Data protection statement for social media

BMWKMS utilises the option provided by Meta Platforms Ireland Ltd. (Merrion Road, Dublin 4, D04 X2K5, Ireland), hereinafter referred to as Meta, to maintain company pages on Facebook and Instagram for the publication of topics from BMWKMS or the organisational units Housing, Art, Culture, Media and Sport.

These services maintained by Meta enable the use of anonymous statistics that Meta compiles from (possibly personal) data of visitors and interaction with the company pages (so-called insights). As far as we are currently aware, Meta places cookies on the visitor's end device and reads them when they visit the company website.

In its ruling C-201/16 of 5 June 2018, the ECJ decided that (formerly Facebook, now Meta) Facebook Ireland Ltd. and the operator of a fan page (company page) are to be regarded as joint controllers for the processing of personal data for the creation of page insights. Therefore, insofar as Facebook or Meta processes personal data of visitors to the fan page maintained by BMWKMS for the creation of the page insights provided to BMWKMS, Meta Platforms Ireland Ltd. and BMWKMS are jointly responsible within the meaning of Art. 26 GDPR.

According to the guidelines published by Meta Platforms Ireland Ltd, Meta processes the data collected from visitors and may transfer the data to countries outside the European Union. What information Meta collects and how it is used is described in Meta's data usage guidelines. These guidelines also contain information on how to contact Meta as well as the setting options for adverts: https://www.facebook.com/privacy/policy.

In addition, please refer to Meta's terms of use: https://www.facebook.com/terms.php?ref=dp.

BMWKMS has no influence over the collection of personal data of visitors to its company pages and their further processing or use by Meta Platforms Ireland Ltd. In particular, it has no knowledge of the extent to which, where and for how long personal data is stored by Meta, the extent to which Meta fulfils its erasure obligations under data protection law, what evaluations and links are made with the data and to whom the data is passed on.

In connection with the above-mentioned ECJ ruling regarding the Insights offered, Facebook [now Meta] has undertaken to assume all obligations under the GDPR, including those towards data subjects: "Facebook Ireland agrees to assume primary responsibility under the GDPR for the processing of Insights data and to fulfil all obligations under the GDPR with regard to the processing of Insights data (including Articles 12 and 13 GDPR, Articles 15 to 22 GDPR and Articles 32 to 34 GDPR). In addition, Facebook Ireland will make the essence of this Page Insights Supplement available to data subjects."

As the provider of its profile pages, BMWKMS does not collect or process any other personal data from the use of this service.

Meta Platforms, Inc. has had its participation in the EU-US Data Privacy Framework (DPF) certified by the US Department of Commerce. This certification relates to Meta's processing of personal data received from the European Economic Area ("EEA") under the DPF in connection with the certification. More information about the DPF and Meta’s disclosure is available at https://www.facebook.com/privacy/policies/data_privacy_framework. With regard to the Facebook and Instagram services of Meta used by BMWKMS, Meta Platforms Ireland Limited is a joint controller and Meta Platforms, Inc. 1 Meta Way or 1601 Willow Rd, Menlo Park, California 94025, USA, is a processor.

Data retention

BMWKMS does not erase any data held by Meta. Reference is made to the exercise of data subject rights, including the erasure of personal data, within the scope of the joint responsibility of Meta Platforms Ireland Ltd: https://www.facebook.com/privacy/policy/?section_id=8-HowLongDoWe.

BMWKMS has no further knowledge of specific retention periods. According to its own statements, Meta retains information for different lengths of time "on a case-by-case basis" in order to protect legal obligations, the provision of products or Meta's interests or the interests of others.

Comments on various posts can be deleted by the users themselves or by BMWKMS. BMWKMS does not archive comments, but comments or behaviour relevant under criminal law are forwarded to the BMWKMS security officer and any competent authorities.

Categories of data subjects

1. Visitors to the company pages or profiles maintained by BMWKMS on Meta, insofar as Meta Platforms Ireland Ltd. collects personal data from them.
2. Administrators of the company pages or profiles maintained by BMWKMS on Meta
3. Persons who are affected by a posting (or content) on the company pages or profiles maintained by BMWKMS on Meta.

