PRIVACY NOTICE
1. Introduction
The History of Art Academy ("the Academy", "we", "our" or "us") is committed to protecting your privacy and handling your personal information with transparency, integrity and care.
This Privacy Notice explains how we collect, use, store and protect personal information when you visit our Website, make a booking, communicate with us or participate in one of our educational programmes.
We recognise that privacy is an essential part of the relationship between the Academy and its participants and are committed to processing personal data responsibly and in accordance with applicable data protection legislation.
The Academy processes personal data in compliance with the General Data Protection Regulation (EU) 2016/679 ("GDPR"), the Austrian Data Protection Act (Datenschutzgesetz – DSG) and other applicable laws governing the protection of personal information.
Please read this Privacy Notice carefully before using our Website or booking a Course.
2. Scope of this Privacy Notice
This Privacy Notice applies to all personal information collected by the Academy through:
- our Website;
- online booking systems;
- email correspondence;
- newsletter subscriptions;
- enquiries submitted through our contact forms;
- participation in Courses, lectures and educational events;
- communications with the Academy;
- future online educational services.
This Privacy Notice applies regardless of whether our educational activities take place in museums, galleries, historic buildings, hotels, cafés, public spaces, online or at any other venue.
3. Who We Are
The History of Art Academy is an independent educational institution dedicated to the study and appreciation of art history, architecture, museums, collections and cultural heritage.
The Academy organises lectures, seminars, museum-based Courses, educational visits, walking programmes and other learning experiences designed to encourage close engagement with works of art and the built environment.
For the purposes of applicable data protection legislation, the History of Art Academy is the Data Controller responsible for the processing of your personal information.
4. Contact
If you have any questions regarding this Privacy Notice or the way your personal information is processed, you may contact the Academy using the contact details published on our Website.
Website:
The Academy will endeavour to respond to all privacy-related enquiries without undue delay.
5. Principles Governing the Processing of Personal Data
The Academy processes personal information in accordance with the following principles established under the GDPR.
Personal data shall be:
- processed lawfully, fairly and transparently;
- collected only for specified and legitimate purposes;
- limited to information that is relevant and necessary;
- kept accurate and, where appropriate, up to date;
- retained only for as long as necessary;
- protected through appropriate technical and organisational security measures.
The Academy does not collect personal information beyond what is reasonably necessary for the provision of its educational activities and the operation of its Website.
6. Information We Collect
Depending upon your interaction with the Academy, we may collect the following categories of personal information.
Identity Information
- This may include:
- your name;
- title;
- preferred form of address.
Contact Information
This may include:
- email address;
- telephone number;
- postal address (where applicable).
Booking Information
This may include:
- Courses booked;
- booking history;
- attendance records;
- booking confirmations;
- payment status.
Communication Information
When you contact the Academy, we may retain copies of correspondence, enquiries or other communications in order to respond effectively and maintain appropriate administrative records.
Technical Information
When you use our Website, certain technical information may automatically be collected, including:
- IP address;
- browser type;
- operating system;
- device information;
- referring website;
- pages visited;
- date and time of access.
Where cookies or analytics technologies are used, additional information may be collected as described in our separate Cookie Notice.
7. Information You Voluntarily Provide
You may choose to provide additional information when:
- submitting an enquiry;
- registering for a Course;
- subscribing to our newsletter;
- requesting information;
- participating in surveys;
- providing feedback;
- communicating with the Academy.
Providing such information is entirely voluntary.
However, certain information may be required in order to process a booking or respond to an enquiry.
8. Information We Do Not Intentionally Collect
The Academy does not intentionally collect special categories of personal data unless such information is voluntarily provided and reasonably necessary for a specific purpose, for example where accessibility arrangements are requested.
Participants are kindly requested not to provide unnecessary medical information or other sensitive personal information unless specifically requested by the Academy.
The Academy does not knowingly collect personal information from children under the age of sixteen without appropriate parental or legal guardian consent.
9. How We Use Your Personal Information
The Academy uses personal information only where necessary to fulfil legitimate educational and administrative purposes.
Depending upon your interaction with the Academy, your information may be used to:
- process Course bookings;
- administer payments;
- communicate practical Course information;
- respond to enquiries;
- provide customer support;
- maintain attendance records;
- improve our educational programmes;
- ensure the security of our Website;
- comply with legal obligations;
- protect the Academy's legitimate interests.
The Academy does not sell personal information to third parties.
Nor do we engage in automated decision-making or profiling that produces legal or similarly significant effects concerning participants.
Privacy Notice (Part II)
10. Legal Basis for Processing Personal Data
The Academy processes personal data only where a lawful basis exists under the General Data Protection Regulation (GDPR).
