Privacy Policy

As a tourism association, we process the personal data of our members, supporters, prospective customers, business partners, and other persons (collectively referred to as “data subjects”) where we maintain a membership or other business relationship with them and perform our duties, and where we are recipients of services, grants or contributions.

In addition, we process personal data with due care on the basis of our legitimate interests pursuant to Article 6(1)(f) GDPR, e.g. for administrative purposes or public relations activities.

The data processed in this context, as well as the nature, scope, purpose and necessity of the processing, are determined by the underlying membership or contractual relationship, which also establishes the obligation to provide certain data.

We delete data that is no longer required for the performance of our tasks under the Tiroler Tourismusgesetz (Tyrolean Tourism Act) or for other operational purposes. The applicable retention period is determined by the respective tasks and contractual relationships. Data is retained for as long as it remains relevant to business operations or for the purpose of addressing potential warranty or liability obligations, based on our legitimate interests in the clarification and settlement of such obligations. The necessity of retaining personal data is reviewed regularly. In all other cases, statutory retention periods apply. Please also refer to the section “General information on data storage and deletion”

Categories of data processed

• Member data (e.g. full name, company name, contact details including address, etc.)
• Contact data (e.g. postal addresses, email addresses or telephone numbers)
• Information relating to membership fees, participation in events, etc.)
• Payment data (e.g. bank details, invoices, payment history)
• Content data (e.g. text or image-based messages and posts, and related information)

Data subjects

• Members
• Communication partners
• Purposes of processing
• Safeguarding, promotion and representation of local and regional tourism interests in accordance with Section 3 of the Tiroler Tourismusgesetz (Tyrolean Tourism Act) 2006
• Communication
• Organisational and administrative procedures

Public relations and information purposes
This includes all business processes and operational procedures required for these purposes. 

Legal bases
Legitimate interests (Article 6(1)(f) GDPR); Legal obligation (Article 6(1)(c) GDPR).

Further information on processing activities, procedures and services:

Membership administration
Procedures required for member administration include the acquisition and admission of new members, the development and implementation of member retention measures, and ensuring effective communication with members. These activities involve the careful collection and maintenance of member data, the regular updating of member information, and the management of membership contributions, including invoicing and settlement.
Legal bases
Legitimate interests (Article 6(1)(f) GDPR), Membership contract (articles of association) (Article 6(1)(b) GDPR).

Contribution management
Processing activities required for managing membership fees include recording contribution data upon admission of a member, tracking membership payments and systematically updating payment status, processing payment transactions, handling reminders for overdue payments, reconciling accounts in the context of receivables and payables, and maintaining the relevant books and records.

Legal bases
Legal obligation (Article 6(1)(c) GDPR), Legitimate interests (Article 6(1)(f) GDPR), Membership contract (articles of association) (Article 6(1)(b) GDPR).
 

Events and organisational operations

• Planning, execution, and follow-up of events, as well as the general management of statutory activities.
• Planning includes the collection and processing of participant data, coordination of logistical requirements, and determination of the event agenda.
• Implementation includes managing participant registration, updating participant information during the event, and recording attendance and participant activities.
• Post-event follow-up includes analysing participant data to evaluate event success, preparing reports, and archiving relevant event information.
• General organisational operations include managing member data, communicating with members and prospective members, and organising internal meetings and sessions.

Legal bases

• Legitimate interests (Article 6(1)(f) GDPR),
• Membership contract (articles of association) (Article 6(1)(b) GDPR).

Public relations
Processing activities include creating and distributing informational materials, maintaining contact data for press and media relations, and organising and conducting press conferences and public events.
The creation of informational materials involves gathering and preparing information for press releases, newsletters, reports, and other publications.
Distribution takes place via digital and traditional channels, including email distribution lists, websites, and social media. The maintenance of contact data includes collecting and updating data relating to media contacts and other relevant stakeholder groups.
The organisation of press conferences and events includes the planning and execution of these events, managing invitations, and coordinating event logistics.
Interaction with media and stakeholder groups takes place through direct communication with journalists, bloggers, and other opinion leaders, by responding to enquiries, and by providing information.

Legal bases

• Legitimate interests (Article 6(1)(f) GDPR),
• Membership contract (articles of association) (Article 6(1)(b) GDPR)

The personal data of service recipients and clients, business partners, and other third parties is processed in the context of contractual and comparable legal relationships, as well as in connection with pre-contractual measures such as the initiation of business relationships. This processing supports and facilitates business operations in areas such as customer management, sales, payment processing, accounting, and project management.

