Definitions
Display Europe eG is the operator of the Cultural Broadcasting Archive („CBA“), an online database for the collection and online provision of media content especially of radio programmes of community media stations, podcasts, videocasts and articles. Users (“User”) have the possibility to store information (e.g. radio broadcasts) („Information“, individually a „Contribution“) in the database („Upload“) and thus make it available to the public via the internet („making available“). The operator stores the information entered by User without influencing the content of the Contributions and makes the information available online. This service is provided by the operator as hosting within the meaning of Section 16 of the E-Commerce Act („Hosting“).
Regarding the Information, User is obliged to adhere to the framework of the Journalism Trust Initiative (https://www.jti-app.com/footer/cwa) (Journalistic Principles) or a similar journalistic code of conduct (eg “Principle of journalistic conduct by the Austrian Press Council https://www.presserat.at/show_content.php?sid=3).
Scope
The following User Agreement applies to all Information stored by User in the CBA. The reproduction takes place in the interest and on the initiative of User, who makes the information available to the public on the internet. The operator provides User with the service of „Hosting“ as defined in Section 16 ECG. User has no right to permanent reproduction at a specific internet address; the operator may discontinue the service at any time. The operator is entitled to transfer the rights arising from this contract to any legal successors.
Use of works
1. User irrevocably grants the operator the non-exclusive, geographically and temporally unlimited, sublicensable and transferable right to use the Information for storage and reproduction on the internet or in communication networks, in particular to reproduce it, distribute it, transmit it wirelessly or by wire or to broadcast it and to make it available. The authorisation to use the Information includes services such as the dissemination of the information in streaming formats (time-bound as well as time-independent dissemination) or podcasting (dissemination via push services). Further, the authorization to use the information includes also the (automated) creation of transcripts, translations, indexing, enriching metadata and subtitles unless User opts-out from the latter. The granted rights don’t oblige operator to provide the mentioned services. The operator is furthermore entitled to process the information himself or through third parties and to exploit the processing to the same extent.
2. If the User opts-in to have the uploaded content also published directly at displayeurope.eu, User grants the same rights as granted to CBA as aforementioned in 1 also to Display Europe eG (displayeurope.eu).
3. CBA is member of a data space called European Cultural Backbone, where it exchanges metadata with other platforms and offers search and recommendations based on the pooled metadata. The operator is entitled to exchange (processed) Information/metadata in the data space unless and as soon as the User opts-out of the data space services.
3. The User grants third parties – unless the licence choice is CC BY anyway (see below) – the non-exclusive, geographically and temporally unlimited licence to reproduce the Information on the internet, on the radio and to make the copies required for this purpose for non-commercial use in accordance with the Creative Commons licence attribute NC in the currently valid version. The use of the information by third parties requires the naming of the User or the otherwise named rights holder. Furthermore, third parties may make copies for private use as defined by the Copyright Act.
4. If a contribution by the User is not marked otherwise, the Information stored by the User in the CBA is deemed to be licensed under the Creative Commons Licence BY in the version valid at the time of storage (currently 4.0 see https://creativecommons.org/licenses/by/4.0/legalcode).
Third party rights
The User declares that he/she has obtained all rights and consents of third parties required for the provision of the Information on the internet (in particular data protection, copyright, media law, e.g. for music, interview recordings, literature) and shall provide the operator with the relevant documentation upon request. Should the User become aware of circumstances that make the future public reproduction of the Information on the CBA platform impossible or inadmissible, he/she undertakes to inform the operator immediately. The operator will remove the Information in question from the database. Furthermore, the operator is entitled to remove the Information immediately if there are indications that the publication is illegal and/or infringes the rights of third parties. The removal or blocking of the Information is at the sole discretion of the operator, subject to legal requirements.
Liability
The operator of the CBA has no influence on the content of the Information. The User is solely responsible for the content of the Information, in particular under civil, criminal, data protection and media law. The User indemnifies and holds harmless the operator for all claims of third parties, e.g. due to infringement of copyrights and exploitation rights, personal rights, media rights or data protection rights, which are raised on the basis of the Information stored by the User.
