Privacy Policy

for the Whistleblower System at the University of Klagenfurt

Duty to inform pursuant to Art. 13 GDPR


Data subjects

a)      Whistleblowers who disclose their identity
b)     Persons named in the whistleblowing report
c)      Staff members of the internal reporting unit


Purpose of data processing
We process your data for the purpose of complying with the legal requirement to create an internal system that allows (former) employees to report internal breaches of certain legal provisions relating to Union law while maintaining confidentiality.


Data categories
  • Whistleblowers who disclose their identity: Name, title/academic degree, position and function in the organisation, contact details (telephone, e-mail, address, other contact details), content of the report, communication data
  • Persons named in the whistleblowing report: Name, title/academic degree, position and function in the organisation, contact details (telephone, e-mail, address, other contact details), content of the report, measures taken
  • Staff members of the internal reporting unit: Name, title/academic degree, position and function in the organisation, contact details (telephone, e-mail, address, other contact details), content of the report, communication data


Legal basis
The processing of the data is based on the legal obligation of the University of Klagenfurt pursuant to Art. 6 para. 1 lit c GDPR: 
  • DIRECTIVE (EU) 2019/1937; 
  • Whistleblower Protection Act - HSchG, Federal Law Gazette I No. 6/2023; 
  • Policy issued by the Rectorate of the University of Klagenfurt (in preparation).


Data recipients

Internal recipients

  1. Central units (e.g., Financial Directorate; Procurement; Health Management, Occupational Health and Safety & Accessibility), who are consulted by the internal unit to verify the validity of the information – have a confidentiality obligation in accordance with Article 6 HSchG;
  2. Rectorate for the purpose of determining follow-up measures;


External recipients

  1. External experts (e.g., auditors, lawyers) who are consulted by the internal unit to assess the validity of the report;
  2. Courts, administrative authorities in the case of (administrative) criminal offences or proceedings before employment tribunals


Data storage duration
We store your data for 5 years from the time of collection in accordance with Article 8 HSchG, and beyond that period, when this is necessary for administrative/judicial proceedings or investigative proceedings in accordance with the Austrian Code of Criminal Procedure (StPO).


Rights of data subjects as defined in Article. 12 et seq. of the GDPR
As a matter of principle, you have the right to information, rectification, erasure, restriction, data portability and objection. If you believe that the processing of your data breaches data protection law or your data protection rights have otherwise been infringed in any way, you can lodge a complaint with our data protection officer via the e-mail address dsb@aau.at or with the Austrian Data Protection Authority: www.dsb.gv.at/kontakt.

In accordance with Article 8 (9) HSchG, the rights under Articles 13 to 18, 21, 34 GDPR of the person affected by a report do not apply. These rights are: The right to information, access, rectification, erasure, restriction, objection and the right of the person concerned to be notified of a personal data breach. 


Persons responsible for data protection
The Rectorate of the University of Klagenfurt is responsible for data processing, 9020 Klagenfurt a.W., Universitätsstraße 65-67, Austria; rektorat@aau.at. 


Data Protection Officer
You can contact the Data Protection Officer of the University of Klagenfurt at: dsb@aau.at.