CCP Austria Abwicklungsstelle für Börsengeschäfte GmbH (hereinafter referred to as "CCPA") takes the protection of your personal data very seriously and takes this into account in all business processes. We therefore process your personal data in accordance with the statutory data protection regulations, in particular the General Data Protection Regulation ("GDPR") and the Austrian Data Protection Act ("DPA"). 

In this privacy statement, we would like to inform you about the nature, scope and purposes of the processing and use of your personal data by CCPA.

Controller

The controller within the meaning of the GDPR and the DPA is CCPA.

Personal data

Personal data is any information relating to an identified or identifiable natural person (so-called "data subject"). Examples include name, address, email address, IP address, telephone number, date of birth, age, gender or national insurance number. There are also special categories of personal data (so-called "sensitive data"). The GDPR defines this as, for example, health data or data in connection with criminal proceedings. The processing of personal data (e. g. the collection, retrieval, use, storage, or transfer) always requires a legal basis or your consent.

Automated decision-making

CCPA does not use automated decision-making in accordance with Art 22 GDPR.

Legal basis for data processing

CCPA collects and processes your personal data only if a legal basis within the meaning of Art 6 (1) GDPR is fulfilled. Your data is processed in particular based on the following legal bases:

Consent - Art 6 (1) lit. a) GDPR

This data is processed on the basis of your consent, provided that you explicitly give it. Sensitive data (within the meaning of Art 9 GDPR) that you may disclose to CCPA will also be processed on the basis of consent. The scope and purposes of the processing depend on the underlying declaration of consent. You can revoke your consent at any time with effect for the future by notifying CCPA of the revocation by telephone on +43 1 5332244 2887, by email to office​(a)​ccpa.at or by post to CCPA, Strauchgasse 1-3, 1010 Vienna, Austria.

For the fulfilment of a contract – Art 6 (1) lit. b) GDPR

All processing that CCPA carries out in connection with the fulfilment of a contract is based on the legal basis of Art 6 (1) lit. b) GDPR. This also includes data that CCPA processes on the basis of pre-contractual obligations.

Legal obligations – Art 6 (1) lit. c) GDPR

If CCPA is subject to a legal obligation that requires the processing of personal data, Art 6 (1) lit. c) GDPR serves as the legal basis. This includes, for example, processing obligations under EMIR and retention obligations under tax or company law.

Legitimate interest – Art 6 (1) lit. f) GDPR

If the processing of personal data is necessary to safeguard a legitimate interest of CCPA or a third party, Art 6 (1) lit. f) GDPR serves as the legal basis. A legitimate interest of CCPA is in particular:

  • to ensure the operation and management of the CCPA systems, website and fan pages;
  • to be able to conduct direct marketing and report on events at CCPA;
  • to ensure network and data security, but only to the extent that our legitimate interest is consistent with applicable law and the rights and freedoms of data subjects;
  • to assert, exercise or defend legal claims.

Storage of your data and data security

Appropriate organisational and technical precautions are taken to protect your personal data. These precautions relate in particular to protection against unauthorised, unlawful or even accidental access, processing, loss, use and manipulation of your personal data. Notwithstanding our endeavours to maintain an appropriately high level of due diligence at all times, it cannot be ruled out that information that you disclose to CCPA via the Internet may be viewed and used by other persons. Please note that we therefore accept no liability whatsoever for the disclosure of information due to errors in data transmission not caused by CCPA and/or unauthorised access by third parties (e.g., cyber-attacks).

Your personal data will be processed as long as this is necessary to fulfil contractual or legal obligations (such as corporate retention obligations), to defend against any liability claims and for the duration of the declaration of consent. Thereafter, data is deleted or anonymised in such a way that it can no longer be linked to a specific person. CCPA ensures that your personal data is treated in accordance with this privacy statement for the entire period.

Data is stored for the duration of the entire business relationship and beyond in accordance with the statutory retention and documentation obligations. These result from, among other things:

  • Federal Fiscal Code (BAO)
  • Regulation (EU) No. 648/2012 on OTC derivatives, central counterparties, and trade repositories (EMIR)
  • Stock Exchange Act 2018 (BörseG 2018)
  • Austrian Commercial Code (UGB)

Our declared aim is to take all necessary technical and organisational measures to ensure the security of data processing and to process your personal data in such a way that it is protected against access by unauthorised persons. In addition, we improve the security of your data by using risk-minimising measures and preventive safeguards.

Your data protection rights

As a data subject under the GDPR, you have the following rights, among others: the right of access to your stored personal data and information about its origin, recipients, and the purpose of data processing. You also have the right to rectify inaccurate personal data and to have incomplete personal data completed by CCPA, as well as to have your personal data deleted and to restrict the processing of your personal data.

You may also request that your personal data provided to CCPA be made available to you in a structured, commonly used and machine-readable format or that it be transferred to another controller.

When processing your personal data on the basis of legitimate interests pursuant to Art 6 (1) sentence 1 lit. f) GDPR, you have the right to object to the processing of your personal data pursuant to Art 21 GDPR, provided that there are reasons for this arising from your particular situation.

Any questions or requests for information, deletion, correction, objection and/or data transfer can be sent to the email address office​(a)​ccpa.at or by post to the following address: CCP Austria Abwicklungsstelle für Börsengeschäfte GmbH, Strauchgasse 1-3, 1010 Vienna, Austria.

If you are of the opinion that the processing of your personal data by CCPA violates the applicable data protection law or your data protection claims have been violated in any other way, you have the option of complaining to the competent supervisory authority. In Austria, the data protection authority (www.dsb.gv.at) is responsible for this.

Changes to the privacy statement

CCPA reserves the right to adapt this privacy statement, if necessary, for example due to technical developments or legal changes, or to update it in connection with the offer of new services or products. The updated privacy statement will be published on the website www.ccpa.at. We therefore ask you to check the relevant page regularly.