Data Protection Statement of the Gustav Mahler Jugendorchester

Thank you for your interest in the Gustav Mahler Jugendorchester. Data protection has always been important to us. On the occasion of the European General Data Protection Regulation (GDPR) taking effect, we have examined our activities in detail and updated our data protection statement. In this data protection statement we inform you about how we process data in the context of our association’s activities.

Purpose of the business/association:

As a non-profit association domiciled in Vienna, the Gustav Mahler Jugendorchester has been promoting young musicians since it was established in 1986.
The purpose of the association is defined in § 2 (1) of the statutes of the Gustav Mahler Jugendorchester:

(1) The association, whose activities are not designed to generate profit, has the following aims:

To bring young musicians together so they can make music together, but especially to promote young musicians from Austria and other European countries
To enable young musicians to play in the Gustav Mahler Jugendorchester and various ensembles formed from the orchestra, perform in concert, and go on tour in order to expand and enrich their musical education
To supplement young musicians’ university education by helping them plan their studies and transition to a career

(2) The activities of the association are exclusively and directly designed to pursue charitable objectives in line with the Austrian Federal Fiscal Code. The association therefore denies any profit motive.

Means for achieving the association's purpose:

The means for achieving the purpose of the association are explained in § 3 (1) of the statutes of the Gustav Mahler Jugendorchester:

(1) The association pursues its aims with the following activities:

a) Contributing to the Gustav Mahler Jugendorchester, and organising various work periods, including chamber music and chamber orchestra projects
b) Promoting constant dialogue between young musicians and teachers at the Gustav Mahler Jugendorchester
c) Publishing all kinds of publications, especially books, magazines and all other types of printed works
d) Publishing and utilising video and audio recordings of events in which the Gustav Mahler Jugendorchester participates
e) Publishing and selling recordings (CD, DVD, video etc.)

Name and address of the person responsible for processing

The processing activities specified in this data protection statement are the responsibility of the following controller as defined by the General Data Protection Regulation:

Verein Gustav Mahler Jugendorchester
Goethegasse 1
1010 Wien
Austria
Tel.: +43.1.512 98 33
Fax: +43.1.512 98 35
Email: office@gmjo.at
Website: www.gmjo.at
Entered in the register of associations under ZVR number 079344390

Overview of the data we process

As part of our association's activities, we process in particular the following data:

Personal data belonging to young musicians who have registered for or participated in an audition, or who are participating or have participated in a tour of the Gustav Mahler Jugendorchester Personal data include in particular:
General personal data (name, date of birth, place of birth, nationality, photograph etc.)
Contact data (address, email address, phone number etc.)
Instrument
Data about education, professional experience, and previous participation in tours or auditions
Application documents
Other data required for organising and participating in a tour or audition (including arrival and departure, insurance data, account bank information)

b) Teachers and professors who teach the musicians and/or evaluate them during auditions
c) Artists (conductors and soloists) who take part in the Gustav Mahler Jugendorchester
d) Users of our websites and other electronic media (see separate points 9 to 12 further down)
e) Employees, members and functionaries of the association
f) Other contacts, such as business partners, interested persons, applicants etc.

Purposes and legal basis of data processing

We process personal data in accordance with the provisions of the General Data Protection Regulation (GDPR) as well as other applicable data protection regulations and the purposes of our association.

Processing for contract performance

We use the personal data of musicians who register for an audition for the organisation and performance of auditions, for the selection procedure, and to communicate with the musicians. More detailed information about this data processing can be found in the registration forms and information sheets for auditions.

In addition, we use the personal data of musicians and artists to organise and perform our concerts and tours, for announcements, reporting, and the issuing of publications of all kinds about these concerts and tours, and to organise event locations, accommodation and travel for musicians.

The legal basis for this processing is usually Art 6 (1) lit b GDPR (contract performance and steps taken prior to entering into a contract) insofar as processing is necessary for the agreed auditions and tours, and furthermore Art 6 (1) lit f GDPR (legitimate interests of the association; further details below).

Processing due to legal obligations

We also process personal data to comply with legal obligations (in particular processing for social insurance and tax-based purposes, for accounting and bookkeeping) on the basis of Art 6 (1) lit c GDPR and Art 9 (2) lit b (carrying out obligations and exercising rights in the field of employment and social security and social protection law).