Categories of personal data, sources and categories of other recipients

With regard to the categories of personal data of the three "categories of data subjects" and sources, please refer to the websites of Meta Ireland Ltd. www.facebook.com/privacy/policy and privacycenter.instagram.com/policy

According to the policies at www.facebook.com/privacy/policy and privacycenter.instagram.com/policy, Meta shares, collects and receives information from partners, measurement solution providers, service providers and third parties about many users’ information and activities on and off Meta Platforms Ireland Ltd. products.

Examples of this information:

• User device information
• Websites visited by users and cookie data, such as through social plugins or the Meta pixel
• Apps or games used by users
• Purchases and transactions carried out by users
• Adverts viewed by users and any interactions with them
• Use of the products and services of Meta partners, online or in person
• Partners also share information such as email address, cookies and device ID with Meta for advertising purposes
• Partners pass on communications with users to Meta.

In addition, please refer to the processed key figures, which are listed in the following document: https://www.bmwkms.gv.at/dam/jcr:31216a17-86fe-4549-ba0f-b22d63d5e9b1/meta_kennzahlen.pdf (PDF, 151 KB)

Data of persons who are affected by a posting (or content) on the company pages or profiles maintained by BMWKMS on Meta will also be published on the company pages or profiles maintained by BMWKMS on Meta.

Transfer of data to a third country or to an international organisation

According to the policy at www.facebook.com/help/637205020878504/, information about non-registered (and thus also registered users) is transferred or transmitted to the USA or other third countries outside those in which the users live, or stored and processed there.

Meta uses global infrastructure and data centres of Meta, including in the USA. If information from users is transferred or transmitted outside the European Economic Area or stored and processed there, Meta uses "appropriate mechanisms for international transfers".

See in particular pt. 10 at www.facebook.com/legal/terms/dataprocessing.

Profiling

With regard to profiling, please refer to the information provided by META: www.facebook.com/privacy/policy?section_id=0-WhatIsThePrivacy

BMWKMS uses the option provided by LinkedIn Ireland Unlimited Company (Wilton Place, Dublin 2, Ireland) to maintain a company page on LinkedIn for the publication of topics from BMWKMS or the organisational units Housing, Art, Culture, Media and Sport.

This service, which is maintained by LinkedIn, enables the use of anonymous analyses that LinkedIn creates from (possibly personal) data of visitors and interaction with the BMWKMS company page. As far as we are currently aware, LinkedIn uses various technologies such as cookies, pixels, local storage and other similar technologies when the company website is visited. Please refer to the LinkedIn cookie policy: https://de.linkedin.com/legal/cookie-policy

According to the policy published by LinkedIn, LinkedIn processes the data collected from visitors and may transfer the data to countries outside the European Union. What information LinkedIn collects and how it is used is described in LinkedIn’s privacy policy. This policy also contains information on how to contact LinkedIn as well as the settings options for adverts: https://de.linkedin.com/legal/privacy-policy and additional "Regional European Privacy Notice of LinkedIn" https://de.linkedin.com/legal/privacy/eu 

BMWKMS has no influence over the collection of personal data of visitors to its company pages and their further processing or use by LinkedIn. In particular, it has no knowledge of the extent to which, where and for how long personal data is stored by LinkedIn, the extent to which LinkedIn fulfils its erasure obligations under data protection law, what evaluations and links are made with the data and to whom the data is passed on.

As the provider of its corporate website, BMWKMS does not collect or process any other personal data from the use of this service.

The LinkedIn Corporation, 1000 W. Maude Avenue, Sunnyvale, CA 94085, USA, and the US subsidiaries under its control comply with the EU-US Data Privacy Framework (EU-US DPF) as established by the US Department of Commerce. See also: https://www.linkedin.com/help/linkedin/answer/a1343190/?trk=microsites-frontend_legal_privacy-policy&lang=en

With regard to the LinkedIn services used by BMWKMS, LinkedIn Ireland Unlimited Company is a joint controller and LinkedIn Corporation, 1000 W. Maude Avenue, Sunnyvale, CA 94085, USA, a processor.

