Privacy Policy

Statement on the Duty to Provide Information

Privacy Policy and Information Pursuant to Articles 13 and 14 of the GDPR

1. General Information

The protection of your personal data is of particular importance to us. We therefore process your data exclusively in a lawful manner in accordance with legal provisions (in particular the GDPR, DSG 2018, and TKG 2021). In this privacy policy, we inform you about the most important aspects of data processing—the nature, scope, and purposes of the collection and use of personal data—in connection with the use of our website as well as in connection with other services provided by our company.

2. 1.1. Data Controller

The controller (as defined in Article 4(7) of the GDPR) responsible for the processing of your personal data (personal data as defined in Article 4(1) of the GDPR) is:

Elsbethen Tourism Association
Vorderfager 6A
A-5061 Elsbethen near Salzburg
Tel. +43 662 62 91 65
Email: info@elsbethen.info

Data Protection Officer:

We take the protection of personal data seriously and have appointed an external data protection officer for this purpose. Our data protection officer is MMag. Martin Zeppezauer, Thurnbichlweg 54, A-6353 Going am Wilden Kaiser (www.zepedes.com). You can contact our Data Protection Officer at the following email address: martin@zepedes.com Contact us.

1.2. Purposes, Categories of Data, and Legal Bases for the Processing of Personal Data

Purposes of Processing

The purposes of processing your personal data generally stem from our business activities as a tourism organization: providing our online services, processing customer inquiries, orders, and reservations, accounting, and communicating with business partners and customers. For detailed information on the purposes of processing and, where applicable, on further processing for other compatible purposes, as well as on the categories of data processed, please refer to the detailed descriptions of the individual data processing procedures.

 

General Data Categories

  • Personal Master Data (e.g., name, date of birth, age, address)
  • Contact information (e.g., email address, phone number, fax number)
  • Communication data (time and content of the communication)
  • Order or booking information (e.g., goods ordered or services requested, and billing information such as the service period, payment method, invoice date, tax identification number, etc.)
  • Payment information (e.g., account number, credit card information)
  • Contract Data (Contents of Contracts of Any Kind)
  • Web usage data (e.g., server data, log files, and cookies)

Special categories of data („sensitive data“) pursuant to Article 9 of the GDPR

Health data (only if you provide this to us through your explicit consent to process your request (e.g., arranging a hotel that specializes in accommodating guests with food intolerances or allergies))

Legal Basis for Processing

In general, there is no obligation to provide the data described in this Privacy Policy. Failure to provide this data simply means that we cannot offer these services. The legal basis for processing your personal data, which is necessary to fulfill a contract with you or an order you have placed with us, is Article 6(1)(b) of the GDPR. To the extent that the processing of personal data is necessary to fulfill a legal obligation on our part (accounting obligations, bookkeeping obligations, or other statutory documentation requirements), Article 6(1)(c) of the GDPR serves as the legal basis. If the processing of data is carried out in your own vital interest, the legal basis for data processing is Article 6(1)(d) of the GDPR. If we process your data to perform a task carried out in the public interest („official authority“), the legal basis is Article 6(1)(e) of the GDPR. If the processing is necessary to protect a legitimate interest of our company or a third party, and your interests, fundamental rights, and fundamental freedoms do not override our interest, Article 6(1)(f) of the GDPR („legitimate interest“) serves as the legal basis for the processing. In this case, we will also inform you of our legitimate interests. To the extent that we have no other legal basis for the processing of personal data as explained above, we will request your consent to the data processing, in which case we will rely on Article 6(1)(a) of the GDPR or, in the case of the processing of sensitive data, on Article 9 (2)(a) of the GDPR as the legal basis. You may revoke this consent at any time free of charge, without affecting the lawfulness of the processing carried out on the basis of your consent prior to revocation.

1.3. Disclosure of Data to Processors and Third Parties

We process your personal data with the assistance of data processors who help us provide our services. These data processors are bound by an agreement with us, as defined in Article 28 of the GDPR, to strictly protect your personal data and may not process your personal data for any purpose other than providing our services. You can find out which data processors are involved in the detailed descriptions of the individual data processing operations.

Your personal data may be disclosed to service providers typical in this industry—such as banks, tax advisors, or auditors—other than our data processors. Personal data is transferred to government agencies and authorities only as required by mandatory national laws.

