Privacy Notice

Effective: 22.11.2023
Last Updated: 22.11.2023

We are committed to protecting and respecting your privacy. We ensure the compliance with applicable data protection law (EU General Data Protection Regulation (GDPR), Austrian Data Protection Act (DSG) and other applicable national data protection laws. This Privacy Notice will inform you how we use personal data to provide our services and implement projects around the world.

Data Controller

This Privacy Notice sets out the basis on which Boson Dynamics GmbH (“Boson Dynamics”, “we”, “our” or “us”) as the data controller processes personal data about visitors of our website, applicants, experts and support staff working on our projects as well as other third parties (“you” or “your”).

Please read the following carefully to understand how we will use your personal data and what rights you have in relation to our processing of your personal data.

We operate the following website: www.bosondynamicsx.org

Processing of Personal data

We may process personal data when providing our services. Personal data may be collected from the following sources:

• Personal data provided by you (e.g. personally or via e-mail or telephone, our online contact form, or when applying for open opportunities on our website)
• Personal data collected from third parties (e.g. references, LinkedIn and other job platforms)
• Passive collection of technical information in relation to services provided on our website (e.g. Cookies)

Personal data of third parties provided by you: If you provide us with personal data of third parties in specific circumstances (for example by way of an e-mail recommending such third party), we assume that you have obtained the consent of such third party and that such disclosure is in accordance with applicable data protection law and our Privacy Notice. Please do not transfer any personal data of third parties unless this is in accordance with the previous sentence.

Personal data we process may include the following:

• identification data (first name, last name, title(s), gender, address, date of birth)
• contact details and communication data (e-mail, telephone, messages, notes and type of enquiry)
• geographical data (country of residence or employment)
• information about your organisation (as provided by you, e.g. name, type)
• CV and supporting documents (such as identification and contact data, professional experience including present position, education, qualifications, degrees and certificates, experience in the region, language and other skills) if applicable
• salary and remuneration data (if applicable)
• passport or other ID-Documents (if required and provided by you)
• project implementation data (scope, time, participants, reports, communications, etc.)
• other information necessary due to statuary requirements of labour law (e.g. holiday or pension entitlements)
• any other information, documentation or communications that you voluntarily submit to us

The provision of certain data is a requirement to enter into a contract with you or share information as well as to fulfil our statutory obligations. You are not obligated to provide us with your personal data as an applicant. However, if you fail to provide certain data, we may not be able to enter into a contract with you and you may not be able to work with us. Where this is the case, we will duly inform you that the provision of certain data is required.

CVs you give to us must not contain sensitive data relating to your (i) racial or ethnic origin (ii) political opinions (iii) religious or philosophical beliefs (iv) membership of a trade union (v) physical or mental health or biometric details or genetic data (vi) sexual life (vii) the commission of criminal offences or proceedings and associated penalties or fines, (viii) the commission of any unlawful or objectionable conduct and associated penalties, or (ix) any Social Security Number or national identification number. If your CV does contain this information, then you agree that it is at your own risk.

Should we in exceptional circumstances require one of the above categories of sensitive data, we will duly inform you by separate notice.

Purposes of the processing and legal basis

We may process personal data for the purpose of:

• preparing documents for consulting projects,
• reviewing staff profiles and qualifications to meet the project criteria,
• maintaining a pool of qualified consulting network partners in order to engage them in current and future projects, and
• implementing our projects.

For the above mentioned purposes we process personal data only in compliance with applicable data protection laws; especially where the processing is:

• necessary for the performance of our contract with you or in order to take steps at your request prior to entering into a contract (Art 6 para 1 lit b GDPR);
• necessary to comply with our legal or regulatory obligations (e.g. under corporate, tax or employment law) (Art 6 para 1 lit c GDPR, Art 9 para 2 GDPR);
• necessary for the purposes of our legitimate interests (or those of a third party) and as far as your interests and fundamental rights and freedoms do not override those interests (Art 6 para 1 lit f GDPR). Without limiting the applicability of the before mentioned legal grounds, we rely on the legitimate interest as a legal basis, inter alia, for:
  • the purposes set out above and as required by and in compliance with the respective programming and project’s documentation such as but not limited to project information documents, terms of reference provided by our networking partners, which includes:
    • the purposes set out above and as required by and in compliance with the respective programming and project’s documentation such as but not limited to project information documents, terms of reference provided by our networking partners, which includes:
    • the maintenance of a pool of qualified consulting network partners as reference for new projects and for additional tasks in current and future projects, which is inter alia necessary in view of the programme cycles of projects.
• for certain processing activities we may also ask for your consent (Art 6 para 1 lit a GDPR).

