The following provisions aim at informing website visitors about personal data processing in accordance with the requirements of the EU General Data Protection Regulation (GDPR), the Austrian Data Protection Act (DSG) and the Austrian Telecommunications Act 2021 (TKG 2021), especially with due regard to the information obligation according to Art 12-14 GDPR, as well as to information on the rights of the parties concerned according to Art 15-22 and Art 34 GDPR.

SIA Social Impact Award gemeinnützige GmbH (hereinafter referred to as either “we” or “Social Impact Award”) made an effort to present the following information precisely, transparently and comprehensively in a clear and easy language.

Application

This statement applies to personal data processed when you visit a Social Impact Award website that links to it as its data protection statement, vote on it during a campaign, use its contact forms, or comment on its blog.

Definitions

The following definitions apply to the purposes of this statement:

• “Personal data” refers to all information about a (natural) person who can be identified either directly from the provided data or from the data combined with other information.
• “Cookies” are small text files that a website stores in your browser. In this statement, the term also covers similar technologies that store or read information on your device, such as local storage or tracking pixels.

Visiting our website

Server log files

When you visit our website, our server automatically records your IP address, the date and time of access, the page requested, the referring page, your browser type and version, and your operating system. We need this data to deliver the website, to keep it secure and to investigate attacks. We process it on the legal basis of our legitimate interest in operating a secure website (Art 6 (1) lit f GDPR). Log files are deleted after 14 days, unless they are needed to investigate a security incident.

Our website is hosted by Amazon Web Services EMEA SARL, 38 Avenue John F. Kennedy, L-1855 Luxembourg, on servers in Ireland, which processes this data on our behalf.

Fonts: Google Fonts

Our website loads fonts from Google Fonts, a service of Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. To deliver them, your browser connects to Google’s servers, which receive your IP address and information about your browser. Google Fonts doesn’t set cookies. We use it on the legal basis of our legitimate interest in a consistent and readable presentation of our website (Art 6 (1) lit f GDPR).

Video thumbnails

Pages with YouTube videos show preview images loaded from YouTube’s image servers. Your browser receives them directly from Google, which receives your IP address and information about your browser. No cookies are set. We do this on the legal basis of our legitimate interest in showing which video is available (Art 6 (1) lit f GDPR). The video itself only loads when you click it (see Embedded content: YouTube).

Cookies and your consent

Strictly necessary cookies

Some cookies are needed for the website to work, for example to remember your cookie choice or to keep team members logged in. We use them on the legal basis of § 165 (3) TKG 2021 and our legitimate interest in providing a working website (Art 6 (1) lit f GDPR). They don’t need your consent.

Cookies that need your consent

Cookies and similar technologies for analytics and marketing are only loaded after you consent in our cookie banner (§ 165 (3) TKG 2021, Art 6 (1) lit a GDPR). You can give, change or withdraw your consent at any time here: Update your settings Withdrawing your consent doesn’t affect the lawfulness of processing before the withdrawal.

We keep a record of your choice in a cookie in your browser for one month and then ask you again.

Analytics: Google Analytics

With your consent, we use Google Analytics 4, a web analytics service of Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. Google Analytics sets cookies that record how you use our website, for example which pages you visit, how long you stay, where you came from, and your approximate location, device and browser. Google Analytics doesn’t log or store IP addresses. We use the reports to understand how our website is used and to improve it.

Our Google Analytics account is linked to our Google Ads account. This lets us measure whether our ads on Google lead to visits and actions on our website, and show our ads to people who visited our website. For this, Google Analytics shares data about your visit, such as visitor groups and completed actions, with Google Ads.

Google Analytics keeps data about individual events, such as page views, for two months, and data linked to a visitor, such as visitor groups, for 14 months.

We load these services and the marketing tags below through Google Tag Manager, a tool of Google Ireland Limited. Google Tag Manager itself is only loaded after you consent.

Marketing: Meta Pixel

With your consent, we use the Meta Pixel of Meta Platforms Ireland Limited, Merrion Road, Dublin 4, D04 X2K5, Ireland. The pixel tells Meta that you visited our website and which pages you viewed. If you have a Facebook or Instagram account, Meta can link this information to your account. We use it to measure the reach of our posts and campaigns on Facebook and Instagram and to show them to people who visited our website.

We and Meta are joint controllers for collecting this data on our website and transmitting it to Meta (Art 26 GDPR). Meta’s further processing is subject to Meta’s privacy policy.

