Our privacy policy
Impact Hub Company is deeply committed to the protection of your personal data and your privacy. The following data policy shall provide you with an extensive and transparent insight into how we collect, manage and process your personal data. Additionally, the data policy shall provide you with efficient opportunities to influence our processing. In essence, we want you to be in absolute control of your own data disclosure.
To improve the readability of our privacy statements, we addressed different thematic fields with customized privacy statements. Make sure that you are in the right place.
General Data Policy
Recruitment and Employment Privacy Policy
Impact Hub’s General Data Policy
v 1.1 (29th August 2018)
I. Terms
‘Personal data’ means any information relating to an identified or identifiable natural person (‘data subject’); an identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person;
‘Processing’ means any operation or set of operations which is performed on personal data or on sets of personal data, whether or not by automated means, such as collection, recording, organization, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure or destruction.
‘Data subject’ means the natural person whose personal data is processed by a controller or processor.
‘Data controller’ means the natural or legal person, public authority, agency or other body which, alone or jointly with others, determines the purposes and means of the processing of personal data; where the purposes and means of such processing are determined by Union or Member State law, the controller or the specific criteria for its nomination may be provided for by Union or Member State law.
‘Sensitive personal data’ means personal data, revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, trade-union membership; data concerning health or sex life and sexual orientation; genetic data or biometric data.
II. Who we are
Impact Hub Company, an entity located in Vienna, Austria (Impact Hub GmbH, FN 358967v, Lindengasse 56/18-19, 1070 Vienna, Austria).
III. Categories of personal data
Depending on your relationship with us, we may process different categories of personal data.
1) Identity data. Identity data may include your first name, maiden name, last name, username, marital status, title, date of birth and gender.
2) Contact data. Contact data may include your name, mailing address, phone number, email address and other information that enables us to contact you.
3) Membership data. Membership data is data that relates to your membership with a local Impact Hub and may include the duration of the membership
4) Professional data. Professional data is data that relates to your business and professional interests and your work and may include your education, professional experience, company, company details, place of work, working field, impact focus, sustainable development goals.
5) Financial data. Financial data may include data such as your contact details, address, representatives, bank account, payment card details, tax number, VAT number and details about payments between us.
IV. How we process your data
1) If you are not (yet) a Member or a Maker at a local Impact Hub
In the context of your interaction with Impact Hub Company, you, as a natural person, may be subject to certain data processing activities that we perform. We use your personal data in the following ways:
a) Newsletter, marketing, promotional materials
We may use your Contact data to contact you with newsletters to provide you information that may be of interest to you.
Sharing: Involved personal data might be shared with:
– Service providers that are necessary for the performance of the services (FFI: section V).
Legal basis: Consent. You may withdraw consent at any time. Additionally, you may opt out of receiving any, or all, of these communications from us by following the unsubscribe link or instructions provided in the emails sent or by simply contacting us.
Retention period: We retain the Contact data you used to sign up for our newsletter for as long as you remain subscribed (i.e. you do not unsubscribe), a member of a local Impact Hub or until cancel our newsletter service, whichever occurs first.
b) To communicate with you
If you contact us we will process the personal data you have provided in order to answer your request and for possible follow-up.
Sharing: Involved personal data might be shared with:
– Service providers that are necessary for the performance of the services (FFI: section V).
Legal basis: Consent.
Retention period: The collected customer data will be deleted after completion of the request or termination of the business relationship. Legal retention periods remain unaffected.
2) If you are a Member at a local Impact Hub
In the context of your interaction with Impact Hub Company, you, as a natural person and Member at a local Impact Hub, may be subject to certain data processing activities that we perform. We use your personal data in the following ways:
a) Newsletter, marketing, promotional materials
In the same ways as outlined under section IV. 1) a)
b) Surveys
In order to gain deeper knowledge and insights of our member community and their work, identify common support needs or challenges, improve our services towards you and to report to partners and funders we, on a regular basis, conduct surveys amongst Members of local Impact Hubs. Through the surveys, we may collect and otherwise process contact data and – depending on your input, the context and the circumstances – other personal data.
Sharing: Involved personal data might be shared with:
– Service providers that are necessary for the performance of the services (ffi: section V).
– Service providers that support us with the analysis of the results (ffi: section V).
– Your local Impact Hub in aggregated or anonymized form.
– Partners and funders in aggregated form.
– Consulting agencies in aggregated form.
Legal basis: Consent
Specific data security: On the field of surveys we undertake extra efforts to protect your personal data against unauthorized access of third parties. Measures include password protection of the documents containing the personal data, local instead of cloud storing and a strict retention period regime.
Retention periods: On an annual basis we review the security and necessity of the storing of data sets collected through the surveys and accordingly will take appropriate measures like the anonymization or deletion of data sets.
c) Members directory
In order to gain deeper knowledge and insights of our member community and their work, identify common support needs or challenges, improve our services towards you and to report to partners and funders we may store your Contact data, professional data and identity data in our members directory.
Source: You directly or the local Impact Hub you are a member of.