Depending on the circumstances, personal data may be processed on one or more of the following legal grounds:
Performance of a Contract
Where processing is necessary in order to fulfil a booking, provide a Course or otherwise perform our contractual obligations.
This includes, for example:
- processing Course registrations;
- issuing booking confirmations;
- communicating practical information relating to a Course;
- administering payments;
- providing educational services.
Compliance with Legal Obligations
Certain information may be processed where necessary to comply with applicable legal, accounting or taxation requirements.
Legitimate Interests
The Academy may process personal information where such processing is necessary for its legitimate interests, provided that these interests are not overridden by the rights and freedoms of the individual.
Examples include:
- improving the quality of our educational programmes;
- maintaining the security of our Website;
- responding to enquiries;
- preventing fraud or misuse;
- maintaining administrative records;
- protecting the Academy's legal rights.
Consent
Where required by law, the Academy will rely upon your consent before processing your personal information.
Consent may apply, for example, to:
- newsletter subscriptions;
- certain cookies;
- promotional communications;
- optional photography where appropriate.
Consent may be withdrawn at any time without affecting the lawfulness of processing carried out before its withdrawal.
11. Course Bookings
When you book a Course, the Academy processes the information necessary to organise and administer your participation.
This may include:
- your name;
- contact details;
- the Course selected;
- booking reference;
- payment status;
- any accessibility requirements voluntarily disclosed by you.
The Academy uses this information solely for purposes connected with the administration and delivery of the relevant educational programme.
12. Payments
Payments are processed through secure third-party payment providers.
The Academy does not ordinarily store complete credit or debit card information on its own systems.
Payment providers process personal and financial information in accordance with their own privacy notices and applicable data protection legislation.
Participants are encouraged to consult the privacy information published by the relevant payment provider.
13. Communications
The Academy may contact participants regarding matters directly connected with their bookings.
Such communications may include:
- booking confirmations;
- invoices and receipts;
- reminders;
- practical Course information;
- changes of venue;
- cancellations;
- timetable updates;
- important administrative notices.
These communications form an essential part of the contractual relationship and are not regarded as marketing communications.
14. Newsletters and Marketing Communications
Participants may choose to subscribe to the Academy's newsletter in order to receive information regarding:
- forthcoming Courses;
- lectures;
- educational programmes;
- special events;
- publications;
- other Academy news.
Where required by applicable law, newsletters are sent only with the recipient's prior consent.
Every newsletter contains a simple mechanism allowing recipients to unsubscribe at any time.
The Academy does not sell or rent mailing lists to third parties.
15. Website Analytics
The Academy continually seeks to improve the quality, accessibility and effectiveness of its Website.
To better understand how visitors use the Website, analytical tools may be employed to collect aggregated statistical information.
Such information may include:
- pages visited;
- duration of visits;
- navigation paths;
- browser type;
- operating system;
- approximate geographic region;
- referring websites.
Where analytics technologies rely upon cookies or similar technologies requiring consent under applicable law, such processing shall occur only after the necessary consent has been obtained.
Further information is available in the Academy's Cookie Notice.
16. Cookies and Similar Technologies
The Academy uses cookies and comparable technologies to enhance the functionality, security and performance of its Website.
Some cookies are strictly necessary for the operation of the Website.
Others help the Academy understand how visitors interact with the Website so that user experience may be continually improved.
Where legally required, non-essential cookies are activated only after visitors have provided their consent.
Comprehensive information regarding cookies is provided in the Academy's separate Cookie Notice.
17. Third-Party Service Providers
In order to operate efficiently, the Academy may engage carefully selected third-party service providers.
These providers may assist with services including:
- Website hosting;
- online booking systems;
- payment processing;
- email communications;
- newsletter distribution;
- cloud storage;
- website analytics;
- technical support.
Such providers process personal data only on the Academy's documented instructions and only to the extent necessary for the services they provide.
Where required by law, appropriate contractual safeguards are implemented to protect personal information.
18. Sharing Personal Information
The Academy treats personal information with the utmost confidentiality.
Personal data is not sold, traded or disclosed to third parties for commercial purposes.
Personal information may be shared only where necessary:
- with trusted service providers acting on behalf of the Academy;
- where required by law;
- where necessary to establish, exercise or defend legal claims;
- where required to protect the rights, safety or property of the Academy or others.
Whenever personal information is shared, the Academy seeks to ensure that appropriate safeguards remain in place.
19. International Transfers
Where personal information is transferred outside the European Economic Area (EEA), the Academy shall ensure that such transfers take place only where appropriate safeguards exist in accordance with the GDPR.