Depending on your request (e.g., for bookings and inquiries), your personal data will be shared—only to the extent necessary—with hotel partners or other tourism service providers (members of our organization) as required to fulfill your request. The personal data transmitted varies depending on the service.

With your express consent, if there are no available offers in Grödig that match your request, your data will be forwarded to the tourism associations of the surrounding towns in the Salzburg region (www.salzburg.umgebung.com) forwarded. You can select this option separately when submitting your request, if you wish!

1.4. Transfers to Third Countries

As a general rule, we process your personal data within the EU. If we process data in a third country (i.e., outside the European Union (EU) or the European Economic Area (EEA)) or if this occurs in connection with the use of services provided by our processors or third parties, this is done only if the requirements of Art. 44 et seq. of the GDPR for transfers to third countries are met: that is, on the basis of specific safeguards, such as an officially recognized determination that a level of data protection equivalent to that of the EU exists, or in compliance with officially recognized contractual obligations, the so-called „EU Standard Contractual Clauses.“ If we rely on the EU Standard Contractual Clauses as the legal basis for the transfer of your personal data, we will additionally assess the permissibility of this data transfer as part of a comprehensive risk assessment. Should we reach a negative conclusion in this assessment, we will not transfer this data to a third country without your explicit consent pursuant to Art. 49(1)(a) GDPR in conjunction with Art. 6(1)(a) GDPR.

1.5. Data Deletion and Retention Period

We will delete your personal data as soon as the purpose for which we collected it no longer applies. Data may also be retained if we process it for a purpose compatible with the original purpose. It may also be retained if required by laws, regulations, or other provisions to which our company is subject.

1.6. Data Sources

We collect your personal data exclusively from you and do not use any other data sources.

1.7. Profiling

We do not use any automated decision-making or profiling processes that have legal effects on you or similarly significantly affect you. However, with your consent, we will use your usage data to better understand your interests and thereby display information that may be of interest to you, provide you with personalized offers, or display relevant information to you on third-party websites or social media platforms.

1.8. Protecting Your Privacy Rights

Under the GDPR, you generally have the right to access, rectify, erase, and restrict the processing of your personal data. If the legal basis for the processing of your personal data is your consent or a contract concluded with you, you also have the right to data portability. You have the right to withdraw any consent you may have given for the processing of your personal data. This does not affect the lawfulness of the processing of your personal data up to the time of withdrawal. You have the right to object to the processing of your personal data for the purpose of direct marketing. If you object, your personal data will no longer be processed for direct marketing purposes. A detailed explanation of these rights can be found here in Chapter III.

Right to File a Complaint

If you believe that the processing of your data violates data protection law or that your data protection rights have otherwise been infringed, you may file a complaint with the competent supervisory authority. In Austria, this is the Data Protection Authority (Barichgasse 40-42, A-1030 Vienna, 1080 Vienna, email: dsb@dsb.gv.at).

2. Visiting our website

In this section, we explain how we process your personal data when you visit our website.

2.1. Website Layout

For technical reasons, based on the legal basis of Section 165 (3), sentence 3, of the TKG 2021 (required for the operation of our website), the following data—among other things—that your internet browser transmits to us or to our web hosting provider is collected (so-called „server log files“):

  • Browser type and version
  • Operating system used and device type (e.g., desktop / mobile)
  • The website from which you are visiting us (referrer URL)
  • Website you are visiting
  • Date and time of your visit
  • Your Internet Protocol address (IP address)

This data, which is anonymous to us, is stored separately from any personal information you may have provided, and therefore does not allow us to identify any specific individual. It is analyzed for statistical purposes to help us optimize our website and our offerings.

SSL or TLS encryption

For security reasons and to protect the transmission of confidential information—such as orders or inquiries you send to us as the website operator—this site uses SSL or TLS encryption. You can recognize an encrypted connection by the fact that the address bar of your browser changes from „http://“ to „https://“ or by the lock icon in your browser’s address bar. When SSL or TLS encryption is enabled, the data you transmit to us cannot be read by third parties.