Sharing: While the members directory exclusively serves internal purposes, involved personal data might be shared with
– Service providers that are necessary for the performance of the services (FFI: sect. V).
– Your local Impact Hub.
– Partners and funders in aggregated form.
– Consulting agencies in aggregated form.
Legal basis: Legitimate interest. You may opt out from being listed at any time by simply contacting us.
Retention periods: Personal data will only be stored in the Members Directory for the duration of your Membership at a local Impact Hub.
c) Information exchange within the Impact Hub Network
Occasionally we may use your contact data to contact you directly or, share your contact data with other persons belonging or connected to the Impact Hub Network.
Such occasions might be:
– A request to work from a different local Impact Hub through the Impact Hub passport services.
– A request for collaboration or exchange of expertise or experiences with other persons belonging to the Impact Hub Network.
– Participation in cross-regional programs and events.
Legal basis: Contractual necessity or Consent.
Sharing: Involved personal data might be shared with:
– Service providers that are necessary for the performance of the services (FFI: sect. V).
3) If you are a Maker at a local Impact Hub
In the context of your interaction with Impact Hub Company, you, as a natural person and Maker at a local Impact Hub, may be subject to certain data processing activities that we perform. We use your personal data in the following ways:
a) Newsletter, marketing, promotional materials
In the same ways as outlined under section IV. 1) a)
b) Members directory
In the same ways as outlined under section IV. 2) c)
c) Information exchange with the Impact Hub Network
In the same ways as outlined under section IV. 2) d)
d) Maker’s Digest
We may use your Contact data to contact and provide you with information around the Impact Hub Network like personnel changes, events, programs, opportunities to participate, newly available services, governance changes and comparable topics through the “Maker’s Digest”.
Sharing: Involved personal data might be shared with:
– Service providers that are necessary for the performance of the services (FFI: sect. V).
Legal basis: Legitimate interest. You may opt out from being listed at any time by simply contacting us or following the unsubscribe link on the newsletter.
Retention period: We retain the Contact data for as long as you remain subscribed (i.e. you do not unsubscribe), a Maker at a local Impact Hub or if we decide to cancel our newsletter service, whichever occurs first.
e) Surveys In the same ways as outlined under section IV. 2) b).
Additionally, in order to gain deeper knowledge and insights of our Maker community and their work, identify common support needs or challenges, improve our services towards you and to report to partners and funders we, on a regular basis, conduct surveys amongst Makers of local Impact Hubs. Through the surveys we may collect and otherwise process contact data and – depending on your input, the context and the circumstances – other personal data.
Sharing: Involved personal data might be shared with:
– Service providers that are necessary for the performance of the services (ffi: section V).
– Service providers that support us with the analysis of the results (ffi: section V).
– Your local Impact Hub in aggregated or anonymized form.
– Partners and funders in aggregated form.
– Consulting agencies in aggregated form.
Legal basis: Consent
Specific data security: On the field of surveys we undertake extra efforts to protect your personal data against unauthorized access of third parties. Measures include password protection of the documents containing the personal data, local instead of cloud storing and a strict retention period regime.
Retention periods: On an annual basis we review the security and necessity of the storing of data sets collected through the surveys and accordingly will take appropriate measures like the anonymization or deletion of data sets.
4) If you hold a representative role at a local Impact Hub or within the Impact Hub Network
a) In addition to the activities outlined in the previous sections, if you have a representative role at your local Impact Hub (for example: AREPS or customer relationship managers) or within the Impact Hub Network (Board Members, Members of committees) we’ll collect, share and otherwise process your contact data in accordance with the requirements of your specific role and as necessary for the fulfillment of your role and/or the effective execution of network-related decision-making and governance processes.
This might include direct contact or the sharing of your contact data.
Sharing: Depending on the particular role, contact data might be shared with:
– Service providers that are necessary for the performance of the services (ffi: section V).
– Persons belonging to the Impact Hub Network.
– Partners, funders and service providers.
– Potential members.
Legal basis: Contractual obligation or legitimate interest.
Retention periods: Once your role ends we’ll cease processing on the basis of this section in a timely manner.
5) If you belong to a partner, funder, external service provider or other business partner
a) We use your relevant personal data in order to maintain the contractual relationship with you.
Sharing: Depending on the contractual basis and the circumstances, personal data might be shared with:
– Service providers that are necessary for the performance of the services (ffi: section V).
– Other persons whose involvement is necessary for the achievement of the contractual purpose.
– Where imposed by law, competent authorities.
Legal basis: Contractual obligation, legal obligation or legitimate interest.
Retention periods: Once the contract has ended, we’ll generally cease the processing of your personal data unless dictated otherwise by a mandatory statutory obligation.
b) If you are a representative or contact person of a partner, funder, external service provider or other business partner, we’ll temporarily store your contact data in order to preserve the opportunity for future collaborations.
Sharing: Depending on the circumstances, personal data might be shared with:
– Service providers that are necessary for the performance of storage and communication services (ffi: section V).
Legal basis: legitimate interest.
Retention periods: In the absence of renewed collaboration we’ll cease the processing of your personal data after a period of maximally five years.
