Privacy policy

Data processing in connection with voucher purchases: You can purchase vouchers through the voucher shop that we link to on our website. As part of this ordering process, we process your personal data on the basis of Art. 6(1)(b) GDPR, as the processing is necessary for taking pre-contractual steps and for performing the contract. This includes in particular handling your order, payment, and the electronic delivery of the voucher.

Your data is stored for a period of seven years in order to comply with statutory retention obligations, in particular under tax law. It is stored beyond that period only if required by law or necessary for the establishment, exercise, or defense of legal claims.

For the technical processing of voucher orders, we use the external service provider INCERT eTourismus GmbH & Co KG, Leonfeldner Straße 328, 4040 Linz, Austria, as a processor under Art. 28 GDPR. It processes personal data solely on our documented instructions and subject to appropriate technical and organizational measures to protect your data.

8. Use of online marketing and web analytics tools

We use the following applications, for example, to analyze user behavior on our website and thereby run online advertising campaigns tailored to specific target groups.

On our website, we use server-side tagging (SST) with the provider Stape.io to capture and process data securely. Your data is first sent to one of our servers within the European Union and only from there, if at all, passed on to third-party providers such as Google or Facebook. For Google Analytics, your IP address is shortened on this server before any data is passed on to Google. This protects your privacy because sensitive information is not disclosed. A data processing agreement under Art. 28 GDPR is in place with Stape Europe OÜ, based in Estonia. Address: Stape Europe OÜ, Sepapaja tn 6, 15551 Tallinn, Estonia. The server is operated by Scaleway S.A.S. in France. For troubleshooting, Stape stores logs of incoming requests for three days.

8.1. Google Tag Manager

We use Google Tag Manager from the provider Google Ireland Limited (Ireland). It allows website tags to be managed through a single interface. Tags are small sections of code that can, for example, record your activities on our website. Google Tag Manager itself does not set any cookies, but ensures that other tags, which may in turn collect data, are activated.

The storage period of the integrated tracking tools depends on the particular application loaded through Google Tag Manager.

In the account settings of Tag Manager, we have configured it so that Google receives only anonymized data.

Google Tag Manager is not loaded until you have consented to the Statistics or Marketing category. We pass your choice on to the integrated services through what is known as Google Consent Mode. If you have consented to only one of the two categories, the Google service of the other category may still send a short message without cookies to Google, which is used for statistical estimates.

8.2. Google Analytics

If you give your consent within the meaning of Art. 6(1)(a) GDPR and Art. 49(1)(a) GDPR, this website uses Google Analytics, an application of Google Ireland Limited (Ireland).

Google Analytics uses what are known as “cookies”. These are text files that are stored on your computer and that enable an analysis of the user’s use of the website. The information about your use of this website obtained through the cookies is generally transmitted to a Google server in the USA and stored there. The data is also processed essentially by Google. Both Google and, in some circumstances, government authorities in the USA have access to this data. Your IP address is already shortened on our server at Stape before any data is passed on to Google.

On behalf of the operator of this website, Google will use this information to evaluate your use of the website, to compile reports on website activity, and to provide the website operator with further services related to website and internet use.

The anonymized IP address transmitted by your browser as part of Google Analytics is combined with other data about you, such as your search history, personal accounts, usage data from other devices, and any other data Google holds about you.

You can view the cookies set in connection with Google Analytics in the list above. You can withdraw your consent at any time by changing the relevant settings directly through our “cookie consent tool”.

You can withdraw your consent at any time by changing the relevant settings directly through our banner. User and event data is deleted after 14 months. The “Reset user data on new activity” function is enabled. This means that if you visit again before the retention period expires, your data is not deleted.

Google signals

This website uses the “Google signals” feature to extend the statistical reports created with Google Analytics with a cross-device analysis of visitor flows.
When are Google signals collected?

Google signals are applied only to users who are signed in to a Google account during their sessions and who have enabled “Ads Personalization” in their Google account.
What information do we get through Google signals?

Google signals do not give us deeper insight into specific individuals or any way to uniquely identify you or the device you use. From Google, we receive only general demographic information (gender, age group) and possible interests.