Any liability of the operator for damages is excluded to the extent permitted by law and limited to the payments made by the Contractual Partner for the last financial year if any.
Terms of Use
User acknowledges that CBA provides its services according to the Terms of Use published on CBA’s website (“ToU”) which CBA may change from time to time. User undertakes to adhere to the ToU according to its latest published version.
Applicable law and place of jurisdiction
This User Agreement shall be governed by Austrian law to the exclusion of the conflict of laws rules and the UN Convention on Contracts for the International Sale of Goods. For consumers, this choice of law shall only apply to the extent that mandatory provisions of the law of the state in which the customer has his habitual residence do not apply. For all disputes or claims arising from or in connection with this User Agreement, the exclusive jurisdiction of the competent court in 1010 Vienna, Austria is agreed. For consumers, this shall only apply to those who, at the time the action is brought, neither have their domicile or habitual residence in Austria nor are employed in Austria.
Data processing
The User is the data controller („Controller“ or „Principal“) for the personal data associated with the upload, CBA is the processor („CBA“, „Processor“ or „Contractor“). For the present contractual relationship, the Controller and the Processor agree on the attached Processor Agreement.
Agreement on commissioned processing pursuant to Art 28 DSGVO
1. Subject matter of the agreement
-
The subject of this order is the performance of the following tasks: Hosting of the uploaded content and storage of the data entered in the database, as well as the (automated) creation of transcripts and translations. This data may be further processed by CBA to improve the service, in particular the search and to operate a suggestion system. This Processing Agreement is to be understood as a supplement to the User Agreement dated [date] („Main Agreement“). Other data collected or processed in any other way, in particular not in its functions defined in the underlying cooperation, are expressly not covered by the mandate of the Controller.
-
The following categories of data are processed by the Processor on behalf of the Controller: all personal data contained in the uploaded content (especially in video and audio files), such as name, images, voice, personal interests, political views and personal opinions, sexual orientation, professional and academic career, etc.
-
The following categories of data subjects are subject to the processing: Users, interviewees, moderators, other persons mentioned or represented in the uploaded content.
2. Duration of the agreement
This Processing Agreement shall enter into force upon its signature by both Parties and shall be concluded for the duration of the respective cooperation. In view of the nature and purpose of this Processing Agreement, the Parties agree that any termination or expiry of the validity of the Cooperation shall also result in the termination of this Processing Agreement and shall be accompanied by similar effects. This shall not apply to those provisions whose content or nature implies that they shall continue to apply after the termination of the Processing Agreement. This shall not affect the possibility of termination without notice for good cause. The Processor shall be entitled to terminate the Processing Agreement without notice for cause if the Controller insists on the performance of its instructions after having been informed by the Processor that its instructions are in breach of applicable legal requirements pursuant to clause 4.10. The Processor shall be entitled to terminate the Processing Agreement without notice for cause if the Controller insists on the performance of its instructions. In any event, any processing of personal data carried out on behalf of the Processor shall cease immediately upon the effective date of the termination.
3. Obligations of the Controller
1. The Controller shall be the data controller within the meaning of Art 4(7) GDPR with respect to any information pursuant to Section 1.2 of this Processor Agreement that relates to identified or identifiable persons within the meaning of Art 4(1) GDPR („personal data“) provided to the Processor in the course of the performance of the activities referred to in Section 1.1.
2. the Controller shall have the right and the obligation to take the decisions relating to the purposes and means of the processing of personal data.
3. the Controller is responsible, inter alia, for ensuring that there is a sufficient legal basis for the processing of personal data with which the Processor is entrusted
4. Obligations of the Processor
-
The Processor shall be a processor within the meaning of Art 4(8) GDPR with respect to any information pursuant to Section 1.2 of this Agreement that relates to identified or identifiable persons within the meaning of Art 4(1) GDPR („personal data“) that is provided to it in connection with the performance of the activities referred to in Section 1.1.
