Privacy Policy

This Privacy Policy explains how ODON – Offene Daten für Offene Nutzung (“ODON”, “we”, “us”) processes personal data when you visit our website, use our services, or otherwise interact with us.

1. Who is responsible (Controller)

ODON – Offene Daten für Offene Nutzung Gablenzgasse 26/01, 1160 Vienna, Austria Email: info@odon.at

2. What data we process, for what purpose, and on what legal basis

2.1 Visiting our website (server log files)

Our website is hosted by an external hosting provider. When you visit odon.at, the provider automatically records technical data required to deliver the website to you: your IP address, the date and time of the request, the URL requested, the HTTP status code, the amount of data transferred, the referring page, and your browser’s user-agent string.

Purpose: to deliver the website, ensure technical stability, and detect and defend against attacks.
Legal basis: Art. 6(1)(f) GDPR — our legitimate interest in operating a secure and functional website.
Retention: according to the hosting provider’s retention schedule.
Recipient: our website hosting provider (see section 3).

2.2 Contacting us by email

When you send us an email, we process the data you provide (typically your name, email address, and the content of your message). This also applies to project ideas you send us by email (see /en/projects/).

Purpose: to answer your enquiry and, where relevant, to follow up with you.
Legal basis: Art. 6(1)(b) GDPR (pre-contractual steps or contract performance) where your enquiry concerns a service, membership, or similar relationship; Art. 6(1)(f) GDPR (legitimate interest in responding to enquiries) in all other cases.
Retention: for as long as needed to handle your request, and afterwards for up to 3 years where retention is needed for accountability or to document the correspondence.
Recipient: our email provider (see section 3).

2.3 Internship application

When you apply for an internship by email (see /en/internship-application/), we process the data you send us. This typically includes your name, email address, information about your background, interests, and availability, and any documents you attach, such as a CV.

Purpose: to evaluate your application, communicate with you about it, and, if an internship is agreed, to prepare and carry out that internship.
Legal basis: Art. 6(1)(b) GDPR (steps taken at your request prior to entering into a contract) for the application itself; Art. 6(1)(a) GDPR (your consent) if you additionally agree that we may keep your application for future opportunities.
Retention: if no internship comes about, we delete the application no later than 7 months after the end of the selection process. If you consent to us keeping your application for future opportunities, we keep it for a maximum of 12 months. If an internship is agreed, we keep the relevant documentation in line with statutory retention obligations.
Recipients: members of ODON’s board and, where applicable, the mentor responsible for the internship; our email provider (see section 3).

2.4 API token registration

When you request an API token by email (see /en/api-registration/), we process the data you send us (typically your name, email address, expected request volume, and, if provided, a description of your project), together with technical logs of your API calls (including the token identifier, timestamps, endpoints accessed, and IP address).

Purpose: to provide you with API access, prevent abuse, ensure fair use within the association’s means, and maintain the stability and security of the API.
Legal basis: Art. 6(1)(b) GDPR (to provide the API service you requested) for the registration data; Art. 6(1)(f) GDPR (legitimate interest in securing and operating the API) for technical logs.
Retention: registration data for as long as your token is active, plus 12 months after revocation or inactivity. Technical logs for a maximum of 30 days.
Recipients: our API hosting provider and our email provider (see section 3).

2.5 Membership

When you become a full member, associate member, or honorary member of the association, we process the data required to administer membership under the Austrian Vereinsgesetz 2002 and our statutes. This includes your name, postal address, email address, date of membership, membership type, and payment information.

Purpose: to administer membership, organise general assemblies and votes, collect membership fees, and comply with our statutory obligations as a Verein.
Legal basis: Art. 6(1)(b) GDPR (the membership contract), Art. 6(1)(c) GDPR (compliance with Vereinsgesetz 2002 and tax law obligations), and Art. 6(1)(f) GDPR (legitimate interest in running the association).
Retention: for the duration of your membership and for a maximum of 7 years after it ends. Certain data may be kept longer where required by law.
Recipients: members of the board who are responsible for administration, our bank, and, where required, tax authorities.

