The protection of your privacy is important to the Spanish Riding School – Lipizzaner Stud Piber, a public-law body (hereinafter also referred to as SRS-LGP). We would like to explain below what we do to protect your data and what data we collect. In accordance with Articles 13 and 14 of the General Data Protection Regulation (GDPR), we are providing you with information, in particular, on the scope and purpose of the processing of personal data. You will also find information on the cookies we use.
We process personal data within the legal framework of the General Data Protection Regulation (GDPR) and the Austrian Data Protection Act (DSG). The data we store is only made available to third parties in compliance with the statutory requirements. Your personal data will, of course, not be sold to any advertising companies.
- Overview
|
|
|
2. General information and contact details
The Spanish Riding School – Lipizzaner Stud Piber, a public-law body, is the data controller responsible for the data processing described in this privacy notice. If you have any questions, please contact us, for example at:
Address: Michaelerplatz 1, 1010 Vienna
Telephone: +43/1/533 90 31
Email: datenschutz@srs.at
2.1. What is personal data?
The term ‘personal data’ is defined in the GDPR (Article 4(1) GDPR). It covers all information relating to an identified or identifiable person. A person is considered to be identifi if they can be identified either directly or indirectly (e.g. via an identifier or an identification number). Examples of personal data include name, date of birth, address or contact details such as telephone number and email address.
The counterpart to personal data is anonymous data. This cannot be attributed to any identified or identifiable person. The provisions of data protection law therefore do not apply to it.
You can find out which categories of personal data we process about you in the sections below, under the respective purposes listed.
2.2 Legal bases under data protection law
For data processing to be lawful, at least one legal basis in accordance with Article 6(1) of the GDPR must be met. We therefore generally process your personal data only if
- it is necessary for the performance of a contract with you or for pre-contractual measures requested by you (Article 6(1)(b) of the GDPR; e.g. for organising events and the associated ticket sales);
- it is necessary to safeguard a legitimate interest of ours or of a third party (Article 6(1)(f) of the GDPR; e.g. to protect our website from hacker attacks or to prevent fraud and misuse);
- where this is necessary for the performance of a task carried out in the public interest (Article 6(1)(e) of the GDPR);
- you have given your consent to the processing of your data (Article 6(1)(a) of the GDPR; e.g. to receive our newsletter); and/or
- there is a legal obligation (Article 6(1)(c) of the GDPR; e.g. to comply with the corporate or tax law retention obligations applicable to us).
You can find details of the legal basis on which we rely for the processing of your personal data for the specific processing purposes set out below under ‘Processing Purposes’.
3. Source of data
Unless otherwise stated in this privacy notice, the personal data we process is collected directly from you.
4. Presentation, protection and improvement of our website
We are the operator of the website https://www.srs.at/. The website is hosted by internex GmbH. The server is located in Vienna, Austria.
When you access our website via the internet, your device’s web browser automatically transmits the following technical data to us:
- IP address of the request
- Date and time of access (timestamp)
- File requested (URL), including any subpages of the website that you visit
- Data volume (bytes) of the transfer
- Indication of whether the access was successful
- Browser identification data (browser type and version; operating system; user agent)
- The website from which you visit our website (referrer URL)
This technical data is recorded and stored in so-called server logs (log files). It is processed for the purpose of ensuring the error-free display of our website and for website security (Article 6(1)(f) of the GDPR; ‘protection of our legitimate interests’). The server logs (log files) are retained for a period of up to 3 months and are then automatically deleted. Data may be retained for longer if, for example, suspicious access to the website is being investigated. In this case, the data will be deleted once the investigation is complete.
In addition, we use technical data to compile general usage statistics on visits to our website. In doing so, we use the IP address to determine the country from which the access originates. The IP address is then deleted and the anonymised data is stored in a database (Article 6(1)(f) of the GDPR; ‘protection of our legitimate interests’). For this purpose, we use the services of Die Goldkinder GmbH. Their server is located in Vienna, Austria.
The processing of server logs is carried out for the purpose of ensuring the technical functionality of our website, guaranteeing IT security, and detecting, analysing and defending against security incidents. The legal basis for this is Article 6(1)(f) of the GDPR. Our legitimate interest lies in the secure and trouble-free operation of our website. The server logs are stored for a period of up to three months and are then automatically deleted. Storage beyond this period takes place only insofar as it is necessary to investigate specific security incidents or cases of misuse. Once the investigation has been completed, the relevant data is deleted.
In addition, we process technical data to compile general usage statistics regarding visits to our website. For this purpose, only the country of origin of the visit is determined on the basis of the IP address. The IP address is subsequently deleted; only anonymised statistical data that does not allow identification of individual persons is stored. The legal basis for this is also Article 6(1)(f) of the GDPR. Our legitimate interest lies in analysing and improving our website. The processing is carried out by Die Goldkinder GmbH as a data processor in accordance with Article 28 of the GDPR. The servers are located in Vienna, Austria.
Server log files and technical access data
Data categories:
- IP address,
- date and time of access,
- browser information,
- Operating system,
- referrer URL,
- technical access data.
Purpose:
To ensure technical operation, IT security, error analysis and the detection of misuse. Server log files are generally stored for up to 3 months and then automatically deleted. They are only stored for longer if this is necessary to analyse specific security incidents, cases of fraud or to enforce or defend against legal claims. (Art. 6(1)(f) GDPR.)
5. Communication and contact form
You can communicate with us via various contact channels. Depending on which channel you choose, different data may be processed. In any case, we process the content of your message and the information you provide in order to deal with or respond to your enquiry. In order to reply, it may be necessary for us to process data stored about you (such as contracts, sponsorships and/or Circle memberships). Furthermore, we record when we have replied to you (Article 6(1)(b) of the GDPR, insofar as your enquiry relates to a contract or pre-contractual measures; “necessary for the performance of a contract or for taking steps prior to entering into a contract” and Article 6(1)(f) of the GDPR for processing other enquiries and documenting the correspondence. The legitimate interest lies in efficient communication, the processing of enquiries and the ability to provide evidence of the correspondence; “Our legitimate interest lies in the efficient processing of enquiries, the documentation of communication and the traceability of correspondence”).
