Data Privacy Policy

The controller responsible for processing your personal data on our website is TSG Tourismus Salzburg GmbH. Our details can be found in the Legal notice.

Data Protection Officer

You can contact our Data Protection Officer at privacy@salzburg.info.

Data Protection

We take the protection of your personal data very seriously. We process your personal data in accordance with the applicable data protection legislation and this Privacy Policy. As a rule, our website can be used without providing personal data. Where personal data (such as your name, address or email address) is collected on our website, it is provided voluntarily wherever possible. Unless otherwise stated in this Privacy Policy, all processing of personal data takes place within the European Union.

Online Voucher Shop

If you purchase vouchers through our online shop, the data required to issue the voucher and prepare the invoice will be processed for the purpose of fulfilling your order. The legal basis is the performance of a contract or the implementation of pre-contractual measures (Article 6(1)(b) GDPR). The data will be deleted after the statutory retention period (seven years) has expired. Data is transmitted to payment service providers so that the payment method used can be verified and authorised.
In the online shop, you may also register for a user account so that you can view your previous orders and complete new purchases more quickly. Data relating to inactive user accounts will be deleted 24 months after the statutory retention period for purchased vouchers has expired.

Contact Form

When you submit the contact form, the personal data you enter will be processed for the purpose of handling your enquiry on the basis of the consent you provide by submitting the form. There is no legal or contractual obligation to provide the personal data. If you do not provide it, the only consequence is that you will be unable to submit your enquiry and we will be unable to process it. You have the right to withdraw your consent at any time by giving written notice, without affecting the lawfulness of processing carried out on the basis of your consent before its withdrawal. You have the right to object at any time, by giving written notice, to the use of your personal data for direct marketing purposes. If you object, your personal data will no longer be processed for direct marketing purposes.

Email Newsletter

By selecting the checkbox, you consent to the processing of the personal data you have entered for the purpose of receiving information about promotions, news and events by email newsletter until you withdraw your consent or object. Information about your use of the newsletter, such as clicking individual articles or opening the newsletter, is also recorded, aggregated and used to optimise its content and delivery. There is no legal or contractual obligation to provide the personal data. If you do not consent, the only consequence is that you will not receive an email newsletter. You have the right to withdraw your consent at any time by giving written notice or by clicking the unsubscribe link in the email newsletter, without affecting the lawfulness of processing carried out on the basis of your consent before its withdrawal. You may object in the same way to the use of your personal data for direct marketing purposes. If you object, your personal data will no longer be processed for direct marketing in the form of an email newsletter.

Processors and Data Recipients

We process your personal data with the assistance of processors that support us in providing our services (such as web hosts and email newsletter delivery services). These processors are contractually required to protect your personal data rigorously and may process it only for the purpose of providing our services. Your personal data is disclosed only to service providers customarily used in business, such as banks (where payments are made to you), tax advisers (if you appear in our accounts) and delivery service providers (where items are sent to you), among others.

Information on the Use of Cookies:

This website uses software to analyse how the website is used. Analysing this data can provide valuable insights into users’ needs. These insights help us further improve the quality of our services. So-called cookies are used for this purpose. Cookies are data stored in your browser that make it possible to recognise a visitor on an anonymous basis. Cookies can generally be rejected or deleted using the appropriate browser settings. The statements made here about cookies also apply in a similar way to other technical browser functions, such as local storage and session storage. Some of the cookies on this website are necessary for the website to function and are placed on the basis of our legitimate interest in operating the website securely and efficiently. As a rule, no information is disclosed to third parties for their own business purposes in this context.
Cookies for analytics and profiling purposes are used only with your express consent.

We use “CookieYes”, provided by CookieYes Limited, 3 Warren Yard, Warren Park, Wolverton Mill, Milton Keynes MK12 5NW, United Kingdom, to manage consent. For technical reasons, the publicly visible IP address of your device is transmitted to CookieYes, and a strictly necessary cookie containing information about your consent is stored on your device. We have entered into a data processing agreement with CookieYes under which CookieYes may not use the data for its own purposes. Although the United Kingdom is not a member of the European Union, the European Commission has determined by a decision pursuant to Article 45 GDPR that the United Kingdom provides a level of data protection comparable to that of the EU. No separate legal basis is therefore required for this transfer to a country outside the EU.
You may withdraw any consent you have given at any time HERE.

