noyb

Terms and Conditions for noyb's “CRIF – Access Project”

1. Subject matter of the contract

1.1.    Contracting parties
This contract is concluded between you and the non-profit association noyb - European Center for Digital Rights, Goldschlagstraße 172/4/3/2, 1140 Vienna ("noyb").

1.2.   Aim of the project and companies involved
1.2.1.      Aim of the project
The primary objective of noyb's activities under this agreement is the legal review of data processing by the company CRIF GmbH, Company Number 200570g ("CRIF") and the evaluation of the extent to which claims have arisen for the participating persons as a result. Based on the results of this project, noyb will examine the prospects of success of enforcing such claims, including by way of a potential representative action for redress.

1.2.2.       CRIF
CRIF is a so-called credit reference agency within the meaning of Section 152 of the Austrian Industrial Code ("Gewerbeordnung"). CRIF collects data on other companies and private individuals in order to assess creditworthiness (probability of default) and stores this data - often for many years. Based on previous court rulings and decisions by the data protection authority, noyb is of the opinion that several of CRIF's data processing practices may not be compatible with the General Data Protection Regulation ("GDPR"). Details can be found on the noyb website.

1.2.3.       CRIF partners
This agreement also includes the possibility for noyb to review data processing practices of CRIF partners in connection with their participation in data processing by CRIF. CRIF partners within the meaning of these contractual terms and conditions are in particular data suppliers who have collected personal data of the participating person and provided it to CRIF (such as the address publisher AZ Direct Österreich GmbH, Company Number 201931h, or various debt collection agencies) and data recipients who have received personal data of the participating person from CRIF (such as banks, mobile phone providers, online stores, insurance providers and many more). The specific CRIF partners who have processed the personal data of the participating person in each individual case are often only revealed by the initial information provided by CRIF or other evidence obtained in accordance with section 1.3.2.

1.3.   Activities of noyb under this contract
1.3.1.       Initial situation
In order to determine whether CRIF or CRIF partners are processing your data at all and to assess whether there may have been any legal infringements that make a subsequent lawsuit (including a representative action) appear promising, noyb will take the following steps for you:

1.3.2.       Step 1: Obtaining evidence: Request for information from CRIF and any CRIF partners
After the contract has been concluded (see point 3.), noyb will invoke your right to information in accordance with Article 15 GDPR vis-à-vis CRIF and possibly CRIF partners on the basis of the information provided by you in the online form.

If noyb is of the opinion that an assertion of the right to information within the framework of this contract appears reasonable, noyb will assert these claims in your name and on your behalf against these companies, whereby it is at the discretion of noyb to which companies the claim for information is asserted.

1.3.3.       Possible intermediate step: Enforcement of the right to information
In the event that CRIF or a CRIF partner does not respond or does not fully respond to the request for information within the time limits set out in Article 12(3) GDPR, noyb may, in your name and on your behalf, lodge a complaint with the Austrian data protection authority and/or bring an action on any conceivable legal basis (including non-material damages) before the competent civil court. noyb is entitled to refrain from such enforcement.

By concluding this contract, you assign any claims for damages due to a lack of or failure to provide information to noyb for the purpose of enforcement. This means that noyb can enforce these claims in its own name; however, any obtained compensation (minus costs of enforcement) will be paid out to you in any case (see details in points 5.2. and 5.3.).

1.3.4.       Step 2: Data check and evaluation
If the data you provided in the online form and received by way of information from CRIF or CRIF partners is suitable for data analysis, noyb will provide it to external experts who can carry out a statistical evaluation. Details can be found in the privacy policy.

The aim of this evaluation is to better understand the data processing by CRIF and the CRIF partners and to be able to make a qualified assessment with regard to its admissibility under data protection law. In particular, the plausibility and accuracy of the scores issued, which CRIF uses to express the supposed creditworthiness of the participating persons, are to be examined.

1.3.5.       Step 3: Transmission of the results and examination of the possibility of a representative action
After receiving the information about your personal data processed by CRIF or the CRIF partner, noyb will send it to you.
noyb will also attempt to provide you with a scientific evaluation of your individual data, which may include, for example, the accuracy of your specific score - however, this cannot be guaranteed.

Furthermore, noyb will examine, on the basis of all available information, whether you and the other participating persons are entitled to claims against CRIF or a CRIF partner for damages and/or for the surrender of income generated by the unlawful use of your data. noyb is not obliged to examine all possible claims, but will assess at its own discretion and taking into account the interests of the participating persons which claims can be asserted with a good chance of success.

