PRIVACY POLICY

The controller responsible for the processing of personal data under the General Data Protection Regulation (GDPR) is:

Dance Vision Salzburg
Association Register (ZVR): 1403401151
Linzer Bundesstrasse 30/8
5023 Salzburg, Austria
Telephone: +43 676 9077135
Email: info@dance.vision

The Salzburg Academy for Dance Arts (SADA) is an educational initiative presented and organised by Dance Vision Salzburg.

This Privacy Policy explains how personal data are collected, used, stored, and otherwise processed in connection with:

• our websites and online platforms;

• enquiries, contact forms, and newsletter subscriptions;

• educational programmes, courses, workshops, and training pathways;

• auditions, applications, registrations, and enrolment procedures;

• rehearsals, events, performances, and related activities;

• communications with participants, applicants, parents or legal guardians, artists, faculty, partners, and other persons involved in SADA activities; and

• administrative, contractual, financial, and organisational processes connected with our programmes and services.

Personal data are processed in accordance with the GDPR, the Austrian Data Protection Act (Datenschutzgesetz – DSG), and other applicable data protection legislation.

Depending on the nature of the interaction with SADA, we may process the following categories of personal data:

• Identity data: name, date of birth, nationality, and address.

• Contact and communication data: email address, telephone number, postal address, correspondence, and communication records.

• Application, participation, and contractual data: applications, registrations, bookings, programme selections, attendance records, audition materials, training-related information, and contractual documentation.

• Payment and billing data: bank details, including IBAN where applicable, invoices, payment records, and accounting information.

• Website and technical data: IP address, device and browser information, cookie identifiers, and technical usage data where generated through our website or online services.

• Media data: photographs, video recordings, audio recordings, and related consent records where applicable.

• Health-related data: information concerning injuries, medical restrictions, allergies, medical certificates, or other health-related circumstances where relevant and necessary for safe participation.

• Consent and preference data: records of consent, withdrawal of consent, newsletter preferences, cookie preferences, and other communication preferences.

We seek to process only personal data that are adequate, relevant, and limited to what is necessary for the respective purpose.

Personal data may be processed on one or more of the following legal bases under Article 6 GDPR:

Performance of a contract or pre-contractual measures – Article 6(1)(b) GDPR

This includes processing necessary to:

• handle applications, registrations, bookings, and auditions;

• administer participation in programmes, courses, workshops, rehearsals, and performances;

• communicate programme-related information;

• manage contractual relationships; and

• process payments and related administrative matters.

Compliance with legal obligations – Article 6(1)(c) GDPR

Personal data may be processed where necessary to comply with legal obligations, including accounting, taxation, association law, statutory retention obligations, and other applicable regulatory requirements.

Legitimate interests – Article 6(1)(f) GDPR

Where appropriate, personal data may be processed on the basis of legitimate interests, including:

• internal administration and programme organisation;

• IT and information security;

• prevention of misuse or fraud;

• protection of persons, property, and organisational interests;

• establishment, exercise, or defence of legal claims; and

• improvement and appropriate operation of our services.

Where processing is based on legitimate interests, the interests and fundamental rights and freedoms of the data subject are taken into account.

Consent – Article 6(1)(a) GDPR

Where required or appropriate, processing may be based on consent, including for:

• newsletters and marketing communications;

• non-essential cookies and similar technologies; and

• certain uses, publication, or sharing of identifiable photographs, video recordings, or audio recordings.

Where processing is based on consent, consent may be withdrawn at any time with effect for the future. Withdrawal does not affect the lawfulness of processing carried out before withdrawal.

Vital interests – Article 6(1)(d) GDPR

In exceptional circumstances, personal data may be processed where necessary to protect the vital interests of the data subject or another natural person, particularly in an emergency.

Health-related personal data constitute a special category of personal data under Article 9 GDPR and are processed only where an applicable condition under Article 9(2) GDPR is satisfied.

Depending on the circumstances, this may include:

• explicit consent under Article 9(2)(a) GDPR;

• processing necessary to protect the vital interests of the data subject or another natural person where the data subject is physically or legally incapable of giving consent, under Article 9(2)(c) GDPR; or

• processing necessary for the establishment, exercise, or defence of legal claims, where applicable, under Article 9(2)(f) GDPR.

Health-related information may include injuries, medical restrictions, allergies, medical certificates, or other circumstances relevant to safe participation in dance training, rehearsals, performances, or other programme activities.

Where SADA requests health-related information or medical confirmation in connection with participation or safety, only information reasonably necessary for the relevant purpose should be provided and processed. SADA does not seek unrelated medical information.

Where necessary, more specific information concerning the applicable legal basis and Article 9 condition may be provided at the point at which health-related information is requested or collected.

Personal data are disclosed only where necessary for the respective purpose and may be shared with categories of recipients such as:

• IT, website hosting, and technical service providers;

• email and newsletter service providers;

• cloud storage and backup providers;

• payment service providers and banking institutions;

• ticketing, event management, and administrative service providers;

• professional advisers or other service providers where necessary; and

• competent public authorities where disclosure is required by law.

Where a service provider processes personal data on behalf of Dance Vision Salzburg as a processor, appropriate contractual arrangements are put in place in accordance with Article 28 GDPR.

Recipients such as banks, public authorities, or other independent organisations may process personal data as independent controllers where applicable and are not necessarily processors acting on our instructions.

Personal data are not disclosed to third parties for unrelated purposes without an appropriate legal basis.

Some service providers may process personal data outside the European Economic Area (EEA).

Where personal data are transferred to a third country or international organisation, such transfers are carried out only where the requirements of Chapter V GDPR are satisfied.