Data retention

BMWKMS does not erase any data held by LinkedIn. Reference is made to the exercise of data subject rights, including the erasure of personal data, within the scope of joint responsibility at LinkedIn Ireland Ltd: https://de.linkedin.com/legal/privacy-policy and https://de.linkedin.com/legal/privacy/eu

BMWKMS has no further knowledge of specific retention periods. According to LinkedIn, you can "ask them to delete your personal data. Most of your profile data can be deleted via your account settings. (...) For any data that cannot be deleted in your settings, you can submit a data deletion form." See also: https://de.linkedin.com/legal/privacy/eu and https://www.linkedin.com/help/linkedin/answer/a1342613/

Comments on various posts can be deleted by the users themselves or by BMWKMS. BMWKMS does not archive comments, but comments or behaviour relevant under criminal law are forwarded to the BMWKMS security officer and any competent authorities.

Categories of data subjects

1.  Visitors to the company page maintained by BMWKMS on LinkedIn, insofar as LinkedIn Ireland collects personal data from them.
2.  Administrator of the company page maintained by BMWKMS on LinkedIn.
3. Persons who are affected by a posting (or content) on the company page maintained by BMWKMS on LinkedIn.

Categories of personal data, sources and categories of other recipients

With regard to the categories of personal data of the three "categories of data subjects" and sources, please refer to the LinkedIn Ireland websites https://de.linkedin.com/legal/privacy-policy and https://de.linkedin.com/legal/privacy/eu

According to the policies at en.linkedin.com/legal/privacy-policy and en.linkedin.com/legal/privacy/eu, LinkedIn shares, collects and receives information from partners and affiliates including Microsoft, service providers and third parties about many users’ information and activities on and off LinkedIn Ireland products.

In addition, please refer to the processed key figures, which are listed in the following document: https://www.bmwkms.gv.at/dam/jcr:2ea47510-169c-4d8a-9af5-e9750635f36f/linkedIn_kennzahlen.pdf (PDF, 163 KB)

Data of persons who are affected by a posting (or content) on the company page maintained by BMWKMS on LinkedIn will also be published on the company page maintained by BMWKMS on LinkedIn.

Transfer of data to a third country or to an international organisation

According to LinkedIn's privacy policy, data is processed both inside and outside the USA. Reference is made to pt. "5.2 Cross-border data transfers" of the privacy policy: https://de.linkedin.com/legal/privacy-policy#others

In addition, the data is shared by LinkedIn Ireland with LinkedIn Corporation in the USA as well as with third-party providers and processors. These include the parent company Microsoft, cloud service providers, content delivery networks, telecoms providers, maintenance service providers, member support providers, development service providers, market research companies, fraud and abuse prevention providers, marketing and analytics providers, payment service providers, external auditors and consultants, managed service providers and consulting and professional services firms such as legal and tax advisers. Reference is made to the section on"Data Sharing with Third Parties" in LinkedIn's "Regional European Privacy Notice": https://www.linkedin.com/legal/privacy/eu.

Profiling

With regard to profiling, please refer to the information provided by LinkedIn: en.linkedin.com/legal/privacy/eu

BMWKMS uses the option provided by Google Ireland Limited (Gordon House, Barrow Street, Dublin 4, Ireland) to maintain YouTube websites for video hosting and the publication of videos from BMWKMS and the organisational units Housing, Art, Culture, Media and Sport.

This YouTube service maintained by Google enables the use of anonymous statistics that Google compiles from (possibly personal) data of visitors and interaction with YouTube websites (so-called analytics). As far as we are currently aware, Google uses various technologies (e.g. cookies, pixel tags, browser web storage, application data caches, etc.) to read data when YouTube websites are visited.