If noyb files a representative action on the basis of these results, you will be informed that you can join this action. You are then free to decide whether you wish to join this action, assert your claims independently or not pursue your claims further.

1.4.  Power of representation and deliveries to noyb
You grant noyb a power of representation for all legally relevant declarations and actions necessary in connection with this contract vis-à-vis CRIF and CRIF partners.

1.4.1.       Representation vis-à-vis CRIF and CRIF partners
You authorise noyb to represent you directly vis-à-vis CRIF and CRIF partners, outside of proceedings before authorities or courts, as well as before authorities and courts, to initiate and refrain from initiating proceedings, to accept service of documents of all kinds, to initiate and withdraw appeals of any type, to obtain the enforcement of claims, interim injunctions and to refrain from doing so, to conclude settlements of any kind, to appoint trustees, lawyers and or representatives with equal or lesser powers of attorney, in particular where there is a legal obligation to be represented by an attorney, and in general to do everything that noyb deems useful and necessary in the context of enforcing claims against CRIF and CRIF partners.

This power of representation is based on any legal grounds, in particular on a contract within the meaning of Sections 1002 et seq. of the Austrian General Civil Code ("ABGB"), as well as Section 10 of the Austrian General Administrative Procedure Act ("AVG") and Article 80(1) GDPR.

noyb is authorised to represent you with reference to the granted power of representation with regard to any claim against the companies mentioned under point 1.2, provided that this is done to fulfill the obligations or to protect the rights of noyb under this contract.

1.4.2.        Discharge of debt and delivery to noyb
You expressly agree that any debt-discharging performance by CRIF or CRIF partners is to be made solely to noyb if noyb has asserted rights against these companies in your name and on your behalf. This also applies in particular to responses to a request for information in accordance with Article 15 GDPR.

1.5. Rights and obligations of the participating persons
1.5.1.       Information you receive from CRIF or from other companies
If CRIF or other companies from which noyb obtains information for you do not send information to noyb, but directly to you, it is necessary that you inform noyb of this and forward the information received to noyb immediately and in full. noyb will provide suitable technical options for this purpose (see point 1.6.). Failure to pass on the information received allows noyb to terminate the contract under point 4.1.

1.5.2.       Updating your data shared with noyb
According to the information available to noyb, circumstances such as place of residence, relocation, gender and possibly also the same name as other persons can have an influence on the assessment of creditworthiness by credit agencies such as CRIF. If your data changes, this assessment may therefore also change. It may also become necessary to communicate with you. For the purposes of this contract, it is therefore particularly important that noyb always has up-to-date information about you.

You therefore undertake to notify noyb as soon as possible of any changes to your name, residential address, etc. compared to the information you provided to noyb when concluding the contract. For the modalities of communication, see point 1.6.

1.5.3.       Information about own legal enforcement
noyb exercises your rights in the context of this project together with the rights of many other participating persons and can therefore not take into account specific cases that occur during noyb's activities with individual persons.
In order to avoid inconsistencies between the exercise of rights by noyb and yourself, you undertake not to assert any claims against CRIF and CRIF partners on the basis of the GDPR during the term of the contract without informing noyb at least two weeks in advance. 
In order to avoid a contradictory exercise of rights or this information obligation, noyb and you have the possibility to terminate this contract at any time in accordance with point 4.1.

1.6. Communication between noyb and participating persons
All communication between noyb and the participating persons takes place either via the web application, with which the participating persons can register for this project, or via e-mail.
Communication by post is possible, but noyb reserves the right to respond to participants electronically or by telephone.

2. Confidentiality and use of your data

noyb undertakes to maintain the confidentiality of all personal data and other information provided by the participating persons or received via information and will only pass this on to third parties for the fulfillment of this contract as described in the data protection declaration. 

All employees of noyb or other persons involved in the fulfillment of this contract are bound to data secrecy by noyb in accordance with Section 6 Austrian Data Protection Act (“DSG”), even beyond their work for noyb.

noyb has the right to publish aggregated data (e.g. statistical evaluations that do not allow any conclusions to be drawn about individuals) or anonymised data or to use both in any other way.

Any further disclosures, such as quotes from participating persons or the exemplary publication of information in press releases or other public documents, will only be made with the prior express consent of the participating persons.

Section 2 of this contract shall continue to apply indefinitely, even after termination of the contract as a result of withdrawal, termination or fulfillment.