Technical Service Providers

We create and edit the content of our website with the help of the following service providers, whom we have obligated through a corresponding agreement within the meaning of Article 28 of the GDPR to process your data exclusively within the scope of our mandate:

Technical Design:

WDW WerbeDesign Wanger e.U. (Hammerlweg 1, A-5071 Wals near Salzburg); For more information on data protection, visit: https://www.wdw.at/datenschutz.htm

Web Hosting:

RTM Business IT GmbH (Arnsdorf, A-5112 Lamprechtshausen). For more information on data protection, visit: https://www.rtm-bit.com/datenschutz.htm

2.2. Cookies

Cookie Banner – Cookies on Our Website

Our website uses cookies to help us make our website more user-friendly and efficient for you, to conduct statistical analyses of how our website is used, and to display content that may be of interest to you on other websites as well. Cookies are small text files used to store information during or about visits to websites and are stored on the website visitor’s computer. The legal basis for cookies that are strictly necessary for the proper functioning of our website (e.g., shopping cart cookies) is Section 165(3), Sentence 3 of the Telecommunications Act of 2021 (TKG 2021). Cookies that are not necessary for the functioning of our website (e.g., analytics or marketing cookies) are disabled and are only activated upon your consent pursuant to Article 6(1)(a) of the GDPR via our cookie banner („Accept“). By clicking „Settings,“ you can enable or disable individual cookies or groups of cookies. If you restrict the use of cookies on our website, you may no longer be able to use all features of our website to their full extent. Detailed information about the cookies used on our website is available in our cookie banner.

The legal basis for the use of this cookie banner (consent management platform), to manage and document your consent and settings regarding cookies and other tools requiring consent for access to our website, is our legal obligation pursuant to Art. 6(1)(c) of the GDPR. When you access our website, a connection is established with the server of our cookie banner provider, and a cookie is subsequently stored in your browser to save your cookie settings. The processed data is stored until the specified retention period expires or until you delete these cookies.

We use the following cookie banner / the following provider:

Consent Management Platform by WDW WerbeDesign Wanger e.U. (Hammerlweg 1, A-5071 Wals near Salzburg); For more information on data protection, visit: https://www.wdw.at/datenschutz.htm

 

Changing Cookie Settings in Your Web Browser

You can configure your web browser’s settings to control how it handles cookies—that is, which cookies are accepted or rejected. You can also delete cookies already stored on your computer or device at any time. The exact location of these settings depends on the specific web browser. Detailed information on this can be found in the help section of your web browser.

In addition, you have the option to generally opt out of cookies and similar tracking technologies through the services listed below by configuring your individual preferences—specifying which technologies for usage- and interest-based advertising you wish to allow:

2.3. Communicating with Us

Contact Form and Email

On our website, we offer you the option to contact us via email and/or through a contact form. In this case, the information you provide will be processed for the purpose of handling your inquiry on the legal basis of contract performance pursuant to Article 6(1)(b) of the GDPR. We have a legitimate interest pursuant to Article 6(1)(f) of the GDPR in using a contact form. This legitimate interest lies in providing our website visitors with a way to contact us that does not require them to open their own email client. There is no legal or contractual obligation to provide this personal data. Failure to provide this data simply means that you cannot submit your inquiry and we cannot process it. Data will only be disclosed to third parties if this is stated on the website or in this Privacy Policy, if it is necessary for the performance of a contract, or if required by law. We store your data only for as long as is necessary to process your inquiries or to address any follow-up questions.

2.4. Online Store(s) / Booking Portal(s)

For the purpose of providing contractual services, as well as their payment and fulfillment in connection with online purchases, reservations, and brochure orders, we process your personal master data, contractual and payment data, as well as communication data (IP address and server log files) based on the legal grounds of Article 6(1)(b) of the GDPR (performance of a contract) and Article 6(1)(c) of the GDPR (legal obligation to maintain records and archive data).

We store this data for as long as required by the purpose, as mandated by law (retention period for invoices pursuant to § 132 BAO for 7 years; gift certificate orders for 30 years until the expiration of the redemption period) or we need this data based on the legal basis of Article 6(1)(f) of the GDPR (legitimate interest) to defend against potential liability claims. If you cancel the order process, we will store the data for 14 days to resolve any issues that may have arisen during the order process.

There is no legal or contractual obligation to provide personal data. Failure to provide such data will simply mean that we cannot process your reservations or orders.