Depending on the circumstances, this may include:

• a European Commission adequacy decision under Article 45 GDPR;

• appropriate safeguards, including Standard Contractual Clauses, under Article 46 GDPR; or

• another lawful transfer mechanism provided for by the GDPR.

Where required, supplementary safeguards are applied in accordance with applicable data protection law.

Information concerning applicable safeguards may be requested by contacting info@dance.vision.

Our website may use cookies and similar technologies.

Essential cookies and technologies that are strictly necessary for the operation of the website or for providing a service expressly requested by the user may be used without prior consent where permitted by law.

Optional cookies and similar technologies, including analytics or marketing technologies, are used only where the required consent has been actively provided.

Where consent is required, users may accept, reject, or manage optional cookies through the cookie consent mechanism provided on the website. Consent may be withdrawn or preferences changed at any time through the available cookie settings.

Users may also control cookies through their browser settings. Disabling certain cookies may affect the functionality of the website.

More detailed information concerning individual cookies, providers, purposes, and storage periods may be provided through the website’s cookie consent tool.

Personal data are retained only for as long as necessary for the purposes for which they were collected or processed, or for as long as required by applicable law.

Retention periods may vary depending on the category and purpose of the data.

Typical retention periods include:

• Accounting and tax records: generally seven years in accordance with applicable Austrian tax law, subject to longer retention where legally required.

• Contractual and claims-related data: for the duration of the contractual relationship and thereafter for the applicable statutory limitation periods or for as long as reasonably necessary for the establishment, exercise, or defence of legal claims.

• Applications and audition materials relating to unsuccessful or non-enrolled applicants: generally up to six months after completion of the relevant application or audition process, unless a longer retention period is required or separately agreed on an appropriate legal basis.

• Consent records: for as long as reasonably necessary to demonstrate the existence, scope, or withdrawal of consent and to comply with applicable accountability requirements.

• Newsletter data: until consent is withdrawn or the subscription is otherwise terminated, subject to any limited retention necessary to document withdrawal or objection.

• Media data: for as long as required for the relevant lawful purpose, subject to applicable consent, withdrawal, contractual arrangements, and legal retention requirements.

Where personal data are no longer required, they are deleted, anonymised, or otherwise handled in accordance with applicable law.

Certain personal data are necessary in order to process an application, registration, booking, contractual relationship, payment, or other request.

Where personal data are required for entering into or performing a contract, complying with a legal obligation, or safely providing a programme or service, failure to provide the required information may mean that SADA cannot:

• process an application, registration, or booking;

• enter into or perform the relevant contractual relationship;

• provide the relevant programme or service;

• process a payment or issue required documentation; or

• permit participation where information reasonably necessary for safe participation has not been provided.

Where information is optional, this will be indicated where appropriate.

SADA does not require the provision of personal data that are not reasonably necessary for the relevant purpose.

Subject to the conditions and limitations provided by applicable law, data subjects have the right to:

• obtain access to their personal data under Article 15 GDPR;

• request rectification of inaccurate or incomplete personal data under Article 16 GDPR;

• request erasure of personal data under Article 17 GDPR;

• request restriction of processing under Article 18 GDPR;

• receive applicable personal data in a portable format under Article 20 GDPR;

• object to processing based on legitimate interests under Article 21 GDPR;

• object at any time to processing for direct marketing purposes;

• withdraw consent at any time with effect for the future where processing is based on consent; and

• exercise applicable rights concerning automated individual decision-making under Article 22 GDPR.

SADA does not carry out automated decision-making, including profiling, within the meaning of Article 22 GDPR.

The exercise of these rights may be subject to statutory conditions, exceptions, and retention obligations.

Requests concerning data protection rights may be addressed to:

info@dance.vision

Data subjects also have the right to lodge a complaint with a competent supervisory authority if they consider that the processing of their personal data infringes applicable data protection law.

In Austria, the competent supervisory authority is:

Austrian Data Protection Authority
(Österreichische Datenschutzbehörde)
Barichgasse 40–42
1030 Vienna
Austria
Email: dsb@dsb.gv.at
Telephone: +43 1 52 152-0

Where SADA programmes or services involve minors, their personal data are processed with particular care.

Where appropriate, applications, registrations, contractual matters, or communications relating to a minor may be submitted, approved, or handled by a parent or legal guardian.

Where processing is based on consent and consent from a parent or legal guardian is required by applicable law, the appropriate consent or authorisation will be obtained.

Special rules apply to consent-based processing in connection with information society services offered directly to children. Under Austrian law, consent under Article 6(1)(a) GDPR in this specific context may be given independently by a child who has reached the age of 14. Where the child is under 14, consent or authorisation from the holder of parental responsibility is required to the extent provided by Article 8 GDPR and Austrian law.

These specific age rules concerning information society services do not mean that all processing of a minor’s personal data is based on consent. Other lawful bases may apply depending on the processing activity.

Information addressed specifically to children will be provided in a clear and understandable form appropriate to the circumstances.

We implement appropriate technical and organisational measures designed to protect personal data against accidental or unlawful destruction, loss, alteration, unauthorised disclosure, unauthorised access, or other unlawful processing.

Such measures are selected taking into account the nature, scope, context, and purposes of processing, as well as the risks to the rights and freedoms of individuals.

Access to personal data is restricted, where appropriate, to persons who require access for the relevant purpose.

Reasonable measures are taken to maintain an appropriate level of protection in accordance with applicable data protection law.

This Privacy Policy may be updated where reasonably necessary, including to reflect changes in legal requirements, processing activities, organisational procedures, technologies, or services.

The current version will be made available on our website.

Where appropriate, material changes may also be communicated through other suitable means.

The effective date shown below indicates the current version of this Privacy Policy.

18 August 2026