The collected data is used to fulfil contractual obligations and to ensure efficient and effective business processes. This includes the processing of business transactions, the management of customer relationships, the optimisation of sales strategies, and the management of internal accounting and financial processes. 

In addition, the data supports the protection of the controller’s rights and facilitates administrative tasks and the organisation of the company.

Personal data may be disclosed to third parties where this is necessary to fulfil the specified purposes or to comply with legal obligations. Data is deleted once statutory retention periods have expired or when the purpose of processing no longer applies. This also includes data that must be retained for longer periods in order to comply with tax, accounting, or other legal documentation requirements.

Categories of data processed:

• Account data (e.g. full name, residential address, contact information, customer number, etc.);
• payment data (e.g. bank details, invoices, payment history);
• contact data (e.g. postal addresses, email addresses or telephone numbers);
• content data (e.g. text or image-based messages and posts, and related information such as authorship details and creation timestamps);
• contract data (e.g. subject of the contract, contract duration, customer category);
• usage data (e.g. page views, time spent on pages, click paths, usage frequency and intensity, device types and operating systems used, interactions with content and functions);
• metadata,
• communication data and
• procedural data (e.g. IP addresses, timestamps, identifiers, persons involved);
• log data (e.g. log files relating to logins, data retrieval or access times).

     

Categories of data subjects:

• Service recipients and clients;
• prospective customers;
• communication partners;
• business and contractual partners;
• third parties; users (e.g. website visitors, users of online services);
• employees (e.g. staff members, applicants, temporary workers and other personnel);
• clients and customers.

 

Purposes of processing: Performance of a contract and provision of contractual services; office and organisational procedures; business processes and business management; communication; marketing; sales promotion; public relations; financial and payment management; security measures; IT infrastructure (operation and provision of information systems and technical equipment such as computers, servers, etc.).

Retention and deletion: Deletion is carried out in accordance with the section “General information on data storage and deletion”.
Legal bases: Performance of a contract and pre-contractual measures (Article 6(1)(b) GDPR); Legitimate interests (Article 6(1)(f) GDPR); Legal obligation (Article 6(1)(c) GDPR).

Further information on processing activities, procedures and services:

Customer management and customer relationship management (CRM):
Processes required in the context of customer management and customer relationship management (CRM) (e.g. collecting prospective customer data in compliance with data protection regulations, implementing measures to promote customer retention and loyalty, ensuring effective customer communication, handling complaints and providing customer service in accordance with data protection standards, managing and analysing data to support customer relationships, administering CRM systems, maintaining secure account management, and performing customer and audience segmentation).
Legal bases: Performance of a contract and pre-contractual measures (Article 6(1)(b) GDPR); Legitimate interests (Article 6(1)(f) GDPR).

Contact management and maintenance: Procedures necessary for organising, maintaining, and securing contact information (e.g. establishing and maintaining a central contact database, regularly updating contact information, monitoring data integrity, implementing appropriate data protection measures, ensuring access controls, performing backups and restoring contact data, training employees in the effective use of contact management software, regularly reviewing communication history, and adapting contact strategies).
Legal bases: Performance of a contract and pre-contractual measures (Article 6(1)(b) GDPR); Legitimate interests (Article 6(1)(f) GDPR).
 
General payment transactions: Procedures necessary for processing payments, monitoring bank accounts, and controlling payment flows (e.g. creating and verifying transfers, processing direct debits, reviewing bank statements, monitoring incoming and outgoing payments, managing chargebacks, reconciling accounts, and cash management).
Legal bases: Performance of a contract and pre-contractual measures (Article 6(1)(b) GDPR); Legitimate interests (Article 6(1)(f) GDPR).
 
Accounting, accounts payable, accounts receivable: Processes necessary for recording, processing, and monitoring business transactions in the areas of ​​accounts payable and accounts receivable (e.g. creating and verifying incoming and outgoing invoices, monitoring and managing outstanding items, processing payments, handling dunning procedures, reconciling accounts in relation to receivables and payables, and maintaining accounts payable and accounts receivable records).
Legal bases: Performance of a contract and pre-contractual measures (Article 6(1)(b) GDPR); Legal obligation (Article 6(1)(c) GDPR); Legitimate interests (Article 6(1)(f) GDPR).
 
