Skip to main content

English version here!

Privacy Policy

Wiener Schule für Osteopathie GmbH

1. General Information

This privacy policy explains what personal data we—Wiener Schule für Osteopathie GmbH—process, how and for what purpose this processing (carried out with the aid of automated systems) takes place, and what rights you have as a data subject.

2. Data Controller

The data controller is Wiener Schule für Osteopathie GmbH, Moeringgasse 20/7, 1150 Vienna, registered in the commercial register under number FN 563436h (Commercial Court of Vienna).

The representative for the data controller is Raimund Engel, raimund.engel@wso.at, Wiener Schule für Osteopathie GmbH, Moeringgasse 20/7, 1150 Vienna, Tel: +43 1 879 38 26 0.

3. Provision of the Website and Server Log Files

When you access our website, the browser used on your device automatically sends information to our website's server, where it is temporarily stored in what are known as server log files.

The following data is collected automatically, without any action on your part:

  • IP address of the requesting computer
  • Date and time of access
  • Name and URL of the accessed file
  • Website from which access originated (referrer URL)
  • Browser used, the operating system of your computer (if applicable), and the name of your internet service provider

This data is processed based on our legitimate interest, in accordance with Art. 6 Para. 1 lit. f of the GDPR, to ensure a smooth connection to the website, to facilitate a user-friendly experience, and to evaluate system security and stability. Log file data is deleted after 14 days, unless further retention is required for evidentiary purposes in the event of security incidents.

4. Contacting us via the website / email

If you contact us via email or a contact form, the data you provide (name, email address, telephone number, and the content of your inquiry) will be processed for the purpose of handling your request and addressing any follow-up questions. The legal basis for this is the implementation of pre-contractual measures or the fulfillment of a contract (Art. 6 Para. 1 lit. b of the GDPR), or our legitimate interest in responding to your inquiry (Art. 6 Para. 1 lit. f of the GDPR). We will not share this data with third parties without your consent.

5. Cookies and cookie management

Our website uses cookies. Cookies are small text files that are placed on your device via your browser. They do not cause any harm.

  • Technically necessary cookies: We use technically necessary cookies to keep our website functional and user-friendly. The legal basis for this is Article 6(1)(f) of the GDPR (legitimate interest).
  • Optional cookies (analytics, marketing): Cookies used for analytics or marketing purposes are only placed following your explicit consent, provided via our cookie banner (Article 6(1)(a) of the GDPR in conjunction with Section 165(3) of the 2021 Telecommunications Act [TKG 2021]). You may withdraw your consent at any time via the cookie settings on our website, or you may configure your browser to notify you whenever cookies are being placed, allowing you to approve them on a case-by-case basis.

6. Collection and processing of personal data during ongoing operations

Protecting personal data is of particular importance to us. Consequently, your personal data is processed only to the extent permitted by legal provisions and necessary for the fulfillment of the specific purpose in question.

In the course of our activities, the following personal data is collected and processed for the purposes outlined below:

a. Student administration:

We process the following data concerning students in basic training programs, university certificate/diploma programs, and postgraduate (PG) seminars for the purposes of managing student course contracts, handling enrollment at DUK, and completing registration forms. The legal basis for this is the performance of a contract (Article 6(1)(b) of the GDPR):

Name, address, telephone number, email address, date of birth, bank account details, profession

b. Regarding the administration of employees:

For the purpose of managing contracts with our employees, processing salary payments, and registering them with the relevant social security authorities—based on the legal grounds of contract performance (Art. 6 para. 1 lit. b GDPR) and compliance with legal obligations (Art. 6 para. 1 lit. c GDPR):

Name, address, telephone number, e-mail address, social security number, date of birth, bank account details

c. For the provision of treatments to our patients at the teaching clinic:

In the course of providing treatments to our patients—carried out by our therapists, tutors, and students—we process the following personal data based on the performance of a contract (Art. 6 para. 1 lit. b GDPR). Regarding health-related data, we process this information based on explicit consent in accordance with Art. 9 para. 2 lit. a GDPR or Art. 9 para. 2 lit. h GDPR (provision of healthcare or treatment):