According to the guidelines published by Google, Google processes the data collected from visitors and may transfer the data to countries outside the European Union. We refer you to the point "Where your data is stored" under "Data protection and security settings" in the Privacy Help Centre: https://support.google.com/policies/answer/9581826 or https://policies.google.com/privacy/frameworks. Google describes what information it collects and how it is used in its privacy policy: https://policies.google.com/privacy. Information on "Requirements in Europe" can also be found there (or at https://policies.google.com/privacy/frameworks) as can contact options for Google: https://policies.google.com/privacy#europeanrequirements

In addition, reference is made to the "Guide to data protection in Google products", including YouTube, which provides further information on data protection and the setting options for users: https://policies.google.com/technologies/product-privacy

Google provides the following information on the legal framework for data transfers: https://policies.google.com/privacy/frameworks.

BMWKMS has no influence over the collection of personal data of visitors to its YouTube websites and their further processing or use by Google. In particular, it has no knowledge of the extent to which, where and for how long personal data is stored by Google, the extent to which Google fulfils its deletion obligations under data protection law, which evaluations and links are made with the data and to whom the data is passed on. 

As the provider of its YouTube web pages, BMWKMS does not collect or process any other personal data from the use of this service.

Google LLC (1600 Amphitheatre Parkway, Mountain View, CA 94043, USA) complies with the EU-US Data Privacy Framework (EU-US DPF) as established by the US Department of Commerce. See also: https://support.google.com/policies.

With regard to data responsibility, Google states the following:

"The data controller responsible for processing your information will depend on your habitual residence, unless otherwise stated in the privacy notice of a particular service:

• Google Ireland Limited, based in Gordon House, Barrow Street, Dublin 4, Ireland, for users of Google services who have their habitual residence in the European Economic Area or Switzerland.
• Google LLC, located at 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA, for users of Google services who have their habitual residence in the United Kingdom.

Google LLC is the data controller responsible for the processing of information indexed and displayed in services such as Google Search and Google Maps, regardless of your place of residence. Google Ireland Limited is the data controller responsible for the processing of information used to train Google AI models for use in services provided by Google Ireland Limited in the European Economic Area or Switzerland."

Please refer to the section on"Data controller" in the privacy policy: https://policies.google.com/privacy.

Data retention

BMWKMS does not erase any data from Google or the YouTube service. Reference is made to the exercise of data subject rights by Google Ireland Limited, including the erasure of personal data: https://policies.google.com/privacy#inforetaining.

BMWKMS has no further knowledge of specific retention periods. According to Google, the data it collects is stored for "different periods of time, depending on what data is involved", how the data is used and what the user's individual settings are. We refer to the following passages in Google's privacy policy https://policies.google.com/privacy#infodelete and https://policies.google.com/technologies/retention. In addition, Google provides further information on the duration of data storage and information on how long it takes for information to be deleted at https://policies.google.com/technologies/retention.

Any comments on various posts can be deleted by the users themselves or by BMWKMS. BMWKMS does not archive comments, but comments or behaviour relevant under criminal law are forwarded to the BMWKMS security officer and any competent authorities. 

Categories of data subjects

1. Visitors to the YouTube websites maintained by BMWKMS on Google, insofar as Google collects personal data from them.
2. Administrators of the YouTube websites maintained by BMWKMS on Google.
3. Persons who are affected by a video or audio (or content) on the YouTube websites maintained by BMWKMS on Google.

Categories of personal data, sources and categories of other recipients

With regard to the categories of personal data of the three "categories of data subjects" and sources, please refer to the website https://policies.google.com/privacy.

According to its privacy policy on https://policies.google.com/privacy/google-partners, Google shares, collects and receives data from partners, websites and apps, in particular through the integration of its services (e.g. embedded YouTube videos, Google Analytics, adverts). In this regard, please also refer to https://policies.google.com/privacy/example/your-activity-on-other-sites-and-apps and https://policies.google.com/technologies/partner-sites.

In addition, please refer to the processed key figures, which are listed in the following document: https://www.bmwkms.gv.at/dam/jcr:d51af3b4-fe0d-49a6-afa3-bd570b33c892/youtube-kennzahlen.pdf (PDF, 163 KB)

Data of persons who are affected by a video or audio (or its content) on the YouTube websites maintained by BMWKMS on Google are also published on the YouTube websites maintained by BMWKMS on Google.