If you use the contact form on our website, we also process the email address and subject line you provide, as well as the technical data automatically transmitted by your device, such as your IP address, the date and time of your message, and the referrer URL. We anonymise the technical data and process it for the purpose of continuously improving the structure of our website (or rather, for the purposes of protection against misuse, spam detection and IT security). In addition, you will receive an automatically generated reply to confirm receipt of your enquiry and to ensure orderly communication (Article 6(1)(f) of the GDPR for the processing of other enquiries and the documentation of correspondence. The legitimate interest lies in efficient communication, the processing of enquiries and the traceability of correspondence; “Our legitimate interest lies in the efficient processing of enquiries, the documentation of communication and the traceability of correspondence”).
In addition, you have the option of sending us an email, for example to office@srs.at . If you have any questions regarding data protection, please contact datenschutz@srs.at . As part of email communication, your email address and previous correspondence will also be processed. If you contact us by telephone, we will also process your telephone number and create a written record of your enquiry. Letters sent to our postal address are usually scanned to document the correspondence and to process your enquiry efficiently (Article 6(1)(b) of the GDPR, insofar as your enquiry relates to a contract or pre-contractual measures; ‘necessary for the performance of a contract or for taking steps prior to entering into a contract’ and Article 6(1)(f) of the GDPR for the processing of other enquiries and the documentation of correspondence. The legitimate interest lies in efficient communication, the processing of enquiries and the ability to provide evidence of correspondence; ‘safeguarding our legitimate interests’).
We retain your correspondence for as long as is necessary to deal with your enquiry and, beyond that, in accordance with statutory retention obligations or for the purpose of establishing, exercising or defending legal claims.
Data categories:
- Name and contact details,
- Content of the enquiry,
- Email correspondence,
- telephone notes,
- other information provided by you.
Purpose:
To process and respond to your enquiry and to document the communication.
The data is generally stored for the duration of the processing of your enquiry. Once the communication has been concluded, the data will be deleted, provided there are no statutory retention obligations or the storage is necessary for the establishment, exercise or defence of legal claims. Article 6(1)(b) of the GDPR (pre-contractual measures or performance of a contract) or Article 6(1)(f) of the GDPR (legitimate interest in orderly communication and documentation).
In connection with the conclusion of contracts, we may send you contract-related information, for example by email or post. Advertising will only be sent to you with your express consent.
6. Newsletter
On our website, you have the option to subscribe to our newsletter, through which we keep you informed about our latest offers. The newsletter promotes, for example, our demonstrations, events and event venues, as well as horse sales. We use the Brevo service to send out our newsletter. Data processing takes place on servers within the European Union."
To register for and receive our newsletter, we ask you for your first name, surname, email address, title and any other titles you may hold (Article 6(1)(a) of the GDPR; ‘consent’). However, the only mandatory information is your email address. We ask for your first name and surname so that we can address you personally, if you so wish. In addition, we automatically record your IP address and the time of your registration.
To ensure that you are the authorised user of the email address provided, we use the so-called double opt-in procedure. This means that, following your registration, we will send an email to the address you provided, asking you to confirm that you wish to receive the newsletter. If you do not confirm your registration within 24 hours, the data you have provided will be automatically deleted after one month. Should you complete the confirmation, we will again automatically record your IP address and the time of confirmation. The double opt-in procedure serves to verify your consent and to prevent the misuse of your personal data. The legal basis for this is Article 6(1)(f) of the GDPR. Our legitimate interest lies in the legally compliant documentation of consents given and in preventing fraudulent newsletter subscriptions.
Data categories:
- Name,
- email address,
- newsletter preferences,
- Proof of consent (time, IP address).
Purpose:
To send and manage the newsletter, and to provide evidence of the consent given.
The data will be stored for as long as you subscribe to the newsletter. Once you have withdrawn your consent, your data will be removed from the mailing list. Proof of consent may also be retained for as long as is necessary to fulfil statutory obligations to provide evidence or to defend against legal claims. Article 6(1)(a) of the GDPR and Article 6(1)(f) of the GDPR for proof of consent.
You may unsubscribe from the newsletter at any time without giving a reason and withdraw your consent to receive the newsletter. You can do this, for example, by clicking on the link provided in every newsletter email or by sending an email to datenschutz@srs.at . The lawfulness of the data processing remains unaffected until the time of withdrawal.
7. Participation in prize draws
If you take part in one of our prize draws, we will process the data you provide in the entry form (first name, surname, street, postcode, town, country, email) for the purpose of selecting the winner from among the entrants by random draw, notifying the winner of the prize and delivering the prize to the winner. Where necessary, the prize will also be sent to the winner, for example by email, and/or handed over to Österreichische Post AG for dispatch, together with the winner’s first name, surname and postal address (Article 6(1)(b) of the GDPR; ‘necessary for the performance of a contract’).
Furthermore, we collect the technical data automatically transmitted to us by your device, such as your IP address, the date and time of your competition entry, and the referrer URL when you submit the entry form. We anonymise this technical data and process it for the purpose of continuously improving the design of our website (Article 6(1)(f) of the GDPR; ‘to safeguard our legitimate interests’).
The personal data processed in connection with the competition will be deleted once the competition has ended, provided there are no statutory retention obligations or further storage is necessary to establish, exercise or defend legal claims.
Provided you give us your consent, we will also process your first name, surname, title and email address in order to send you information about our current offers (such as demonstrations, events, event venues and the purchase of horses) to your email address (Article 6(1)(a) of the GDPR; ‘consent’; see point 9 of the privacy notice).
Data categories:
- Name,
- address,
- email address,
- participation details.
Purpose:
To organise the prize draw, identify and notify the winners, and deliver the prizes.
The data will be deleted once the competition has ended, as soon as it is no longer required for its organisation. Data relating to winners may be stored for a longer period where this is necessary for processing, documentation or to comply with legal obligations. Article 6(1)(b) of the GDPR
8. Press
You can view the latest press releases under the ‘Press’ section on the website. If you download an article in PDF format from there, we automatically store your IP address, the date and time of the download, and the referrer URL. This technical data is initially processed to ensure the secure operation of our website. They are subsequently anonymised and used to compile statistical analyses and to continuously improve our website.” (Art. 6(1)(f) GDPR; “pursuit of our legitimate interests”).
In addition, we regularly make images available in this context for free editorial use. These can be downloaded via a link from external platforms (such as ‘WeTransfer’ by WeTransfer B.V.). Under data protection law, the external platform is solely responsible for data processing (e.g. accessing the external platform and downloading the images). WeTransfer’s privacy policy can be found here.