How can I disable Google signals?

If you want to disable this feature for yourself, you have to do so proactively through the setting in your Google account. The link takes you to the options for making changes in your Google account: https://support.google.com/ads/answer/2662856.

You can find further information about Google signals directly on Google’s information page at https://support.google.com/analytics/answer/7532985?hl=de

8.3. Google Ads

With your consent under Art. 6(1)(a) GDPR, we use Google Ads in order to show you advertising on websites of Google Ireland Limited (Ireland) and other third-party providers.

Our purpose is to show you advertising that is of interest to you and to make our website more interesting for you. With conversion tracking, we can determine how successful the individual advertising measures are. For this we use cookies, which allow certain parameters for measuring reach, such as ad impressions or clicks by users, to be measured. If users reach our website through a Google ad, Google Ads stores a cookie on the corresponding device.

We receive only aggregated evaluations of user behavior, on the basis of which we can determine which of the advertising measures used are particularly effective. We do not receive any further data from the use of the advertising media.

You can find more information about the cookies in the cookie list above.

8.4. The Hotels Network

With your consent under Art. 6(1)(a) GDPR, we use the service of the provider The Hotels Network (Spain). This allows us to show personalized pop-up messages to our website visitors.

The Hotels Network uses cookies in the form of a hexadecimal character string in order to identify users on their next visit and to personalize the user experience. This content can differ for different user groups, for example by geographic location, search behavior, or device. You can find more information about the cookies in the cookie list above.

8.5. Social media and social ads

We regularly post information about our company and our services on various social media platforms, such as Facebook and Instagram, which are products of Meta Platforms Inc. (formerly “Facebook Inc.”), as well as LinkedIn and YouTube.

The personal data you enter on social media pages, such as comments, videos, images, likes, and public messages, is published by the respective social media platform. You are not obliged to provide your personal data. We reserve the right to delete content on our page if this should become necessary. We are happy to answer inquiries via the relevant messenger services.

In addition, we regularly run advertising (“ads”) through our social media pages. The legal basis for this data processing is our legitimate interest under Art. 6(1)(f) GDPR in the interest of our public relations and communication.

The social media platforms provide anonymized statistics that help us gain insights into user behavior on the relevant social media pages (so-called “Page Insights”).

The legal basis for this data processing is our legitimate interest under Art. 6(1)(f) GDPR.

Personal data is processed by the social media platform and by us as so-called joint controllers under Art. 26 GDPR. This means that, in addition to us, the operator of the social media platform is also regarded from a data protection perspective as a further controller that carries out its own data processing. However, we have only limited influence over the operator’s data processing. The respective operator informs you about this processing in its own privacy policy. Web tracking methods may also be used regardless of whether you are signed in or registered with the social media platform. It cannot be ruled out that the provider of the social media platform uses your profile and behavioral data, for example to evaluate your habits, personal relationships, and preferences.

Facebook Pixel from Meta Platforms Inc.

With your consent, the so-called Facebook Pixel on our website sets cookies (abbreviated “fr” and “fbp”) from the provider “Facebook” or “Meta Platforms Inc.” For the data processing associated with the pixel, Facebook Ireland Limited (Ireland) is, in addition to us, a joint controller under Art. 26 GDPR: https://www.facebook.com/legal/controller_addendum

The pixel collects data about your use of our website and matches it with Facebook’s data. This is so that advertising from us that is tailored to you can be shown to you on Facebook’s websites. Facebook also uses the data for its own advertising purposes and for the advertising purposes of third parties in accordance with the Facebook Data Policy.

Meta Conversions API: In addition, our tagging server (see Stape above) transmits events such as page views or inquiries directly from server to server to Meta. In the process, your IP address, information about your browser, and the identifiers from the Meta cookies may be transmitted. The legal basis is your consent to the Marketing category under Art. 6(1)(a) GDPR.