Financial accounting and taxes: Processes necessary for recording, managing, and monitoring financially relevant business transactions, as well as for calculating, reporting, and paying taxes (e.g. posting and recording transactions, preparing quarterly and annual financial statements, processing payments, handling dunning procedures, reconciling accounts, tax advisory measures, preparing and filing tax returns, and managing tax matters).
Legal bases: Performance of a contract and pre-contractual measures (Article 6(1)(b) GDPR); Legal obligation (Article 6(1)(c) GDPR); Legitimate interests (Article 6(1)(f) GDPR).
 
Purchasing: Processes necessary for procuring goods or services (e.g. supplier selection and evaluation, price negotiations, order placement and monitoring, inspection and control of deliveries, invoice verification, order management, inventory management, and the creation and maintenance of purchasing policies).
Legal basis: Performance of a contract and pre-contractual measures (Article 6(1)(b) GDPR); Legitimate interests (Article 6(1)(f) GDPR).
 
Processes necessary for marketing, advertising, and sales promotion (e.g. market analysis and target group definition, development of marketing strategies, planning and execution of advertising campaigns, design and production of advertising materials, online marketing including SEO and social media campaigns, event marketing and trade fair participation, customer loyalty programmes, sales promotion measures, performance measurement and optimisation of marketing activities, budget management, and cost control).
Legal basis: Legitimate interests (Article 6(1)(f) GDPR)

Economic analyses and market research: For business and operational purposes, and in order to identify market trends as well as the needs and preferences of contractual partners and users, available data relating to business transactions, contracts, enquiries, etc. is analysed. The group of data subjects may include contractual partners, prospective customers, customers, visitors, and users of the controller’s online services. The analyses are conducted for business evaluation, marketing, and market research purposes (e.g. identifying visitor groups with different characteristics). Where available, profiles of registered users, including information on services used, may also be taken into account. The analyses are conducted exclusively for the controller’s internal purposes and are not disclosed externally, unless the results are anonymous and based on aggregated, i.e. anonymised, data. User privacy is respected at all times; data is pseudonymised for analysis purposes wherever possible and, where feasible, processed anonymously (e.g. in aggregated form).
Legal basis: Legitimate interests (Article 6(1)(f) GDPR).
 
Public relations: Processes necessary for public relations activities (e.g. developing and implementing communication strategies, planning and conducting PR campaigns, creating and distributing press releases, maintaining media contacts, monitoring and analysing media coverage, organising press conferences and public events, crisis communication, creating content for social media and company websites, and managing corporate branding).
Legal basis: Legitimate interests (Article 6(1)(f) GDPR).

Guest Wi-Fi: Processes necessary for establishing, operating, maintaining, and monitoring a wireless network for guests (e.g. installing and configuring Wi-Fi access points, creating and managing guest accounts, monitoring network connectivity, ensuring network security, troubleshooting connectivity issues, updating network software, and complying with data protection regulations).
Legal bases: Performance of a contract and pre-contractual measures (Article 6(1)(b) GDPR); Legal obligation (Article 6(1)(c) GDPR); Legitimate interests (Article 6(1)(f) GDPR).

Privacy Policy and information pursuant to Article 13 of the General Data Protection Regulation (GDPR) for applicants

The controller responsible for processing your data is:

Tourismusverband Innsbruck und seine Feriendörfer
Burggraben 3
A-6020 Innsbruck
Austria
[email protected]

If you have any questions regarding data protection, you may contact our Data Protection Officer at the above address or at [email protected].

General information

When you enter personal data or upload documents via our application portal as part of an online application for a job posting, this is done via an encrypted platform.

Within our organisation, your data will only be accessed by employees of the Human Resources department and the responsible managers involved in the applicant selection process.

If you submit an application for an advertised position or an unsolicited application via other channels, e.g. by email to [email protected], your application is just as welcome and will be processed internally in accordance with the same principles. Naturally, all employees are bound by confidentiality obligations, and data processing is carried out in accordance with applicable security standards and the GDPR.

Data processing

Applications are generally processed electronically, and we distinguish between the following data categories:
 

• Identification data
• This includes the personal information you provide, such as your full name, address, contact details, etc.
• Application content data

This includes data that expresses your interest in one or more positions with us, information about your professional background, skills, qualifications, experience, etc., which we obtain from your cover letter or CV.