Feratel DESKLINE Online Bookings, Booking Inquiries, and Brochure Requests

To process online bookings, brochure requests, and inquiries, we process your personal data in order to provide you with the services you have booked, with the assistance of our service provider, feratel Media Technologies AG (Maria-Theresien-Straße 8, A-6020 Innsbruck). To this end, we store and process master data, communication data, contract data, and payment data from our customers, prospective customers, and other business partners. This processing is carried out for the purpose of providing contractual services or fulfilling pre-contractual obligations based on the legal grounds of Article 6(1)(b) of the GDPR (booking transactions, responding to requests for quotes, and sending brochures) as well as Article 6(1)(c) of the GDPR (legally required retention periods for bookings and invoices). To this end, the data fields marked as required are necessary for the establishment and performance of the contract. We disclose your personal data to third parties (hotel partners or other tourism service providers) in connection with these data processing activities based on the legal basis of Article 6(1)(b) of the GDPR (if necessary to process a booking), or on the basis of our legitimate interest pursuant to Article 6(1)(f) of the GDPR for the use of the corresponding booking software. We have entered into a corresponding agreement with feratel as a data processor pursuant to Article 28 of the GDPR, which ensures that your data is processed exclusively within the scope of our mandate. For more information on feratel’s data protection practices, please visit: https://www.feratel.com/datenschutz.html

Third-Party Payment Service Providers

To process payments for orders and bookings, we use external payment service providers—based on the legal basis of Article 6(1)(b) of the GDPR (performance of a contract)—through whose platforms you can make your payments. The payment data you enter as part of the order (e.g., account numbers, credit card numbers including security codes, passwords/TANs, etc.) is processed exclusively by our payment service providers and is not visible to us. We receive only a confirmation of the completed payment or a notification that the payment could not be processed from our payment service providers. For more information on data protection and the terms and conditions of our payment service providers, please visit:

Datatrans AG, Kreuzbühlstrasse 26, CH-8008 Zurich.
Tel. +41 44 256 81 91
Email: info@datatrans.ch
https://www.datatrans.ch/de/datenschutzbestimmungen/

2.5. Links to Other Online Stores

SalzburgerLand Card Online Store

To enable our users to quickly purchase the SalzburgLand Card online, we provide a link to the online ticket shop of SalzburgLand Tourismus GmbH (Wiener Bundesstraße 23, A-5300 Hallwang). This link is embedded in the page using an HTML link. Clicking on the link opens a new browser window. On this page, you can purchase the SalzburgerLand Card online by providing your personal information. For further information on the purpose and scope of data collection, as well as the further processing and use of the data by SalzburgLand Tourismus GmbH—which acts as the data controller responsible for the further processing of your personal data—and options for protecting your privacy, please refer to the privacy policy of SalzburgLand Tourismus GmbH: https://www.salzburgerland.com/de/impressum-und-datenschutz/.

SalzburgCard Online Store

To enable our users to quickly purchase the SalzburgCard online, we provide a link to the online ticket shop of Salzburg Tourismus GmbH (Auerspergstraße 6, A-5020 Salzburg). This link is embedded in the page using an HTML link. When you click on the link, a new browser window will open. On this page, you can purchase the SalzburgCard online by providing your personal information. For more information on the purpose and scope of data collection, as well as the further processing and use of your data by Salzburg Tourismus GmbH—which acts as the data controller responsible for the further processing of your personal data—and options for adjusting your privacy settings, please refer to the privacy policy of Salzburg Tourismus GmbH: https://cardstatic.feratel.com/doc/cardwebshop/scc01/DataProtection_de.pdf.

2.6. Web Analytics—Statistical Analyses of Our Website

Google Tag Manager

We use the service provided by Google Ireland Limited („Google“) (Gordon House, Barrow Street, Dublin 4, Ireland) to manage website tags through a shared tool. The Google Tag Manager tool itself (which implements the tags) is a domain that does not set cookies and does not collect any other personal data. The tool triggers other tags, which may in turn collect data. Google Tag Manager does not access this data. If a deactivation has been set at the domain or cookie level, it remains in effect for all tracking tags implemented using Google Tag Manager. For more information on Google’s privacy practices, visit: https://www.google.com/policies/privacy/. Google is a certified partner of the EU-U.S. Data Privacy Framework. The legal basis for (at least in some cases) data transfers to the U.S. is therefore an adequacy decision by the European Commission within the meaning of Art. 45(3) of the GDPR, by which the European Commission certifies that the U.S. provides an adequate level of data protection. For more information on Google’s data protection practices, visit: https://www.google.com/policies/privacy/. For more information on how Google uses personal data: https://business.safety.google/privacy/.

