Legal Grounds for Data Processing

Processing may be performed provided that consent is given and the processing meets the following conditions according to which the data have to be:

  • obtained and processed fairly and lawfully;
  • collected for specific, explicit and legitimate purposes, and subsequently processed in accordance with these purposes;
  • collected in an adequate, relevant, and non-excessive way, in view of the purposes for which they are collected;
  • accurate, comprehensive and, when necessary, kept up to date;
  • stored in a form that permits identification of data subjects for no longer than is necessary for the purposes for which the data were collected, or for which they are further processed. Personal data can only be stored beyond this necessary period for processing for historical, statistical or scientific purposes.
  • kept secure

If consent is not given, the processing is permissible only if it meets one of the following conditions:

  • it complies with any legal obligation to which the data controller is subject;
  • it protects the data subject’s life;
  • it performs a public service mission entrusted to the data controller or the data recipient;
  • it performs either a contract to which the data subject is a party or steps taken at the request of the data subject prior to entering into a contract;
  • it pursues the data controller’s or the data recipient’s legitimate interest, provided this is not incompatible with the interests or the fundamental rights and liberties of the data subject.

Please visit:


According to the Telecommunications Act 2003, master data, traffic data, location data and content data may be collected and processed only for the purposes of providing a communications service. The transmission of this data may take place only to the extent necessary for the provision, by the operator of a public communications service, of the communications services for which these data have been collected and processed. The data may be used for the purpose of marketing of communications services or the provision of value added services as well as for other transmissions only with the consent of the data subjects, which may be withdrawn at any time.