8.6. Bing Ads

We use the remarketing function “Bing Ads” of Microsoft Corporation, One Microsoft Way, Redmond, WA 98052-6399, USA (“Microsoft Advertising / Bing Ads”). In doing so, Microsoft Bing Ads stores a cookie on your computer if you reached our website through a Microsoft Bing ad. In this way, Microsoft Bing and we can recognize that you clicked on an ad, were redirected to our website, and reached a predetermined target page (a so-called conversion page). We learn only the total number of users who clicked on a Bing ad and were then redirected to the conversion page. No personal information about your identity is disclosed. For data transfers to Microsoft Corporation, a valid certification under the Data Privacy Framework (adequacy decision) is in place, which you can view here.
You can see the cookies set in connection with Bing Ads, as well as their storage period and purpose, in the list above. You can withdraw your consent at any time by changing the relevant settings directly through our “cookie consent tool”.

Bing Universal Event Tracking (UET)

In addition, technologies of Bing Ads are used on our website to collect and store data from which usage profiles are created using pseudonyms. This service allows us to track the activities of users on our website if they reached our website through Bing Ads ads. If you reach our website through such an ad, a cookie is set on your computer. A Bing UET tag is integrated into our website. This is a piece of code that, in conjunction with the cookie, stores some non-personal data about the use of the website. This includes, among other things, the time spent on the website, which areas of the website were accessed, and which ad the users came to the website through. Information about your identity is not collected.

Note: Microsoft may, in some circumstances, track your usage behavior across several of your electronic devices through so-called cross-device tracking, and is thereby able to show personalized advertising on or in Microsoft websites and apps. You can disable this at http://choice.microsoft.com/de-de/opt-out.

You can find more information about Bing’s analytics services on the Bing Ads website ( https://help.bingads.microsoft.com/#apex/3/de/53056/2 ).

You can find more information about data protection at Microsoft and Bing in Microsoft’s privacy statement ( https://privacy.microsoft.com/de-de/privacystatement ).

9. Embedding of fonts

The fonts on our website are stored on our own server. When you access the website, no connection is made to servers of Google or other font providers. The exception is the embedded newsletter form from Smart Host (see section 5).

10. Data processing in connection with bookings at our hotel

You can make bookings, inquiries, and reservations by phone, by e-mail, using a web form, or through third-party hotel platforms. We collect only the data required for the booking. The legal basis for the data processing is Art. 6(1)(b) GDPR.

Personal bookings and inquiries by e-mail: We treat any information about you that you voluntarily send us as confidential. Please do not provide any sensitive data (such as religious affiliation, health, or ethnic origin). We use your data solely to process and answer your inquiry. You receive the offer in response to your inquiry by e-mail or as a personalized web offer with information and additional services. The web offer and the messages that follow it (such as a reminder about the offer, booking confirmation, etc.) are sent by our processor Access Workspace Germany GmbH (Guestline), based in Munich, Germany.

Bookings through our website: During the booking process, you are taken to a web form where you are asked to enter your booking-related data. If you do not complete the booking, no data is stored. Only after a successful booking is this data transmitted, through the interface of Hotelpartner YM GmbH (Austria), to our hotel management software “Guestline” from Access Workspace Germany GmbH.

To complete the booking, you are redirected to Guestline’s “GuestPay” service. Only the credit cards listed on the website are accepted, and the card data is transmitted in encrypted form in compliance with PSD2.

Bookings by web form via third-party hotel platforms: You can also make bookings through our web presences on various platforms, such as booking.com. In addition, bookings may be offered through other platforms as well. However, we have only limited influence over this.

The legal basis for the data processing is our legitimate interest under Art. 6(1)(f) GDPR. This arises from our interest in answering inquiries from our customers, business partners, and prospective customers and in promoting and maintaining customer satisfaction. A further legal basis is Art. 6(1)(b) GDPR.

11. Compliance with the Austrian Registration Act (Meldegesetz), keeping a guest register, and processing reservations via straiv by Straiv GmbH

As an accommodation provider, we are required to keep what is known as a guest register. To comply with this act, you are required to provide us with the following data in the event of a stay at the hotel: name, address, date of birth, ID document, nationality, and number of accompanying travelers.

To be able to meet this legal obligation, we offer to collect the data on site or electronically. We also store your data in our hotel management software Guestline.

