The protection of your personal data is a special priority for us. Therefore we are processing your data exclusively in accordance with the legal provisions of the DSGVO [German acronym of the Austrian Data Protection Act Regulation] and the TKG [German acronym of the Austrian Telecommunications Act] 2003. With this declaration regarding data protection, we are informing you about the most important aspects of data processing within the framework of our website as well as which rights you have according to the current data protection laws and how you can exercise these rights.
Furthermore, this declaration regarding data protection also applies to all cases stated below, whenever personal details of natural persons are being processed by Salzburg AG Tourismus GmbH [Salzburg Corp. Tourism Ltd].
We reserve the right to adjust this declaration regarding data protection at any time due to legal or technical developments. The current version as published on www.5schaetze.at is applicable.
Contacting us
If you contact us through a form on the website or through e-mail, then the details provided by you therein will be stored by us in order to process your inquiry and for any follow-up questions for a period of six months. These data will not be forwarded to anyone without your consent.
SSL-Encryption
This website is using SSL encryption for reasons of security and to protect the transmission of confidential information, such as inquiries, which you send to us as the site's operator. You can recognize an encrypted connection if the address line of the browser changes from "http://" to "https://" and the lock symbol in your browser's address line. When the SSL encryption is activated, then the data, which you send to us, cannot be read by any third party.
Compilation of access data and log-files
On the legal basis of our justifiable interests in accordance with Article 6 (1), lit. f DSGVO [German acronym for the Austrian Data Protection Act Regulation] we are compiling data about each access to the server on which this service operates (so-called server log files).
Among these query data are the name of the accessed website, the file, date and time of the query, the amount of the transmitted data, the notification about the successful query, the browser type and its version, the operating system of the user, the referring URL (the previously visited site), the IP-address and the querying provider).
For security reasons (such as the detection of abuse or fraudulent acts), the log-file information is stored for a maximum duration of seven days and thereafter it is deleted. Data, which require longer storage for evidentiary purposes, are excluded from deletion until the final clarification of the incident in question.
Children
Children should not send any personal details to the websites of Salzburg AG Tourismus GmbH [Salzburg Corp. Tourism Ltd.] without their parents’ consent. Salzburg AG Tourismus GmbH [Salzburg Corp. Tourism Ltd.] advises all parents and guardians to instruct their children in the safe and responsible use of personal details on the internet. Salzburg AG Tourismus GmbH [Salzburg Corp. Tourism Ltd.] will not knowingly collect personal details of children or use them in anyway or to disclose them to any third parties without authorization.
1. Who is responsible for the processing of data and who is the person for you to get in touch with?
Salzburg AG Tourismus GmbH
Markt 35
5360 St. Wolfgang [Austria]
Telephone +43 662 8884 9700
E-Mail: info@5schaetze.at
2. Purpose of data processing by Salzburg AG Tourismus GmbH as well as other specific information (according to Art. 13 as well as 14 DSGVO [German acronym for the Austrian Data Protection Act Regulation])
a) Website Google Analytics / Google Re-marketing
This website uses Google Analytics and Google Re-marketing services of Google Inc. ("Google"). Google Analytics and Google Re-marketing are using so-called "cookies", i. e. text files, which are stored on your computer and which enable an analysis of the use of the website by you. The information generated by said cookie regarding your use of this website (including your IP-address) will be forwarded to a server of Google in the U.S. and stored there.
This website uses Google Analytics with the extension "_anonymizelp()", whereby the IP-addresses are processed only in an abbreviated form in order to exclude the possibility of a direct, personal reference.
Google will use this information in order to evaluate your use of the website, to compile reports about the activities regarding this website for the operator of the website, and to provide additional services relating to the use of the website and the internet in general. Google will also transfer this information to third parties if need be, provided that this is mandated by law or to the extent that third parties are processing these data on behalf of Google.
Third party vendors, including Google, are advertising on websites on the internet based on previous visits by a user to this website. Google will in no way connect your IP-address with other data, which have been stored by Google.
You can prevent the installation of these cookies through corresponding settings of your browser software; but we are pointing out to you, that in such case you may not be able to use the full scope of all functions of this website. By using this website, you are giving your consent to have data obtained by you processed by Google in the manner and for the purpose described above.
The collection and storage of data may be revoked at any time with a future effective date. We have entered into an appropriate agreement with the provider regarding the collection of order details. The processing of data is carried out based on the legal provisions of § 96 (3) TKG [German acronym for the Austrian Telecommunications Act] as well as Art. 6 (1) lit f (justified interest) of the DSGVO [German acronym of the Austrian Regulation of the Data Protection Act].
Our concern in accordance with the DSGVO [German acronym of the Austrian Data Protection Act Regulation] (justified interest) is the improvement of our offers and our image on the web. Since the private sphere of our users is important to us, the user data are pseudonymized. The user data will be stored for a time period of 14 months.