3. Conclusion of contract and withdrawal

3.1.       Offer and acceptance
By completing the online form in the web application with which the participating persons can register for this project and by confirming your participation by clicking on the button provided for this purpose on the website ("binding participation"), you submit a binding offer to conclude this contract and to be represented by noyb. You will receive confirmation that noyb has received your application in the web application for download and by e-mail.

noyb will check that the participation requirements have been met and will contact you by e-mail if there are any queries. If you meet the participation requirements, noyb will confirm your participation in a separate e-mail and thereby accept your offer. This e-mail will also contain a copy of these terms and conditions and the privacy policy, as well as an optional withdrawal form.

noyb can reject your offer at any time, even if you fulfill the participation criteria, and does not have to give any reasons for rejecting the conclusion of the contract.


3.2.       Right of withdrawal
As the contract is concluded online, you have the right to withdraw from this contract within 14 days. This period begins on the day the contract is concluded, i.e. as soon as noyb has accepted your offer by e-mail. The declaration of withdrawal is not bound to any particular form; however, you can use the withdrawal form sent with the acceptance e-mail.

In the event that noyb has already acted for you in your name and on your behalf at the time of withdrawal, the consequences described in point 4.2 apply accordingly.

After withdrawing from the contract, you can assert all claims covered by this contract yourself; the assignment of any possible claims for damages in accordance with point 1.3.3. is rescinded.

4. Termination of the contract

4.1.       Right of termination
Apart from the right of withdrawal described under point 3.2, you can terminate this contract at any time without giving reasons. Notice of termination must be sent by e-mail to crifprojekt@noyb.eu or by post.

noyb may also terminate this contract if one of the following reasons apply (ordinary termination):
  • The participating person no longer fulfills the participation criteria or it turns out that they never fulfilled them;
  • The Participant has failed to properly fulfill their obligations under Section 1.5 and noyb concludes that this could affect noyb's ability to assert claims in the name and on behalf of the Participant under this Agreement;
  • noyb or a third party has suffered or is at risk of suffering damage as a result of conduct for which the participating person is liable in accordance with point 6.2.
  • The participating person objects to an amendment to these contractual conditions in accordance with point 7.3.
The right to extraordinary termination in the event of other serious circumstances that make it unreasonable to adhere to the contract remains unaffected.

Notice of termination will be sent by e-mail to the e-mail address you have provided.

4.2.       Consequences of termination
It is possible that noyb has already acted for you at the time the termination takes effect and has exercised rights on your behalf against CRIF or CRIF partners or has asserted claims against CRIF or CRIF partners, before authorities or in court. 

In this case, noyb will inform the contacted companies or the authorities and courts that it no longer has power of representation and request them to handle the further exercise of your rights directly with you. The assignment of any possible future claims for damages in accordance with point 1.3.3. will be revoked.

After a termination becomes effective, you can enforce all claims covered by this contract yourself. At the request of the participating person, noyb will withdraw complaints or lawsuits that have already been filed, as far as possible without waiving the claim, and will bear the associated costs (see point 5.2.). noyb points out, however, that the withdrawal of a complaint or lawsuit may have the consequence that a later assertion of the claim in question is no longer possible for reasons of limitation pursuant to § 24(4) of the Austrian Data Protection Act (“DSG”) or the statute of limitations pursuant to § 1489 of the Austrian Civil Code (“ABGB”), since the effect of the official or judicial assertion of the claim, which preserves the time limit, no longer applies.

If a participating person terminates this contract and does not wish to withdraw an action already brought by noyb, the risk of legal costs for this action is transferred to the participating person when the termination takes effect.

4.3.       Contract fulfillment by noyb
This contract also ends when the steps under points 1.3.2. to 1.3.5. are fulfilled, without the need for termination. noyb will inform you as soon as this is the case.

After fulfillment of the contract, you may reassert all claims covered by this contract yourself, insofar as these have not already been fulfilled; the assignment of any possible future claims for damages or claims for damages that have already arisen at this point in time in accordance with point 1.3.3 shall be rescinded. 

A possible future contract for participation in a representative action remains unaffected by this.

4.4.       Data deletion after termination of contract
The deletion of your personal data after termination of the contract is governed by the privacy policy.

5. Costs and payment of funds received

5.1.       Obtaining information, enforcement via authorities, statistical analysis and other activities of noyb
noyb bears all costs in connection with obtaining information from CRIF and CRIF partners and all associated communication as well as the statistical evaluation of the information received. The participating persons do not incur any costs.

If noyb decides to enforce claims for information against CRIF or CRIF partners before the data protection authority (see point 1.3.3.), noyb shall also bear all associated costs. 

Reimbursement of costs that you incur yourself in connection with this contract (such as postage costs if you yourself insist on postal communication with noyb) is excluded.