Other documents
Additional documents that you provide may include proof of your qualifications, employment certificates and references, letters of recommendation, etc. We expressly advise you not to send us copies of identification documents or criminal record certificates. These will be destroyed immediately because we have no legal basis under the GDPR to store them. Should it be necessary to review such documents in specific cases, for example to verify that you hold a valid driver’s licence, we will request that you present them during your interview. Even then, no copies will be made.
'
If the other documents include sensitive personal data (which the GDPR refers to as “special categories of data”), these will also be deleted immediately if there is no legal basis for processing them.

Purpose of data processing

Legal basis
By submitting a job application, you express your intention to enter into an employment relationship with us. We process your personal data for this purpose. Processing is therefore based on Article 6(1)(b) GDPR for the performance of pre-contractual measures during the application process, for establishing an employment relationship, or for issuing a rejection if we are unable to offer you an employment contract.

If your application is successful, the data you provided may be used for the purposes of the employment relationship. If your application is not successful, we may offer to retain your application on file for a maximum of two years. During this period, we may contact you if a suitable employment opportunity arises. In this case, processing after the initial application process is based on your explicit consent pursuant to Article 6(1)(a) GDPR. You therefore have the right at any time to request that we remove your application documents from our records and delete them. Such consent must be given explicitly; it is not automatically granted with your application.

Transfer of your personal data

Personal data processed in this context will generally not be disclosed to third parties. Exceptions apply only where we are legally obligated or authorised to do so. In specific cases, this may include specialised recruitment consultancies that assist us with personnel selection, or legal advisers for the defence or enforcement of legal claims, all of whom act as independent data controllers, as well as IT service providers with whom we have entered into data processing agreements pursuant to Article 28 GDPR.

Data retention periods and deletion of your personal data
Application documents are permanently deleted seven months after an application is rejected. If, despite a preliminary rejection, you accept our invitation and consent to us retaining your application data in our records, we will delete this data automatically after a maximum of two years without further notice, provided that we have not entered into an employment relationship with you by that time. If no employment relationship is established, you may withdraw your consent to the continued storage of your data in our application records at any time without providing reasons. The documents will then be deleted immediately after the seven-month retention period has expired.

Information about your rights as a data subject

Articles 15 to 21 of the GDPR outline the rights of data subjects. These are:
 

• Right of access and rectification
  You have the right to obtain information about the personal data we process about you at any time. If the data is no longer correct or is incomplete, you have the right to request rectification or correction. Please inform us of this immediately. Where we have shared your data with third parties, we will also inform them of your request for access where there is a legal obligation to do so.
  •  Your right to erasure of your personal data'
    You have the right to request the erasure of your personal data where at least one of the following grounds applies:      
    • The purpose for which we collected the personal data no longer exists and we are no longer subject to any statutory retention periods.
    • The processing was based on consent and you have withdrawn this consent, insofar as no other legal basis for the processing applies.
    • You object to the processing and there are no overriding legitimate grounds for the processing.
    • Your personal data has been unlawfully processed.
    • There is a legal obligation to erase your data.                               

         
      

Your right to request the restriction of processing of your personal data

You have the right to request the restriction of processing of your data where one of the following grounds applies:

• The accuracy of your personal data stored by us is contested and we have had the opportunity to verify its accuracy.
• The processing is unlawful and, instead of requesting erasure, you request the restriction of use.
• We no longer need your data for processing purposes.
• You have objected to the processing and it has not yet been determined whether your interests override ours.

 

Your right to object to data processing

You have the right to object to the processing of your personal data, including where such processing is carried out lawfully. If you object, we will no longer process your data for the specified purposes unless we can demonstrate compelling legitimate grounds for the processing which override your interests, e.g. processing is required for exercising or defending a legal claim. The objection may be submitted informally.
 

Your right to data portability

You have the right to receive personal data that you have provided to us, and that we process by automated means, in a structured, machine-readable, and portable format*), provided that no legal or confidentiality obligations prevent this.
*) Documents submitted to us in PDF format or scanned by us will be provided in PDF format.
 
Your right to lodge a complaint
If you are not satisfied with our response to a request, you may contact our Data Protection Officer at [email protected] or, of course, lodge a complaint with the competent supervisory authority. The Austrian Data Protection Authority (Österreichische Datenschutzbehörde), Barichgasse 40-42, A-1030 Vienna, Austria, is responsible.

Information pursuant to Article 13 of the General Data Protection Regulation (GDPR)

We process personal data provided in connection with registration and participation in the General Assembly solely for the purpose of organising and conducting the event, which must be convened in accordance with Section 9 of the Tyrolean Tourism Act.''