To collect your data electronically, we use the web app straiv from Straiv GmbH, Industriestraße 23, 70565 Stuttgart, Germany. You can also conveniently enter the mandatory information before your arrival, for example through our website www.zeitgeist-vienna.com/einchecken. You are not obliged to provide your data in advance. You can also provide your data directly at check-in at the hotel front desk.

If it is not possible for technical reasons to collect the data electronically, we can record it on a paper form.

The registration authority and public security officers must be granted access to the guest register at any time upon request (§ 10(2) Meldegesetz). Every month, we transmit the number of our guests and their nationalities in electronic form to the City of Vienna for the nationality statistics. The legal basis for the collection and transmission of the data is Art. 6(1)(c) GDPR in conjunction with § 19 of the Meldeverordnung (Registration Ordinance, including Annex A) and § 10 Meldegesetz. We are legally required to retain the guest register data for seven years (§ 10(2) Meldegesetz), extended by the duration of any proceedings before the tax authority, and in accordance with § 19(5) of the Meldegesetz-Durchführungsverordnung (Registration Act Implementing Ordinance).

12. Informational e-mails in connection with your booking

If you provided your e-mail address when booking, you will receive a so-called “pre-stay e-mail” with further information about your stay before you arrive. Through a survey, you can state your wishes and interests regarding your upcoming stay. Taking part in the survey is voluntary. The information from the survey is used to coordinate wishes and interests with you during your stay and to be able to offer you services in line with your interests in the future as well. The e-mail also contains a link to our web app straiv. Using it is voluntary and allows you to send us your data in advance for the purposes of the Meldegesetz. In addition, you can access information about our hotel digitally and, if applicable, pay for your stay online and check out yourself.

For payment, you are redirected to a GuestPay page from Guestline. There you can choose to pay by Visa or MasterCard. If you enter your credit card details, they are stored in encrypted form and in compliance with PSD2. Upon successful payment, you receive a payment confirmation and, at check-out, an e-mail. The data processing is based on our contract under Art. 6(1)(b) GDPR.

In addition, you can pay at any time at one of the credit card terminals we provide.

Furthermore, shortly after your departure, you receive a so-called “post-stay e-mail” giving you the opportunity to rate your stay with us. The results gathered through the survey are used in aggregated form to improve the hotel’s services. You can also publish your feedback through a review link on external portals such as Google and TripAdvisor. If you have a TripAdvisor account, you can rate your stay there voluntarily. We ask that you not provide any sensitive data, such as health data, in the survey. You can cancel the survey at any time by closing the browser window. The answers given up to that point are deleted. When you submit your overall rating, the data collected becomes part of our rating on www.tripadvisor.com and your review is published on TripAdvisor, for which TripAdvisor itself is responsible and which explains the data processing in its privacy notice: https://tripadvisor.mediaroom.com/de-privacy-policy.

The e-mails are sent and the surveys are conducted by our processor Smart Host (Germany).

13. Retention period in connection with overnight stays

To comply with tax-law retention obligations, your data is stored under § 132(1) of the Austrian Federal Fiscal Code (BAO) for at least seven years, extended by the duration of any proceedings before the tax authority, and under § 19(5) of the Meldegesetz-Durchführungsverordnung. All data relevant to billing is also transmitted to our tax advisory firm, PBW Wirtschaftsprüfungs- und Steuerberatungs GmbH (Austria), and entered into our accounting software BMD NTCS from BMD SYSTEMHAUS GesmbH (Austria) and into Guestline.

The legal basis for this is in each case Art. 6(1)(c) GDPR; for the transfer to external tax and legal advisors, our legitimate interest under Art. 6(1)(f) GDPR applies, which lies in obtaining appropriate legal advice for our company.

No Tripadvisor widget is embedded on this website.

14. Display of Google reviews

On our website, we display reviews from our Google Business Profile: the name the author provided on Google, the date, the star rating, and the text. We retrieve the reviews through Google’s API to our server and deliver them from there; no connection to Google is made when our website is accessed. The legal basis is our legitimate interest under Art. 6(1)(f) GDPR in showing potential guests authentic reviews.

