Privacy policy

The controller within the meaning of Art. 4 (7) GDPR is:

For any data protection question and to exercise your rights, you can reach us – including our data protection contact – using these details.

Unity Hub runs on the Microsoft Azure cloud platform. Whenever you open a page, our server necessarily processes your IP address, the date and time, the requested address, your browser identifier (user agent), your preferred language and the status and size of the response. We need this data to deliver the pages, to keep the service stable and secure and to fend off abuse.

Event images are loaded directly into your browser from a Microsoft Azure file store. For technical reasons, Microsoft, as our processor, also receives your IP address and browser information when this happens.

Legal basis: Art. 6 (1) (f) GDPR (legitimate interest in secure and reliable operation).

Unity Hub only uses cookies and browser storage that are strictly necessary for the service you have explicitly requested (for example, to keep you signed in) or that store a setting you chose yourself. We do not use analytics, tracking or advertising cookies, we do not embed third-party content (such as videos, maps, social media plugins or external fonts) and we do not create usage profiles.

Under § 165 (3) TKG 2021 such cookies do not require consent, which is why we do not show a cookie banner. Where personal data is involved, the legal basis is Art. 6 (1) (b) GDPR (signing in to and using your account) or Art. 6 (1) (f) GDPR (remembering your display settings).

You can delete or block cookies in your browser at any time, but you will not be able to sign in without the necessary ones. The following entries are used:

• uh_sessionCookieStrictly necessary

  Purpose

  Keeps you signed in. Contains your encrypted sign-in credentials (access tokens); not readable by scripts.

  Duration

  Until you sign out; ends after 14 days without use and after 30 days at the latest.

  Provider

  Unity Hub itself – never shared with third parties

• uh_oidcCookieStrictly necessary

  Purpose

  Protects signing in with an organisation account via Microsoft (encrypted security check for the redirect). Only set during that sign-in.

  Duration

  10 minutes; deleted immediately after sign-in.

  Provider

  Unity Hub itself – never shared with third parties

• uh_pkCookieStrictly necessary

  Purpose

  Protects signing in with a passkey (encrypted intermediate sign-in state). Only set during that sign-in.

  Duration

  5 minutes.

  Provider

  Unity Hub itself – never shared with third parties

• unityhub.resendTokenunityhub.resendUntilSession storageStrictly necessary

  Purpose

  Remembers how long you have to wait before requesting another code, so that it survives a page reload.

  Duration

  Until you close the browser tab.

  Provider

  Unity Hub itself – never shared with third parties

• uh_localeCookiePreference

  Purpose

  Remembers the language you last used (German or English) if it differs from your browser's language setting.

  Duration

  Until you close the browser.

  Provider

  Unity Hub itself – never shared with third parties

• uh_themeCookiePreference

  Purpose

  Stores the appearance (light, dark or system) you chose yourself in the appearance menu. Only set when you choose one.

  Duration

  1 year from your last choice.

  Provider

  Unity Hub itself – never shared with third parties

If you sign in with an organisation account, we redirect you to Microsoft (login.microsoftonline.com). Microsoft sets its own cookies there, which are governed by Microsoft's privacy terms.

You need an account to sign up for events. For this we process:

• your email address (required; it is also your user name)
• one-time codes and sign-in links that we email to you (valid for only a few minutes and not stored)
• optionally, passkeys: the public key, identifier and name you gave the passkey, plus when and how often it was used. Biometric features such as your fingerprint or face never leave your device and are not processed by us.
• sign-in sessions: when a session started, expires or ended, and the IP address it was started from (so that we can detect abusive sign-ins; deleted 30 days after the session ends)
• security data such as failed sign-in attempts and temporary account lockouts

Staff of HOSI Wien and its partner organisations sign in with their organisation account via Microsoft Entra ID. Microsoft then provides us with your account and organisation identifiers, your email address and your given, family and display names; these are refreshed at every sign-in. If your organisation is registered in Unity Hub, you are automatically listed as one of its members.

Legal basis: Art. 6 (1) (b) GDPR (providing the account you asked for); for security data and IP addresses, Art. 6 (1) (f) GDPR (protecting your account and our service).

In your profile you can enter your given name, family name, a chosen name, your date of birth, your phone number and a profile picture. Given name, family name, date of birth and phone number are required to sign up for events; some roles also require a profile picture. We use these details to recognise you at events, to reach you if needed and to comply with age limits.

Your profile picture is stored in our database and is not publicly accessible. Besides you, only the administrators of organisations you have signed up with can see it (see “Event sign-ups”).

Legal basis: Art. 6 (1) (b) GDPR (organising your volunteer work).

When you sign up for a shift, we store the shift, the status of your sign-up (e.g. confirmed, waitlisted, cancelled), the time, your message to the organising team and the history of all status changes. If the organising team rejects a sign-up, we store the reason they chose and any message to you; you see both under "My registrations" and in the email about it.

