Privacy
1. Controller and contact
ATZP Bildungs- & Kulturverein
ZVR: 1136287463
Matthias-Schönerer-Gasse 17/24
1150 Vienna, Austria
Represented by chairwoman Gülnur Ala
info@atzp.at
+43 664 994 44 142
For privacy requests, contact info@atzp.at.
2. Visiting the website
The site runs through OpenAI Sites on Cloudflare infrastructure. Technical connection data, including IP address, access time and requested page, is processed to deliver content and prevent attacks. Our legitimate interest is providing a secure, reliably accessible website (Article 6(1)(f) GDPR).
The website code set up by ATZP uses no analytics or advertising cookies and no tracking services. Images, video, music and fonts load from the website. Language selection uses the page address. Hosting providers’ technical security measures and logs are separate from this.
3. Contact and project enquiries
Contact buttons open your email or phone app. Opening an email draft alone does not send us a message. When you contact us, we process your contact details and enquiry to respond. Article 6(1)(b) GDPR applies to requests for membership or services; general enquiries rely on Article 6(1)(f), with the legitimate interest of answering association-related correspondence.
The project form requires a name, email address and selected offer. Organisation, audience, participant count, preferred period, location and message are optional. We use this information to respond and prepare a possible collaboration; submitting the form does not create a binding booking.
4. Membership applications
The online form requires first and last name, email address, date of birth, membership category and confirmation of the application after reading the statutes. Date of birth is used in particular to distinguish adult and youth membership. For applicants under 18, a parent or legal guardian’s name, email address and confirmation are also required. The online form cannot be submitted without these required details.
Phone number, citizenship, address, preferred start date and personal message are optional. The payment preference records bank transfer or interest in future SEPA direct debit; the application collects no bank account details. Please do not send health information or identity document copies through this form.
Details are used to review and process the application and, following admission, administer membership (Article 6(1)(b) GDPR). The board decides on admission. There is no automated admission decision or profiling. Submission alone creates neither membership nor an obligation to pay.
5. Delivery and recipients
For direct submission, the website server temporarily processes the details and sends the membership application or project enquiry to info@atzp.at through Zoho Mail. The connection uses Zoho’s EU endpoints. Form contents are not stored in the website database. If direct sending is unavailable, a draft can be prepared and sent from the visitor’s own email app. The form indicates the available delivery method.
Application and contact details are subsequently processed in the association’s mailbox and, where applicable, membership records. Recipients are the association personnel responsible for handling them and the hosting and email providers to the extent needed for their tasks. Membership applications are not published on the website.
6. Retention and form protection
Enquiries and unsuccessful applications are retained only while needed for processing, necessary follow-up or specific legal claims. For accepted members, retention depends on membership administration and any continuing statutory record-keeping duties. Data must be deleted when its purpose ends and no other legal basis remains. Statutory retention relies on Article 6(1)(c) GDPR.
The Zoho mailbox currently used has a 30-day cleanup interval for its spam and trash folders. This setting does not apply to messages in the inbox and does not establish a general retention period for membership applications. Any remaining backup copies are also subject to the provider’s terms.
To prevent abuse and duplicate sending, the form stores pseudonymous counters, a random application reference and delivery status (Article 6(1)(f) GDPR). These records contain neither a raw IP address nor application text. Counters expire after one hour and submission references after 24 hours. Expired entries are technically deleted during a subsequent form request that passes the preliminary technical checks, rather than automatically at the exact expiry time. Provider log and backup retention periods still require confirmation.
7. External links and WhatsApp
Instagram, Facebook, X and WhatsApp appear as links rather than automatically loaded feeds. Opening a link allows that service to process connection and, where applicable, account details under its own privacy terms. If you contact us through WhatsApp, WhatsApp processes your telephone number, connection data and, where applicable, profile details under its own privacy terms. Using WhatsApp is voluntary and is not required for membership or for contacting ATZP.
8. Event photos and videos
Event images and videos document our association’s activities and are publicly accessible on the website. Event photos are published with the consent of the people shown (Article 6(1)(a) GDPR). You may withdraw your consent at any time for future use. Please send questions, objections or a withdrawal request to info@atzp.at, identifying the image or video concerned. Withdrawal does not affect the lawfulness of processing before consent was withdrawn.
9. Donations and SEPA
Transfers are completed in your banking app or through your bank. The website receives no banking login credentials. When a payment arrives, the association receives details shown on its bank statement, such as sender name, account details, amount and reference. They are used to allocate payments and maintain accounts; required statutory retention relies on Article 6(1)(c) GDPR. The participating banks process the payment.
SEPA direct debit is not yet set up. Selecting it in the membership application records interest only and creates no mandate. Future use requires setup with the bank, a separate valid mandate and additional information about processing mandate data.
10. Providers and international processing
Hosting and form processing are provided through OpenAI Sites on Cloudflare infrastructure. The applicable service and data processing terms, recipient countries and any required transfer safeguards still need final confirmation for this setup. Processing exclusively within the European Economic Area has not been established.
We use a Zoho mailbox in the EU region for email. According to Zoho’s privacy information, service data for these accounts is stored in the EU. Access from India may occur in certain support situations; Zoho states that it uses Standard Contractual Clauses and supplementary safeguards for this. The data processing agreement applicable to our association’s account still needs final confirmation.
General provider information: OpenAI · Cloudflare · Zoho. This information does not replace checking the applicable contracts.
11. Your rights
Subject to the legal conditions, you may request access, correction, erasure, restriction of processing and data portability. You may object to processing based on legitimate interests on grounds relating to your particular situation. You may withdraw consent at any time for future processing, without affecting the lawfulness of processing before withdrawal.
Contact ATZP at info@atzp.at. You may also complain directly to the Austrian Data Protection Authority. You do not need to contact ATZP first.
Updated: 10 October 2026.