Processing for legitimate interests and in the context of the lawful activities of the association as well as processing of public data

We process data of musicians, artists, teachers and professors in accordance with the aims of our association, also to maintain contacts and promote dialogue among these persons and in general, including for the purpose of supporting and supervising musicians in the context of their education. Furthermore we use the data to analyse developments and trends in university education and the young musician sector. The legal basis for this processing is provided by Art 9 (2) lit d GDPR (processing by a not-for-profit body in the context of its legitimate activities) and Art 6 (1) lit f GDPR (legitimate interests of the association).

In the context of the aims of our association we collect the data provided to us by the participants and contributors of a tour or audition as well as personal data obtained from publicly accessible sources (press, internet and other media). The legal basis for this is provided by Art 9 (2) lit e GDPR insofar as the data were published by the affected person themselves. For the rest, processing is performed on the basis of the legitimate interests of the association as per Art 6 (1) lit f GDPR in media reporting and the professional development of musicians, artists, teachers and professors with whom the association maintains contact, as well as in the documentation of their career, including current engagements with leading international orchestras.

Processing on the basis of consent

Processing of personal data for specific purposes can also be performed on the basis of consent. Consent can be withdrawn at any time. This also applies to the withdrawal of declarations of consent that were granted to us before the GDPR took effect, i.e. prior to 25 May 2018. Generally the withdrawal of consent applies only to the future. Processing performed prior to the withdrawal are not affected and remain lawful.

Storage duration

We store the data for as long as we need to in order to fulfil the purposes specified above. We comply with the legal record retention periods (as a rule seven years as per the Austrian Commercial Code and Austrian Federal Fiscal Code) and statutes of limitation (as a rule 3 years; 30 years at maximum). Furthermore, it is required by one of our association purposes, which is to maintain contacts with musicians, artists, teachers and professors, and by our purpose of monitoring their professional development, that we save the data for an indefinite period as long as the affected person does not object to the processing or request erasure.

Transfer of personal data to third countries

Personal data are transferred to bodies in countries outside the European Union (EU) or the European Economic Area (EEA) (referred to as third countries) if this is necessary to perform the association's purpose or to perform a contract with third parties (event organisers), if it is legally required (e.g. tax-based reporting obligations) or the affected person has granted explicit consent. Personal data can also be processed in a third country if service providers are commissioned as part of order processing.

Insofar as there is no decision from the EU Commission on whether the affected country offers appropriate levels of data protection, we will provide for suitable guarantees as per the provisions in Art 44 ff GDPR insofar as there is no exception as per Art 49 GDPR (e.g. the data transfer has the explicit consent of the affected persons, or to perform a contract concluded with the affected person or in that person's interest).

Data collection on our website www.gmjo.at

When a user opens our website, it, like other websites, collects the data that the user's web browser transfers automatically. The data are saved in server log files. None of this information allows us to draw conclusions about your identity. It includes in particular IP addresses, date and time of access, the URL called, previously visited URLs, operating system and browser type. We use this information to ensure correct functioning and to monitor the performance of our website. Processing is performed on the basis of our legitimate interest (Art 6 (1) lit f GDPR).

If you use our website without deactivating cookies (in your browser settings, for example), you agree to our use of cookies. Processing is performed on the basis of the legal provisions of § 96 section 3 TKG 2003 (Austrian Telecommunications Act) as well as on your consent. Processing is also performed on the basis of our legitimate interests (Art 6 (1) lit f GDPR).
Cookies are files that make it possible to save specific, device-related information on the access device of the user (PC, smartphone or similar). They are required for technical reasons in order for the website to function. They also serve to make websites user-friendly and therefore benefit users (e.g. saving login data). Furthermore, the third-party cookies on our website (for details, see points 10 and 11) are used to make website users aware of the various social media pages of the Gustav Mahler Jugendorchester, and to collect statistical data on website use and analyse them in order to improve our offering (see “Google Analytics”). Users can influence the way cookies are used. Most browsers offer an option to restrict or completely prevent the storing of cookies; this may result in website functions being limited or unavailable.