Server Log File

For the purpose of monitoring technical functionality and improving the operational security of the web server, this website processes the following personal data in a server log file on the basis of the controller’s overriding legitimate interest (technical security measures):

  • content accessed
  • date and time of the server request
  • browser type / browser version
  • operating system used
  • IP address

 

This data is stored only temporarily and is subsequently deleted.

Facebook Pixel

This website uses Facebook Pixel, a web analytics service provided by Meta Platforms Ireland Limited, 4 Grand Canal Square, Dublin 2, Ireland (“Meta”), on the legal basis of your consent (analysis of website use). Some of the data is transferred to the United States. The data is transferred to the United States on the basis of the EU–US Data Privacy Framework. When you visit our website, software establishes a connection to Facebook’s servers and transmits data to Facebook servers, some of which are located in the United States. Facebook Pixel also uses cookies to store information about website users and analyse their use of the website. According to Meta, Facebook will use the collected data to evaluate use of the website, compile reports on website activity and provide other services relating to website and internet use. Meta may also transfer this information to third parties where required by law or where such third parties process the data on Facebook’s behalf. Detailed information about how Facebook handles user data can be found in Facebook’s privacy policy.

You can prevent Facebook Pixel from collecting your user data on this website by clicking the following link. An opt-out cookie will be placed to prevent your data from being collected during future visits to this website: Disable Facebook Pixel.

Google Tag Manager

To manage and control individual elements on this website, we use Google Tag Manager provided by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland, tel.: +353 1 543 1000, fax: +353 1 686 5660, email: support@google.com (“Google”), which in turn transfers your data to the United States for further processing. Google Tag Manager’s functions are strictly necessary for our website. However, only the IP address of your device is transmitted to Google for technical reasons. This takes place on the basis of our legitimate interest in the secure, technically reliable and efficient management of the services on our website (Article 6(1)(f) GDPR). We have entered into a data processing agreement with Google in this regard, which requires Google, among other things, not to use the transmitted data for its own purposes. We point out that the United States provides a lower level of data protection than the EU and that US companies may be required to disclose data to courts, law enforcement agencies, supervisory authorities or security bodies. Google has undertaken to comply with the principles of the EU–US Data Privacy Framework (DPF) in order to achieve a level of data protection comparable to that of the EU. Pursuant to Article 45 GDPR, no additional legal basis is therefore required for the transfer of data to the United States.

Google Analytics

For error analysis and statistical evaluation of our website, and only with your consent, our website uses Google Analytics, an analytics service provided by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland, tel.: +353 1 543 1000, fax: +353 1 686 5660, email: support@google.com (“Google”), which in turn transfers your data to the United States for further processing. We point out that the United States provides a lower level of data protection than the EU and that US companies may be required to disclose data to courts, law enforcement agencies, supervisory authorities or security bodies. Google has undertaken to comply with the principles of the EU–US Data Privacy Framework (DPF) in order to achieve a level of data protection comparable to that of the EU. Pursuant to Article 45 GDPR, no additional legal basis is therefore required for the transfer of data to the United States.

Google Maps

This website uses Google Maps to display interactive maps and provide directions. Google Maps is a mapping service provided by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland, tel.: +353 1 543 1000, fax: +353 1 686 5660, email: support-at@google.com (“Google”). When you use Google Maps, information about your use of this website, including your IP address and the starting address entered in the route-planning function, may be transferred to Google in the United States. When you access a page on our website that contains Google Maps, your browser establishes a direct connection to Google’s servers. Google sends the map content directly to your browser, which embeds it in the website. We therefore have no control over the extent of the data collected by Google in this way. To the best of our knowledge, this includes at least the following data:

  • date and time of the visit to the relevant webpage,
  • internet address or URL of the webpage accessed,
  • IP address,
  • starting address entered for route planning.

 

The transfer of data is necessary for the map to be displayed correctly and takes place on the basis of your express consent. We have entered into a data processing agreement with Google under which Google may not use the data for its own purposes. Google has undertaken to comply with the principles of the EU–US Data Privacy Framework (DPF) in order to achieve a level of data protection comparable to that of the EU. Pursuant to Article 45 GDPR, no additional legal basis is therefore required for the transfer of data to the United States.