The administrators of the organisation running the event see your name (your chosen name, otherwise your given and family name), your email address, the status of your sign-up, your message and their own internal notes about it. As soon as you have signed up for an event of an organisation (in any status), its administrators – and only those of that organisation – can also open your profile: your name, email address, phone number, date of birth and age, your profile picture, your sign-ups with that organisation and any exclusion. They use this to check requirements such as a minimum age or a profile picture before confirming a sign-up. An administrator's decision on your profile picture or on a requirement that cannot be checked automatically (e.g. a training) is stored for that organisation together with an optional note. A picture approval only applies to the picture that was reviewed; if you upload a different one, it is reviewed again. If an administrator does not accept your picture, we email you the reason. Each time an administrator opens your profile page, we record which organisation did so and when; you can see this in your data download (without the administrator's name). Administrators can also download the sign-ups of an event as a CSV file. It lists everyone who signed up with the data above (name, email address, phone number, date of birth and age, your message, the organisers' notes and the status of your requirements). For each person in such a download we record, as for a profile view, which organisation did it and when, and you see it in your data download. Once downloaded, the file is no longer under the app's control; the organisation is responsible for handling it confidentially and deleting it when it is no longer needed. Other organisations and other users cannot see your profile.

To ensure events run safely and smoothly, an organisation can exclude people from signing up for its events. In that case we store the person concerned, the reason and the person responsible.

Only information about the event itself is public (visible without signing in) – such as its description, image, contact address and the number of open spots – never the names of people who have signed up.

Legal basis: Art. 6 (1) (b) GDPR; for exclusions and internal notes, Art. 6 (1) (f) GDPR (safe and orderly running of events); for the record of profile views and downloads, Art. 6 (1) (f) GDPR (accountability and protection against misuse).

When you sign up, Unity Hub automatically checks whether you meet the requirements of the role – such as a minimum age (calculated from your date of birth as of the day of the shift), a complete profile or a profile picture –, whether the shift still has open spots (otherwise you are put on the waitlist), whether it overlaps with another of your shifts and whether an exclusion applies.

These are fixed rules that are visible to you; no profiling takes place. There is no automated decision with legal or similarly significant effects within the meaning of Art. 22 GDPR. Before confirming a sign-up, the organisation's administrators see how you meet each requirement (e.g. your age on the day of the shift). Some requirements – such as your profile picture or a training – have to be confirmed by them; a sign-up cannot be confirmed while a mandatory requirement is not met. Rejections are always decided by a person. If the organisation has set an event to confirm its members automatically, your sign-up is confirmed right away when you are a member of the organisation running the event and meet every mandatory requirement (including those an administrator has to confirm); this works in your favour and never excludes you. If you do not meet a requirement or are not a member, a person still decides. The organisation can likewise set that members who meet every mandatory requirement move up the waitlist before others.

If you believe a check wrongly excludes you, please contact the organising team or us.

Unity Hub does not ask for information about your sexual orientation, gender identity, health or any other special category of personal data. However, because HOSI Wien is an LGBTIQ advocacy organisation, the mere fact that you volunteer with us may allow conclusions to be drawn about such matters.

We therefore process your data solely in the course of our statutory activities as a non-profit association (Art. 9 (2) (d) GDPR), treat it confidentially and do not disclose it to anyone outside HOSI Wien and the organisation running the event without your consent.

Please do not enter sensitive information that is not needed for the event in free-text fields such as messages to the organising team.

We only send service emails that result from your own actions or from decisions made by event organisers:

• sign-in codes and links, and confirmation codes when you change your email address
• notices about security changes to your account (changed email address, added or removed passkey, deleted account)
• messages about your shift sign-ups: receipt, waitlist, moving up, confirmation, rejection including the reason, cancellation, withdrawal, and changes to or cancellation of an event. They include a calendar entry (.ics file) for the shift.
• a notice if an administrator of an organisation does not accept your profile picture, with the reason they gave and a link to your account.
• a reminder two days before a confirmed shift (with the calendar entry); you can turn it off under "Notifications", and we keep that setting until you delete your account.
• messages from the administrators of an event you have signed up for. They only concern that event and may be personalised with your name and your shifts and may include file attachments added by the administrators and a calendar file with your shifts. Personal files (e.g. a certificate) may be attached too; they go only to you and are sent only after the administrators confirmed that they are meant for you. Administrators can only reach people registered for their event; they see whether the message was delivered to you. You can read these messages of the last 90 days again under "My messages" in your account.
• summaries for administrators of an organisation (only for you as an administrator): weekly on Mondays at 7:00 or daily, sent only when there is something to report. They contain numbers and shifts (open sign-ups, what is new, shifts needing people), no names of volunteers. If you turn it on under "Notifications", you also get a message right away when a sign-up needs approval. You set the frequency or turn them off under "Notifications"; we keep this setting until you delete your account.

Replies to messages about an event go to the address stored for that event or organisation. The language of these messages follows your preferred language; we store it when you sign in and you can change it under "Notifications". Unity Hub does not send newsletters or advertising.