Transfer of data to a third country or to an international organisation

According to Google's privacy policy, data is processed on servers "all over the world". Please refer to Google's framework conditions for data transmission in the section on "Legal framework conditions for data transmission": https://policies.google.com/privacy/frameworks.

According to Google, it “cooperates with companies and organisations in various ways [note: worldwide]":

• So-called partners: websites and apps that are not operated by Google, but whose owners work with Google for advertising purposes; apps from "developer partners" on Google Play; other partners to improve the security of Google services (e.g. for information on security threats, etc.); see "Who are Google’s partners?" at https://policies.google.com/privacy/google-partners
• processors: Google provides "affiliates [note: "a legal entity that is part of the Google group of companies, including the following companies that provide services in the EU: Google Ireland Limited, Google Commerce Ltd, Google Payment Corp and Google Dialer Inc."], other trusted companies or individuals" with personal data, for example to support the operation of data centres, provide Google services, customer support and, in particular, providers that assist with the review of video content on YouTube "for public safety reasons and help us [Google] improve Google's audio recognition technologies by analysing and listening to sample excerpts of stored audio recordings from users". Please refer to the section on "Data transfer" in the privacy policy https://policies.google.com/privacy#infosharing.
• Data that personally identify you, such as your name or email address, will be passed on to Google advertising partners if users ask Google to do so themselves. This is the case, for example, "if you see an advert for a flower shop in your area and select the 'Tap to call' button". Google then connects the call and "possibly forwards your phone number to the flower shop". Please refer to the section on"Who are Google’s partners?" in the privacy policy: https://policies.google.com/privacy/google-partners.

Profiling

The term profiling is not explicitly mentioned by Google, but it is assumed that Google uses profiling. Please refer to the privacy policy "Requirements in Europe": https://policies.google.com/privacy#europeanrequirements.

BMWKMS uses the option provided by PicDrop GmbH (Am Kupfergraben 4/4a, 10117 Berlin, Germany) to maintain a photo and video platform at PicDrop.com in order to make photos and, where appropriate, videos from the ministry available to the public. The platform serves both as an upload and hosting option for photos and videos as well as for internal voting on the selection of photos and videos to be published.

As far as we are aware, PicDrop uses cookies and "comparable tracking technologies" when the website is visited. A distinction is made between cookies for more convenient use, for statistical recording and analysis of general user behaviour (access data), technically necessary cookies, third-party cookies & tracking, for payment providers, for video and streaming platforms, for social media and for in-app notifications. Please refer to the PicDrop.com cookie banner and point 5 "Cookies & implemented technologies" in the privacy policy: https://www.picdrop.com/web/de/privacy#editCookieConsent.

According to PicDrop, the processing and use of the data generally takes place in the territory of the Federal Republic of Germany, in a member state of the European Union or in another signatory state to the Agreement on the European Economic Area. According to PicDrop, any transfer to a third country requires the prior written consent of BMWKMS, which cannot be refused by BMWKMS without justified reason, and may only take place if the special requirements of Art. 44 et seq. GDPR are fulfilled. Please refer to the processing contract with PicDrop and to the section on"I have a general question about the GDPR" in the FAQs: https://www.picdrop.com/web/de/faq#safety-privacy.

PicDrop may transfer the data collected from visitors (access figures, etc.) to countries outside the European Union. What information PicDrop collects and how the data is used is described in PicDrop's privacy policy: https://www.picdrop.com/web/de/privacy.

Information on how to contact PicDrop can be found in the legal notice: https://www.picdrop.com/web/de/imprint.

When the platform "Federal Ministry of Housing, Arts, Culture, Media and Sport" is used to transfer and host photos and videos, BMWKMS uses the processor PicDrop: https://www.picdrop.com/web/de/privacy.

