Privacy Policy

Controller

The controller for the processing of personal data on this website is:

ZRK - Zentrum für Risiko- & Krisenmanagement
Graben 28/1, A-1010 Vienna, Austria
Register of Associations (ZVR) 796766303, Landespolizeidirektion Wien
office@zfrk.org, phone +43 650 225 29 91

For questions about data protection please contact the Chairman of the Board of Directors, DI Johannes Göllner, MSc, johannes.goellner@zfrk.org. Further details about the association are given in the imprint.

Cookies and local storage

This website sets a single cookie, and a strictly necessary one at that:

• PHPSESSID - the session identifier. It ties your entries together within one visit, carries the security token that protects forms against misuse (CSRF token), remembers the language you chose and keeps you signed in to the internal area. The cookie holds nothing but a random string, no information about you personally; it cannot be read by scripts in the browser (HttpOnly), is only transmitted over an encrypted connection (Secure), and expires as soon as you close your browser.

In addition, this website stores one entry in your browser's local storage (cookie_consent) once you have answered the notice at the bottom of the page. It records only how you decided, so the notice does not reappear on every page. This entry is never transmitted to us and stays in your browser until you delete it there.

We use no advertising cookies, no profiling, no cross-site recognition and no third-party consent tool.

Legal basis for the session cookie: section 165(3) of the Austrian Telecommunications Act 2021, as it is strictly necessary to provide the functions you asked for, and Art. 6(1)(f) GDPR (legitimate interest in a secure and functioning website).

Audience measurement

We would like to know which pages are being read - without recognising the people who read them. The measurement therefore runs on our own server, without cookies and without a service such as Google Analytics.

Each page view transmits: the address requested, the language, the referring page (if any) and the device class (mobile, tablet, desktop). Your IP address and browser identification are not stored. Together with the current date and a secret key they are fed into a one-way calculation; only its result is stored, a string from which the original values cannot be recovered. Because the date is part of the calculation, the identifier differs the next day - recognition across days is therefore impossible.

Visits by search engines and other automated agents are not counted. If your browser sends the "Do Not Track" setting, no measurement takes place at all.

You may object. The notice at the bottom of the page offers the button "Decline"; the counting then stops. Your decision is kept in your browser and applies to all further pages.

Legal basis: Art. 6(1)(f) GDPR. Our legitimate interest is to judge our own content on the basis of anonymous totals. No access to your device takes place.

Forms on this website

Personal data reaches us mainly through the forms on this website. Mandatory fields are marked as such; without them we cannot deal with the matter at hand. All other entries are voluntary.

Contact form

Data: name, e-mail address, subject, message.
Purpose: answering your enquiry.
Route: the message is not stored in the website database but sent straight to our office as an e-mail.
Legal basis: Art. 6(1)(b) GDPR for enquiries about membership or a service, otherwise Art. 6(1)(f) GDPR.

Enquiries from the competence centres and departments

Data: name, e-mail address, message, the department concerned.
Purpose: forwarding to the responsible contact person.
Route: through our form service (see "Recipients and service providers") as an e-mail to the office.
Legal basis: Art. 6(1)(b) or (f) GDPR.

Event registration

Data: first name, surname, e-mail address, organisation (voluntary) and, if you tick the box, your consent to the newsletter.
Purpose: managing attendance, sending your confirmation with a ticket number, notifying the office. If you tick the newsletter box, a separate confirmation e-mail follows for that - see below.
Route: the registration is stored in our database and linked to the event.
Legal basis: Art. 6(1)(b) GDPR.

Newsletter

Data: e-mail address, time of subscription and of confirmation.
Purpose: sending our newsletter.
Route: subscription takes two steps. First you receive an e-mail with a confirmation link; only when you click it do we add the address to the list. Without that confirmation nothing is sent to the address, and the waiting entry is deleted after 30 days. Every issue carries an unsubscribe link; one click is enough and no reason is required.
Legal basis: Art. 6(1)(a) GDPR. You may withdraw your consent at any time with effect for the future.

Membership applications

The membership application is the most extensive form on this website. Depending on the type of membership it collects:

• Companies and institutions: name of the organisation, commercial register number, VAT identification number, address, country of registered office, website, telephone (landline and mobile), e-mail address and bank details (IBAN/BIC); for the contact person: title, first name, surname, academic degree, function, date of birth, e-mail address, telephone number and the e-mail address for invoices; plus membership type, service package, HUB membership and the annual fee calculated from them.
• Individuals: title, first name, surname, academic degree, date of birth, e-mail address, nationality, mobile and landline number, and the postal address.