Cookies
Our website is using so-called cookies. These are small harmless text files, which are stored on your end-user device with the help of the browser. They do not cause any harm.
We are using cookies in order to design our offers in a user-friendly way. Some cookies remain on your end-user device, until you delete them. They enable us to recognize your browser during your next visit. If you do not want that, then you can change the settings of your browser so that it will inform you about the storage of cookies and that you will only permit that in individual cases.
Upon deactivation of cookies, the functions of our website may be restricted. You may find additional information about the cookies used by this website here.
b) Mouseflow
Purpose of Processing
Your data are used in order to show you personalized advertising messages and optimize your experience on our website.
Your personally attributable data are processed for the following purposes:
In order to generate anonymized profiles and keep a record of sessions, which helps make the website more user-friendly
Safeguard operability of the website
Guarantee convenient use of the website
Analyze user behaviors
Legal Foundation
The processing of your personally attributable data occurs within the framework of your expressed consent. You have the right to revoke your consent at any time, whereby your revocation shall in no way impact the legality of our having processed your data until that point in time.
Recipient Categories
Within the scope of this service, we receive anonymized data which we employ for the aforementioned purposes. Furthermore, the company Mouseflow, ApS also receives these anonymized data. It has been contractually stipulated that said data may only be stored on European servers and are completely anonymized.
Data Storage
Mouseflow uses two types of cookies (further information may be found here). The cookie mf_[website-id] is installed only temporarily for the duration of the session and contains data about the current session. It is deleted upon conclusion of the session.
The cookie mf_user allows determination of whether the user is a new or returning user. More information is not stored and this cookie is deleted after 90 days.
c) Sweepstakes
Purpose of processing
The purpose of data processing is the notification of winnings and upon appropriate consent the sending of a newsletter.
Legal basis
The legal basis for the processing of data is the rules of participation as they can be retrieved from the website of Salzburg AG Tourismus GmbH. There is no legal or contractual obligation to provide personal details. Said provision is, however, required for participating in the sweepstakes. The failure to provide these details will only result in your inability to participate in the sweepstakes.
Data categories
- First and last name of the participant
- E-mail address
- Telephone number
- Mailing address
- Facebook-User-ID and profile image
- WhatsApp Profile
- Instagram-User-ID and profile image
Categories of recipients
- Order processors within the framework of the provision of services (shipping partner)
- Facebook, WhatsApp, Instagram
Data storage / deletion
We are processing your personal details to the extent required until the expiration of the storage obligations as mandated by taxation, company and value-added-tax laws of seven years. Furthermore, your data will remain stored for as long as required for the enforcement of any legal claims.
d) Profiling - in order to avoid an automated decision-making process; (personalized advertising)
Purpose of processing
The purpose of data processing is to generate a newsletter containing advertising that is tailored to the customer and based on the customer’s web-surfing patterns.
Legal foundation
The processing of your data occurs pursuant to your expressed consent consistent with Art. 6 (1) (a) GDPR.
Data categories
- First and last name
- Email address
- Surfing patterns
- Telephone number = optional
- Postal address = optional
- Country of origin = optional
Categories of data recipients
Data processing entities contracted to provide customer-related services (internal and external partners for implementation and postal/email distribution).
Data storage/deletion
The processing of your personally identifiable data occurs pursuant to your expressed consent. You have the right to revoke your consent at any time, whereby said revocation shall in no way affect the legality of data having been processed up to the point of revocation. Revocation requests should be addressed to Salzburg AG Tourismus GmbH:
Telephone: +43 662 8884 9700
Email: info@5schaetze.at
e) Surveys
Purpose of the processing
The purpose of the data processing through the survey is to know the requirements and needs in order to fulfill them in the best possible way. With the help of the feedback we can work customer:inside oriented.
Legal basis
Your data will be processed in accordance with your consent pursuant to Art. 6 Para. 1 lit. a DSGVO.
Data categories
- Age
- Country of origin
- Customer satisfaction
- Visited attractions
Recipient categories
Within the scope of this service, commissioned processors (market research) receive your data.
Data storage / deletion
Your personal data will be processed in accordance with the consent you have given us. You have the right to revoke your consent at any time, whereby the revocation does not affect the lawfulness of the processing up to this point. The revocation can be made via Salzburg AG Tourismus GmbH:
Phone +43 662 8884 9700
E-mail: info@5schaetze.at
f) Video surveillance
Purpose of processing
The purpose of data processing is self/object protection or the fulfillment of legal duties of care, in each case including the preservation of evidence, with exclusive evaluation in the occasion defined by the purpose designation, insofar as certain facts justify the assumption that the monitored object could become the target or location of a dangerous attack.
Legal basis
The legal basis is provided by § 12 DSG 2018 as well as §§ 353 ff. ABGB (protection of property), § 80 StPO (Code of Criminal Procedure), the operating agreement as well as the operating agreement with WSB.
