BONUS Vorsorgekasse AG, Traungasse 14-16, 1030 Vienna.
Email: kundenservice@bonusvorsorge.at

BONUS Vorsorgekasse has appointed a data protection officer who is available to answer your questions regarding the processing of personal data at datenschutz@bonusvorsorge.at.

Employers must pay contributions for their employees in accordance with § 1 BMSVG and enter into a membership agreement with a pension fund in accordance with §§ 9–11 BMSVG.

Self-employed individuals must pay pension contributions for the self-employed in accordance with Section 49 of the BMSVG if they are subject to mandatory insurance under Section 2 of the GSVG, and must enter into a membership agreement with a pension fund. In addition, freelancers may voluntarily pay contributions to the self-employed pension scheme in accordance with Section 64 of the BMSVG.

As the data controller, we process the personal data reported by the Main Association for the purpose of executing and administering the contract. This includes name, date of birth, social security number, address, email address, gender, marital status, and bank account information.

As a pension fund, we are required under the Financial Market and Money Laundering Act to fulfill due diligence obligations to prevent money laundering and terrorist financing. We also process your personal data for this purpose.

We collect only the necessary data; this means that, in some cases, less information than that described above may suffice.

• Contract initiation, administration, and performance: Article 6(1)(b) of the GDPR

We process your personal data to provide our services in connection with the performance of the underlying contracts.

• Processing Based on Legal Obligations: Article 6(1)(c) of the GDPR

We process your personal data to comply with legal obligations such as the BMSVG, regulatory requirements, and corporate and tax law retention obligations.

• Processing Based on Your Consent: Article 6(1)(a) of the GDPR

If you have given us your consent to process your personal data, such processing will take place only in accordance with the purposes specified in the consent form and to the extent agreed therein.
Consent may be withdrawn at any time without providing a reason. Withdrawal does not affect the lawfulness of processing carried out on the basis of consent prior to its withdrawal.

Please note that the provision of personal data is necessary for compliance with contractual or legal obligations or for the conclusion of a contract. If you do not provide this data, we may have to refuse to conclude a contract or may no longer be able to fulfill existing contractual obligations.

The administration of employee and self-employed pension plans by pension funds is governed by the Occupational Employee and Self-Employed Pension Act (BMSVG).

The pension fund receives the data directly from the Main Association of Social Security Institutions. Self-employed individuals establish their own pension plans by signing a contract themselves.

To the extent necessary or appropriate for the performance of the contract, BONUS transfers data to external recipients, such as processors within the meaning of the GDPR (e.g., IT service providers, printing companies). All data processors are contractually obligated to treat your data confidentially and to process it only for the purpose of providing services.

In addition, we may transfer your personal data to other recipients, such as government agencies to fulfill legal reporting obligations or courts.

We will retain your data only for as long as is necessary for the purposes for which it is processed. We will delete your personal data as soon as it is no longer necessary for the aforementioned purpose.

However, personal data may be retained for a period of time to assert or defend against claims. The statutory limitation periods are up to thirty years.

We do not use automated decision-making or profiling.

We only use cookies that are technically necessary for you to visit our website.

When you visit our website, the browser on your device automatically sends information to our website’s server. This information is temporarily stored in a so-called log file. The following information is collected automatically without any action on your part and stored until it is automatically deleted after 90 days:　

• IP address　
• Date and time of the request　
• Content of the request (specific page)　
• Access status / HTTP status code　
• Amount of data transferred　
• Website from which the request originated　
• Browser type and version　
• Operating system and its user interface　
• Language and version of the browser software　
• Name of the website accessed　
• Confirmation of successful retrieval　
• We process the aforementioned data for the following purposes:　
• To ensure a smooth connection to the website　
• Ensuring system security and stability, as well as　
• other administrative activities　

The legal basis for data processing is Article 6(1)(f) of the GDPR. Our legitimate interest stems from the purposes listed above for data collection. Under no circumstances do we use the collected data to draw conclusions about your identity.

Under Articles 15 through 22 of the GDPR, you have the following rights with respect to the data controller:

Rights to access, rectification, erasure, restriction of processing, and objection to the processing of your data in accordance with the requirements of data protection law.

Data subjects must identify themselves and provide the necessary information to ensure that the response is addressed to the actual data subject. To do so, please include a copy of your identification document and a handwritten signature.

Furthermore, you have the right to lodge a complaint with the Data Protection Authority, as the supervisory authority, if you believe that the processing of your personal data is not lawful.

Austrian Data Protection Authority
Barichgasse 40-42
1030 Vienna
Tel.: +43 1 52 152-0
Email: dsb@dsb.gv.at