Emails are sent via Amazon Simple Email Service (Amazon SES) of Amazon Web Services in Frankfurt am Main (Germany); this involves your email address and the content of the message. The delivery service tells us whether a message was delivered or bounced; for bounced addresses we only keep an irreversible check value (hash) so that we do not write to them again. We do not track whether or when you open an email or click a link. Organisations can show the logo they uploaded to us in their emails. It is loaded from our storage (Microsoft Azure, EU) once your mail program loads images, which technically transmits your IP address and the time of the request (you can switch image loading off in your mail program). We do not store or evaluate these requests and do not use them to tell whether you opened an email. Sign-in links contain your email address and a short-lived code, so please do not forward them.

Legal basis: Art. 6 (1) (b) GDPR.

To prevent mass sign-in attempts or requests, we limit the number of requests per IP address or per account. The IP address is only held briefly in memory for this. So that codes cannot be requested endlessly, we store an irreversible hash of your email address for 60 seconds after each email.

Legal basis: Art. 6 (1) (f) GDPR (protecting our service and your account).

To detect errors and monitor availability and response times, we use Microsoft's Azure Application Insights on the server. It records technical data about requests, errors and response times, including the requested addresses. Parameters in addresses – such as the email address and code in sign-in links – are removed before transmission. Microsoft truncates the IP address by default. No code runs in your browser for this and no cookies are set.

Legal basis: Art. 6 (1) (f) GDPR (legitimate interest in a stable, error-free service).

Your data is only available to those who need it for the purposes described:

• responsible staff and administrators of HOSI Wien
• the administrators of the organisation running an event, if you sign up for it (see “Event sign-ups”)
• Microsoft Ireland Operations Limited, One Microsoft Place, South County Business Park, Leopardstown, Dublin 18, Ireland, as processor for hosting, database, file storage, organisation-account sign-in and error diagnostics (Microsoft Azure). A data processing agreement pursuant to Art. 28 GDPR is in place with Microsoft.
• Amazon Web Services EMEA SARL, 38 Avenue John F. Kennedy, L-1855 Luxembourg, as processor for email delivery (Amazon SES). A data processing agreement pursuant to Art. 28 GDPR is in place with Amazon Web Services.

We only pass data to other third parties where we are legally obliged to. We do not sell data.

We process your data in data centres in the European Union. For maintenance and support, Microsoft may in individual cases access data from third countries, in particular the USA. Microsoft Corporation is certified under the EU-U.S. Data Privacy Framework, for which the European Commission has adopted an adequacy decision (Art. 45 GDPR); in addition, the European Commission's standard contractual clauses apply (Art. 46 (2) (c) GDPR).

Emails are processed in Amazon Web Services data centres in Frankfurt am Main. Here too, Amazon.com, Inc. may in individual cases access data from the USA for maintenance and support; Amazon is certified under the EU-U.S. Data Privacy Framework (Art. 45 GDPR), and the standard contractual clauses apply in addition (Art. 46 (2) (c) GDPR).

• We keep account and profile data, your profile picture, passkeys and event sign-ups until you delete your account. You can do this yourself at any time under “My account”; this also permanently deletes your sign-in sessions, memberships and event sign-ups including their history.
• Decisions of administrators on your profile picture or on requirements are kept until you delete your account and are deleted with it. The record of who opened your profile is deleted after 12 months.
• A sign-in session ends after 14 days without use and after 30 days at the latest. Session records (including the IP address) are deleted automatically 30 days after the session ends.
• In the change history of other records (e.g. who confirmed a sign-up), only a random identifier without name or email address remains after your account is deleted.
• One-time codes are valid for a few minutes; the resend cooldown lasts 60 seconds.
• For every email sent we keep a delivery record (recipient address, type of message, status, time) for 12 months; subject and content of queued messages are deleted 90 days after sending. Sign-in codes and links are never stored. The check value of a bounced address is deleted after 12 months. The record that a message reached you (without its content) is deleted 12 months after sending. File attachments and personal files of messages are stored without public access and deleted 90 days after sending.
• Technical diagnostic data is deleted after the retention period configured in Azure (90 days by default).
• Statutory retention obligations remain unaffected.

Under the GDPR you have the right to:

• access the data stored about you (Art. 15)
• have inaccurate data rectified (Art. 16)
• erasure (Art. 17)
• restriction of processing (Art. 18)
• data portability (Art. 20)
• object to processing based on our legitimate interests (Art. 21)

You can do much of this directly in your account: edit your profile, delete your account and download a complete copy of everything stored about you in a machine-readable format (JSON) – account data, profile picture, passkeys, sign-in sessions, memberships, event sign-ups including notes and history, and exclusions. For anything else, write to us using the contact details above. We will respond within one month (Art. 12 (3) GDPR).

Go to “My account”

If you believe that we are not processing your data lawfully, you can lodge a complaint with the supervisory authority. In Austria this is:

Your email address is required to create an account. Profile details are voluntary but are needed to sign up for events. There is no legal obligation to provide us with data, but without it you can only use Unity Hub to a limited extent.

We update this privacy policy whenever Unity Hub's features or the legal situation change. The version published here applies; you can see the date of the last change at the top.