Accordingly, processing is carried out on the basis of a legal obligation (Article 6(1)(c) GDPR) to which we are subject and/or our legitimate interests in ensuring the smooth and efficient conduct of the event (Article 6(1)(f) GDPR).

Registration data will be shared only with our data processors and will be retained for a period of three years from the date of the event, after which it will be deleted. Under the GDPR, you have data subject rights (right of access, rectification, erasure, restriction of processing, data portability, and the right to object). These rights may be exercised against the data controller, i.e. us. 

If you have any questions regarding data protection or data security, you may contact our Data Protection Officer or exercise your right to lodge a complaint with a data protection authority of your choice.

Contact:

Controller: [email protected]
Data Protection Officer: [email protected]

General information on data protection can be found on our Privacy Policy page.

Privacy notice and information pursuant to Article 13 of the General Data Protection Regulation (GDPR) for data subjects in connection with video surveillance in the marked areas of our premises.
 

The controller responsible for processing your data is:
 

Tourismusverband Innsbruck und seine Feriendörfer
Burggraben 3
A-6020 Innsbruck
[email protected]

If you have any questions regarding data protection, you may contact our Data Protection Officer at the above address or at [email protected].

General information

When you enter our publicly accessible areas, you are counted by our footfall measurement system and/or recorded by our video surveillance system.

Data processing

The following data is collected during the course of this processing:
 

Video footage without audio (not anonymised)
Visitor count (anonymised)

Identification data

As a rule, it is not possible to identify you from the video data unless you are a person known to us. No personal data is linked to the recorded video footage unless a public authority makes a substantiated request for us to do so.

Legal bases, purposes of processing

Legitimate interests (Article 6(1)(f) GDPR) arising from the purposes of the processing (de-escalation, protection of persons, safeguarding our right to control access to and use of the premises, and anonymised footfall measurement).

Disclosure of your personal data

Personal data processed in this context will generally not be disclosed to third parties. Exceptions apply only where we are required or authorised to do so by law or by a public authority. In specific cases, we are authorised to use the minimum amount of stored video footage necessary for the exercise or defence of legal claims. In such cases, recipients include legal representatives, public authorities and courts of law.

Data obtained from footfall measurement is anonymised. Following the immediate deletion carried out as part of counting visitor numbers at our entrances and exits, the data no longer falls within the scope of the GDPR.

Data retention periods, deletion of your personal data

As a rule, video recordings are automatically deleted after 72 hours. Exceptions apply only where, in a specific case, longer retention of secured footage is necessary for the defence against or assertion of claims. In such cases, the retention period ends once any relevant proceedings have been finally concluded or, at the latest, after four years if no claims have been asserted.  

Information about your rights as a data subject

As a data subject, you have various rights under the GDPR, in particular the rights set out in Articles 15 to 21 GDPR:

Right to object

You have the right to object at any time, on grounds relating to your particular situation, to the processing of your personal data where the processing is based on Article 6(1)(e) or (f) GDPR. This also applies to profiling based on those provisions. If your personal data is processed for direct marketing purposes, you have the right to object at any time to the processing of your personal data for such marketing. This also applies to profiling insofar as it is related to such direct marketing. As the specific processing described here does not directly identify you, no direct marketing will be carried out on the basis of it.

Right to withdraw consent

You have the right to revoke your consent at any time. Your consent is not required for the specific processing activities described here (video recording, footfall measurement). Accordingly, there is no consent to withdraw in relation to these processing activities.

Right of access

You have the right to obtain confirmation as to whether your personal data is being processed and, where this is the case, to access that data and receive further information and a copy of the data in accordance with the applicable legal requirements.

Right to rectification

In accordance with legal requirements, you have the right to request the completion of incomplete personal data or the rectification of inaccurate personal data.

Right to erasure and restriction of processing

In accordance with legal requirements, you have the right to request that your personal data be erased without undue delay or, alternatively, to request restriction of the processing of such data.

Right to data portability

In accordance with legal requirements, you have the right to receive personal data that you have provided to us in a structured, commonly used and machine-readable format, or to request that the data be transmitted to another controller.

Right to lodge a complaint with a supervisory authority

You have the right to lodge a complaint with a supervisory authority if you believe that the processing of your personal data infringes the GDPR. You may do so in particular in the Member State of your habitual residence, place of work or place of the alleged infringement. Our competent supervisory authority is the Austrian Data Protection Authority (Österreichische Datenschutzbehörde). For any data protection enquiries, please contact our Data Protection Officer at [email protected] in the first instance.

