Upload photos & videos

Guest uploads – privacy information (English)

This is an English version of the section "Gäste-Uploads" (guest uploads) of our privacy policy. The German version at laviesta.at/datenschutz is authoritative.

For guest uploads, the more specific information in this section applies and, to that extent, takes precedence over the general information in the sections "Übermittlungen in Drittländer" (transfers to third countries), "Löschung von Daten" (erasure of data) and "Verwendung von Foto und Videomaterial" (use of photo and video material) of the German privacy policy. In all other respects, visits to the upload page itself are treated in the same way as visits to all pages of this website.

What this is about: At our events, you can send us photos and videos via the upload page laviesta.at/en/upload (German: laviesta.at/upload), without an account or login. The upload page is linked in the footer of our website; you do not need a code. You can upload from the start of an event until 30 days after it ends. If uploads are open for several events, you choose your event on the upload page. We share selected recordings on laviesta.at and on our Instagram, Facebook and TikTok accounts.

Controller: Alexander Bergbauer (La Viesta), Kaasgrabengasse 121A, 1190 Vienna, Austria, email: office@laviesta.at.

Data we process:

• the photos and videos you upload, including the metadata stored in them (e.g. time of recording, device and, if your device stored it, location data), and the original file name;
• images and sound recordings of people who can be seen or heard in the photos and videos. We receive these data from the guests who upload the recordings;
• your optional details: name and Instagram name;
• the record of your consent: time, version of the consent text and language;
• technical details for each file on our website: event, upload number, size, file type, times and status of the upload, without name, Instagram, file name or IP address;
• connection data (IP address, browser and device details, time) when you open the upload page, when your browser sends control requests to our website and when you upload to Google. To prevent misuse, the upload function does not store your IP address in plain text. It stores only a pseudonymised short value (a hash with a random key generated anew each day), and only in counters that expire after 48 hours at most.

What we use the data for:

• receiving and storing your photos and videos;
• sharing selected recordings on laviesta.at and on our Instagram, Facebook and TikTok accounts to document and promote our events (see also the section "Zweck der Verarbeitung" of the German privacy policy);
• naming or tagging you when we share your recordings, if you gave your name or Instagram;
• handling withdrawals of consent, objections and deletion requests (matched via the upload number);
• providing the upload function and protecting it against misuse and overload.

Legal bases:

• your consent (Art. 6(1)(a) GDPR), given via the tick box on the upload page: for storage with Google, including the connection data passed to Google in the process, for sharing the recordings and for your optional details. The rights of use in the recordings are governed by the section "Gäste-Uploads" of our terms and conditions;
• people who can be seen or heard in uploaded recordings but did not upload them themselves: our legitimate interest in documenting and promoting our events (Art. 6(1)(f) GDPR). Everyone who uploads also confirms that they will not upload anything that shows someone in an embarrassing or humiliating way. This is a safeguard, not a legal basis. On the right to object, see below;
• providing the upload page, control requests to our website, protection against misuse and overload, and the technical details: our legitimate interest in a secure, working upload function (Art. 6(1)(f) GDPR);
• handling withdrawals, objections and deletion requests: legal obligation (Art. 6(1)(c) in conjunction with Arts. 12, 17 and 21 GDPR).

Storage location and recipients:

• Google (where the files are stored): the files go directly from your browser to Google (connection to www.googleapis.com). They are stored in a private folder with Google (Google Drive). Google stores everything uploaded: the files, file names and file descriptions (containing the upload number, the record of consent and, if given, name and Instagram). During the upload, Google technically receives your IP address, browser details and the time. The provider of Google Drive for users in the European Economic Area is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. Google operates servers worldwide, so data may also be processed outside the EU, in particular in the USA. For guest uploads, any transfer to Google LLC (USA) is based on the European Commission's adequacy decision for the EU-U.S. Data Privacy Framework (Art. 45 GDPR), under which Google LLC is certified. More information is in Google's privacy policy: policies.google.com/privacy.
• Access to the Google account: the upload function of our website uses the Google Drive interface only with the "drive.file" permission. It can therefore only see and create the folders and files it has created itself, not the other contents of the account. It does not pass any data from the Google account on to third parties.
• Web hosting (GoDaddy): the upload page and the short control requests (start and completion of each file) run via our web server at GoDaddy. Name, Instagram and file name travel with the control requests via our web server (and Cloudflare) to Google; our upload function passes them only to Google and does not store them on our server. The files themselves go directly to Google. The provider is GoDaddy.com, LLC, 100 S. Mill Ave, Suite 1600, Tempe, AZ 85281, USA, which processes the data on our behalf (Art. 28 GDPR). In doing so, the web server creates logs of requests (e.g. with IP address and time), which GoDaddy manages. GoDaddy does not state a fixed retention period for these logs for our hosting plan; under the contract, GoDaddy is required to store and dispose of logs in a controlled way. GoDaddy keeps backup copies of our website for up to 30 days; after that they are overwritten. According to our hosting plan, the website and database are located in GoDaddy's "Europe" region. Data may also be processed in the USA; this is covered by the adequacy decision for the EU-U.S. Data Privacy Framework (Art. 45 GDPR), under which GoDaddy.com, LLC is certified.
• Cloudflare: the network and security service Cloudflare sits in front of our website. It forwards every request to the website and processes the IP address and request data in doing so (for the control requests, this includes name, Instagram and file name). The files themselves do not pass through Cloudflare. Cloudflare (Cloudflare, Inc., 101 Townsend St., San Francisco, CA 94107, USA) is engaged for this by our host GoDaddy; we have no contract of our own with Cloudflare. Cloudflare may process data outside the EU, in particular in the USA; this is covered by the adequacy decision for the EU-U.S. Data Privacy Framework (Art. 45 GDPR), under which Cloudflare, Inc. is certified. Neither Cloudflare nor GoDaddy states a fixed retention period for this connection data for our hosting plan.
• Publication: recordings that we share are publicly visible. On Instagram, Facebook and TikTok, the platform operators also process the content (see the section "Onlinepräsenzen in sozialen Medien" of the German privacy policy).
• Other guests have no access to the uploads. There is no public gallery and no sharing link to the folder.
• Files that Google flags as harmful are automatically moved to a blocked subfolder. They are neither opened nor shared.

Technically necessary entries in your browser: so that an interrupted upload can continue (e.g. after a loss of signal or if your phone reloads the page), the upload function stores the following in your browser:

• for each file currently being uploaded, an entry in the browser's local storage ("localStorage"). It contains the upload address at Google that is valid only for this one file (valid for one week at most), the upload number, the file's sequence number and a check value. It is stored under a check value (hash) derived from the file name, size and modification time, and contains no name, no Instagram and no readable file name. The upload function removes the entry as soon as the file is complete. It removes other entries the next time the upload page is opened if they are older than six days. If you do not open the upload page again, the entry stays until you delete it in your browser settings; by then, the upload address in it has long been invalid.

You can delete these entries at any time in your browser settings. They are strictly necessary for the upload function you requested, so no separate consent is required (section 165(3) of the Austrian Telecommunications Act 2021, TKG 2021).

Retention:

• photos and videos that we select for sharing, together with name and Instagram: until you withdraw your consent, someone objects or the purpose no longer applies;
• all other photos and videos, including files in the blocked subfolder: until you withdraw your consent or someone objects, and no longer than 12 months after the event;
• record of consent (time, version, language): in the file description at Google, for as long as the file;
• technical details of the uploads on our website: 180 days, after which only aggregated figures without upload numbers are kept;
• pseudonymised IP short values and daily keys: 48 hours at most;
• the encrypted upload address of a file on our server: until the upload is complete or cancelled (about 8 days at most);
• entries in your browser: see above.

Voluntary: uploading is voluntary, as is giving a name and Instagram. Uploading is not possible without ticking the consent box.

Right to object (Art. 21 GDPR): where we process data on the basis of our legitimate interest (see "Legal bases"), you may object at any time on grounds relating to your particular situation, informally by email to office@laviesta.at. If you can be seen or heard in an uploaded recording, an informal objection without giving reasons is enough: we will then stop sharing the recording and delete it.

Your rights, withdrawal and deletion: you have the right of access, rectification, erasure, restriction, data portability, objection and withdrawal of consent, and the right to lodge a complaint with the Austrian Data Protection Authority (section "Rechte der betroffenen Personen" of the German privacy policy). You can withdraw your consent at any time with effect for the future. Processing carried out on the basis of your consent before its withdrawal remains lawful (Art. 7(3) GDPR).

• Withdrawals, objections and deletion requests can be sent informally by email to office@laviesta.at, ideally quoting the upload number shown after the upload (e.g. AB12-CD34). This lets us find the files without asking for further data. Without the upload number, the event, the approximate time and, if given, name or Instagram will help.
• We reply without undue delay and within one month at the latest (Art. 12(3) GDPR). After a withdrawal, an objection or a deletion request, we permanently delete the files concerned with Google (Google Drive), stop sharing them and remove posts containing them from our accounts. Where we have made a recording public, we take reasonable steps to inform other controllers processing it of the deletion request (Art. 17(2) GDPR). Beyond that, copies that third parties have already passed on are outside our control.

No automated decision-making: the upload function does not make any automated decisions within the meaning of Art. 22 GDPR.