When downloading press releases, the following personal data is processed:
- IP address,
- date and time of the download,
- referrer URL (the previously visited page from which the download was initiated),
- technical access data (insofar as this is processed by the web server).
When using external platforms to download image material (e.g. WeTransfer), technical connection data – in particular the IP address and usage data – may also be processed by the respective provider. We have no influence over this data processing.
Purpose:
The technical data is processed to provide the requested press releases, to ensure the security, stability and functionality of our website, to detect and prevent misuse, and to analyse and optimise our website after anonymisation. The processing is carried out on the basis of Article 6(1)(f) of the GDPR. Our legitimate interest lies in the secure operation of our website and in the continuous improvement of our digital offering.
Technical access data is stored only for as long as is necessary to ensure the security and functionality of our website and to detect and prevent security incidents. The data is subsequently deleted or anonymised. Anonymised data is used for statistical analysis and to improve our website either permanently or for as long as is necessary for these purposes.
Data processing carried out by external platforms (e.g. WeTransfer) is the sole responsibility of the respective provider under data protection law. The retention period is governed by the data protection policies of the respective provider. The retention periods described above apply to the storage of server logs
9. Cookies
We use cookies to provide certain services on the website. Cookies are small text files that are placed and stored on your device via your web browser. We use cookies, for example, to facilitate navigation on our website or to save your shopping basket in the online shop.
The legal basis for the processing of personal data in connection with technically necessary cookies is Article 6(1)(f) of the GDPR. Our legitimate interest lies in providing a functional and secure website.
The majority of the cookies we use are known as ‘session cookies’. These are set only for the duration of your visit and are automatically deleted once you leave our website. ‘Persistent cookies’, on the other hand, remain stored on your device beyond this point. You can recognise persistent cookies by the specified storage period.
Furthermore, cookies can be distinguished according to whether they are set by us as so-called first-party cookies or by a third party as so-called third-party cookies. Third-party cookies can, for example, enable us to integrate certain third-party services.
When you visit our website for the first time, the cookie banner will be displayed. Here, you can set your cookie preferences and select your consents. In the cookie banner, we distinguish between the following cookies:
- Cookies that are technically necessary for certain services
- (Optional) Functional cookies enable us to offer advanced features (Art. 6(1)(a) GDPR (consent))
- (Optional) Analytics cookies for statistical analysis and measuring the use of our website (Art. 6(1)(a) GDPR)
- (Optional) Marketing cookies for advertising purposes (Article 6(1)(a) of the GDPR)
Functional, analytics and marketing cookies are set only if you have given your consent via the cookie banner.
You can select in the cookie banner that no optional cookies should be set. In this case, we will only use cookies that fall into the ‘technically necessary’ category. Please note that, in this case, certain functions of the website may only be available to a limited extent.
You can also prevent cookies from being set on your device by adjusting your browser settings accordingly.
You can withdraw or change your consent at any time with future effect via the cookie settings on our website.
10. Cookie banner by Usercentrics
We use the “Cookiebot” service provided by Usercentrics GmbH to operate our cookie banner. When you interact with the cookie banner, we collect your consent data (consent ID, consent number, time of consent, opt-in or opt-out, cookie banner language, customer settings, template version), data about your device (HTTP agent, HTTP referrer), your IP address and your geolocation for the purpose of collecting, managing and documenting the consents you have given via the cookie banner (Article 6(1)(c) of the GDPR; ‘legal obligation’ and Article 6(1)(f) of the GDPR; ‘protection of our legitimate interests’).
The data is generally processed in Munich, Germany, although Usercentrics uses sub-processors who may carry out processing in third countries, such as the USA. The European Commission has adopted an adequacy decision pursuant to Article 45 of the GDPR regarding the ‘EU-US Data Privacy Framework’. Where personal data is transferred to the USA in connection with the use of sub-processors, this is done exclusively to companies certified under the EU-US Data Privacy Framework, or on the basis of appropriate safeguards in accordance with Article 46 of the GDPR (e.g. standard contractual clauses), provided that no adequacy decision applies.”
Data categories:
- Cookie settings,
- Consent status,
- Consent ID,
- Time of decision,
- technical information.
Purpose:
To record and manage your cookie consents.
Data is stored for the period necessary to document your selection and to fulfil statutory record-keeping obligations. Article 6(1)(c) GDPR and Article 6(1)(f) GDPR.
11. Google Tag Manager
Google Tag Manager is a service provided by Google Ireland Limited that enables the integration of various third-party services on our website. It handles the integration and activation of various JavaScript codes and, in this respect, serves to manage the integrated services. Google Tag Manager is used exclusively for the management and integration of tags. It does not itself create user profiles or set analytics cookies. However, when the service is accessed, technically necessary connection data (e.g. the IP address) is transmitted to Google. Google does, however, collect data and pass it on to the integrated services, provided you have given your consent (Article 6(1)(a) of the GDPR; ‘on the basis of consent’).
Google processes, for example, certain aggregated data in order to monitor stability, performance and installation quality. Google is independently responsible for this under data protection law. Google’s privacy policy can be found here.
In the course of providing the service, personal data may be transferred to companies within the Google Group or to data processors outside the European Economic Area, in particular to the USA. The European Commission has adopted an adequacy decision pursuant to Article 45 of the GDPR regarding the ‘EU-US Data Privacy Framework’. US companies may therefore seek certification under the ‘EU-US Data Privacy Framework’.
12. Google Ads and Google Conversion Tracking
We use the ‘Google Ads’ service provided by Google Ireland Limited to display advertisements as part of Google’s internet search service and on third-party websites that are part of Google’s partner network.
Our adverts are delivered by Google via so-called ‘ad servers’. Google delivers our adverts via its advertising platform. If you give us your consent to do so, cookies containing a unique identifier number and your IP address will be stored on your device. When you, as a user, click on one of our adverts and are redirected to the linked offer, the identification number stored in the cookie on your device is reported back to Google. This enables Google to determine which user clicked on which of our adverts, when, using which device, in which web browser, on which website, and what action the user in question took immediately beforehand (e.g. whether they searched for a specific search term or specifically entered a website address). If you are registered with a Google service, Google may link this to your account. You can find Google’s privacy policy here.
We are subsequently provided with anonymous statistical analyses by Google, which enable us to assess how successful and effective our adverts are.
The assignment and transmission (‘feedback’) of the identification number and IP address stored on your device to Google is based on your consent (Article 6(1)(a) of the GDPR; ‘consent’).