15. Data processing in the application process

You are welcome to send us your application documents directly or through the corresponding job postings on various career platforms. The data you submit is processed for the purpose of a (possible) employment relationship. The legal basis for this data processing is Art. 6(1)(b) GDPR.

You can also send us your applicant data through the onboard application tool that we have embedded on our website. Please do not provide any sensitive data (such as religious affiliation, health, or ethnic origin). We use your data solely to process and answer your application. For this purpose, we use onboard GmbH, Dr. J. Köllensperger Straße 10/B, 39011 Lana (BZ), Italy, as a processor. The job listing on our careers page is loaded directly from the servers of onboard GmbH; your IP address is transmitted to onboard in the process. onboard sets cookies only on the pages of the individual job postings, and only technically necessary ones (session, protection against misuse). The legal basis for embedding it is our legitimate interest in an up-to-date overview of open positions (Art. 6(1)(f) GDPR).

In the application process, we collect from you only the data that is required for performing an employment relationship with us. Within our company, only those persons who are involved in the decision-making process have access to your personal data.

If you are hired, your personal data is stored for the duration of your employment relationship, and for at least seven years under § 132(1) BAO, in order to fulfill all payroll tax and levy obligations. After your employment relationship ends, we are required to archive your data relevant for tax purposes for 30 years within the statutory retention periods under § 1478 of the Austrian General Civil Code (ABGB).

If your application is unsuccessful, your personal data is deleted in compliance with data protection law no later than seven months after the rejection. At your request, we are happy to keep your application documents on file and ask that you give us your express consent for this in writing. By doing so, you give us your voluntary consent to continue storing your applicant data and to consider and contact you for future vacancies. In this case, we store your data for a maximum of 1.5 years from your consent or until you withdraw it. Your data is deleted automatically after the 1.5 years have expired.

16. Processing in connection with the exercise of data protection rights

To the extent your data has been processed on the basis of consent under Art. 6(1)(a), Art. 9(2)(a), or Art. 49(1)(a) GDPR, we will process your data only for the stated purpose. Under Art. 5(2) GDPR, we must be able to demonstrate that you have consented to the data processing in question.

If you withdraw your declaration of consent, your data will be deleted within the period prescribed by law. Please note, however, that data subject to the tax-law retention obligation under § 132(1) BAO must be stored for at least seven years, extended by the duration of any proceedings before the tax authority.

Your rights as a data subject

You have the right under Art. 15(1) GDPR to obtain, upon request and free of charge, access to the personal data stored about you. Furthermore, where the statutory requirements are met, you have the right to rectification (Art. 16 GDPR), erasure (Art. 17 GDPR), and restriction of processing (Art. 18 GDPR) of your personal data. If you yourself provided the data being processed, you have the right to data portability under Art. 20 GDPR.

Where the data processing is based on Art. 6(1)(e) or (f) GDPR, you have the right to object under Art. 21 GDPR. If you object to data processing, it will cease in the future unless the controller can demonstrate compelling legitimate grounds for the further processing that override the data subject’s interest in objecting.

In the cases mentioned above, if you have any open questions, or if you wish to lodge a complaint, please contact us by e-mail at datenschutz@zeitgeist-vienna.com.

You also have the right to lodge a complaint with a data protection supervisory authority. In particular, the complaint can be lodged with a supervisory authority in the EU member state of your place of residence, your place of work, or the place of the alleged infringement. If you are concerned that your rights under data protection law have been violated or that the processing of data infringes the GDPR, you can submit your complaint directly to the competent Austrian Data Protection Authority (Datenschutzbehörde), Barichgasse 40-42, 1030 Vienna, by e-mail at dsb@dsb.gv.at.

Unless stated otherwise in the previous sections, the provision of personal data is neither required by law or by contract nor necessary for the conclusion of a contract. Failure to provide your personal data may mean, for example, that we cannot answer your inquiries.

In preparing this privacy policy, we received legal advice from SCALELINE LTD. The legal texts are protected by copyright.