Embedding third-party services and content on our website www.gmjo.at

On the basis of our legitimate interests (i.e. interest in the analysis, optimisation and efficient operation of our website as per Art 6 (1) lit f GDPR), we offer third-party content and services on our website (www.gmjo.at) in order to integrate their contents and services, for example videos or fonts (hereafter referred to as “content”).
This always assumes that the third-party providers of this content perceives the user's IP address, as they would be unable to send content to the user's browser without the IP address. The IP address is therefore required to present this content. We try to use content only if the relevant supplier uses IP addresses only to deliver the content. Third-party providers can furthermore use so-called pixel tags (invisible graphics, also referred to as web beacons) for statistical and marketing purposes. Pixel tags make it possible to analyse information such as user traffic on the pages of this website. This pseudonymous information can also be saved in cookies on the user’s devices and contain, among other things, technical information about the browser and operating system, linking websites, visit time and other information on use of our website, and can also be combined with such information from other sources.
- Youtube: We embed videos from the “YouTube” platform provided by Google LLC, 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA. Privacy policy: https://policies.google.com/privacy?hl=en, Opt out: https://adssettings.google.com/authenticated.
- Instagram: Our website can contain embedded functions and services from the Instagram service, offered by Instagram Inc., 1601 Willow Road, Menlo Park, CA, 94025, USA. These can include content such as images, videos or texts and buttons allowing users to share contents of this website on Instagram. As long as the users are members of the Instagram platform, Instagram can assign access to the aforementioned contents and functions to the users’ profiles on Instagram. Instagram data policy: http://instagram.com/about/legal/privacy/ .
Our website can contain embedded functions and services from the Twitter service, offered by Twitter Inc., 1355 Market Street, Suite 900, San Francisco, CA 94103. These can include content such as images, videos or texts and buttons allowing users to share contents of this website on Twitter. As long as the users are members of the Twitter platform, Twitter can assign access to the aforementioned contents and functions to the users’ profiles on Twitter. Twitter is certified under the Privacy Shield agreement and thereby guarantees to comply with European data privacy laws
(https://www.privacyshield.gov/participant?id=a2zt0000000TORzAAO&status=Active). Privacy policy: https://twitter.com/de/privacy, Opt out: https://twitter.com/personalization.
Our website can contain embedded functions and services from the LinkedIn service, offered by the LinkedIn Ireland Unlimited Company, Wilton Place, Dublin 2, Ireland. These can include content such as images, videos or texts and buttons allowing users to share contents of this website on LinkedIn. As long as the users are members of the LinkedIn platform, LinkedIn can assign access to the aforementioned contents and functions to the users’ profiles on LinkedIn. LinkedIn privacy policy: https://www.linkedin.com/legal/privacy-policy.. LinkedIn is certified under the Privacy Shield agreement and thereby guarantees to comply with European data privacy laws (https://www.privacyshield.gov/participant?id=a2zt0000000L0UZAA0&status=Active). Privacy policy: https://www.linkedin.com/legal/privacy-policy, Opt out: https://www.linkedin.com/psettings/guest-controls/retargeting-opt-out.
- Facebook: We use social plugins from the facebook.com social network, which is operated by Facebook Ireland Ltd., 4 Grand Canal Square, Grand Canal Harbour, Dublin 2, Ireland (“Facebook”). These can include content such as images, videos or texts and buttons allowing users to share contents of this website on Facebook. A list of Facebook social plugins and their appearance is available here: https://developers.facebook.com/docs/plugins/.
Facebook is certified under the Privacy Shield agreement and thereby agrees to comply with European data privacy laws and ensure an appropriate level of data protection (https://www.privacyshield.gov/participant?id=a2zt0000000GnywAAC&status=Active).
When a user calls up a function on this website that contains such a plugin, their device will connect directly to the Facebook servers. The contents of the plugin are transferred by Facebook directly to the user's device, which integrates this content into the website. During this process, user profiles of the users can be generated from the processed data. We therefore have no influence on the volume of data that Facebook collects with the aid of this plugin, and are therefore informing users according to our current knowledge.
The integration of the plugins provides Facebook with the information that a user has opened the relevant page of the website. If the user is logged in to Facebook, Facebook can allocate the visit to the user’s Facebook account. When the user interacts with the plugins, for example by operating the like button or posting a comment, the relevant information is sent from their device directly to Facebook and saved there. If a user is not a member of Facebook, it is still possible that Facebook can obtain their IP address and save it.
For the purpose and scope of data collection. the further processing and use of data by Facebook, and related rights and settings for protecting user privacy, see the Facebook privacy statement: https://www.facebook.com/about/privacy/.
If a user is a member of Facebook but does not want Facebook to use this website to collect their personal data and link them to their membership data stored on Facebook, the user must log off Facebook and delete their cookies before using our website. To make additional settings or object to the use of your data for advertising profiles, go to the Facebook profile settings: https://www.facebook.com/settings?tab=ads or the US site http://www.aboutads.info/choices/ or the EU site http://www.youronlinechoices.com/. The settings are not platform-specific, which means they are applied to all devices, such as desktop computers or mobile devices