Privacy notice and information pursuant to Article 13 of the General Data Protection Regulation (GDPR) for data subjects in connection with the use of the Maximilian avatar on our premises.

The controller responsible for processing your data is:

Tourismusverband Innsbruck und seine Feriendörfer
Burggraben 3
A-6020 Innsbruck
[email protected]

If you have any questions regarding data protection, you may contact our Data Protection Officer at the above address or at [email protected].

General information

When you enter the area where the Maximilian avatar is located, you have the opportunity to communicate with it. No visual recognition is used. You can use the avatar by tapping on-screen options or by voice input. Before your voice input is transmitted to the connected service providers, who interpret it in order to generate a response using artificial intelligence, your voice input is altered locally using a randomisation process, thereby anonymising it. This means that neither your identity nor your individual biometric voice pattern can be inferred from it. Although each voice input is anonymised immediately, the process is relevant for data protection purposes and must therefore be documented. The original voice input is neither transmitted nor stored. Only the technically altered voice input, which cannot be traced back to individual users, is transmitted.

Data processing

The following data is processed within the avatar system:
 

Commands entered via the touch screen, anonymous, no attribution to a specific person is possible.
Voice commands given to the Maximilian avatar, anonymised prior to transmission to service providers who interpret the commands and provide a response in text or spoken form.
Identification data

Since no original voice recording is made, you cannot be identified. We do not store your personal data and it therefore cannot be analysed. Questions submitted to the avatar are collected and analysed for statistical purposes but are never attributed to a specific user.

Legal basis, purposes of processing

Legitimate interests (Article 6(1)(f) GDPR) arising from the purpose of the processing: operating an avatar to promote tourism objectives within the remit of the tourism association.

Disclosure of your personal data

Personal data processed in this context is not stored permanently and therefore cannot be disclosed. The anonymised voice data disclosed for speech recognition purposes cannot be traced back to data subjects, even by comparison with original voice recordings of the same person.

Data retention periods, deletion of your personal data

As a rule, original voice commands are not retained; they are deleted immediately after anonymisation.

Information about your rights as a data subject

Articles 15 to 21 of the GDPR set out the rights of data subjects. These are:

Right to object

You have the right to object at any time, on grounds relating to your particular situation, to the processing of your personal data where the processing is based on Article 6(1)(e) or (f) GDPR. This also applies to any profiling based on those provisions. If your personal data is processed for direct marketing purposes, you have the right to object at any time to the processing of your personal data for such marketing. This also applies to profiling insofar as it is related to such direct marketing. As the specific processing described here does not identify you, no direct marketing will be carried out on the basis of it.

Right to withdraw consent

You have the right to revoke your consent at any time. Your consent is not required for the specific processing activities described here (use of the Maximilian avatar). Accordingly, there is no consent to withdraw in relation to these processing activities.

Right of access

You have the right to obtain confirmation as to whether your personal data is being processed and, where this is the case, to access that data and receive further information and a copy of the data in accordance with the applicable legal requirements. As no data attributable to you is stored as part of this processing, we are unable, for technical reasons, to provide information about stored data.

Right to rectification

In accordance with legal requirements, you have the right to request the completion of incomplete personal data or the rectification of inaccurate personal data. As no personal data is stored as part of these processing activities, there is no personal data that can be rectified.

Right to erasure and restriction of processing

In accordance with legal requirements, you have the right to request that your personal data be erased without undue delay or, alternatively, to request restriction of the processing of such data. In relation to the specific processing activities concerned in this case, however, we are unable to comply with requests for erasure or restriction of processing, as no personal data is stored.

Right to data portability

In accordance with legal requirements, you have the right to receive personal data that you have provided to us in a structured, commonly used and machine-readable format, or to request that the data be transmitted to another controller. Since no personal data is stored as part of this processing, we cannot comply with any request made under this right.

Right to lodge a complaint with a supervisory authority

You have the right to lodge a complaint with a supervisory authority if you believe that the processing of your personal data infringes the GDPR. You may do so in particular in the Member State of your habitual residence, place of work or place of the alleged infringement. Our competent supervisory authority is the Austrian Data Protection Authority (Österreichische Datenschutzbehörde). For any data protection enquiries, please contact our Data Protection Officer at [email protected] in the first instance.

Important information: Use of the Maximilian avatar is permitted only for persons over the age of 13.