According to PicDrop, PicDrop uses the following sub-processors as processors:

• Hosting platform & files: Boreus GmbH, Germany, boreus.de as hosting provider for Amazon Web Services EMEA SARL, Luxembourg (server location: Europe, European Economic Area), aws.amazon.com
• Email dispatch: The Rocket Science Group LLC d/b/a MailChimp, USA, mailchimp.com

As the provider of its photo and video platform, BMWKMS does not collect or process any other personal data from the use of this service.

Data retention

According to PicDrop, personal data is generally only stored for as long as is necessary to fulfil contractual or legal obligations, taking into account, for example, statutory limitation periods for evidence purposes or retention obligations, accounting reasons or legal documentation obligations. PicDrop then deletes the data “without undue delay”. Please refer to point "3. Save & delete data" of the privacy policy: https://www.picdrop.com/web/de/privacy.

According to PicDrop, the information stored in the log files does not allow any direct conclusions to be drawn about a person and is stored for 90 days.

The deletion of data from PicDrop is reviewed by BMWKMS on a case-by-case basis and is carried out at the discretion of BMWKMS. With regard to the exercise of data subject rights, including the erasure of personal data, please refer to point "9. Rights" of the PicDrop privacy policy: https://www.picdrop.com/web/de/privacy.

PicDrop states that it only retains personal data for as long as is necessary to fulfil contractual or legal obligations for which the data was collected, after which PicDrop deletes the data immediately, unless the data is still required until the expiry of the statutory limitation period for evidence purposes for civil law claims or due to statutory retention obligations.

According to PicDrop, contractual data must be retained for evidence purposes for three years from the end of the year in which the business relationship with the contractual partner ends – any claims expire at the earliest at this point in time in accordance with the statutory limitation period.

According to PicDrop, some data must still be retained for accounting reasons. PicDrop states that it is obliged to do so due to statutory documentation obligations that may arise under the German Commercial Code, the German Fiscal Code, the German Banking Act, the German Money Laundering Act and the German Securities Trading Act. According to PicDrop, the periods specified there for the retention of documents are between two and ten years.

Categories of data subjects

• Visitors to the photo and video platform maintained by BMWKMS at PicDrop, insofar as PicDrop GmbH collects personal data from them.
• Administrators of the photo and video platform maintained by BMWKMS at PicDrop, insofar as PicDrop GmbH collects personal data from them.
• Persons who are affected by a photo or video (or content) on the photo and video platform maintained by BMWKMS at PicDrop.

Categories of personal data, sources and categories of other recipients

Please refer to the PicDrop GmbH website at https://www.picdrop.com/web/de/privacy  

Each time you use the PicDrop platform, the access data that the browser automatically transmits to enable you to visit the website are processed. In particular, the access data include:

• IP address of the requesting device,
• Date and time of the enquiry,
• Referrer URL (the previously visited page),
• Information about the browser and operating system used.

According to the privacy policy at https://www.picdrop.com/web/de/privacy, PicDrop may share, collect and receive information from measurement solution providers (e.g. Google Ads, Google Analytics, Meta, Microsoft), service providers (data centres) and third parties on a wide range of user information and activities on and off PicDrop products. Please refer to PicDrop’s privacy policy: https://www.picdrop.com/web/de/privacy.

The data on the images and in the videos (or their content) will also be published on the photo and video platform maintained by PicDrop at the discretion of BMWKMS.

Transfer of data to a third country or to an international organisation

Beyond the publication of the photos or videos, BMWKMS does not intend to transfer personal data to a third country or an international organisation.

According to PicDrop’s privacy policy, photo and video data is processed within Germany. Please refer to the following sources: https://www.picdrop.com/web/de/faq#safety-privacy.

In addition, PicDrop shares data with third-party providers and processors on different legal bases. These include Google, Microsoft and Meta. Please refer to PicDrop's privacy policy: https://www.picdrop.com/web/de/privacy.

Profiling

BMWKMS is not planning to carry out any profiling. PicDrop's privacy policy does not contain any references to profiling. Data may be shared with third parties (Google, Meta, Microsoft, etc.) who may use profiling.