Privacy

Please note: This is a translation for convenience. The legally binding version is the German one, available at gutgebruellt.at/datenschutz.

This notice applies to the website www.gutgebruellt.at. It describes which personal data we process, why, on what legal basis, and what rights you have. It is provided under Articles 13 and 14 of the General Data Protection Regulation (GDPR).

A separate privacy notice applies to the member area “My gutgebrüllt”, where you create an account and register your child for courses. You will find it in the member area itself; it covers the account, your child’s details, voluntary health information, photo permissions and fees.

Controller

The controller within the meaning of Article 4(7) GDPR is:

Kulturverein gutgebrüllt
Hofzeile 10–12/1/4, 1190 Vienna, Austria
Association register number (ZVR): 572347315
Represented by the chair, Martina Gahleithner

Email: office@gutgebruellt.at
Phone: +43 677 643 88 247

We are a small non-profit cultural association and are not required to appoint a data protection officer (Article 37 GDPR). For any data protection question, please use the contact details above.

The essentials

• This website sets no cookies. That is why there is no cookie banner, and none is needed.
• There are no analytics or statistics services, no Google Analytics, no advertising and no profiling.
• There are no social media plugins and no embedded content from other providers, so no videos, maps or feeds. Links to other sites are plain links.
• All fonts and images are served from our own web space. Opening a page sends no request to Google or any other third party.
• The website is hosted in the European Union.
• Data only reaches us when you write to us, call us, sign up for the newsletter or use the member area.
• We make no automated decisions within the meaning of Article 22 GDPR.

Hosting and server logs

The website is hosted by Hostinger International Ltd., 61 Lordou Vironos Street, 6023 Larnaca, Cyprus, on servers in a data centre in the European Union. To make pages load quickly, Hostinger also delivers them through its own network of caches.

When you open a page, your browser necessarily transmits data that Hostinger stores in log files:

• the address requested and the file retrieved,
• date and time of access,
• the amount of data transferred and whether the request succeeded,
• browser type and operating system,
• the previously visited page, if your browser sends it,
• your IP address.

Purpose: delivering the website, operational security, and detecting and investigating faults and attacks.
Legal basis: our legitimate interest in a secure, working website (Article 6(1)(f) GDPR).
Recipient: Hostinger as processor under a contract pursuant to Article 28 GDPR.
Retention: only as long as operation and security require; the logs are then deleted automatically.

We do not analyse these logs and do not combine them with other data.

Storage on your device

We do not set cookies. For a single feature the website stores one entry in your browser’s storage. It stays on your device and is not transmitted to us or to third parties.

Entry	Type	Purpose	Lifetime
gg:vorhang	session storage	Remembers that the opening animation has already played in this session, so it does not start again on every page.	Deleted as soon as you close the browser tab.

The entry is strictly necessary for displaying the website and therefore does not require consent under section 165(3) of the Austrian Telecommunications Act 2021 (TKG 2021). It contains no personal data. You can remove it at any time via your browser’s option to clear site data.

The member area uses its own technically necessary session cookie for signing in. It is only created when you sign in there and is described in the member area’s privacy notice.

Newsletter

Once sign-up is switched on, you can subscribe to our newsletter in the footer of the website. We write a few times a year about what is happening on stage and in the courses.

We process your email address, the language of the page you sign up on, and the place on the website where the form was. The data goes to our own server, which also runs the member area and is likewise hosted by Hostinger in the EU. You then receive an email with a confirmation link. You are only subscribed once you click it (double opt-in). We store the time of sign-up and confirmation as proof of your consent.

Legal basis: your consent (Article 6(1)(a) GDPR, section 174(3) TKG 2021).
Sending: via Brevo (Sendinblue SAS, 106 boulevard Haussmann, 75008 Paris, France) as processor under Article 28 GDPR.
Withdrawal: at any time via the unsubscribe link in every email or by writing to office@gutgebruellt.at. Withdrawal does not affect the lawfulness of processing before it.
Retention: until you unsubscribe. We keep the proof of consent afterwards for as long as claims can arise from it.

The form contains an invisible field that only automated programs fill in; if it is filled in, nothing is stored. To prevent abuse, the server also briefly limits the number of sign-up attempts and uses your IP address to do so.

Contacting us by email and phone

Our website has no contact form. When you write to us or call us, we process the information you give us, usually your name, email address or phone number and the content of your message. Questions about the courses are answered on behalf of the association by Johannes Christian, a member of the board.

