Privacy Policy

Creative Science – Privacy Policy (GDPR)

Last updated: 04.01.2026

1. Data Controller

The data controller responsible for the processing of personal data is:

creativescience.at – Viktoria Felcser
Address: Herbeckstraße 73/14, 1180 Vienna, Austria
Email: creativescience.at@gmail.com
Phone: +43 677 64116971
VAT ID: ATU80771835
IBAN / Account number: AT95 1200 0100 4011 9942

2. Scope of This Policy

This Privacy Policy applies to:

• the website www.creativescience.at

• camp registration and participation

• communication with parents/guardians

3. Hosting and Website Platform (Google Sites)

This website is created and hosted using Google Sites, a service provided by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland.

When visiting this website, certain technical data may be processed by Google, including:

• IP address

• device and browser information

• usage data

Google may process data on servers within the European Union and, where applicable, in third countries.

Google acts as a data processor and may also act as an independent controller for certain services.

For more information, please refer to:
https://policies.google.com/privacy

4. Categories of Personal Data

We may process the following categories of personal data:

Child’s data:

• Name

• Age / date of birth

• Relevant health information (e.g. allergies, medical conditions)

• Participation data

Parent/Guardian data:

• Name

• Email address

• Phone number

• Billing information

Technical data:

• IP address

• browser type

• access logs (via Google services)

5. Purpose of Data Processing

Personal data is processed for the following purposes:

• administration of camp registrations

• communication with parents/guardians

• ensuring participant safety (including medical information)

• compliance with legal obligations

• handling payments and invoicing

• operation and security of the website

6. Legal Basis (Art. 6 GDPR)

Processing is based on:

• Art. 6(1)(b) – performance of a contract

• Art. 6(1)(c) – compliance with legal obligations

• Art. 6(1)(f) – legitimate interests (organization, safety, communication)

• Art. 6(1)(a) – consent (photos, sensitive data)

7. Special Categories of Data (Art. 9 GDPR)

Health-related information is processed only:

• where strictly necessary for the safety of the child

• based on explicit consent of the parent/guardian (Art. 9(2)(a) GDPR)

8. Data Sharing

Personal data will not be sold or disclosed to third parties except:

• where required by law

• to emergency services (if necessary)

• to service providers (e.g. payment providers), strictly limited and GDPR-compliant

Google (as hosting provider) processes technical data as described above.

9. International Data Transfers

Some data processing by Google may involve transfers outside the EU/EEA.

Such transfers are based on:

• Standard Contractual Clauses (SCCs)

• or other GDPR-compliant safeguards

10. Data Retention

Personal data is retained only as long as necessary:

• registration and participation data: up to 3 years

• invoicing data: as required by Austrian tax law (typically 7 years)

• health data: deleted immediately after the camp, unless required for legal reasons

11. Photos and Media

Photos and videos of participants:

• are only taken with explicit prior consent

• may be used for marketing (website, social media)

Consent may be withdrawn at any time with future effect.

12. Data Subject Rights

Under GDPR, you have the right to:

• access your personal data (Art. 15)

• rectification (Art. 16)

• erasure (“right to be forgotten”, Art. 17)

• restriction of processing (Art. 18)

• data portability (Art. 20)

• object to processing (Art. 21)

• withdraw consent at any time (Art. 7(3))

Requests can be sent to:
creativescience.at@gmail.com

13. Data Security

Appropriate technical and organizational measures are implemented to ensure:

• confidentiality

• integrity

• availability of data

14. Cookies

This website uses essential cookies provided by Google Sites for functionality and security.

No additional tracking or marketing cookies are actively used by the Organizer.

15. Supervisory Authority

You have the right to lodge a complaint with:

Austrian Data Protection Authority (DSB)
Barichgasse 40–42
1030 Vienna, Austria
https://www.dsb.gv.at

16. Changes to This Policy

The Organizer reserves the right to update this Privacy Policy.

The latest version will always be available on the website.