Google Analytics

Google is a certified partner of the EU-U.S. Data Privacy Framework. The legal basis for (at least in some cases) data transfers to the U.S. is therefore an adequacy decision by the European Commission within the meaning of Art. 45(3) of the GDPR, by which the European Commission certifies that the U.S. provides an adequate level of data protection. The IP address transmitted by the respective browser as part of Google Analytics is not combined with other data held by Google. On our behalf, Google will use the information collected to evaluate the use of the website and to compile reports on website activity. Data collection by Google Analytics can be prevented by adjusting the cookie settings for this website. You may also object to the collection and storage of your IP address and the data generated by cookies at any time with future effect. The corresponding browser plugin can be downloaded and installed from the following link: https://tools.google.com/dlpage/gaoptout. User data is stored for 14 months. For more information on Google's use of data, as well as options for settings and opting out, please see Google's Privacy Policy (https://policies.google.com/privacy) as well as in the settings for the display of ads by Google (https://adssettings.google.com/authenticated). For more information on how Google uses personal data: https://business.safety.google/privacy/.

Google Ads Conversion Tracking

Our website uses the „Google Ads Conversion Tracking“ service provided by Google Ireland Ltd. (Gordon House, Barrow Street, Dublin 4, Ireland). When we run ads on Google, we use what is known as conversion tracking. When you click on an ad placed by Google, a cookie is set for conversion tracking (valid for 30 days). This allows us to recognize that you clicked on one of our ads and were redirected to our site. However, we do not receive any personal information; we only learn the total number of users who clicked on one of our ads and were redirected to a page tagged with a conversion tracking tag. We use Google Ads Conversion Tracking based on your consent (settings via our cookie banner) pursuant to Art. 6(1)(a) of the GDPR. Google is a certified partner of the EU-U.S. Data Privacy Framework. The legal basis for (at least in some cases) data transfers to the U.S. is therefore an adequacy decision by the European Commission within the meaning of Article 45(3) of the GDPR, by which the European Commission certifies that the U.S. provides an adequate level of data protection. Further information on Google’s use of data, as well as options for settings and opting out, can be found in Google’s Privacy Policy (https://policies.google.com/privacy) as well as in the settings for the display of ads by Google (https://adssettings.google.com/authenticated). For more information on how Google uses personal data: https://business.safety.google/privacy/.

2.7. Web Marketing

Google Remarketing

Our website uses the features of „Google Analytics Remarketing“ in conjunction with the cross-device features of Google AdWords and Google DoubleClick, based on the legal basis of your consent pursuant to Art. 6(1)(a) of the GDPR. The provider is Google Ireland Ltd. (Gordon House, Barrow Street, Dublin 4, Ireland). This feature enables the advertising audiences created with Google Analytics Remarketing to be linked to the cross-device features of Google AdWords and Google DoubleClick. In this way, interest-based, personalized advertising messages—tailored to you based on your previous usage and browsing behavior on one device (e.g., a cell phone)—can also be displayed on another of your devices (e.g., a tablet or PC). If you have given your consent, Google will link your web and app browsing history to your Google Account for this purpose. This allows the same personalized ads to be displayed on any device on which you sign in with your Google Account. To support this feature, Google Analytics collects Google-authenticated user IDs, which are temporarily linked to our Google Analytics data to define and create audiences for cross-device advertising. Cookies are deleted after 1 year. Google is a certified partner of the EU-U.S. Data Privacy Framework. The legal basis for (at least in some cases) data transfers to the U.S. is therefore an adequacy decision by the European Commission within the meaning of Art. 45(3) of the GDPR, by which the European Commission certifies that the U.S. provides an adequate level of data protection. You can permanently opt out of cross-device remarketing/targeting by disabling personalized ads in your Google Account; to do so, follow this link: https://www.google.com/settings/ads/onweb/. The aggregation of the collected data in your Google Account is based solely on your consent, which you can provide to or revoke with Google (Art. 6 (1) (a) GDPR). For more information on Google’s privacy practices, visit: https://www.google.com/policies/privacy/. For more information on how Google uses personal data: https://business.safety.google/privacy/.