Google Conversion Tracking enables us to track whether you have carried out a specific action or transaction (e.g. purchasing a ticket). As soon as you complete an action on our website, Google can recognise this and records your conversion. Google Conversion Tracking is also based on your consent (Article 6(1)(a) of the GDPR; ‘consent’).
"In the course of providing services, personal data may be transferred to companies within the Google Group or to data processors outside the European Economic Area, in particular to the USA." The European Commission has adopted an adequacy decision pursuant to Article 45 of the GDPR regarding the ‘EU-US Data Privacy Framework’. US companies may therefore seek certification under the ‘EU-US Data Privacy Framework’.
In connection with Google Ads and Google Conversion Tracking, the following cookies are set in your device’s browser:
| Cookie name: | test_cookie |
| Purpose: | checks whether the browser you are using allows cookies to be set |
| Duration: | 15 minutes |
| Type: | Optional (third-party) |
| Cookie name: | IDE |
| Purpose: | Contains a randomly generated user ID. Google uses this ID to recognise you across different website domains and display personalised adverts. |
| Retention period: | 1 year |
| Type: | Optional (third party) |
| Cookie name: | Conversion |
| Purpose: | Stores conversions you have made |
| Retention period: | 3 months |
| Type: | Optional (third party) |
13. Web analytics with Matomo
If you give us your consent, we use the ‘Matomo’ service provided by InnoCraft Ltd to analyse our website. In addition to technical data (such as your anonymised IP address, country or region, browser type, referrer URL, date and time, and operating system used), Matomo collects, in particular, your usage behaviour on our website (webpages and subpages viewed, documents clicked on and downloaded, links used to other domains, and search parameters) and analyses this together with the user ID. On the basis of this analysis, we are subsequently provided with statistics on, for example, the number of website visitors, page views and the time spent on our website. The use of Matomo is based on your consent (Article 6(1)(a) of the GDPR; “consent”). The data collected via Matomo is stored for a period of 24 months and is subsequently deleted or anonymised.
Matomo’s servers are located in New Zealand. The European Commission has adopted an adequacy decision for New Zealand in accordance with Article 45 of the GDPR. “Where Matomo engages sub-processors for specific services and personal data is transferred to third countries in the process, this is carried out in accordance with the requirements of Articles 44 et seq. of the GDPR. For transfers to the USA, this may be carried out in particular through the EU-US Data Privacy Framework, provided the respective recipient is certified accordingly, or through appropriate safeguards in accordance with Article 46 of the GDPR.” The European Com mission has adopted an adequacy decision in accordance with Article 45 of the GDPR regarding the “EU-US Data Privacy Framework”. US companies can therefore obtain certification under the ‘EU-US Data Privacy Framework’.
14. Use of our online shops
In addition, we operate the following online shops:
- Spanish Riding School: Tickets for events at the Spanish Riding School in Vienna can, for example, be purchased here. The web shop for the Spanish Riding School is hosted by Jetticket Software GmbH in Vienna, Austria.
- Lipizzaner Stud Piber: Tickets for events at the Piber Lipizzaner Stud in Köflach can be purchased here, for example. The online shop for the Piber Lipizzaner Stud is hosted by LMS Sport GmbH in Duisburg, Germany.
Through our online shops, we automatically collect the technical data transmitted to us by your device’s web browser (see point 7), such as your IP address, browser type and version, and the date and time of access. This data is used to ensure the secure and trouble-free operation of our online shops, for error analysis, and to detect and prevent cases of fraud and misuse (Article 6(1)(f) of the GDPR; ‘protection of our legitimate interests’). It is retained for a period of 3 months and then deleted. A longer retention period may apply if, for example, a suspicious online shop order is being investigated. In this case, the data will be deleted once the investigation has been completed.
Data categories:
- Name,
- Address,
- contact details,
- Account details,
- Order history,
- saved preferences.
Purpose:
To provide and manage the customer account and to allocate orders.
The data will be stored for as long as your customer account remains active. You may request the deletion of your customer account at any time. Data that must continue to be stored due to statutory retention obligations or to safeguard legal claims will only be deleted once these periods have expired. Article 6(1)(b) of the GDPR.
The specific data processing activities relating to the two online shops are set out below:
14.1. Spanish Riding School online shop
In the Spanish Riding School online shop, you have the option to create an account. To do so, you must complete the registration process and click the ‘Register’ button. In your account, you can store the following data: title, first name, middle name, surname, company name (if applicable), date of birth, address including street, house number, postcode and town, country, language, telephone number, email address and password. In addition , we store your ID and the fact that you have ticked the checkbox to consent to our Terms and Conditions. Data that must be provided is marked with an “*” during the registration process. You may provide the remaining data voluntarily in your account. The data is processed for the purposes of account registration, customer management and the allocation of orders placed by you (Article 6(1)(b) of the GDPR; “necessary for the performance of a contract”). Data will be stored for the duration of your account use. You may delete your registered account at any time.
If you order tickets for events at the Spanish Riding School via our online shop, we also process the following data: the contents of your shopping basket (type of event, date and time of the performance, venue, seat booking, seat category, number of tickets, type of tickets, any discount along with whether the ticket is for an adult, senior citizen, student, school pupil or child, voucher, as well as price and currency), the delivery option you have chosen (delivery of the ticket to your email address or collection on site), the payment method you have chosen (Vpay, Visa, Mastercard or Maestro) and the relevant payment details (date and time of receipt of payment, amount, currency and reference number). The data collected during the ordering process is processed for the purpose of selling tickets, including delivering tickets to your email address or making them available for collection on site, as well as for settling the ticket price. In addition, you have the option to view your order history in your account (Article 6(1)(b) of the GDPR; ‘necessary for the performance of a contract’). Data relevant to billing is retained for seven years and deleted once the retention periods required under company and tax law have expired.
In connection with payment processing, your data will be passed on to Hobex AG and Datatrans AG. Data processing may take place in Switzerland in particular. Switzerland is a third country for which an adequacy decision has been issued by the European Commission. The adequacy decision can be accessed here, for example. Hobex AG’s privacy policy can be found here, for example.
We anonymise ticket sales data in order to compile general statistics on attendance at our events and guided tours at the Spanish Riding School and to measure our sales figures. It is not possible to trace this statistical data back to you (Article 6(1)(f) of the GDPR; ‘protection of our legitimate interests’).