Purpose: handling and answering your enquiry.
Legal basis: steps prior to or performance of a contract (Article 6(1)(b) GDPR), otherwise our legitimate interest in answering enquiries (Article 6(1)(f) GDPR).
Retention: until your matter is settled; beyond that only where statutory retention duties apply or claims may be asserted.

Please note that an unencrypted email can be read by third parties on its way to us. For confidential matters, please call.

Registering for theatre courses

Registration runs through the member area “My gutgebrüllt”. Which data we process there, why and for how long is set out in the member area’s privacy notice. The website itself does not take any registration data; it only links to the member area.

You can also register your child by email to theaterkurse@gutgebruellt.at. We then process:

• your child’s first name, surname and date of birth,
• the first name and surname of the parent or guardian,
• postal address, email address and phone number,
• the course you would like.

Purpose: handling the registration, running the course and invoicing.
Legal basis: performance of the contract for course participation or steps prior to it (Article 6(1)(b) GDPR), and compliance with tax record-keeping duties (Article 6(1)(c) GDPR).
Necessity: without this information we cannot process the registration.
Retention: information relevant for tax purposes for seven years (section 132 of the Austrian Federal Fiscal Code, BAO), everything else for three years after the end of the course.

Registration is made by parents or guardians. We do not address our offers directly to children and do not obtain consent from children.

Ticket reservations

You can reserve tickets by email to karten@gutgebruellt.at or by phone. The “Reserve tickets by email” buttons only open your own email program with the performance in the subject line; the website itself transmits nothing.

For a reservation we process your name, a way to contact you, and the performance, date and number of seats.

Purpose: reservation, having the tickets ready at the box office, and invoicing.
Legal basis: performance of a contract (Article 6(1)(b) GDPR), for invoicing also Article 6(1)(c) GDPR.
Retention: information relevant for tax purposes for seven years (section 132 BAO), everything else until the end of the season.

Photographs and video from courses and performances

On this website we show photographs from rehearsals, courses and performances since 2007. Children and young people can be recognised in many of them. Such images are personal data.

Purpose: documenting our work and the association’s public relations.
Legal basis: the consent of the person shown or of their parents or guardians (Article 6(1)(a) GDPR), which is asked for separately and voluntarily at course registration. The protection of likeness under section 78 of the Austrian Copyright Act also applies.
Withdrawal: you can withdraw consent at any time with effect for the future, without any disadvantage to you. Write to office@gutgebruellt.at, naming the page and image if possible, and we will remove it from the website. Withdrawal does not affect the lawfulness of processing before it.

Recipients of your data

Your data stays with the association. Outside the association it is only received by:

• Hostinger (Cyprus) as host of the website and our server, processor under Article 28 GDPR,
• Brevo (France) for sending the newsletter and the member area’s emails, processor under Article 28 GDPR,
• public authorities, where we are legally obliged to provide information.

We do not sell data, trade addresses or pass anything on for advertising.

Transfers to third countries

Our service providers are based in the European Union, and the website and our server are located in a data centre in the EU. No transfer of your data to countries outside the EU or EEA is intended. Should Hostinger or Brevo exceptionally use sub-processors outside the EEA for technical operation, this is based on the European Commission’s standard contractual clauses (Article 46(2)(c) GDPR) in the respective processing agreements.

Retention at a glance

We keep personal data only as long as necessary for the purpose and then delete it, unless a statutory retention duty applies or we still need it to establish or defend legal claims. The main periods are the seven-year retention period under section 132 BAO and the general limitation periods.

Your rights

Under the GDPR you have the right to:

• access whether and which data we process about you (Article 15),
• rectification of inaccurate data (Article 16),
• erasure (Article 17),
• restriction of processing (Article 18),
• data portability (Article 20),
• object to processing based on legitimate interest (Article 21),
• withdraw consent with effect for the future (Article 7(3)).

An informal message to office@gutgebruellt.at is enough. We reply without undue delay and within one month at the latest. If you have a member area account, you can also download your data and delete the account yourself there.

Right to lodge a complaint

If you believe we are breaching data protection law in processing your data, you can complain to the supervisory authority. In Austria this is the

Österreichische Datenschutzbehörde (Austrian Data Protection Authority)
Barichgasse 40–42, 1030 Vienna
Phone: +43 1 52 152-0
dsb@dsb.gv.at · www.dsb.gv.at

Links to other websites

On some pages we link to third-party websites, such as venues, press outlets, music on Spotify or the sites of people involved. Only the respective providers are responsible for their content and their handling of your data. A link only becomes a transfer of data once you click it.

Changes to this notice

We update this notice when our website or the law changes. The version published here applies.

Last updated: September 2026