5.2.       Proceedings before Courts
In the event of judicial enforcement of claims for information and/or claims for damages due to breaches of the duty to provide information (see point 1.3.3.), noyb shall also bear all associated costs.

Only in the event that noyb obtains a decision that CRIF or a CRIF partner is obliged to make a payment and the amounts won or agreed in settlement are actually paid out to noyb, noyb may deduct the reasonable and usual enforcement costs incurred (in particular for legal representation, experts or procedure financing), which do not have to be borne by CRIF or CRIF partners, from the amount won. If the amount does not cover the costs, noyb will cover the difference. Under no circumstances will the participating persons be obliged to pay anything amount exceeding any damage payment.

5.3.       Payment of money received and forfeiture in the event of unavailability
noyb enables a free payout of the damages claimed or agreed in the settlement to a SEPA bank account that is held in euros and has an IBAN. In the event of a payout, the participating person provides the relevant bank details after being contacted by noyb. 

noyb will inform the participating persons at least twice by e-mail about the possible payout and at least once by SMS or phone call. If a payout is still not possible, the entitlement to payout expires three years after the first notification attempt by noyb.

noyb undertakes to use forfeited claims for charitable projects for the enforcement of digital rights or consumer rights (carried out by noyb or third parties).

6. Risks and liability

6.1.       Limitations of liability
The liability of noyb for claims for damages of the participating persons, which were only caused by slight negligence on the part of noyb, is excluded.
noyb will check the data provided by the participating persons and the data received via requests for information in accordance with Article 15 GDPR with the utmost care. Nevertheless, it cannot be ruled out that errors may occur in individual cases and noyb may, for example, make incorrect statements to third parties regarding a participating person (e.g. an incorrect date of birth in a request for information) or erroneously come to the conclusion that a person is not entitled to the claims mentioned in point 1.3 and therefore refrains from asserting them.

If you suspect that noyb has made a mistake or threatens to make a mistake that has led or could lead to damage, you undertake to inform noyb immediately so that noyb is put in a position to mitigate damage that has already occurred or to prevent imminent damage as far as possible.

6.2.       Liability of participating persons for willful misrepresentation and other activities with intent to cause damage
A participating person is liable to noyb for all damages incurred by noyb as a result of deliberate misrepresentation by the participating person and other activities undertaken by the participating person with intent to cause damage. It is sufficient that the participant considers the possibility of damage occurring to be possible and accepts this. This liability also extends to damages to third parties for which noyb is liable to pay compensation; the participant shall indemnify and hold noyb harmless in this respect. 

Liability may arise in particular, but not exclusively, from the fact that
  • a participating person obtains participation in this project or a related class action by making false statements;
  • a participating person registers another affected person for this project without a corresponding request and authorisation;
  • a participating person uses the participation in this project to obtain information about noyb's approach to CRIF or CRIF partners and passes this on to CRIF, CRIF partners or other third parties.
noyb reserves the right to bring such behavior of the participating persons to the attention of the competent authorities, without prejudice to any civil law claims.

7. Final provisions

7.1.       Binding nature of the German version of these contractual terms and conditions
These Terms and Conditions were drawn up in German and are also provided in an English translation. In the event of any ambiguities in the English language version or inconsistencies between the language versions, the content of the German language version alone shall prevail.

7.2.       Applicable law and place of jurisdiction
This contract shall be governed by Austrian law to the exclusion of national and supranational conflict of law rules.
However, in accordance with the principle of most favourable condition (“Günstigkeitsprinzip”), this choice of law cannot result in the participating persons, as consumers, being deprived of the protection afforded to them by mandatory provisions under the law of the country in which they have their habitual residence.
The place of performance for all activities of noyb is Vienna. The place of jurisdiction for legal disputes in connection with this contract is the competent court in Vienna. If this place of jurisdiction is inadmissible under the law applicable to the place of residence of a participating person as a consumer, the court competent for the place of residence of the participating person shall have jurisdiction.

7.3.       Severability clause and amendments to these contractual terms and conditions
Should one or more provisions of these contractual terms and conditions be wholly or partially invalid or lose their validity at a later date, this shall not affect the validity of the remaining provisions.

Amendments and additions to these contractual terms and conditions and all contracts concluded on the basis thereof can only be made in writing. Should noyb make such changes, the participating persons will be informed by e-mail at least three weeks in advance. You will be given the opportunity to object to the change. In such a case, noyb reserves the right to terminate the contract in accordance with point 4.1. If no objection is made, the change is deemed to have been accepted.