Finally, in order to maintain the operation and functionality of our online shop, the aforementioned data is processed for the purposes of technical support and to carry out updates, bug fixes and/or maintenance.
When you use our online shop, the following cookies are set in your device’s browser:
| Cookie name: | BIGipServer~ASP~ |
| Purpose: | The assigned web server is stored for future visits to the online shop. |
| Duration: | The cookie is deleted when the browser is closed |
| Type: | Technically necessary |
| Cookie name: | inhouse_cookie |
| Purpose: | To record the interaction with the cookie banner. The cookie prevents the banner from being displayed repeatedly. |
| Retention period: | 365 days |
| Type: | Technically necessary |
| Cookie name: | inhousecookie_extended |
| Purpose: | Stores the selection of convenience cookies to save filter settings in the online shop. |
| Retention period: | 365 days |
| Type: | Technically necessary |
| Cookie name: | JSESSIONID |
| Purpose: | The assigned Java session is stored for subsequent requests to ensure correct mapping. |
| Duration: | The cookie is deleted when the browser is closed. |
| Type: | Technically necessary |
| Cookie name: | DWRSESSIONID |
| Purpose: | The assigned session is stored for further Ajax calls to ensure correct mapping. |
| Duration: | The cookie is deleted when the browser is closed. |
| Type: | Technically necessary |
| Cookie name: | inhouse_filter |
| Purpose: | Stores the filter settings in the online shop. |
| Duration: | The cookie is deleted when the browser is closed. |
| Type: | Optional |
14.2. Lipizzaner Stud Piber online shop
You also have the option to create an account in the Lipizzaner Stud Piber online shop. The registration process can be completed by clicking the ‘Submit Registration’ button. In your account, you can save the following details: title, first name, surname, company name (if applicable), date of birth, address (including street, house number, additional address details, postcode, town and country), telephone number, mobile number, fax number, email address and password. In addition, we store your ID and the fact that you have ticked the checkbox to agree to our Terms and Conditions and have taken note of our privacy policy. Mandatory details are marked with an “*” during the registration process. You may provide the remaining details in your account on a voluntary basis. The data is processed for the purposes of account registration, customer management and the allocation of orders placed by you (Article 6(1)(b) of the GDPR; ‘necessary for the performance of a contract’). The data will be stored for the duration of your account use. You may delete your registered account at any time.
We also carry out a security check to ensure that you are a human and not a bot. You will be shown an image containing a combination of letters and numbers. You will be asked to enter this combination into an input field. The system then checks whether the combination you have entered matches the one displayed in the image. In doing so, your IP address, as well as the date and time, are also processed (Article 6(1)(f) of the GDPR; ‘protection of our legitimate interests’).
If you order tickets for the Lipizzaner Stud Piber via our online shop, we also process the following data: the contents of your shopping basket (quantity and type of ticket, e.g. day ticket, guided tour, season ticket, entry to the climbing park and participation in a foal experience, the desired date and time, the time from which entry is permitted, location and, where applicable, any discount, together with whether the ticket is for an adult, senior citizen, student, school pupil or child, vouchers, as well as price and currency), the delivery option you have chosen (delivery of the ticket to your email address or by standard or express delivery), the payment method you have chosen (MasterCard, Visa, Amex, Diners Club) and the relevant transaction details (date and time of receipt of payment, amount, currency and reference number). The data collected during the ordering process is processed for the purpose of selling tickets, including delivery of the tickets to your email address or delivery address, as well as for issuing season tickets and processing payment for the ticket price. In addition, you have the option to view your order history in your account (Article 6(1)(b) of the GDPR; ‘necessary for the performance of a contract’). The data relevant to billing is retained for seven years and deleted once the retention periods required under company and tax law have expired.
In connection with payment processing, your data (in particular the transaction number and transaction amount) will be passed on to PAYONE GmbH. You can find PAYONE GmbH’s privacy policy here.
If you order a season ticket, you must also complete and sign the terms and conditions of use during your first visit. In doing so, we process your surname, first name, date of birth, address (including street, house number, postcode and town), email address, as well as the date and your signature, in order to be able to verify compliance with the terms of use and to handle any liabilities and warranties (Article 6(1)(b) of the GDPR; ‘necessary for the performance of a contract’; Article 6(1)(f) of the GDPR; ‘necessary for the purposes of our legitimate interests’).
If you have any questions regarding your order, you can use, for example, the contact form on the online shop. When you submit your enquiry, we process your first name, surname, email address, subject line and the content of your message, together with the technical data automatically transmitted to us by your device’s web browser (such as your IP address, as well as the date and time), in order to process your enquiry (Article 6(1)(b) of the GDPR; “necessary for the performance of a contract” or “necessary for the implementation of pre-contractual measures”). In this context too, the security check described above is carried out to ensure that you are a human being and not a bot.
If you give us your consent to do so, we use the ‘Matomo’ service to analyse the use of our online shop (see the details under point 16 of the data protection information). In doing so, your online shop ID, any orders and/or abandoned shopping baskets are also processed (Article 6(1)(a) of the GDPR; ‘consent’).
Processing is carried out on the basis of Article 6(1)(f) of the GDPR. Our legitimate interest lies in ensuring the secure and trouble-free operation of our online shop, as well as carrying out necessary maintenance and support measures.”
Optional cookies are only set if you have given your consent via the cookie banner.
Data categories:
- Name,
- contact details,
- Billing details,
- Order details,
- Ticket details,
- payment and settlement details.
Purpose:
Processing of ticket purchases, delivery of tickets, payment processing and invoicing.
Contract and invoicing data are generally stored for up to 7 years in accordance with tax and company law retention obligations. Furthermore, data may be stored for longer where this is necessary to establish, exercise or defend legal claims. Article 6(1)(b) GDPR and Article 6(1)(c) GDPR.
15. Application management and job vacancies
15.1. Applying via our website
You also have the option of applying for vacancies via our website.
We use the services of our data processor, softgarden e-recruiting GmbH, to manage applications submitted via the form on our website. The service is hosted in Berlin, Germany. You can find softgarden’s privacy policy here.
When you apply for a vacancy, we collect the following personal data from you via the online form: title (optional), professional title (optional), first name, surname, email address, telephone number, cover letter (optional), additional attachments (optional), salary expectations and your earliest possible start date. If you already have an account with us, the data already on file will be used for this purpose. You also have the option to upload your CV and other documents (such as a covering letter, employment references or other certificates) as part of your application. To upload your CV, you may optionally use the services of the ‘Xing’ platform.