Online presence in social media

We maintain an online presence in social networks and platforms (social media pages) in order to communicate with the interested persons and users active on those pages and inform them about our activities.
When a user visits the social media pages of the Gustav Mahler Jugendorchester, the relevant social network or platform processes that user’s personal data. The Gustav Mahler Jugendorchester does not collect any of the user’s personal data when the user visits one of our social media pages.
Please note that the personal data of users visiting our social media pages may be processed outside the European Union. This can cause risks to users, as this could make it more difficult to assert users’ rights, for example. In regard to US providers certified under the Privacy Shield, please note that they thereby agree to comply with European data privacy laws and ensure an appropriate level of data protection.
Furthermore, the user data are as a rule processed by the relevant social network or platform for market research and advertising purposes. As a result, user profiles can be created from the usage behaviour and the user interests it indicates, for example. User profiles in turn can be used, for example, to show adverts within and outside the platform that are assumed to correspond to the users’ interests. To this end, cookies are usually stored on the users’ computers and used to store the usage behaviour and interests of the users. In addition, usage profiles can be used to store data independently of the devices used by the user ( especially if the users are members of the relevant platforms and are logged in).
Personal data of users are processed on the basis of a legitimate interest in effective information for users and communication with users as per At 6 (1) lit f GDPR. If users are asked to consent to data processing by the relevant suppliers (i.e. state their consent by, for example, ticking a checkbox or pressing a button), the legal basis for processing is provided by Art 6 (1) lit a and Art 7 GDPR.
For a detailed explanation of the various kinds of processing and the ways to object (opt out), please refer to the supplier information referred to below.
If you require information or want to assert your user rights, please note that contacting the providers directly is the most effective way to do so. Only providers have access to user data and can therefore take the relevant steps and provide information. If users of our social media pages nonetheless require help, they can also contact us directly.
- Facebook (Facebook Ireland Ltd., 4 Grand Canal Square, Grand Canal Harbour, Dublin 2, Ireland) - privacy policy: https://www.facebook.com/about/privacy/, Opt out: https://www.facebook.com/settings?tab=ads and http://www.youronlinechoices.com, Privacy Shield: https://www.privacyshield.gov/participant?id=a2zt0000000GnywAAC&status=Active.
- Google/ YouTube (Google LLC, 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA) – Privacy policy: https://policies.google.com/privacy, Opt out: https://adssettings.google.com/authenticated, Privacy Shield: https://www.privacyshield.gov/participant?id=a2zt000000001L5AAI&status=Active.
- Instagram (Instagram Inc., 1601 Willow Road, Menlo Park, CA, 94025, USA) – Privacy statement / opt out: http://instagram.com/about/legal/privacy/.
- Twitter (Twitter Inc., 1355 Market Street, Suite 900, San Francisco, CA 94103, USA) - Privacy policy: https://twitter.com/de/privacy, Opt out: https://twitter.com/personalization, Privacy Shield: https://www.privacyshield.gov/participant?id=a2zt0000000TORzAAO&status=Active.
- LinkedIn (LinkedIn Ireland Unlimited Company Wilton Place, Dublin 2, Ireland) - Privacy policy https://www.linkedin.com/legal/privacy-policy , Opt out: https://www.linkedin.com/psettings/guest-controls/retargeting-opt-out, Privacy Shield: https://www.privacyshield.gov/participant?id=a2zt0000000L0UZAA0&status=Active.