17. Our Social Media Presence

We maintain the following social media accounts. For the sake of transparency, we also provide the name of the respective platform operator and its address:

LinkedIn
Account: https://www.linkedin.com/company/hotel-zeitgeist-vienna/
Operator: LinkedIn Ireland Unlimited Company
Wilton Plaza, Wilton Place, Dublin 2, D02 AD98, Ireland

YouTube
Channel: https://www.youtube.com/c/HotelZeitgeistViennaWien
Operator: Google Ireland Limited
Gordon House, Barrow Street, Dublin 4, Ireland

Facebook
Page: https://www.facebook.com/ZeitgeistVienna
Operator: Meta Platforms Ireland Limited
Merrion Road, Dublin 4, D04 X2K5, Ireland

Instagram
Profile: https://www.instagram.com/hotelzeitgeistvienna/
Operator: Meta Platforms Ireland Limited
Merrion Road, Dublin 4, D04 X2K5, Ireland

Facebook and Instagram are products of Meta Platforms Inc. (USA). Further information is available at: https://www.facebook.com/help/1561485474074139/?helpref=related

When you visit or interact with these sites, personal data is processed by both us and the respective platform operator. We provide detailed information on this below.

17.1. Data Processing by Us

Maintaining Our Social Media Pages and Communication

We maintain the social media pages listed above, publish content, and communicate with you. The personal data you enter on these pages (for example, comments, videos, images, likes, public messages, or direct messages via the available messaging services) is published on the respective platform or transmitted to us. We reserve the right to delete content if necessary. Where appropriate, we may share content on our page.

The legal basis is our legitimate interest in public relations, communication, and external presentation pursuant to Article 6(1)(f) of the GDPR. If you contact us via a messaging service, we process your data to handle and respond to your inquiry; the legal basis is Article 6(1)(f) of the GDPR.

Page Insights and Joint Controllership (Article 26 of the GDPR)

The platforms LinkedIn, Facebook, and Instagram provide us with statistics and insights from which we gain an understanding of the types of actions people take on our page (so-called page insights). These insights are generated based on information about the people who have visited our page and are provided to us in an aggregated, anonymized form.

The legal basis for this processing is our legitimate interest in the statistical analysis of user behavior to improve our online presence, pursuant to Article 6(1)(f) of the GDPR.

This processing is carried out by us and the respective platform operator (LinkedIn Ireland Unlimited Company or Meta Platforms Ireland Limited) as joint controllers pursuant to Article 26 of the GDPR. We have entered into the required agreements on joint controllership with the operators. These agreements specify, in particular, who fulfills which information obligations and how you can exercise your rights. You can view the key provisions of these agreements via the following links:

LinkedIn: https://legal.linkedin.com/pages-joint-controller-addendum
Facebook (Page Insights): https://www.facebook.com/legal/terms/page_controller_addendum
Instagram: https://www.facebook.com/legal/controller_addendum

To the extent that YouTube also provides us with statistics on our channel, Google processes the underlying data under its own responsibility (see 17.2).

You may generally exercise your data subject rights with any of the joint controllers. Please note that the primary responsibility for processing Insights data lies with the platform operators, as only they have full access to the underlying user data.

17.2. Data Processing by the Platform Operators

In addition to us, the respective platform operator also processes personal data under its own responsibility. In this respect, the platform operator is also a data controller within the meaning of the GDPR. We have only limited influence over this processing. Where we can exert influence, we work within the scope of our capabilities to ensure that data is handled in compliance with data protection regulations. In many cases, however, we cannot influence the processing carried out by the operator and do not know exactly what data the operator processes.

The respective operator will inform you about the processing of your personal data in its own privacy policy:

LinkedIn (LinkedIn Ireland Unlimited Company): https://de.linkedin.com/legal/privacy-policy
YouTube (Google Ireland Limited): https://policies.google.com/privacy
Facebook (Meta Platforms Ireland Limited): https://www.facebook.com/privacy/policy/
Instagram (Meta Platforms Ireland Limited): https://help.instagram.com/519522125107875

17.3. Transfer to Third Countries

When using the platforms, your personal data is generally also processed by the respective platform operator on servers located in third countries, particularly in the United States.

