Privacy policy
This policy describes what personal data Österreichische Unterstützungskasse ÖUK processes for membership administration, voluntary contribution collection, and support-case handling — for members in Austria and in Germany alike.
1. Data controller
Österreichische Unterstützungskasse ÖUK, ZVR no. 162639382, Hans-Resel-Gasse 19, A-8020 Graz. Contact for privacy inquiries: office@unterstuetzungskasse.at, subject line “Datenschutz”.
2. What data we process
Account and membership information (name, email address, password hash, date of birth, address, telephone number, occupation, country and member ID); signed membership applications and employer details; contribution model, employer/employee shares and contribution history; bank information used to set up a mandate, its status and the final four IBAN characters; support descriptions, recommendations and board decisions. Health information may be provided in enrollment and illness, caregiving or other support requests and is processed only with explicit consent. The Android app currently has no file-upload feature. Consent evidence records the timestamp, language, text version and checksum. The app uses no advertisements, advertising IDs or location permissions.
3. Purposes and legal bases
Account administration, membership, contribution records and voluntary support requests are processed to perform the membership relationship (Art. 6(1)(b) GDPR). Voluntarily provided health information requires separate explicit consent for the specific enrollment or support-assessment purpose (Art. 9(2)(a) GDPR). Necessary accounting evidence is retained under statutory obligations (Art. 6(1)(c) GDPR, § 132 BAO). Limited membership and consent evidence supports traceability and handling disputes (Art. 6(1)(f) GDPR). Retention for a specific proceeding or legal dispute requires a documented purpose, responsible operator and expiring hold; health information necessary for such a claim is subject to Art. 9(2)(f) GDPR.
4. Recipients and processors
Within ÖUK, the board and authorised staff have access where needed for their duties. Vercel Inc. (USA) hosts the site and API, with server functions in Frankfurt. Neon/Databricks provides the database on AWS in Frankfurt (eu-central-1); database connections use TLS encryption. These providers are subject to their respective data-processing terms and subprocessor lists. EU server locations do not exclude international technical processing or access; the transfer mechanisms specified in the relevant processing agreements, including EU Standard Contractual Clauses, apply. No external payment provider is currently used for automatic collection; that integration is not active. Personal data is not sold or transferred for advertising.
5. Retention
On confirmed account deletion, login and core profile details are immediately erased or made unusable. Open applications are withdrawn, mandates are cancelled, and health declarations and free text in applications and decision rationales are erased unless a documented hold applies to a specific proceeding. During normal operation, health declarations and free text in completed applications and decision rationales is removed by the daily erasure run after 90 days. IP addresses and browser information in application and consent evidence are removed after 30 days. Signed membership evidence, necessary employer details and consent evidence are retained while the account exists and for up to three years after account deletion. Contribution history also supports membership-standing calculations during membership. Accounting records of contributions and payouts and their related structured decisions, including request category, are retained for seven years from the end of the relevant calendar year (§ 132 BAO), or longer where required for pending tax proceedings. Expired identifiable financial records are erased; anonymous monthly totals remain. Expiring holds are checked at each erasure run. Drafts are erased after their displayed expiry. Provider backups may retain older copies until their configured recovery window ends and are not used for normal operations. Erasure must be reapplied before restored data is used.
6. Cookies
The member-facing site currently uses no analytics or marketing cookies. The internal admin console sets a single strictly-necessary cookie to remember the chosen interface language. If that changes, this policy will be updated and consent obtained where required.
7. Data subject rights
You have the right to access (Art. 15 GDPR), rectification (Art. 16), erasure (Art. 17) within statutory retention periods, restriction of processing (Art. 18), data portability (Art. 20), and objection (Art. 21). Any consent you have given can be withdrawn at any time with effect for the future.
8. Right to complain
Members resident in Austria can contact the Austrian data protection authority (Datenschutzbehörde, Barichgasse 40–42, 1030 Vienna, dsb.gv.at). Members resident in Germany can contact the data protection authority responsible for their state of residence.