Data controller:

Innsbruck Information und Reservierung GmbH 
Burggraben 3 
A-6020 Innsbruck 
[email protected]

Purpose of processing

You can book online to take part in events organised or arranged by the tourism association. The processing of your personal data, with the exception of country of origin, is strictly necessary for the performance of a contract and is carried out on the basis of Article 6(1)(b) GDPR. You are asked to provide your country of origin for statistical purposes. This processing is carried out on the basis of Article 6(1)(f) GDPR, in the legitimate interests of the data controller. You also have the option to rate the service providers included in your booking. If you tick this box, you consent to receiving a link to a review page after the event. The associated processing is carried out on the basis of your consent under Article 6(1)(a) GDPR.

Categories of data processed

Name, contact details, country of origin, where applicable your acknowledgement of any minimum age or other requirements, other messages, any consent given in relation to reviews and the use of photographs, selected products, number of persons, individual and total prices, and details of the cashless payment method used (transmitted only in encrypted form to the payment processor and not stored by us).

Recipients

Recipients of personal data relating to bookings include the partner businesses conducting the events and the banks processing payments. These parties act as independent controllers for data protection purposes. Data is not disclosed to other external recipients unless there is a legal obligation to do so. Our IT systems are operated by an external service provider with whom a data processing agreement is in place pursuant to Article 28 GDPR.

Retention periods

The processed data is retained for seven years from the end of the respective calendar year, in accordance with statutory requirements regarding the retention of evidence of business transactions for the tax authorities. Thereafter, the data is deleted.

DATA SUBJECT RIGHTS

As a data subject, you have various rights under the GDPR, in particular the rights set out in Articles 15 to 21 GDPR:

Right to object
You have the right to object at any time, on grounds relating to your particular situation, to the processing of your personal data where the processing is based on Article 6(1)(e) or (f) GDPR. If your personal data is processed for direct marketing purposes, you have the right to object at any time to the processing of your personal data for such marketing.

Right to withdraw consent
You have the right to withdraw any consent you have given at any time, with effect for the future.

Right of access
You have the right to request confirmation as to whether your personal data is being processed and, where this is the case, to access that data and receive further information and copies of the data in accordance with legal requirements.

Right to rectification
In accordance with legal requirements, you have the right to request the completion of incomplete personal data or the rectification of inaccurate personal data.

Right to erasure and restriction of processing
In accordance with legal requirements, you have the right to request that your personal data be erased without undue delay or, alternatively, to request restriction of the processing of such data.

Right to data portability
In accordance with legal requirements, you have the right to receive personal data that you have provided to us in a structured, commonly used and machine-readable format, or to request that the data be transmitted to another controller.

Right to lodge a complaint with a supervisory authority
Without prejudice to any other administrative or judicial remedy, you have the right to lodge a complaint with a supervisory authority if you believe that the processing of your personal data infringes the GDPR. You may do so in particular in the Member State of your habitual residence, place of work or place of the alleged infringement. Our competent supervisory authority is the Austrian Data Protection Authority (Österreichische Datenschutzbehörde).

For any data protection enquiries, please contact our Data Protection Officer at [email protected] in the first instance.

Privacy notice and information pursuant to Article 13 of the General Data Protection Regulation (GDPR)

Digital Holiday Assistant
PRIVACY NOTICE

This privacy notice explains how 

Tourismusverband Innsbruck und seine Feriendörfer, 
Burggraben 3, 
6020 Innsbruck, 
Austria, 
[email protected], 

as the data controller (hereinafter referred to as the "Controller"), collects and processes personal data ("data") in connection with the Digital Holiday Assistant service.

The protection of your personal data and privacy is of great importance to the Controller. The Controller processes personal data exclusively in accordance with applicable data protection regulations, in particular the Austrian Data Protection Act. 

The Data Protection Officer can be contacted at: [email protected]

What is personal data?

“Personal data” is legally defined as “any information relating to an identified or identifiable natural person (‘data subject’)”. This includes, for example, information such as your name, address and email address, as well as other information that can be linked to a specific natural person.

Collection, processing and use of personal data: purposes and legal bases

Registration, identification and profile

To use the Digital Holiday Assistant, users have the option to register and create a profile on the Digital Holiday Assistant Progressive Web App (PWA) provided by the Controller, using a device such as a smartphone or PC. Registration or identification enables users to access the services provided through the Digital Holiday Assistant. Registration using an email address is required to access the information provided and to receive information about services offered by the Controller.

