-59 years, 60+ years)

If the licensee commissions us, on the basis fo a corresponding agreement, to request additional (e.g. organisation-specific) data or a group report evaluation of less than 10 data records, this or the inclusion of additional information may also result in the assignment of the results to a specific person. This processing is carried out by us in the role of the data processor on behalt fo the licence holder, who is the responsible data controller. 

3. Appropriation, storage period, the legal basis

We process your data on the following legal basis:

• Fulfilment of contract (Art 6 paragraph 1 lit b GDPR) (see 2.1.)
• Your consent (Art 6 paragraph 1 lit a GDPR) 
• Protection of legitimate commercial interests (Art 6 paragraph 1 lit f GDPR) (see 2.1. Current information)
• Legitimate commercial interests of the contract partner (Art 6 paragraph 1 lit f GDPR) (see 3.2.)

3.1  Portal administrator, contractual partner

We process your personal data, if necessary, for the duration of the entire business relationship (from the initiation through processing to the termination of a contract) or for the expected useful life of the portal solution. Moreover, we process your personal data in accordance with the statutory retention requirements and documentation obligations, which, among other things, stem from the German Commercial Code (UGB) or the Federal Tax Code (BAO), as well as until the end of any legal dispute or ongoing warranty and guarantee periods.

In addition, the statutory limitation periods are, e.g. in accordance with the General Civil Code (ABGB) in certain cases up to 30 years (the general limitation period is 3 years).

3.2 Results from f4i-tools, statistical data

For the purpose of analysis and evaluations, we save and process the anonymised results, group reports (from 10 people per statistical individual feature) from the f4i-tools and statistical data (see 2.2.) This important information is used for improvements of our services and for developments of new, needs-based products for digital competence-building. This information is also prepared and made available to you to aid you in decisions pertaining to, for example further training and education.

With this important data, we also evaluate the interest and participation in the competence surveys in the respective year-on-year comparison and evaluate regions, age groups and genders, where and by whom our services are used. We use the evaluations, among other things, to adapt digitisation strategies and thus our products. The data is basically processed anonymously. If, in exceptional cases, there is a reference to a person, processing takes place in accordance with Section 7 (1) 2 DSG for statistical purposes that do not aim to achieve personal results. Accordingly, the data is generally kept for an indefinite period of time.

The data collected as part of CHECKs or other f4i-tools is processed as a result of your legitimate interest to get an overview of the digital competences of a specific target group. In return, you are obliged to inform the target groups about how their data is being processed.

4. Disclosure of information, data recipients

fit4internet does not publish personal data. In cases of statutory information obligations, however, we must comply with these. Your data is handled only by f4i-employees who need the data to fulfil contractual and/or legal obligations as well as to safeguard our legitimate interests. This also applies to business initiation under the license agreement.

The anonymous, accumulated CHECK results and statistical data are used and also published by the publisher of the fit4internet platform to pursue objectives such as funding programmes as well as research, publications, statistical presentations, etc. Personal data will not be used at any time.

In order to operate our portal solution and website, our contractors, such as hosting providers, CMS technicians and software service providers gain access to your personal data in the course of their work, provided this data is necessary for the performance of the respective services. All contractors are contractually obliged to treat your data confidentially and to process the data only within the scope of their service provision. Order processing contracts are processed in accordance with Art 28 GDPR.

It is possible that some data recipients are located outside of your country or process your personal data abroad. However, we only transfer your personal data to countries, which the EU Commission has classified as having an adequate level of data protection. We take measures to ensure that all recipients of your data have an adequate level of data protection.

5. Cookies and web analysis

We use cookies and web analysis tools on our platform and on the web pages for the operation of f4i-tools, which on the one hand are technically necessary and on the other hand serve to continuously improve our products and services. Further information on the use of cookies and web analysis tools can be found in the privacy policy on the platform.

6. Automated decision-making

We do not make use of automated decision-making and we do not create individual profiles in accordance with Art. 22 GDPR.

7. Your rights in connection with the processing of your data.

You have the right to

• request information at any time about which of your personal data is being processed (Art. 15 GDPR);
• rectification and deletion of your data (Art. 16 GDPR);
• restriction of the processing of your data (Art. 18 GDPR);
• objection to the processing of your data (Art. 21 GDPR);
• data portability (Art. 20 GDPR).

If you feel the processing of your data by us violates your rights in accordance with the GDPR or national data protection laws, please contact us. This is the only way we can deal with your request as quickly as possible. You also have the right to lodge a complaint with the competent data protection authority in Austria.

8. Contact information and address

If you have any questions or concerns, please feel free to contact us directly by e-mail or post at the following address:

fit4internet in Austria – Raising Digital Competences
Hintere Zollamtsstraße 17 / 3^rd floor
1030 Wien
portal-verein@fit4internet.at

Update: March 2024