V. Access to your data
We use a number of third parties to provide us with services which are necessary to run our business or to assist us with running our business and who process your information for us on our behalf. These include the following:
1) Google’s G Suite
We use G Suite for our email, calendaring, document storage, and collaboration. The provider of the services is Google LLC located in the United States. All data, including occasionally contained personal data, will (also) be stored on servers located in the US.
In order to provide you with appropriate safeguards, the transfer of personal data is governed by the EU-US Privacy Shield and a data-processing agreement between us and Google LLC. Google’s G Suite security set-up is available here.
2) Google Analytics
We use Google Analytics to track and report website traffic as part of our marketing efforts in order to continuously improve your website experience. The provider of the services is Google LLC located in the United States. All data will (also) be stored on servers located in the US.
3) MailChimp
We use MailChimp for the distribution and analysis of our newsletters, general marketing and promotional activities. Contact data of subscribers is stored on servers hosted in US-based data centers. The transfer of personal data is governed by the EU-US Privacy Shield. Full details of MailChimp’s security set-up is available on their website here https://mailchimp.com/about/security/.
We continuously make sure to configure our use of MailChimp to be compliant with the requirements of the GDPR and other relevant laws.
4) Questback
We use Questback for our surveys and to register and collect consent from the data subjects. More information on how Questback secures personal data can be found here https://www.questback.com/information-security/
5) Social Entrepreneurship Center
The Social Entrepreneurship Center of the Vienna University for Economics and Business Administration supports us with the analysis of data collected through our annual Maker and Member surveys.
6) Local Impact Hubs
Data containing personal data of Members and Makers of a local Impact Hub from to time might be shared with the respective local Impact Hub. We take appropriate measures, including anonymization, aggregation and the setup of data-processing agreements, to make sure that the personal data remains adequately protected.
7) Impact Hub Company’s team
Staff of Impact Hub Company is located within and outside the European Economic Area. We take appropriate technical and organizational measures to make sure that personal within and outside the EEA remains adequately protected.
VI. Data Security
The security of all your Personal Information is important to us. To the best of our ability, we are taking appropriate technical or organizational measures to protect your Personal Information against unauthorized access or unlawful processing and accidental loss, destruction or damage. While we strive to protect your Personal Information, we cannot ensure or warrant the security of any information that you directly or indirectly transmit to us, and you do so at your own risk.
VII. Your rights
We grant you all the rights relating to your personal data that the European General Data Protection Regulation – as implemented in the Austrian data protection law – provides for data subjects. These rights include:
1) The right to access your data
You have the right to request access to the personal data that we have collected about you and to request specific information and insights on how we treat, share, store and otherwise process this personal data. To exercise this right please file an access request via email. Within 30 days following this request we will provide you with a copy (on paper if you do not choose otherwise) of all the personal data that we possess about you and will explain to you the details of the treatment of your personal data.
2) The right to rectification
In the case personal data that we store about you is incorrect, inaccurate, or outdated you have the right to demand that we correct these errors. To exercise this right, it is sufficient to just point the errors out in an email to the address given below.
3) The right to erasure (the ‘right to be forgotten’) / withdrawal of consent
At all times you are absolutely free to withdraw any consent given by stating so in an email. As a consequence of such a withdrawal of consent, within the following 30 days, we will do everything within our reasonable possibilities to make sure that we stop processing and storing personal data about you and will request those partners of us which have access to your personal data to do the same.
4) The right to object to processing
On top of the right to erasure, we grant to you the right to object to the processing of your personal data. You exercise this right by stating so in an email. As soon as you raise objections we will be required to demonstrate that we have compelling grounds for continuing the processing, or that the processing is necessary in connection with our legal rights. If we cannot demonstrate this, we will cease the processing activity in question immediately.
5) The right to restrict processing
In cases in which we, or the partners that have access to your personal data, legally cannot delete the relevant personal data (for example in the case that the data are required for the purposes of exercising or defending legal claims) or where you do not wish to have the data deleted, we may continue to store the data, but you are entitled to limit the purposes for which the data can be processed, via stating so in an email.
VIII. Complaints
You have the right to lodge a complaint with a supervisory authority, in particular in the European Union (or European Economic Area) state where you work, normally live or where any alleged infringement of data protection laws occurred. Find an overview of the national data protection authorities here.
IX. Changes to this privacy policy
We reserve the right to change this privacy policy at any time. If we make material changes to this privacy policy we will notify you via email and will update the version number and date above. Your continued relationship with us after having been notified of changes shall constitute your agreement to be bound by any such changes.
X. Governing law
As far as permitted by law, this privacy policy and its terms shall be governed by and construed in accordance with the data protection laws of Austria and any legal dispute concerning this privacy policy, its interpretation, and our handling of your personal data shall be adjudicated in Austrian jurisdiction.
XI. Feedback and how to contact us
If you want to exercise your rights, have any queries on this policy, wish to contact us or know further details on how we use personal data please contact us electronically at: [email protected] or postal under: Impact Hub Company, Lindengasse 56/18-19, 1070 Vienna, Austria