Data storage

We store personal data on secure servers located in Austria, provided by Hulla & Co Human Dynamics KG, an affiliated company. We have implemented appropriate technical and organisational measures in accordance with applicable data protection laws in order to protect your personal data against accidental or unlawful destruction, alteration, unauthorised disclosure or access and any other unlawful or unauthorised processing.

We will only store your personal data as long as there is a legitimate purpose for such storage.

We may store personal data during the existing relationship with you and, following its termination, as long as there is a corresponding statutory retention obligation (e.g. under corporate, tax or employment law), a party could assert any claims arising from or in connection with the relationship or the project or other legitimate interests in line with this Privacy Notice apply.

Where we no longer need to process your personal data for the purposes set out above, we will delete your personal data from our systems.

Where permissible, we will also delete your personal data on your request. Information on how to make a deletion request can be found in the “Your Rights” section of this Privacy Notice below.

Your rights

Your rights in accordance with applicable law, in particular Chapter III of the GDPR, as a data subject in connection with our processing activities are:

• the right to access
• rectification
• erasure
• restriction of processing, or
• if applicable, to object to the processing
• to data portability

Where processing is based on your consent, you have the right to withdraw your consent at any time with effect for the future. This will not affect the lawfulness of processing based on consent before its withdrawal.

We do not engage in profiling and have no automated decision-making processes in place as defined in Art 22 GDPR.

You also have the right to lodge a complaint with the competent supervisory authority. For more information on the competent data protection authorities, please go to http://ec.europa.eu/justice/article-29/structure/data-protection-authorities/index_en.htm.

The competent data protection authority for Austria is:

Österreichische Datenschutzbehörde
Hohenstaufengasse 3
1010 Wien
Tel. +43 1 531 15 202525
Fax +43 1 531 15 202690
e-mail: dsb@dsb.gv.at
Website: http://www.dsb.gv.at/

Recipients of personal data and international data transfer

As we offer our services on a global level, we may disclose your personal data to Boson Dynamics clients, networking partners, or other third parties, in order to provide our services, meet our contractual obligations, fulfill legal obligations or our other business purposes as specified above.

If we instruct a processor with the processing of your personal data on our behalf, such processor is subject to the contractual obligation (i) to process personal data only in accordance with applicable data protection law, and (ii) to process such personal data only in accordance with our prior written instructions, and (iii) to implement appropriate measures to ensure confidentiality and security of personal data.

Some of the mentioned recipients may be located in countries outside the European Union (EU) or European Economic Area (EEA), for which an adequate level of data protection has not yet been recognized by the European Commission. In this case we will only transfer such data that are necessary for (i) the preparation or performance of a contract with you, (ii) the implementation of pre-contractual measures taken at your request or (iii) for the conclusion or performance of a contract concluded in your interest with a third party (Art 49 para 1 lit b and c GDPR). Where none of the before mentioned conditions applies we will either obtain your explicit consent or implement adequate safeguards to protect your personal data (in particular we will conclude of EU Model Clauses pursuant to Art 46 para 2 lit c GDPR with the respective recipients). For information on the implemented safeguards please contact us at info@bosondynamics.org.

Updates to this privacy notice

From time to time we may update this Privacy Notice to reflect changes in our information practices. If we make any material changes we will announce this by means of a notice on this website prior to the change becoming effective. We encourage you to periodically review this page for the latest information on our privacy practices.

Contact information

If you have any questions about this Privacy Notice or in the event of any other request in relation to the processing of personal data by Boson Dynamics, please contact us at: info@bosondynamics.org. You may also write us at:

Boson Dynamics GMBH
Wollzeile 11, 2.OG
A 1010 Vienna
Austria

What we may need from you
We may need to request specific information from you to help us confirm your identity and ensure your right to access your personal data (or to exercise any of your other rights). This is a security measure to ensure that personal data is not disclosed to any person who has no right to receive it. We may also contact you to ask you for further information in relation to your request to speed up our response.

Web Analytics

We use web analytics to collect statistics about the use of our website. These statistics are important for us to be able to continuously improve our website and our content. Data protection is a top priority for us, which is why we rely on the Plausible analysis tool. In contrast to other trackers such as Google Analytics, Plausible deliberately does not use cookies and does not store any personal data, neither in the browser nor on Plausible's servers. Only general data such as pages accessed, browsers and devices used and origin are analyzed. You can find a complete overview of the data collected in Plausible's data policy. Provider: OÜ Plausible Insights, Västriku tn 2, Tartu 50403, Estonia.