Certain sub-processors used by softgarden (e.g. to protect against DDoS attacks) are based in a third country, such as the USA. The European Commission has adopted an adequacy decision under Article 45 of the GDPR regarding the ‘EU-US Data Privacy Framework’. US companies can therefore obtain certification under the ‘EU-US Data Privacy Framework’.
By providing your title, first name, surname, email address, username and password, you can create an account with softgarden. The processing is carried out on the basis of your consent (Article 6(1)(a) of the GDPR). The data is stored to simplify the application process and is generally retained until you delete your account. You may do so at any time. Your application will still be considered. However, you may also apply via our website (or by email/post – see15.2 ) without creating an account.
Furthermore, you may also use the data stored on the ‘Xing’ platform. Xing is operated by New Work SE in Germany. By logging into your Xing account, you authorise us to access the data stored on Xing (Article 6(1)(a) of the GDPR). A connection to Xing’s servers is only established once you access the platform (by clicking the ‘Xing’ button). New Work SE is solely responsible for data processing carried out on the Xing platform or in connection with it. You can find Xing’s privacy policy here.
In addition, your application data is processed for the automated generation of a report. We count the number of times a job advertisement is clicked on (‘views’) using a so-called tracking pixel (Article 6(1)(f) of the GDPR; ‘protection of our legitimate interests’). A tracking pixel is a small text file that is loaded each time the job advertisement is accessed. This enables us to record the number of views as a numerical figure. No personal data is stored in the process.
To display the locations of vacancies on an interactive map, the open-source mapping service ‘OpenStreetMap’ is also integrated. The map data is loaded via a server operated by the OpenStreetMap Foundation, which is located in the United Kingdom. This results in your IP address being transmitted (Article 6(1)(a) of the GDPR; ‘consent’). An adequacy decision by the European Commission pursuant to Article 45 of the GDPR is in place for the transfer of data to the United Kingdom. OpenStreetMap’s privacy policy can be found here.
15.1.1. Cookies
Finally, to verify that you are a human and not a bot, we have implemented the “Friendly Captcha” service provided by Friendly Captcha GmbH in Wörthsee, Germany, which transmits further technical data to the OpenStreetMap Foundation for processing. Processing takes place only with your consent. In the process, the connection data, environmental data, interaction data and functional data transmitted by your browser are sent to the Friendly Captcha server. Your IP address is anonymised in the process. On this basis, an assessment is made as to whether the website visitor is likely to be a bot or a human. This result is transmitted to us by Friendly Captcha. This enables us to protect ourselves against misuse and spam (Article 6(1)(f) of the GDPR; ‘protection of our legitimate interests’). You can find Friendly Captcha’s privacy policy here.
In connection with softgarden, the following cookies are set in your device’s browser:
| Cookie name: | JSESSIONID |
| Purpose: | The assigned Java session is stored for subsequent visits to ensure correct allocation. |
| Duration: | The cookie is deleted when the browser is closed. |
| Type: | Technically necessary |
15.2. Applications by email or post
If you do not wish to apply via our website, you may also submit your application to us by email or post. In this case, our data processor, softgarden e-recruiting GmbH, will not be involved in the process. Should we receive such an application, we will collect the personal data contained therein – as provided by you. This usually includes: title, first name, surname, email address, telephone number, cover letter, CV, any other attachments, salary expectations and the earliest possible start date, for the purposes of structured recording, communication and, where applicable, arranging an interview, as well as establishing an employment relationship with you.
15.3. General information
We process the personal data set out above for the purposes of systematically recording, communicating and, where applicable, arranging a job interview, as well as establishing an employment relationship with you. (Article 6(1)(b) of the GDPR; ‘necessary for the performance of a contract or for taking steps prior to entering into a contract’).
The provision of the aforementioned personal data is not required by law or by contract. You are not obliged to provide this data. Please note that we will be unable to process your application if you do not provide us with the data marked with an ‘*’ in the online form. We process all other personal data that you provide to us voluntarily in order to safeguard our legitimate interest (Article 6(1)(f) of the GDPR) in the efficient handling of recruitment processes and in maintaining an optimal workforce.
If you cannot find a vacancy that appeals to you, you also have the option of contacting us so that we can consider you for future vacancies. To do so, you may provide the following details: your title, first name, surname, email address, area of interest, career stage, preferred location and CV. Mandatory fields are marked with an “*”. With your consent, you will be added to our “talent pool” (Article 6(1)(a) of the GDPR; “consent”).
We would like to expressly point out that, as a rule, there is no need to provide us with special categories of data within the meaning of Article 9(1) of the GDPR (e.g. religious beliefs, health status). Should you nevertheless provide us with such data, we will redact or delete it immediately upon receipt and will not process it further.
Depending on the specific position for which you are applying, we may engage an external recruitment consultant, e.g. Brenner&Company International Management Consulting GmbH, to assist with the recruitment process. For this purpose, we will transfer your personal application documents to the relevant recruitment consultant (usually based within the EU/EEA) on the basis of our legitimate interests in supporting the conduct and optimisation of the application process (Article 6(1)(f) of the GDPR).
Should no employment relationship subsequently be established, we will delete your application data within 7 months – the storage is based on our legitimate interests in defending legal claims (Article 6(1)(f) of the GDPR), unless you wish us to retain your data in our ‘talent pool’ for future vacancies (Article 6(1)(a) of the GDPR; ‘consent’). In this case, we will retain your application documents until you withdraw your consent or for a period of 5 years.
Furthermore, we process your personal data for the purpose of asserting, exercising or defending legal claims, as well as for conducting proceedings before authorities (including courts), if you contest the rejection of your application and/or assert claims for damages; in any event, for the duration of the proceedings on the basis of our legitimate interests (Article 6(1)(f) of the GDPR). If you exercise your rights as a data subject under Article 15 et seq. of the GDPR or lodge a data protection complaint, we will process your personal data for three years from the date on which these rights are exercised on the basis of our legitimate interests (Article 6(1)(f) of the GDPR in conjunction with Section 24(4) of the DSG) to defend against legal claims or until the conclusion of any administrative or judicial proceedings. In these cases, we transfer your personal data on the basis of our legitimate interests to assist in the assertion, exercise or defence of legal claims, as well as for the conduct of proceedings before authorities (including courts), to a solicitor or tax adviser (Article 6(1)(f) of the GDPR).