2.8. Integration of Additional Third-Party Services and Content

We incorporate third-party content and features into our website. This always requires that the providers of this content or these features collect users’ IP addresses. Without the IP address, they would not be able to send the content to the user’s browser. The IP address is therefore necessary for displaying this content. We make every effort to use only content whose providers use the IP address solely for the purpose of delivering the content. However, we have no control over whether third-party providers store the IP address, for example, for statistical purposes. The legal basis for the use of these services is, insofar as they are necessary for the functioning of our website, our legitimate interest pursuant to Art. 6(1)(f) of the GDPR; otherwise, it is your consent pursuant to Art. 6(1)(a) of the GDPR. Information regarding the purpose and scope of further processing and use of the data by the providers of the embedded services/content, as well as additional information within the meaning of Articles 13 and 14 of the GDPR, can be found via the information links listed below. The following services/content are embedded in our website:

Google Maps

Our website uses the Google Maps service provided by Google Ireland Ltd. (Gordon House, Barrow Street, Dublin 4, Ireland). This feature allows us to display relevant map content on our website. In doing so, your IP address, as well as information about your browser version and language settings, is transmitted to the servers of Google Ireland Ltd. According to Google’s own statements, the data is stored by Google for 1 year. We have a legitimate interest within the meaning of Art. 6(1)(f) of the GDPR in using Google Maps. Our legitimate interest lies in presenting our website in a consistent and visually appealing manner, as well as in providing a geographic overview of the offerings in our region. However, we only use Google Maps if you have given your consent. The legal basis for the processing of your data is therefore your consent pursuant to Article 6(1)(a) of the GDPR. For more information on Google’s privacy policy, please visit: https://www.google.com/intl/de/policies/privacy/. In the process, your IP address, as well as information about your browser version and language settings, is transmitted to the servers of Google Ireland Ltd. According to Google’s own statements, the data is stored by Google for 1 year. We have a legitimate interest within the meaning of Art. 6(1)(f) of the GDPR in using Google Maps. Our legitimate interest lies in presenting our website in a consistent and visually appealing manner, as well as in providing a geographic overview of the offerings in our region. However, we only use Google Maps if you have given your consent. The legal basis for the processing of your data is therefore your consent pursuant to Article 6(1)(a) of the GDPR. Google is a certified partner of the EU-U.S. Data Privacy Framework. The legal basis for (at least in some cases) data transfers to the United States is therefore an adequacy decision by the European Commission within the meaning of Article 45(3) of the GDPR, by which the European Commission certifies that the United States provides an adequate level of data protection. For more information on Google’s privacy policy, please visit: https://www.google.com/intl/de/policies/privacy/. For more information on how Google uses personal data: https://business.safety.google/privacy/.

YouTube

We embed videos from the “YouTube” platform, provided by Google Ireland Ltd. (Gordon House, Barrow Street, Dublin 4, Ireland), in enhanced privacy mode. This is done pursuant to Article 6(1)(f) of the GDPR, where our interest lies in the seamless integration of the videos and the resulting appealing design of our website. However, we only use YouTube if you have given your consent. The legal basis for the processing of your data is therefore your consent pursuant to Article 6(1)(a) of the GDPR, which you may revoke at any time with future effect. When you visit a page on which we have embedded a YouTube video, a connection is established with Google’s servers, and the content is displayed on the website by being transmitted to your browser. According to Google, in enhanced privacy mode, your data (in particular, which of our web pages you have visited) and device-specific information, including your IP address, are only transmitted to the YouTube server when you watch the video. Google is a certified partner of the EU-U.S. Data Privacy Framework. The legal basis for (at least in some cases) data transfers to the U.S. is therefore an adequacy decision by the European Commission within the meaning of Art. 45(3) of the GDPR, by which the European Commission certifies that the U.S. provides an adequate level of data protection. If you are logged into Google at the same time, this information will be associated with your Google account. You can prevent this by logging out of your Google account before visiting our website or by adjusting your individual settings in your Google account via the following link: https://adssettings.google.com/authenticated. For more information on YouTube's privacy policy, visit: https://www.google.com/policies/privacy/. For more information on how Google uses personal data: https://business.safety.google/privacy/.