Data categories
In the context of video surveillance, the following categories of data are processed from persons who are in the video-monitored area, as well as persons who are identified in the event of an incident:
- Image data of the persons concerned
- Location of the image recording
- Time of image recording
- Identity of the persons concerned, as far as recognizable from the recording for the evaluator
- Role of the person concerned (e.g. perpetrator, victim, witness), if recognizable from the recording
Recipient categories
After an evaluation in the event of an incident, the following recipients receive this data:
- Insurance companies (exclusively for processing insurance claims)
- Wasserverband Salzburger Becken (for the assertion of claims for damages)
Data storage / deletion
The data is stored in accordance with the legal regulation (cf. § 12 DSG 2018) for a period of 72 hours and then automatically deleted.
g) Apps
BERT
BERT as web chat on the website
Purpose of the processing
The personal data collected by the Cognigy software tool after consent to data storage includes the first name provided as well as all conversations and the respective website URL from which a message is written to BERT. If the first name is not provided by the user, only the conversations are stored. Depending on the content of the message, further personal data may also be collected.
The data is processed for the following purposes:
for the personalized user experience by recognizing the customer of BERT
for verification purposes in the event of an incident (e.g.: use of live chat, use of future order functions or simply when BERT sends a message to our customer service on behalf of the customer)
the additional context available enables BERT to provide more targeted answers and to understand and solve the user's concerns much better
Legal basis
The processing of your personal data is based on your consent or on the legitimate interest of Salzburg AG Tourismus GmbH. You have the right to revoke your consent at any time, whereby the revocation does not affect the legality of the processing up to this point in time. The revocation can simply be made directly at BERT (e.g. by entering “Delete my data”).
Use of generative AI
Interactions with BERT should provide users with helpful answers to their concerns and solve customer problems. In order to provide an answer that is as individualized and context-based as possible, we use large language models via a third-party API.
All user input is only used by the service provider to create the prompt and completion. User input is not used at any time for the further development of LLMs or any content filters. Likewise, the third-party provider does not store user input.
Legal basis
The processing of your personal data through the use of Generative AI is based on the legitimate interest of Salzburg AG Tourismus GmbH.
Data storage
We process your personal data, if necessary, for the duration of your continued use of this service and beyond that until the expiry of the tax, company and VAT retention obligations of seven years. In addition, your data will be stored for as long as is necessary to enforce legal claims.
3. Which data protection rights am I entitled to because of the processing of data by Salzburg AG Tourismus GmbH [Salzburg Corp. Tourism Ltd.]?
Right of disclosure
You may require a confirmation from us as to whether and to which extent we are processing your data.
Right to correction
If your personal details, which we are processing, are incomplete or incorrect, then you can demand from us at any time to correct or complete them.
Right to deletion
You can demand the deletion of your personal details, if we process them unlawfully or if the processing of it violates your justified protective rights in an unreasonable manner.
However, we would like to point out to you that there might be reasons, which would oppose the immediate deletion, for example, if we must comply with our obligation to store these data as regulated by law.
Right to restriction of processing
You may demand from us the restriction of processing of your data in the following cases:
- if you are disputing the correctness of the data for a period of time which would allow us to determine the correctness of the data;
- if the processing of the data is unlawful, but you refuse their deletion and instead demand a restriction of the use of the data;
- if we do no longer need the data for their intended purpose, but you still require the data to make or defend legal claims or if you have filed an objection against the processing of the data.
Right to transferability of data
You may demand from us that we make your data available to you in a structured, commonly used and machine-readable format, provided that we are processing these data based on an approval granted by you or due to justified interests, or if the processing is required in order for us to comply with the contract between us, and the processing of your data is carried out using automated processes.
Right to object
If we are processing your data to carry out tasks, which safeguard public interests, to exercise official authority, or if we are referring to our justified interests when processing your data, then you can file an objection against such data processing, if there are prevailing protective rights for your data.
You may at any time object to the mailing of advertising without stating any reasons. However, we would like to point out that we are entitled to continue to process your data despite your objection if we can prove that there are compelling reasons for such processing, which prevail over your interests, rights, or liberties or if the processing serves the assertion, exercising or defense of legal claims.
Right to revoke
If the processing of data is based on your consent, you can revoke it at any time.
Right to complain
In order to ascertain your rights, you may contact us by e-mail at info@5schaetze.at or by regular mail to the address stated in item 1. In order to be able to guarantee the protection of your rights and your privacy, we may require additional information (for example: a copy of your identification) to verify your identity if in doubt.
In case of any violation of the protection of your data, you may direct any complaints to
Oesterreichische Datenschutzbehoerde [Austrian Data Protection Authority]
Barichgasse 40-42, 1030 Vienna [Austria]
Telephone: +43 1 52 152-0
Е-mail: dsb@dsb.gv.at