Marketing: LinkedIn Insight Tag

With your consent, we use the LinkedIn Insight Tag of LinkedIn Ireland Unlimited Company, Wilton Place, Dublin 2, Ireland. The tag tells LinkedIn that you visited our website. If you have a LinkedIn account, LinkedIn can link this information to your account. We use it to receive aggregated reports about our website visitors, to measure our LinkedIn campaigns and to show them to people who visited our website.

We and LinkedIn are joint controllers for collecting this data on our website and transmitting it to LinkedIn (Art 26 GDPR). LinkedIn’s further processing is subject to LinkedIn’s privacy policy.

Embedded content: YouTube

Some pages contain videos from YouTube, a service of Google Ireland Limited. Until you click a video, we only show a preview image (see Video thumbnails). When you click it, the video player is loaded from YouTube. YouTube then sets cookies, receives your IP address and information about the page you are on, and can link this to your Google account if you are logged in. By clicking, you consent to this (§ 165 (3) TKG 2021, Art 6 (1) lit a GDPR). YouTube’s processing is subject to Google’s privacy policy.

Newsletter sign-up form: Mailjet

Our newsletter sign-up forms are provided by Mailjet, a service of Sinch, and are loaded from Mailjet’s servers. With your consent in our cookie banner, the form is loaded and Mailjet receives your IP address and information about your browser (§ 165 (3) TKG 2021, Art 6 (1) lit a GDPR). Without your consent, the form isn’t shown, and no data is sent to Mailjet. What happens when you sign up is described in our Data Protection Statement for Newsletter Subscribers.

Links to social media

Our website links to our profiles on Facebook, Instagram, LinkedIn, X, YouTube and TikTok. These are plain links. No data is sent to these platforms until you click one.

Contacting us

Contact forms

If you contact us through a form on our website, we process the data you enter, usually your name, your email address and your message, together with the date and time of submission. We use it to answer your request. We do this on the legal basis of pre-contractual measures (Art 6 (1) lit b GDPR) where your request concerns taking part in one of our programs or working with us, and otherwise on our legitimate interest in answering inquiries (Art 6 (1) lit f GDPR).

Submissions are sent to us by email and stored in our website’s database. They are deleted two years after submission, unless your request leads to further cooperation.

Spam protection: Cloudflare Turnstile

To protect our forms from spam and abuse, we use Cloudflare Turnstile, a service of Cloudflare, Inc., 101 Townsend St., San Francisco, CA 94107, USA. Turnstile checks whether a form is submitted by a person or a bot, using information about your browser and device, and your IP address. We do this on the legal basis of our legitimate interest in keeping our forms free of spam (Art 6 (1) lit f GDPR).

Email

If you email us, we process your email address and the content of your message to answer you, on the same legal bases as for contact forms.

Voting in our campaigns

During community voting campaigns, you can vote for your favorite venture. To make sure each person votes only once and the competition stays fair, you confirm your vote by signing in with an existing Facebook, Google or X account. The provider then sends us [OPEN: data received, e.g. a user ID, name, email address]. [OPEN: what we keep, i.e. what makes it quasi-anonymous; whether IP address and time are stored.] Signing in gives you no access to other features of our website.

We process this data on the legal basis of our legitimate interest in a fair vote (Art 6 (1) lit f GDPR). The provider learns that you used your account to sign in to our website. This is subject to its own privacy policy: Meta, Google, X.

We anonymize your account within two months after the campaign ends.

Transfers outside the EU

Amazon Web Services, Cloudflare, Google, Meta, LinkedIn, Sinch (Mailjet), X may transfer data to the United States. These providers are certified under the EU-US Data Privacy Framework, which the European Commission has recognized as providing an adequate level of protection (Art 45 GDPR).

Safety

Social Impact Award makes the necessary arrangements in compliance with the applicable data protection laws in order to protect the personal data in our possession from loss, misuse, unauthorized access, publication, modification or deletion.

Your rights concerning personal data

You are inter alia entitled to (i) verify if and what personal data about you we process and to receive copies of this data, (ii) to request the revision, the supplementation or the deletion of your personal data, as long as it is false or not in conformity with the law, (iii) to make a request at us to limit your data processing, (iv) under certain circumstances to object to your data processing or to revoke your consent to data processing, whereby a revocation does not affect the legality of the processing prior to the revocation, (v) to request data portability, (vi) to know the identity of third parties to whom your personal data is transmitted and (vii) to lodge a complaint with the Data Protection Authority.

You can change your cookie settings at any time here: Update your settings For all other requests, write to privacy@socialimpactaward.net.

More information concerning your data

• Our general Privacy Policy statement, including expanded rights and the Data Protection Officer contact information;
• Our Imprint, including contact details.