3. Other Data Processing in Business and Customer Interactions

In this section, we provide information about other data processing activities that take place outside of our website.

3.1. Job Applications

The contact information and application materials you submit to us as part of a job application are processed by us exclusively for internal purposes to select suitable candidates for employment. There is no legal or contractual obligation to provide personal data. Failure to provide this information simply means that you will not be able to submit your application and we will not be able to process it. The personal data provided in this process will be stored by us in accordance with legal requirements for a maximum of 6 months; if the applicant expressly consents to having their documents retained, the documents will be stored for a maximum of 2 years.

3.2. Online Presence on Social Media

In addition to our website, we maintain an online presence on social networks and platforms. The legal basis for using these services is our legitimate interest pursuant to Article 6(1)(f) of the GDPR. Our legitimate interest lies in communicating with customers and business partners who are active on these platforms and in informing them about our services via these networks. When accessing the respective networks and platforms, the terms and conditions and privacy policies of the respective operators of these networks apply. Further information regarding the processing of your personal data by the respective providers of these services (which personal data is processed for what purposes and on what legal basis, how long this data is stored by the respective provider, and, where applicable, information on profiling and transfers to third countries) can be found below in the descriptions of the individual services or via the information links provided there.

Facebook Fan Page

We operate a Facebook fan page on the „Facebook“ platform operated by Meta Platforms Ireland Ltd. (4 Grand Canal Square, Grand Canal Harbour, Dublin 2, Ireland).  The legal basis for processing the associated personal data is our legitimate interest within the meaning of Article 6(1)(f) of the GDPR. Our legitimate interest lies in providing customers and potential new customers with information about us and our offerings through this information channel. Please note that you use this Facebook page and its features at your own risk. This applies in particular to the use of interactive features (e.g., commenting, sharing, rating). When you visit our Facebook page, Facebook collects, among other things, your IP address as well as other information gathered via cookies or other tracking technologies. The data collected about you in this context is processed by Facebook and may be transferred (at least in part) to the United States. Facebook / Meta is a certified partner of the EU-US Data Privacy Framework. The legal basis for (at least in some cases) data transfers to the United States is therefore an adequacy decision by the European Commission within the meaning of Art. 45(3) of the GDPR, by which the European Commission certifies that the United States provides an adequate level of data protection. The European Court of Justice (ECJ) has ruled that „Facebook“ and the operators of a Facebook fan page process this personal data as joint controllers within the meaning of Article 26 of the GDPR. Facebook makes the joint data processing agreement available at the following link: https://www.facebook.com/legal/terms/page_controller_addendum. As the operators of our fan page, we have no influence over the specific terms of the agreement. Facebook describes in general terms in its Privacy Policy what information it receives and how it is used (including how Facebook uses data from visits to Facebook pages for its own purposes, to what extent activities on the Facebook page are attributed to individual users to personalize content or advertising, how long Facebook stores this data, whether data from a visit to the Facebook page is shared with third parties, and much more) is described in general terms by Facebook in its Data Use Policy. There you will also find information on how to contact Facebook as well as options for managing ad settings. The Privacy Policy is available at the following link: https://www.facebook.com/privacy/policy/. As fan page administrators, we do not receive any additional (non-public) information about individual Facebook users from Facebook’s analytics; rather, we receive only statistically processed information (e.g., total number of page views, page activity, post reach, etc.) that helps us make our posts more engaging.

Instagram

Instagram is an online service for sharing photos and videos. We have a profile (account) on Instagram. The provider is Meta Platforms Ireland Ltd. (4 Grand Canal Square, Grand Canal Harbour, Dublin 2, Ireland). For more information about the processing of your personal data through the use of Instagram, as well as contact information, please visit: https://privacycenter.instagram.com/policy/

TikTok

TikTok is a video platform for short videos that also offers social networking features. We use this service to generate interest in our offerings through short videos. The provider is TikTok Technology Ltd. (10 Earlsfort Terrace, Dublin, D02 T380, Ireland). For more information about the processing of your personal data through the use of TikTok, as well as contact information, please visit: https://www.tiktok.com/legal/privacy-policy-eea?lang=de.