No automated decision-making, including profiling, takes place in accordance with Article 22 of the GDPR.
16. Embedding of videos
To display video content on our website, we use video players from various providers.
16.1. YouTube
For example, we have embedded YouTube videos from Google Ireland Limited so that we can show you videos stored on YouTube directly on our website. These are embedded in what is known as ‘enhanced privacy mode’. This means that no data about you as a user is transferred to YouTube unless you play the videos. Only with your consent, when you play the videos, is a connection established to Google’s servers (Article 6(1)(a) of the GDPR; ‘consent’). In doing so, the following data is transferred to Google. Google may use sub-processors who may process your data in a third country, such as the USA. The European Commission has adopted an adequacy decision pursuant to Article 45 of the GDPR regarding the ‘EU-US Data Privacy Framework’. US companies can therefore obtain certification under the ‘EU-US Data Privacy Framework’.
If you have a Google account and are logged in, the data will, for example, be associated with your Google account. Google may use the data, for example, to create user profiles, to design, personalise and improve YouTube, and to optimise advertising. Google is solely responsible for this under data protection law. You can find Google’s privacy policy here.
16.2. Matterport
In addition, we use the “Matterport” service to display our premises as a 3D model. The 3D model is loaded via a US-based server operated by Matterport Inc. In doing so, your anonymised IP address, the ID of the 3D model and other technical data (such as the type of device, operating system, browser language and the country from which access is made) are transmitted to Matterport Inc. and processed by them in the USA (Article 6(1)(a) of the GDPR; ‘consent’). The European Commission has adopted an adequacy decision pursuant to Article 45 of the GDPR regarding the ‘EU-US Data Privacy Framework’. US companies may therefore seek certification under the ‘EU-US Data Privacy Framework’.
For example, if you have a Matterport account and are logged in to it, Matterport will associate your use of the 3D model with your account and process this data to improve Matterport. Matterport is solely responsible for this under data protection law. You can find Matterport’s privacy policy here.
17. Sponsorship and patronage
If you decide to support us voluntarily, there are several options available to you. For example, you can sponsor a foal or a young stallion, or become a member of our circle. The associated data processing takes place to the extent that it is necessary for the establishment, performance and fulfilment of the type of support you have chosen (Article 6(1)(b) of the GDPR; ‘necessary for the performance of a contract’).
We use, for example, your first name, middle name, surname, title, date of birth, company name (if applicable), address including street and house number, postcode, town and country to produce your sponsorship certificate or supporter’s card, to display your sponsorship plaque at the relevant horse box in the Stable Block of the Vienna Hofburg, and to send you your sponsorship/supporter’s gift. In addition, we process your payment method and the relevant transaction details (date and time of receipt of payment, amount, currency and reference number) in order to allocate incoming payments to you and to manage them. We generally store your personal data for the duration of the sponsorship, membership or other patronage relationship. Once this relationship has ended, your data will only be retained for as long as is necessary to comply with statutory retention obligations, in particular under tax and company law (generally 7 years), or insofar as storage is necessary to establish, exercise or defend legal claims. The legal basis for this is Article 6(1)(b) of the GDPR (performance of a contract) and Article 6(1)(c) of the GDPR (compliance with a legal obligation).
If you are a member of our Cercle, your name may, upon request, be listed on a roll of honour at the Stallburg and on our website (Article 6(1)(a) of the GDPR; ‘consent’).
18. Company magazines
When you register for our company magazines, the following data is collected from you: first name, surname and postal address. We process this data to send the company magazines you have ordered to your postal address. To this end, we also pass the data on to Österreichische Post AG. We also process the data to document successful deliveries (Article 6(1)(a) of the GDPR; ‘consent’).
You may cancel your subscription to the corporate magazines at any time without giving a reason and withdraw your consent to receive them. You can do this, for example, by emailing datenschutz@srs.at . The lawfulness of the data processing remains unaffected until the time of withdrawal.
We store your personal data for the duration of your consent to receive the company magazines. Following the withdrawal of your consent, your data will be deleted, provided there are no statutory retention obligations or further storage is necessary to establish, exercise or defend legal claims.
19. Retention period
As a general rule, we only store personal data to the extent and for as long as is necessary to achieve the purposes set out in the privacy notice (e.g. to fulfil and invoice a contract with you). A longer storage period may apply, for example, due to statutory retention obligations. The Federal Tax Code (BAO) and the Austrian Commercial Code (UGB), for example, stipulate that data relevant to invoicing must be retained for up to 7 years. In specific cases, the relevant limitation periods for potential warranty and/or compensation claims may also be taken into account when determining the storage period. For details, please refer to the respective processing purposes.
20. Place of data processing
Data processing generally takes place within the European Union or the European Economic Area. Should personal data be transferred to a third country or an international organisation, this is indicated separately. In the case of an international data transfer, the provisions of Part Five of the GDPR are complied with. This means that either
- an adequacy decision by the European Union is in place (these can be accessed here);
- the European Commission’s Standard Data Protection Clauses have been agreed with the data recipient in the third country (click here for the Standard Data Protection Clauses);
- the data recipient in the third country is subject to approved Binding Corporate Rules; or
- there is a legal basis for specific cases in accordance with Article 49 of the GDPR (these can be found here; e.g. your consent, with a reference to the risk involved in international data transfers).
21. Data disclosure
In some cases, we are legally obliged to disclose or transfer data to third parties. This is the case, for example, with regard to security police orders or tax audits carried out by the relevant tax office. Furthermore, we engage various service providers to deliver our services. Data is generally transferred to a ‘ ’ known as a data processor. In such cases, we remain responsible for compliance with the GDPR under data protection law. To this end, we enter into so-called data processing agreements with our service providers (Article 28 of the GDPR). In exceptional cases, we may disclose personal data to a controller acting independently or jointly with us. Examples of independent controllers include auditors, tax advisers and solicitors.
