Your data. Clearly handled.

Last updated: 3 August 2026. This Privacy Policy reflects the current WordPress website, the self-hosted Admidio member area and the services described below.

This Privacy Policy explains how the registered association ESIS Austria, publicly presented as ESIS Austria Group, processes personal data when you visit esis-ag.at, use the Admidio member area, apply for membership, register for activities, view public events or galleries, submit content or contact us.

1. Controller

The controller responsible for the processing described in this Privacy Policy is:

ESIS Austria
ZVR number: 272469416
c/o Montanuniversität Leoben, Werkstoffkunde und Prüfung der Kunststoffe
Otto-Glöckel-Straße 2
8700 Leoben, Austria
Email: info@esis-ag.at

2. Hosting and server log files

The WordPress website, the Admidio installation and the association’s email infrastructure are hosted by Hetzner Online GmbH in Germany, which processes data on our behalf.

When you access the website, technical log data may be processed, including your IP address, date and time of the request, requested page or file, referrer URL, browser and operating-system information and response status. We process this data to deliver the website, maintain technical stability, prevent misuse and investigate security incidents. The legal basis is Art. 6(1)(f) GDPR. Our legitimate interests are the secure and technically reliable operation of the website.

Under the current hosting configuration, web-server access and error logs and mail-server logs are retained for seven days. Hetzner provider backups may be retained for up to 14 days. Data required to investigate a specific security incident may be retained for longer for the duration of the investigation and any related legal claims.

3. Cookies and consent management

The public WordPress pages currently do not use analytics, advertising or marketing cookies. The self-hosted Admidio system uses a technically necessary session cookie for secure operation, login and session management; it expires when the session ends. Admidio may also store that its own cookie notice has been acknowledged. WordPress may use technically necessary cookies when an authorised user signs in to administer the website.

Technically necessary storage is used to provide a service expressly requested by the visitor and does not require consent under Section 165(3) of the Austrian Telecommunications Act 2021. Where personal data is processed, the legal basis is Art. 6(1)(f) GDPR. Optional cookies or comparable technologies will be activated only after consent pursuant to Art. 6(1)(a) GDPR.

4. Membership application and member area (Admidio)

We use the self-hosted software Admidio to receive membership applications, administer memberships and roles, provide account access, communicate with members and manage membership fees.

Data processed during the current registration

• Required account and contact data: username, password, email address and other authentication-related data.
• Required profile data: first name and surname.
• Required billing address: street, postal code, city and country.
• Optional registration data: institution or company.
• Application confirmations: acknowledgement that the registration is a membership application and acknowledgement of the current notice concerning the Statutes.

The required fields are necessary to identify the applicant, communicate about the application, create and secure the account and administer the membership and contribution. Without the required username, email address, first name, surname and billing address, we cannot process the membership application or provide the member account. Institution or company details and later voluntary profile fields may be omitted without affecting the application.

If you later provide further information in your profile, such as a mobile number, we process that information for the purposes for which you provided it. Account and membership data may also include membership status, roles and groups, member number, correspondence, access permissions and login-related technical data.

We process application and membership data to take steps at your request and administer the membership relationship (Art. 6(1)(b) GDPR), comply with accounting and other legal obligations (Art. 6(1)(c) GDPR), and pursue our legitimate interests in secure and efficient association administration and the prevention of misuse (Art. 6(1)(f) GDPR).

Access is role-based and limited to authorised board members, administrators and other function holders who require the information for their duties. Application data is retained for the application process. Member and account data is retained for the duration of membership and afterwards only where required by statutory obligations or the establishment, exercise or defence of legal claims.

Login protection

To detect and limit automated attacks on the Admidio login, we record the IP address, attempted login name and time of each failed login. After three failed attempts from one IP address within 15 minutes, the local login form requires a simple captcha; after 15 failed attempts within that period, further attempts from the address are temporarily refused. No external captcha provider is used. Attempt records are deleted after 24 hours. The legal basis is Art. 6(1)(f) GDPR; our legitimate interest is protecting member accounts and the association’s systems against unauthorised access.

