Information in Accordance with Article 13/14 GDPR
Legally Required Information of Austrian National Tourist Office

On these pages, we inform you in accordance with Art. 13 and 14 GDPR about the processing of your personal data and the rights that you are entitled to as a data subject.

Name and contact details
Party responsible for data processing:

Österreich Werbung
Vordere Zollamtsstraße 13, 1030 Vienna, Austria
Tel.: +43 1 588 66-0
Fax: +43 1 588 66-40
E-Mail: datenschutz@austria.info

Purposes and Legal Basis of the Processing

We process,

in accordance with Article 6(1)(a) of the GDPR, the personal data of guests and individuals interested in holidays in Austria based on their consent, which they may provide, for example, when requesting information materials, participating in guest surveys and tourism research projects, or subscribing to our newsletters. Consent can be withdrawn at any time with effect for the future. For instance, you may withdraw your consent to the processing of your personal data for marketing and advertising purposes if you no longer agree with the processing. The legality of processing carried out before the withdrawal remains unaffected.
in accordance with Article 6(1)(b) and (f) of the GDPR, the personal data of subscribers to our tourism research publications, as well as participants in industry events, tourism fairs, online training sessions, and competitions, to fulfil our contractual obligations and protect our legitimate interests.
in accordance with Article 6(1)(a) and (f) of the GDPR, the personal data of users of our websites, social media channels, and other online services for the purpose of optimising and aligning our content, targeting visitors with tailored advertising offers, and investigating disturbances and security incidents. This is done based on the consent provided by the users as well as the legitimate interests we hold as operators of these services and in our capacity as the national Austrian tourism organisation.
in accordance with Article 6(1)(a), (b), and (f) of the GDPR, personal data from Austrian and international tourism companies and tourism partners based on their consent to receive information materials, to fulfil contractual obligations or pre-contractual measures, and due to the legitimate interests we hold in our role as the national Austrian tourism organisation.

Where we process personal data to protect legitimate interests, this is done based on a balancing of interests against the rights and interests of the individuals concerned, for the following purposes:

Promotion and marketing of Austrian tourism offers as part of our responsibilities as the national Austrian tourism organisation
Protection against financial loss or reputational damage, property protection
Safeguarding our legal interests and defending legal claims
Fraud prevention, investigation of disturbances, and security incidents

Processed Data Categories

For guests and individuals interested in Austria, we process personal details such as name, address, language, and, if provided, date of birth, email address, telephone number, and specific interests. We also store the origin of the contact, the type of enquiry, notes on registration or consent, materials and marketing actions sent, as well as information about previous activities and interactions.

For participants in competitions and prize draws, we process data required to carry out the event, as well as data they have voluntarily provided to us. Typically, this includes names and electronic contact details, entries and evaluation results, and, where applicable, photos and details of interests.

As part of our tourism research, we primarily process statistical data, such as overnight stay figures or customer satisfaction levels. When surveys are conducted, we store the responses exclusively in anonymised form, so they cannot be traced back to the survey participants.

For subscribers to our studies and publications in the field of tourism research, we process names, addresses, and electronic contact details, the name, address, and type of the associated company, as well as the names and contact details of other authorised users. When studies are downloaded from the internet, we process the time and network address of the download to detect breaches of our terms of use.

For Austrian and international tourism partners, in addition to names, addresses, and electronic contact details, we may also process information about contact persons and their areas of responsibility. We store previous enquiries and activities, offers and agreements, invitations, and similar data that arise during business and marketing activities. Depending on the specific order, additional data may be stored, such as company profiles and details of exhibition stands as part of our tourism events.

In principle, we only process data that is absolutely necessary for the respective processing purpose or that has been voluntarily provided to us. No processing is carried out for automated decision-making, including profiling, as defined by Article 22 of the GDPR.

Recipient of Personal Data

We do not generally share personal data with third parties unless this is absolutely necessary for the respective processing or is explicitly requested by the individuals concerned.

Where there is a legal obligation, personal data will be transmitted to public authorities and institutions, such as regional or tax authorities. To defend our legal or economic claims, personal data may be shared with legal representatives and courts.

If we engage data processors to carry out processing on our behalf, they are contractually obligated to comply with our instructions. Personal data is not sold or otherwise marketed to third parties.

Duration of Data Storage

Data processed on the basis of consent is generally stored until the consent is withdrawn.

For data processed in the context of contractual relationships, the retention period is determined by legal regulations on documentation and record-keeping obligations. As a rule, this period is seven years. In exceptional cases, particularly for certain contractual matters, the retention period may be longer.

Data related to the assertion, exercise, or defence of legal claims is stored for as long as necessary for the respective purpose. The retention period is primarily based on statutory limitation periods and is typically three years.

Data concerning Austrian tourism companies and tourism partners, processed in fulfilment of our role as the Austrian tourism organisation, is generally deleted three years after the partner ceases business activities.

Data Subject Rights

You have the right to:

Request information about your personal data in accordance with Article 15 of the GDPR;
Request the correction or completion of your personal data in accordance with Article 16 of the GDPR;
Request the deletion of your personal data in accordance with Article 17 of the GDPR;
Request the restriction of the processing of your personal data in accordance with Article 18 of the GDPR;
Request the transfer of your personal data, which you have provided to us, to yourself or to another data controller in accordance with Article 20 of the GDPR;
Object to the processing of your personal data in accordance with Article 21 of the GDPR;
Withdraw your previously given consent at any time with effect for the future.

Please use the designated technical options for this purpose or contact the addresses provided above.

You also have the right to lodge a complaint with a data protection authority. In Austria, the competent authority is the Austrian Data Protection Authority, Barichgasse 40-42, 1030 Vienna.

As of: June 2024