YouTube

This website uses YouTube to display videos. YouTube is a service provided by Google LLC, 1600 Amphitheatre Parkway, Mountain View, California 94043, USA. When you use YouTube, information about your use of this website may be transferred to Google in the United States. When you access a page on our website that contains YouTube videos, your browser establishes a direct connection to Google’s servers. Google sends the video directly to your browser, which embeds it in the website. We therefore have no control over the extent of the data collected by Google in this way. To the best of our knowledge, this includes at least the following data:

  • date and time of the visit to the relevant webpage,
  • internet address or URL of the webpage accessed,
  • IP address,
  • video accessed and the quality settings used.

 

We have no control over Google’s further processing and use of the data and therefore cannot accept responsibility for it. YouTube videos are activated only with your consent (Article 6(1)(a) GDPR).

For information about the purpose and scope of data collection, Google’s further processing and use of the data, your rights in this regard and the settings available to protect your privacy, please refer to Google’s Privacy Policy (https://policies.google.com/privacy?hl=de).
Google LLC has undertaken to comply with the provisions of the EU–US Data Privacy Framework (DPF), which the European Commission has recognised as providing adequate protection for personal data. Therefore, pursuant to Article 45 GDPR, no further legal basis is required for the transfer of data to the United States.

Data Protection Information on Video Surveillance

Video surveillance with recording is used on the premises of TSG Tourismus Salzburg GmbH, including the premises of Salzburg Congress, Paracelsusbad and Kurhaus, to protect people and property and to investigate accidents, incidents and criminal offences. The system does not include technical person-recognition functionality. 
Data protection information on video surveillance pursuant to Article 13 GDPR

Whistleblowing System

For confidential or anonymous reports of unlawful conduct, we use a whistleblowing system available at https://whistleblowersoftware.com/secure/TSG . Any contact details or additional information you enter in connection with a report will be processed confidentially. The legal basis for processing is a legal obligation arising from the Austrian Whistleblower Protection Act (HinweisgeberInnenschutzgesetz – HSchG) (Article 6(1)(c) GDPR). This also applies to the processing of special categories of data or sensitive data pursuant to Article 9(2)(g) GDPR.

You may submit a report anonymously, in which case none of your personal data will be processed.

If you decide to submit a confidential report, your name and, optionally, your telephone number and email address will be stored and forwarded to the internal reporting office, which will handle your case confidentially and will not disclose your data within the company.

You may submit a report orally by recording an audio file, which will be uploaded to our servers. You can enable voice distortion to ensure the highest possible degree of anonymity.

You may also upload documents to be attached to the case. These documents may contain personal data.
Data relating to reports received will be retained for five years from the most recent data transmission, unless a longer retention period is required after investigative proceedings have been initiated.

Information is disclosed to legal advisers appointed by us who are subject to professional confidentiality obligations and, where applicable, to public authorities for the purpose of investigating and initiating proceedings. Information is also disclosed to technical service providers that support us in operating the whistleblowing system. However, they may not use the data for their own purposes and are bound by additional agreements to the strict requirements of the General Data Protection Regulation and the associated high security standards.

When reports are processed in accordance with the Austrian Whistleblower Protection Act, the data subject rights that would otherwise apply are restricted by law. This applies in particular to the right of access, the right to rectification, the right to erasure, the right to information, the right to restriction of processing, the right to object and the right to be notified of a personal data breach.

Your Rights

You have the right of access, rectification and erasure and the right to restriction of the processing of your personal data. Where the legal basis for processing your personal data is your consent or a contract concluded with you, you also have the right to data portability. You have the right to withdraw any consent you may have given to the processing of your personal data. Withdrawal does not affect the lawfulness of the processing of personal data carried out before the withdrawal. You have the right to object to the processing of your personal data for direct marketing purposes. If you object, your personal data will no longer be processed for direct marketing purposes. You also have the right to lodge a complaint with a supervisory authority.
Please note that the rights referred to here are restricted by law when reports are processed through the whistleblowing system.