YouTube

We use a YouTube channel on the „YouTube“ video platform to publish our videos. The service provider is Google Ireland Limited (Gordon House, Barrow Street, Dublin 4, Ireland). For more information about the processing of your personal data when using YouTube, as well as contact information, please visit: https://www.google.com/policies/privacy/.

3.3. Contests

The personal data you provide to participate in our sweepstakes (email address, name, mailing address) will be used by us solely to determine a winner, notify the winner of the prize, and send the prize. Your data will not be shared with third parties. The legal basis for processing your personal data is the performance of a contract pursuant to Article 6(1)(b) of the GDPR. There is no legal or contractual obligation to provide personal data. Failure to provide this data will simply mean that you cannot participate in the sweepstakes. Your data will be stored for the duration of the sweepstakes and—for the purpose of processing any claims for prizes or damages—for a maximum of 3 years thereafter, after which it will be deleted. By participating, you also agree that, if you win, your name will be published on our website and on our public social media channels.

3.4. Photo and Video Documentation at Events

At events, we may take photos and videos of the event—or have them taken by photographers we hire—in which you, as a participant, may be recognizable. We need these photos and videos to document and promote our events and will therefore publish them in our media (e.g., print brochures, website, and social media) and make them available to other media outlets (print and online) for the purpose of promoting our events. You are under no legal or contractual obligation to provide this data. The legal basis for the processing of your personal data (images and videos in which you are recognizable) is our legitimate interest pursuant to Article 6(1)(f) of the GDPR. Our legitimate interest lies in our right to public relations (presenting our activities) and the promotion of our events. You have the right to object to this processing. Please send your objection to the email address provided by us in this Privacy Policy. However, it can be assumed that our aforementioned interest in using the photos does not unduly interfere with your rights as the person depicted. This is particularly true since we take these photos and videos in public spaces and provide advance notice of their creation and use prior to each event. We also always take care to ensure that no legitimate interests of the people depicted are infringed upon. Should your personal rights and freedoms be infringed upon by an image or video we have created for reasons warranting special consideration, we will refrain from further processing or publication. We cannot remove content from print media that has already been distributed. In such cases, however, we will delete the content from our website or social media channels. We generally delete photos and videos from events once we no longer need them for documenting or promoting those events.

3.5. Guest/Visitor Wi-Fi

We offer a password-protected visitor Wi-Fi network at our offices. In order to provide you with hotspot services, we need to use certain personal data from your device. In this context, the MAC addresses (Media Access Control addresses) of devices may also be temporarily stored. Furthermore, we may store log data („log files“) regarding the nature and extent of your use of the services for 7 days. This data cannot be directly linked to you personally, but it can be directly linked to the device you are using and thus indirectly linked to you. To provide this service, we use the services of ETS – EDV & Technik Stöckl (Glanstraße 6, A-5082 Grödig) as our data processor. We have entered into a corresponding agreement with our data processor in accordance with Art. 28 of the GDPR, which ensures that your data is processed exclusively within the scope of our mandate.

3.6. Registration for Activities and Events

At our information offices, you can register for events organized by various providers in our region. For this purpose, we process your personal data (name, email address, and phone number). We process this data on the legal basis of Article 6(1)(b) of the GDPR (performance of a contract/pre-contractual measures) and also share it with the respective event organizer. We will delete or destroy this data after the event.

3.7. Newsletter Service

You can subscribe to our newsletter through our website. To do so, we need your email address and your consent to receive the newsletter.

Once you've signed up for the newsletter, we'll send you a confirmation email with a link to confirm your subscription.

You can cancel your newsletter subscription at any time. Please send your cancellation request to the following email address: [info@elsbethen.info] Or cancel your subscription in the next newsletter by clicking the corresponding link in the footer of the newsletter. We will then immediately delete your data related to the newsletter. 

This withdrawal does not affect the lawfulness of the processing carried out on the basis of the consent until the time of withdrawal.

Current version of the Privacy Policy as of February 1, 2025