For certain third countries, the European Commission has determined, through a so-called adequacy decision, that a level of data protection comparable to that of EU or EEA law exists there. For the United States, such an adequacy decision exists based on the EU-U.S. Data Privacy Framework (DPF) for companies certified under the DPF. Meta Platforms (Facebook, Instagram), LinkedIn, and Google (YouTube) are certified under the Data Privacy Framework. To the extent that no adequacy decision exists for a transfer, we base the transfer on the Standard Contractual Clauses adopted by the European Commission pursuant to Article 46(2)(c) of the GDPR or on another permissible safeguard.

17.4. Retention Period

We store your personal data only for as long as is necessary for the respective purposes or as required by statutory retention obligations.

Content you post (comments, messages, likes) generally remains stored until you delete it or we remove it as part of our moderation process.

We store inquiries you send to us via messaging services for the duration of their processing and beyond, to the extent necessary for evidentiary purposes or due to legal obligations.

Platform operators provide us with page insights only in aggregated, anonymized form and for a limited period of time.

The storage of data by the respective platform operator is governed by that operator’s own privacy policy.

17.5. Your Rights as a Data Subject

Under the GDPR, you have the following rights:

• Right of Access (Art. 15 GDPR): You may request information regarding whether and what personal data we process about you.
• Rectification (Art. 16 GDPR): You may request the correction of inaccurate data or the completion of your data.
• Erasure (Art. 17 GDPR): Under certain conditions, you may request the erasure of your data.
• Restriction of Processing (Art. 18 GDPR): Under certain conditions, you may request that the processing of your data be restricted.
• Data Portability (Art. 20 GDPR): You may request to receive the data you have provided in a structured, commonly used, and machine-readable format.
• Withdrawal of Consent (Art. 7(3) GDPR): To the extent that processing is based on your consent, you may withdraw it at any time with future effect. The lawfulness of the processing carried out prior to the withdrawal remains unaffected.

To exercise your rights, simply send an informal message to the contact information provided. Please note that you may also exercise some of these rights directly with the respective platform operator, as only that operator has full access to certain data.

17.6. Right to Object (Art. 21 GDPR)

To the extent that we process your personal data on the basis of legitimate interests pursuant to Article 6(1)(f) of the GDPR, you have the right to object to such processing at any time for reasons arising from your particular situation. You may submit your objection informally using the contact information provided.

17.7. Right to Lodge a Complaint with a Supervisory Authority (Art. 77 GDPR)

Without prejudice to other legal remedies, you have the right to lodge a complaint with a data protection supervisory authority if you believe that the processing of your data violates the GDPR. You may exercise this right with a supervisory authority in the Member State of your residence, your workplace, or the location of the alleged violation.

The supervisory authority responsible for us is:

Austrian Data Protection Authority (Datenschutzbehörde)
Barichgasse 40-42, 1030 Vienna, Austria
Website: https://www.dsb.gv.at

17.8. Necessity of Providing Data

The provision of your data is neither required by law nor by contract, nor is it necessary for the conclusion of a contract. You are not obligated to provide your personal data. If you do not provide your data, you will not be able to communicate with us or interact with us via our social media pages. In this case, please use the email address provided above to contact us.

17.9. Automated Decision-Making and Profiling

We do not use automated decision-making, including profiling, as defined in Article 22 of the GDPR, that produces legal effects concerning you or similarly significantly affects you. However, the platform operators may analyze your usage and behavioral data for their own purposes, in particular for personalized advertising, and may engage in profiling in this context. We have no influence over this processing. For more information, please refer to the operators’ privacy policies.

Information about your advertising preferences on Facebook is available here: https://www.facebook.com/help/568137493302217

17.10. Note on Web Tracking

The operator of the respective platform uses web tracking methods. Web tracking may occur regardless of whether you are logged in or registered with the platform. We have little control over these methods and, in particular, cannot disable them. It cannot be ruled out that the provider may use your profile and behavioral data to analyze, for example, your habits, personal relationships, or preferences. We have no control over this processing by the provider.