Purpose: reviewing and administering your membership, providing the services it entails, charging and booking the membership fee.
Route: through our form service as an e-mail to mitgliedschaft@zfrk.org. The application is not stored in the website database.
Legal basis: Art. 6(1)(b) GDPR (initiation and performance of the membership relationship), for the bank details likewise Art. 6(1)(b) GDPR for settling payment, for the commercial register and VAT numbers Art. 6(1)(c) GDPR (obligations under tax and association law).

We collect date of birth and nationality because the statutes of the association and the membership records required under association law call for members to be identified unambiguously.

Protection against misuse

Every form carries a field invisible to people and a time lock; both are noticed only by automated senders. In addition we count attempts per IP address: your IP address is stored for at most 24 hours and then deleted automatically. Anyone who writes into the invisible field is blocked for 24 hours; an entry made by hand remains until it is lifted. Legal basis: Art. 6(1)(f) GDPR, legitimate interest in fending off automated attacks.

Recipients and service providers

Your data is neither sold nor passed on for advertising purposes. To run this website we rely on the following service providers, who act as processors on our behalf:

• Web space and e-mail. Website, database and the association's mailboxes are held by the same provider. Every page request produces access data (IP address, time, address requested, browser identification), which the provider logs for a short period to trace faults and fend off attacks. Its mail server also carries the messages this website sends: registration confirmations, newsletters and the notifications to the office.
• Form service at forms.onoqueo.com, operated by oQueo. It receives the membership applications and the departmental enquiries, checks them for automated senders and delivers them as e-mail to the responsible address.

Every component of this page comes from our own server - fonts, images, stylesheets and program components alike. Nothing is fetched from an external delivery network, so no third party learns your IP address merely because you opened a page.

A Google Maps view may appear on event pages if coordinates have been recorded for the event. It is loaded only after an explicit click. Before that, no connection to Google is established and nothing about you is transmitted. If you do click, Google learns your IP address; the provider is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. The legal basis is then your consent under Art. 6(1)(a) GDPR.

Individual article pages carry an embedded YouTube video, for instance the official review of the 2026 ICT Security Conference by the Austrian Armed Forces. It is loaded only after an explicit click. Until then you see nothing but a still image from our own server; nothing is requested from Google, not even a preview image.

If you click play, your browser opens a connection to YouTube. Google thereby learns your IP address, details about your device and browser and the page from which you started the video, and may store data on your device or read it from there. If you are signed in to Google at the same time, the request may be attributed to your account. We embed the player via youtube-nocookie.com; according to Google, in this mode cookies are set only once playback starts. The provider is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. Data may be transferred to Google LLC in the United States; Google LLC is certified under the EU-US Data Privacy Framework, which the European Commission found to provide an adequate level of protection in its decision of 10 July 2023. The legal basis is your consent under Art. 6(1)(a) GDPR and section 165(3) of the Austrian Telecommunications Act 2021, which you give by clicking; you withdraw it by reloading the page, which restores the still image. What Google does with the data is set out in its privacy policy at policies.google.com/privacy.

Public authorities receive data only where we are legally obliged to provide it.

Retention

• Session cookie: until you close the browser.
• Audience measurement: the daily identifier is deleted after 12 months; the plain counts per page and day carry no personal reference and are kept.
• IP addresses for abuse prevention: at most 24 hours; blocks until they expire.
• Contact form and departmental enquiries: until the matter is settled, thereafter six months at most, unless a statutory retention duty applies.
• Event registrations: until the event and the related accounting are complete.
• Newsletter: until you unsubscribe; an unconfirmed subscription is deleted after 30 days.
• Membership data: for the duration of the membership and thereafter for as long as statutory retention periods require - seven years for records and accounts under section 132 of the Austrian Federal Fiscal Code.

Your rights

You have the right to obtain information about the data stored about you, to have it corrected, erased or its processing restricted, to data portability, and to object to processing we base on a legitimate interest. Where you have consented to processing, you may withdraw that consent at any time with effect for the future.

An informal message to office@zfrk.org is enough. No automated decision-making or profiling takes place.

If you believe that the processing of your data infringes data protection law, you may lodge a complaint with the supervisory authority. In Austria this is the Austrian Data Protection Authority, Barichgasse 40-42, 1030 Vienna, www.dsb.gv.at.

Version of 2 October 2026. We update this page whenever the website changes what it does with data.