Signed membership declaration

After admission, a member may generate a bilingual declaration containing the name, postal address, email address, member number, recorded accession date and current membership fee. The declaration records the membership application and acknowledgement of the Statutes and this Privacy Policy. It does not repeat the Board decision, authorise a public profile or create a SEPA mandate.

The member may save the declaration as PDF, sign it using ID Austria or by hand and upload the signed PDF through the protected member area. The file is encrypted before permanent storage outside the publicly accessible website. Its physical path uses random identifiers and contains no name. Access is limited to the member concerned, authorised Board members and administrators. An authenticated upload is recorded automatically without a second membership approval; upload and replacement events are retained in a restricted audit history.

The signed declaration is retained only while required as evidence of the membership relationship, a statutory duty or the establishment, exercise or defence of legal claims. Encrypted backups follow the documented backup cycle and the recovery key is stored separately.

Resignation and privacy requests

Members may use the Admidio Privacy Center to submit a resignation or request the review and erasure of eligible portal data. A resignation request records the member’s name, email address, postal address, member number, submission time, calculated effective date, processing status, board decision and audit history.

A signed resignation PDF may be uploaded voluntarily through the protected member area instead of being sent as an ordinary email attachment. The PDF is encrypted before permanent storage outside the publicly accessible website. The physical storage path uses random identifiers and does not contain the member’s name. Access is limited to the member concerned, authorised members of the association’s board and administrators. Downloads and review actions require an authenticated account and are recorded in the restricted processing history.

The board manually records whether the document has been accepted or requires correction. The encrypted PDF and the restricted request record are normally deleted three years after the case is closed, unless a longer period is necessary for a statutory obligation or the establishment, exercise or defence of legal claims. Encrypted backups follow the documented backup cycle; the encryption recovery key is stored separately.

If a member chooses the external A-Trust PDF Sign service for an electronic signature, the member actively uploads the document to A-Trust. ESIS Austria does not transmit the document to A-Trust. The external service is governed by A-Trust’s own privacy information.

5. Membership fees, invoices and SEPA data

If payment or SEPA information is provided for membership administration, we may process IBAN, BIC, bank, account holder and address, mandate reference and date, contribution amount and due date, invoices and payment status. This information is not published.

The secure SEPA mandate workflow is currently disabled. ESIS Austria does not collect IBAN data or signed mandate PDFs through this workflow before the creditor ID has been issued and the collection process has been configured and tested. This Privacy Policy will be reviewed before the workflow is activated.

The purposes are contribution administration, invoicing, documentation of a SEPA mandate, authorised debits and payment reconciliation. The legal bases are Art. 6(1)(b), Art. 6(1)(c) and, where necessary, Art. 6(1)(f) GDPR. Data may be disclosed where necessary to participating banks, accounting or tax advisers, technical processors and competent authorities. Accounting records and supporting documents relevant for taxation are generally retained for seven years in accordance with Section 132 of the Austrian Federal Fiscal Code (BAO).

6. Events and registrations

For events we may process registrations, participation status, event-specific roles or groups, communications, attendance information and, where applicable, a participation fee and payment status. Processing is necessary to organise and carry out the event (Art. 6(1)(b) GDPR) and for our legitimate interest in orderly event administration (Art. 6(1)(f) GDPR).

Event data is deleted or minimised after the event and its follow-up when it is no longer required, subject to accounting obligations and possible legal claims. Public event information may include the title, date and time, programme, venue, contact details, images and documents intended for public communication.

7. Photos, galleries, news and member submissions

Public member and institution profiles

Members may voluntarily prepare a personal or institutional profile for publication. Depending on the information entered, the public profile may contain a display name, role or function, organisation, short introduction, profile text, fields of expertise, website, public contact email, profile image or logo and image credit. The author account, internal editing history, rights confirmation, consent status and review notes remain restricted to authorised administrators and reviewers.