Data protection provisions for the deployment and use of Google Analytics (with anonymization function)

On our website (www.gmjo.at) we use Google Analytics, a web service from Inc. (“Google”).

Google Analytics uses cookies, which are text files saved on the end device of the user visiting our website and make it possible to analyse how the website is used. Information generated by the cookie about usage of our website is generally sent to a Google server in the US and saved there.

Google participates in the EU-US Privacy Shield (see https://www.privacyshield.gov). For data transfers to Google servers in the US, an adequate level of data protection is considered to be ensured. The Google Analytics component is operated by Google Inc., 1600 Amphitheatre Pkwy, Mountain View, CA 94043-1351, USA.

Because IP anonymization is activated on these websites, the IP addresses of visitors to our website are abbreviated beforehand by Google within member states of the European Union and in other member states of the Agreement on the European Economic Area. Only in exceptional cases is the full IP address transferred to a Google server in the US and abbreviated there.

Google will use this information to analyse use of our website on our behalf in order to compile reports on website activities. Processing is performed on the basis of the legal provisions of § 96 section 3 TKG 2003 (Austrian Telecommunications Act) and on Art 6 (1) lit a GDPR (consent) if the user of our website has agreed to the use of cookies, and on the basis of our legitimate interests as per Art 6 (1) lit f GDPR in the statistical analysis of access to our website.

[The users’ personal data are erased or anonymised after 14 months.]

Visitors to our website can prevent cookie storage by means of a suitable add-on for their web browser; please note, however, that in this case it may not be possible to use all functions of this website in full. In addition, you can prevent the data created by the cookie and relating to use of our website (including your IP address) from being transferred to Google or processed by Google by downloading and installing the browser add-on available from the following link (https://tools.google.com/dlpage/gaoptout).
For more information about how Google uses data, and about settings and opt-outs, see the Google data protection statement (https://policies.google.com/technologies/ads) and the Google ad settings (https://adssettings.google.com/authenticated).

Rights of data subjects according to the General Data Protection Regulation

According to legal data protection provisions, particularly Articles 15 to 21 of the EU General Data Protection Regulation (GDPR), data subjects have a right to the following at any time:

Information about the personal data that have been processed about them
Correction of incorrect data and to completion of incomplete data

Erasure of their data; this right to erasure can be restricted by the specified laws, especially legal retention periods, that the association is subject to, by the right to free expression, and by the right to establish, exercise or defend legal claims
Restriction of processing

Provision of the data provided by you in a structured, standard, machine-readable format (right to data portability)

Opt out from the processing of their personal data for reasons resulting from their particular situation The precondition for this is that processing is performed in order to perform a task in the public interest or to exercise public authority or on the basis of balancing interests. In case of an opt-out the association will no longer process the relevant personal data, unless the association can demonstrate compelling legitimate grounds that override the interests, rights and freedoms of the data subject, or where processing is necessary to establish, exercise or defend legal claims.

Opt out from processing of personal data for the purpose of direct advertising. If the data subject opts out from direct advertising, the association will no longer process the data subject’s data for this purpose.

Enquiries about exercising these rights can be directed to the Gustav Mahler Jugendorchester association under the address listed in point 3 above. We recommend that you submit such enquiries to us in writing or via email.

Affected persons also have the right to contact the supervisory authority with a complaint if they feel their rights or the data protection obligations of the association have been violated. In Austria, the responsible supervisory authority is the Data Protection Authority, Wickenburggasse 8, 1080 Wien, Austria.

Changes and general information about this data protection statement

We will examine this data protection statement from time to time, update it where necessary, and make it available on our website www.gmjo.at .

This data protection statement was written in cooperation with the law firm BRAUNEIS KLAUSER PRÄNDL RECHTSANWÄLTE GMBH, Bauernmarkt 2, A-1010 Wien, Austria (http://www.bkp.at) and with Datenschutz-Generator.de von RA Dr. Thomas Schwenke, a German-language site providing advice on data protection.

Gustav Mahler Jugendorchester, 24 May 2018. www.gmjo.at