Name, address, telephone number, e-mail address, social security number, medical history (anamnesis) and health data, date of birth, bank account details.

d. For the administration of teaching contracts with our tutors:

To prepare invoices for our tutors, we process the following data based on the performance of a contract (Art. 6 para. 1 lit. b GDPR):

Name, address, e-mail address, telephone number, bank account details.

e. For sending our e-mail newsletter:

To send our newsletter and other information regarding services, courses, study programs, and events, we process the following data, provided you have given us your consent (Art. 6 para. 1 lit. a GDPR in conjunction with Section 174 of the Telecommunications Act [TKG] 2021): name, address, e-mail address.

For this purpose, we use the communication channels you have provided to us: e-mail and postal mail. We use the service provider Sparkpost (Bird Global, Inc. / MessageBird B.V.) to send e-mails. Data transfers to third countries (USA) are carried out on the basis of the EU-US Data Privacy Framework or standard contractual clauses.

f. Photographs at Events:

We have a legitimate interest (Art. 6 para. 1 lit. f GDPR) in taking photographs during events and courses for marketing purposes and publishing them on our website. However, no photographs of patients or images that pertain to the highly personal sphere of an individual’s private life will ever be taken.

Should you object to this, you may oppose such processing and publication at any time; this is also indicated to you via a notice sign.

7. Disclosure of Personal Data to Third Parties

Your personal data will not be disclosed to third parties, except:

  • where we are legally obligated to do so—for example, under the Telecommunications Act (TKG), the Criminal Code (StGB), the Code of Criminal Procedure (StPO), or the Federal Fiscal Code (BAO);
  • to authorized medical personnel in the event of a medical emergency (Art. 9 para. 2 lit. c GDPR);
  • on the basis of your explicit and revocable consent.

8. Web Hosting and Data Processing on Our Behalf

When we engage a data processor, we remain responsible for the protection of your personal data.

We only engage external data processors to perform tasks necessary for the provision of our services:

  • Web Hosting: For the hosting and operation of our website, we utilize the services of Hetzner Online GmbH, Industriestr. 25, 91710 Gunzenhausen, Germany. The data is processed on servers located within the European Union.
  • Newsletter distribution: We use the service Sparkpost (Bird Global, Inc.) to send our newsletter.

The provider has committed to us to comply with applicable data protection regulations. A data processing agreement has been concluded in accordance with Art. 28 of the GDPR.

We primarily engage data processors located within the European Union. We only engage data processors outside the European Union if: (i) an adequacy decision exists, (ii) standard contractual clauses have been concluded, (iii) there is certification under the EU-US Data Privacy Framework (DPF), or (iv) binding corporate rules have been established.

9. Duration of processing

We process your data for the duration of the contractual relationship or in accordance with statutory retention periods:

  • Student course data: 7 years (for tax purposes) or 25 years (regarding eligibility/participation credentials).
  • Employee data: up to 30 years (due to claims for employment references).
  • Patient health data: up to 30 years, as required by healthcare regulations.
  • Customer records: 10 years following the last point of contact.
  • Newsletter/marketing: until an objection is raised or consent is withdrawn.

10. Data security

We implement technical and organizational security measures to protect your data against manipulation, loss, destruction, and unauthorized access.

11. Your Rights

You have the right to access (Art. 15 GDPR), rectification (Art. 16 GDPR), erasure (Art. 17 GDPR), restriction of processing (Art. 18 GDPR), data portability (Art. 20 GDPR), and the right to object (Art. 21 GDPR).

a. Right to lodge a complaint:

If you believe that the processing violates data protection law, you have the right to lodge a complaint with the competent supervisory authority. In Austria, this is the Austrian Data Protection Authority (Österreichische Datenschutzbehörde), Barichgasse 40–42, 1030 Vienna, email: dsb@dsb.gv.at, website: www.dsb.gv.at.

b. Exercising your rights:

To exercise your rights, please contact:

  • Email: datenschutz@wso.at
  • Mail: Wiener Schule für Osteopathie, Peter Engel, Moeringgasse 20/7, 1150 Vienna