In this context, the Controller collects your name, email address, residential address and date of birth where this is necessary for the use of the Digital Holiday Assistant or for the recording of guest registration data. Additional data is collected as described in Section 6 of this privacy notice.

The Controller generally collects and processes your data for the purpose of promoting products offered by the Controller or within the region through various marketing activities (e.g. sending email newsletters and messages within the Digital Holiday Assistant PWA), provided you have given your consent. You may withdraw your consent at any time.

If you do not provide all required data, your use of the Digital Holiday Assistant may be limited.

Your data will not be disclosed to third parties, except to our contractual partner Feratel AG, Innsbruck, which processes the data on the Controller’s instructions under a data processing agreement pursuant to Article 28 GDPR.

If you amend or supplement the aforementioned personal data during registration or identification, the updated or additional data will also be stored and processed by the Controller.

The legal bases for processing this data are as follows:

a) The creation of a profile to use the benefits of the Digital Holiday Assistant is based on your consent pursuant to Article 6(1)(a) GDPR. This consent remains in effect until it is withdrawn and may be withdrawn at any time with effect for the future.

b) The use of the benefits of the “Welcome Card” for the duration of your stay is based on Article 6(1)(b) GDPR.

Changes to your personal data
If your personal data, such as your name or email address, changes, you may inform the Controller if you would like these changes to be processed by the Controller.

Data retention
The Controller retains your personal data only for as long as is necessary to fulfil the purposes for which it is processed or to comply with applicable legal obligations. The Controller may continue to retain certain personal data even after you have closed your profile with the Controller, for example where this is necessary to comply with legal obligations. In any event, your personal data will be deleted no later than seven years after your last activity.

Data security
The Controller employs appropriate security measures to protect the personal data it stores against unauthorised access, collection, use, disclosure, copying, alteration or deletion. All data that you transmit to the Controller is stored on secure servers. If you have created a profile, you are responsible for keeping your password secure and confidential.

Cookies
The Controller uses cookies to make navigation and use of the Digital Holiday Assistant as user-friendly as possible. A cookie is an electronic file containing a small amount of data that a website can send to your browser and store on your device (e.g. smartphone) as an anonymous tag to identify your device (though not you personally). For example, cookies may be used to remember your language and login preferences. The Controller cannot use these cookies to identify individual users. You can disable the storage of cookies at any time through your browser settings and can delete cookies that have already been stored.
Users can also access the service without accepting cookies. However, some functions of the service may be limited if cookies are disabled.
Details of the specific cookies used by the Digital Holiday Assistant PWA are provided in the list below.

Changes to this privacy notice
The Controller reviews this privacy notice regularly. It may be necessary to amend this privacy notice from time to time. The current version of the privacy notice is published on the Controller’s PWA.

Your rights under the GDPR
As a data subject, you have various rights under the GDPR, in particular the rights set out in Articles 15 to 21 GDPR:

Right to object
You have the right to object at any time, on grounds relating to your particular situation, to the processing of your personal data where the processing is based on Article 6(1)(e) or (f) GDPR. This also applies to profiling based on those provisions. If your personal data is processed for direct marketing purposes, you have the right to object at any time to the processing of your personal data for such marketing. This also applies to profiling insofar as it is related to such direct marketing.

Right to withdraw consent
You have the right to revoke your consent at any time.

Right of access
You have the right to obtain confirmation as to whether your personal data is being processed and, where this is the case, to access that data and receive further information and a copy of the data in accordance with the applicable legal requirements.

Right to rectification
In accordance with legal requirements, you have the right to request the completion of incomplete personal data or the rectification of inaccurate personal data.

Right to erasure and restriction of processing
In accordance with legal requirements, you have the right to request that your personal data be erased without undue delay or, alternatively, to request restriction of the processing of such data.

Right to data portability
In accordance with legal requirements, you have the right to receive personal data that you have provided to us in a structured, commonly used and machine-readable format, or to request that the data be transmitted to another controller.

Right to lodge a complaint with a supervisory authority
Without prejudice to any other administrative or judicial remedy, you have the right to lodge a complaint with a supervisory authority if you believe that the processing of your personal data infringes the GDPR. You may do so in particular in the Member State of your habitual residence, place of work or place of the alleged infringement. Our competent supervisory authority is the Austrian Data Protection Authority (Österreichische Datenschutzbehörde).

For any data protection enquiries, please contact our Data Protection Officer at [email protected] in the first instance.
 

Contact
For any other questions concerning the PWA or for enquiries directed to the Data Protection Officer, please also contact [email protected].