Membership fees are paid by bank transfer; our bank processes your payment data as an independent controller.

2.6 Donations

If you make a donation, we process your name, contact details, donation amount, and payment reference. Donations are made by bank transfer; our bank processes your payment data as an independent controller.

Purpose: to process the donation, issue receipts where requested, and comply with our bookkeeping obligations.
Legal basis: Art. 6(1)(b) and Art. 6(1)(c) GDPR.
Retention: up to 7 years.

2.7 LinkedIn page

Where LinkedIn and we jointly determine the purposes and means of processing page insights on our LinkedIn Page, LinkedIn Ireland Unlimited Company and ODON are joint controllers under Art. 26 GDPR. The primary responsibility for compliance and for providing information to data subjects lies with LinkedIn (see the LinkedIn Privacy Policy). To exercise your rights regarding data processed on the platform, please contact LinkedIn directly; we will forward any request we receive.

2.8 Data Stories — contributor credits

When we publish a Data Story on our website with an external contributor credited as author, we publish their name and, if provided, their role or affiliation, as part of that story.

Purpose: to attribute published work to its contributors.
Legal basis: Art. 6(1)(a) GDPR — contributors provide their name and role specifically for publication, which constitutes consent. Where a contributor withdraws that consent, we will remove or anonymise their credit.
Retention: for as long as the data story is published.

2.9 Website analytics (Google Analytics)

We use Google Analytics 4 (GA4) to understand how our website is used (for example which pages are visited and how visitors arrive) so that we can improve our content and measure the impact of our work.

Google Analytics runs only if you agree. When you first visit the site, we ask for your consent through a banner. If you decline, or before you make a choice, no Google Analytics code is loaded and no analytics cookies are set. If you accept, GA4 is loaded and sets analytics cookies on your device to recognise returning sessions.

Purpose: website analytics and measurement of the reach and impact of our work.
Legal basis: Art. 6(1)(a) GDPR — your consent, together with § 165(3) TKG 2021 for the storing of and access to information on your device. You can withdraw your consent at any time with effect for the future (see section 4); withdrawal does not affect the lawfulness of processing before withdrawal.
Retention: analytics cookies expire after at most 13 months; aggregated reports in our GA4 property are retained for a maximum of 14 months.
Recipient: Google Ireland Limited / Google LLC, acting as our processor under the Google Ads Data Processing Terms (see section 3).

3. Processors and transfers outside the EU/EEA

We use the following categories of processors:

Website hosting (United States)
Email, document storage, and internal communication (EU / United States)
Website analytics: Google Analytics, provided by Google Ireland Limited / Google LLC, only with your consent (see section 2.9) (EU / United States)
API hosting (Germany)

Transfers to the United States are safeguarded by the EU–US Data Privacy Framework (our providers are self-certified) and by Standard Contractual Clauses. You can request a copy of these safeguards at info@odon.at.

4. Cookies

The only cookies on odon.at are the Google Analytics cookies described in section 2.9. They are set only after you click “Accept” in our consent banner.

You can change or withdraw your choice at any time here:

Analytics status: checking…

Withdrawing consent stops Google Analytics from loading on your next page view.

5. Is providing data mandatory?

Providing personal data is generally voluntary. However:

If you do not provide the information we need to handle your request, we may not be able to handle it (for example, we cannot evaluate an internship application without an email address).
For membership, providing the statutory minimum of data is a contractual requirement under our statutes; without it we cannot admit you as a member.

6. Your rights

Under the GDPR, you have the right of access (Art. 15), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20), and to object (Art. 21). Where processing is based on consent, you can withdraw it at any time with effect for the future (Art. 7(3)).

To exercise any of these rights, please write to info@odon.at.

You also have the right to lodge a complaint with a supervisory authority (Art. 77 GDPR), in Austria the Österreichische Datenschutzbehörde.