Publication is based on consent under Art. 6(1)(a) GDPR and begins only after the author has confirmed publication consent and the Media Team has approved the submission. Consent may be withdrawn at any time in the member area or by emailing webmaster@esis-ag.at. Withdrawal removes the public profile and image without affecting membership or the lawfulness of processing before withdrawal.

Authorised members may submit photos, captions, event information, news, documents or other content for review and publication. The submitting account and editing history may remain visible internally to authorised administrators for moderation, security and accountability, even where no public author name is displayed.

Photos or reports in which people are identifiable are published only where there is an appropriate legal basis. Depending on the circumstances, this may be consent (Art. 6(1)(a) GDPR) or our legitimate interest in documenting and communicating association activities (Art. 6(1)(f) GDPR) after balancing the interests concerned.

Image publication also respects Section 78 of the Austrian Copyright Act. Individual portraits and images from situations in which publication may affect legitimate interests are published only with appropriate permission. Event notices may provide additional information about photography and contact options.

Published events, photographs, captions and news can be accessed worldwide and may be indexed, cached, copied or shared by search engines and third parties. Requests concerning published material may be sent to info@esis-ag.at.

8. Email, system messages and newsletter

The email address provided during registration is required and is used for account-related messages, application and membership administration, replies to enquiries and, where relevant, event communications. Processing is based on Art. 6(1)(b) or Art. 6(1)(f) GDPR.

A newsletter is sent only where it has been requested or valid consent has been given (Art. 6(1)(a) GDPR). You can unsubscribe at any time using the method stated in the message or by emailing us.

9. Contacting us

The website currently provides email links and does not use a separate contact form. If you contact us by email, we process the contact details, message content and related metadata you provide in order to respond and handle follow-up questions.

The legal basis is Art. 6(1)(b) GDPR where the enquiry concerns membership, an event, a contract or a pre-contractual step; otherwise it is Art. 6(1)(f) GDPR. Correspondence is deleted when it is no longer needed, unless statutory retention duties or legal claims require longer storage.

10. External links, maps and locally hosted fonts

Our pages contain ordinary links to external websites, including ESIS International, conference websites and Google Maps links for event locations. No connection to the external provider is made merely because the link appears on our page. Only when you actively open the link do you leave our website; the external provider may then receive technical request data such as your IP address and referrer information under its own privacy policy.

The fonts used on this website, including Manrope and Fira Code, are hosted locally on esis-ag.at. No connection to Google Fonts is established when our pages are loaded.

11. Recipients and international transfers

We do not sell personal data. Within the association, data is available only to people who require it for their assigned duties. External recipients may include Hetzner Online GmbH as hosting and email processor, banks, accounting or tax advisers, legal advisers and authorities where required.

We do not intend to transfer membership or bank data to a third country. An independent external provider may receive data when you actively open an external link. That processing is governed by the external provider’s privacy information.

12. Retention

We retain personal data only for as long as necessary for the respective purpose. Relevant criteria include the duration of an application, membership, account, event or consent; statutory accounting and documentation periods; IT-security requirements; and applicable limitation periods. Data is then deleted or anonymised unless continued retention is legally required.

13. Security

We use appropriate technical and organisational measures, including TLS encryption, role-based permissions and access controls, to protect personal data against loss, misuse and unauthorised access. No internet transmission or storage system can provide absolute security.

14. Your rights

Subject to the legal requirements, you have the right of access (Art. 15 GDPR), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20) and objection (Art. 21). Where processing is based on consent, you may withdraw it at any time with future effect (Art. 7(3)).

Please contact info@esis-ag.at to exercise your rights. You may also lodge a complaint with the Austrian Data Protection Authority, Barichgasse 40–42, 1030 Vienna, Austria. We do not use automated decision-making or profiling within the meaning of Art. 22 GDPR.

15. Changes to this Privacy Policy

We update this Privacy Policy when our services, data processing or legal requirements change. The version published on this page applies.