Such safeguards may include:
- adequacy decisions issued by the European Commission;
- Standard Contractual Clauses approved by the European Commission;
- other lawful transfer mechanisms recognised under applicable legislation.
The Academy endeavours to work with service providers that maintain high standards of privacy and information security.
20. Retention of Personal Information
The Academy retains personal information only for as long as reasonably necessary to fulfil the purposes for which it was collected.
Retention periods may vary depending upon:
- legal obligations;
- accounting requirements;
- contractual obligations;
- legitimate business needs;
- the protection of legal rights.
When personal information is no longer required, it will be securely deleted, anonymised or otherwise disposed of in accordance with applicable legal requirements.
21. Information Security
The Academy recognises the importance of protecting personal information against unauthorised access, disclosure, alteration or destruction.
Appropriate technical and organisational measures are implemented to safeguard personal data.
Such measures may include:
- secure hosting environments;
- encrypted communications where appropriate;
- restricted administrative access;
- password protection;
- regular software updates;
- internal procedures designed to minimise unauthorised access.
While the Academy takes reasonable steps to protect personal information, no method of electronic transmission or storage can be guaranteed to be completely secure.
Participants should therefore also take appropriate precautions when transmitting information electronically.
Privacy Notice (Part III)
22. Your Rights Under the General Data Protection Regulation (GDPR)
The Academy respects your rights regarding the protection of your personal information.
Subject to applicable law, you may have the right to:
- request access to the personal data we hold about you;
- request the correction of inaccurate or incomplete personal data;
- request the deletion of your personal data where there is no lawful basis for its continued processing;
- request the restriction of processing in certain circumstances;
- object to the processing of your personal data where processing is based upon the Academy's legitimate interests;
- withdraw your consent at any time where processing is based upon consent;
- request the transfer of your personal data to another organisation where technically feasible (data portability);
- lodge a complaint with a competent supervisory authority.
The exercise of these rights may be subject to certain legal conditions and limitations under the GDPR and applicable Austrian law.
The Academy will respond to requests concerning personal data without undue delay and, where possible, within one month of receiving the request.
23. Right to Withdraw Consent
Where the processing of personal data is based upon your consent, you may withdraw that consent at any time.
The withdrawal of consent shall not affect the lawfulness of any processing carried out before the consent was withdrawn.
Withdrawal requests may be submitted using the contact details published on the Academy's Website.
24. Children's Privacy
The Academy's educational programmes are principally intended for adults.
The Academy does not knowingly collect personal information from children under the age of sixteen without appropriate parental or legal guardian consent.
Should the Academy become aware that personal information relating to a child has been collected without the necessary consent, reasonable steps will be taken to delete such information without undue delay.
25. Links to Other Websites
The Academy's Website may contain links to websites operated by museums, galleries, cultural institutions, educational organisations or other third parties.
Such websites operate independently from the Academy.
The Academy is not responsible for the privacy practices, policies or content of external websites.
Visitors are encouraged to consult the privacy information published by each external organisation before providing personal information.
26. Changes to this Privacy Notice
The Academy may revise this Privacy Notice from time to time in order to reflect:
- changes in legal requirements;
- technological developments;
- improvements to the Academy's Website;
- changes to educational services;
- developments in data protection practice.
The most current version of this Privacy Notice will always be published on the Academy's Website.
The "Last Updated" date appearing at the beginning of this document indicates when this Privacy Notice was most recently revised.
27. Supervisory Authority
If you believe that your personal information has not been processed in accordance with applicable data protection legislation, you have the right to lodge a complaint with the competent supervisory authority.
For the History of Art Academy, the competent supervisory authority is:
Austrian Data Protection Authority (Datenschutzbehörde)
Barichgasse 40–42
1030 Vienna
Austria
Website: https://www.dsb.gv.at
The Academy would, however, appreciate the opportunity to address your concerns directly before you contact a supervisory authority and encourages you to contact us in the first instance.
28. Contact
Questions regarding this Privacy Notice or the processing of personal information may be directed to the Academy using the contact details published on the Website.
History of Art Academy
Website:
The Academy welcomes enquiries concerning privacy and will endeavour to respond promptly and transparently.
Closing Statement
Respect for privacy forms an integral part of the Academy's commitment to academic integrity, professional responsibility and the trust placed in us by our participants.
The History of Art Academy is dedicated to ensuring that personal information is handled with the same care, respect and attention that characterise its educational mission and its commitment to the study of art, architecture and cultural heritage.
History of Art Academy
Last Updated: July 2026
© History of Art Academy
All rights reserved.