-
The Processor undertakes to process data and processing results during the performance of the activities described under item 1.1 exclusively within the scope of the Controller’s written orders. If the Processor receives an official order to release data of the Controller, the Processor shall – to the extent permitted by law – immediately inform the Controller thereof and refer the authority to the Controller. Similarly, processing of the data for the Processor’s own purposes requires a written order.
-
The Processor declares in a legally binding manner that it has obliged all persons entrusted with the data processing to maintain confidentiality prior to commencement of the activity or that they are subject to an appropriate legal obligation of confidentiality within the meaning of Art 28 (3) lit b DSGVO and Section 6 DSG. In particular, the confidentiality obligation of the persons entrusted with the data processing shall remain in force even after termination of their activity and leaving the Processor.
-
The Processor declares in a legally binding manner that it has taken sufficient measures to ensure the security of processing in accordance with Art 32 GDPR in order to prevent data from being used in an unlawful manner or from being made accessible to third parties without authorisation (for details, see Annex age ./1).
-
The Processor shall take the technical and organisational measures to ensure that the Controller can fulfil the rights of the data subject under Chapter III of the GDPR (duty to inform, right to information, right to rectification and deletion, data portability, objection, as well as automated decision-making in individual cases) within the statutory time limits at any time and shall provide the Controller with all information necessary for this purpose. If a request to this effect is addressed to the Processor and if the Processor indicates that the applicant mistakenly believes it to be the principal of the data processing carried out by it, the Processor shall immediately forward the request to the principal and inform the applicant accordingly. The Processor shall be entitled to reasonable remuneration for the assistance.
-
The Processor shall support the Controller in complying with the obligations set out in Art 32 to 36 GDPR (data security measures, prompt notifications of personal data breaches to the supervisory authority, notification of the person affected by a personal data breach, data protection impact assessment, prior consultation).
-
The Processor is advised that it must set up a processing directory for the present commissioned processing in accordance with Art 30 DSGVO.
-
With regard to the processing of the data provided by the Controller, the Controller shall be granted the right to inspect and control the data processing facilities at any time, including through third parties commissioned by the Client. The Processor undertakes to provide the Controller with the information necessary to monitor compliance with the obligations set out in this agreement.
-
The Processor is obliged to destroy all processing results and documents containing data on its behalf after termination of this Processing Agreement. CBA may, however, further process the data itself as a data controller in the public interest for archival purposes.
-
The Processor shall inform the Controller without undue delay if it believes that an instruction given by the Controller violates EU or Member State data protection provisions.
5. Place of performance of the data processing
All data processing activities are carried out exclusively within the EU or EEA.
6. Sub-processors
The Controller hereby grants the Processor general written authorisation pursuant to Art 28(2) GDPR to use other companies to carry out processing („Sub-Processors“). In particular, the Contractor shall involve the following companies as sub-processors: servus.at – Verein für Kunst und Kultur im Netz, Kirchengasse 4, 4040 Linz, technical support and Internet access; Peter Vratny proserver1.at – EDV-Dienstleistungen, Welser Strasse 91, A-4643 Pettenbach.
The Controller shall be notified in writing of any intended changes to the Sub-Processor in good time so that the Controller can prohibit this if necessary. However, the Controller shall only prohibit the commissioning for good cause. The Processor shall conclude the necessary agreements within the meaning of Art 28(4) GDPR with the Sub-Processor. In doing so, it shall be ensured that the Sub-Processor enters into the same obligations that are incumbent on the Processor on the basis of this Processing Agreement. If the Sub-Processor fails to comply with its data protection obligations, the Processor shall be liable to the Controller for compliance with the obligations of the Sub-Processor.
7. Final provisions
This Processing Agreement shall be governed by Austrian substantive law to the exclusion of the conflict of law rules.
Any amendments or additions to this Processing Agreement must always be made in writing.
In the event of any conflict, the provisions of this Processing Agreement shall prevail over the provisions of the cooperation or other previous agreements between the Controller and the Processor with respect to the activities listed in Section 1.1.