Essentially, there are the following categories of recipients:
- Technical service providers (e.g. for the operation and hosting of our website and online shops, or for compiling usage statistics)
- Regulatory authorities and courts
- Auditors and tax advisers
- Solicitors
- Payroll administrators and bookkeepers
- Payment service providers
- Banks and credit institutions
- Debt collection agencies
- Logistics and postal delivery services
Recipients of personal data
In the course of our business, we transfer personal data to the following recipients or categories of recipients:
| Recipients | Personal data transferred | Purpose of the transfer | Legal basis |
| internex GmbH (hosting) | IP address, technical access data, server log data, website usage data where applicable | Hosting, operation, technical provision and ensuring the functionality of our website | Article 6(1)(f) of the GDPR (legitimate interest in the secure and trouble-free operation of the website); processing as a data processor in accordance with Article 28 of the GDPR |
| Jetticket Software GmbH | Name, address, email address, telephone number, customer data, order details, ticket details, payment information (no full card details, where processed via payment service providers) | Operation of the Spanish Riding School’s online shop, account management, ticket sales, order processing and support | Article 6(1)(b) of the GDPR (performance of a contract or pre-contractual measures); where applicable, Article 6(1)(f) of the GDPR for technical operations; Article 28 of the GDPR for data processing on behalf of the controller |
| LMS Sport GmbH | Name, contact details, order and ticket details | Operation of the Piber Lipizzaner Stud Farm’s online shop, ticket sales and order processing | Article 6(1)(b) of the GDPR; where applicable, Article 28 of the GDPR |
| Hobex AG | Payment information, transaction data, amount, currency, payment status, reference number, and, where applicable, technical payment data | Processing of card payments and payment transactions | Article 6(1)(b) of the GDPR (performance of a contract); where applicable, the payment service provider’s own responsibility |
| Datatrans AG | Payment information, transaction data, technical payment data | Execution and security of electronic payment transactions | Article 6(1)(b) of the GDPR |
| Austrian Post AG | Name, address, contact details where applicable | Dispatch of prizes or other postal items | Article 6(1)(b) of the GDPR (performance of a contract); where applicable, Article 6(1)(f) of the GDPR (efficient handling of the dispatch) |
| Brevo (newsletter service) | Name, email address, newsletter preferences, consent details, technical registration information (e.g. time, IP address) | Sending and managing newsletters, documentation of consent | Article 6(1)(a) of the GDPR (consent); processing as a data processor in accordance with Article 28 of the GDPR |
| Usercentrics GmbH / Cookiebot | Consent ID, consent status, time of consent, cookie settings, IP address, technical device data | Management, storage and proof of cookie consents | Article 6(1)(c) of the GDPR (evidence of legal obligations); Article 6(1)(f) of the GDPR (legally compliant management of consents); Article 28 of the GDPR |
| Google Ireland Limited (Google Ads) | Cookie ID, online identifiers, IP address, usage data, conversion data | Serving of adverts, performance measurement and optimisation of advertising campaigns | Article 6(1)(a) of the GDPR (consent) |
| Google Ireland Limited (Google Tag Manager) | Technical access data, IP address, information about integrated services (only where downstream services are activated) | Management and control of website tags | Article 6(1)(a) of the GDPR (consent, unless technically necessary) |
| Google Ireland Limited (Google Conversion Tracking) | Cookie ID, online identifiers, technical data, conversion information | Measuring the effectiveness of advertisements | Article 6(1)(a) of the GDPR (consent) |
| InnoCraft Ltd. (Matomo) | Anonymised or truncated IP address, usage data, device and browser data, referrer, page views, downloads | Web analytics, statistical analysis and improvement of the website | Article 6(1)(a) of the GDPR (consent) |
| Die Goldkinder GmbH | Technical usage data, anonymised statistical data (depending on specific usage) | Compilation of website statistics and analysis of website usage | Article 6(1)(f) of the GDPR (legitimate interest in analysis and optimisation) or Article 6(1)(a) of the GDPR, if tracking/ana lysis is carried out only with consent |
| WeTransfer B.V. | IP address, technical access data, usage data when accessing the platform or downloading files | Provision and retrieval of media files | Processing by WeTransfer as a separate data controller; the legal basis is set out in WeTransfer’s privacy policy |
| Tax advisers / auditors / solicitors | Accounting data, contract data, invoicing data, communication data | Tax advice, audits, legal advice, safeguarding legal interests | Article 6(1)(b) of the GDPR (performance of a contract), Article 6(1)(c) of the GDPR (legal obligations), Article 6(1)(f) of the GDPR (legitimate interests) |
| Public authorities (e.g. tax office, security authorities) | such personal data as is required by law | Fulfilment of legal obligations, official procedures and audits | Article 6(1)(c) of the GDPR (legal obligation) |
22. Your rights
We would like to inform you that you have the right to
- request confirmation as to whether or not we are processing personal data relating to you; if this is the case, you have the right to access this personal data and the information set out in Article 15(1) and (2) of the GDPR; to receive a copy of the personal data concerning you that is being processed; see Article 15(3) and (4) of the GDPR;
- to request the rectification or completion of inaccurate or incomplete data concerning you (see Article 16 of the GDPR for details);
- to request the erasure of your data, provided there is no legal basis for the continued processing of your data (see Article 17 of the GDPR for details); in this context, we may not be able to comply with a request for erasure if the processing (retention) is necessary to fulfil a legal obligation (statutory retention obligations) or if we are entitled to do so on the basis of overriding interests (e.g. the establishment, exercise or defence of specific legal claims);
- to request the restriction of the processing of your data where certain conditions are met (see Article 18 of the GDPR for details);
- to object to the processing of your data that is necessary to safeguard our legitimate interests or those of a third party (Article 6(1)(f) of the GDPR) . In the event of an objection, we will no longer process your data unless the processing serves to assert, exercise or defend legal claims, or we demonstrate compelling legitimate grounds for the processing which override your interests (taking into account your particular situation where applicable) (see Article 21 of the GDPR for details);
- to receive the data you have provided in a structured, commonly used and machine-readable format. However, the right to data portability applies only where the processing is based on your consent or on a contract (see Article 20 of the GDPR for details).
Where we process your data on the basis of your consent, you have the right to withdraw this consent at any time, e.g. by emailing datenschutz@srs.at. This does not affect the lawfulness of the data processing carried out up to that point (Article 7(3) of the GDPR).
If you wish to exercise any of your rights and/or have any questions regarding the processing of your data, you may contact us at any time with your enquiry:
Spanish Riding School – Lipizzaner Stud Piber, a public-law body
Address: Michaelerplatz 1, 1010 Vienna
Telephone: +43/1/533 90 31
Email: datenschutz@srs.at
You also have the right to lodge a complaint with the Austrian Data Protection Authority or with another data protection supervisory authority in the EU, in particular in your place of residence or work.
Austrian Data Protection Authority
Address: Barichgasse 40–42, 1030 Vienna
Telephone: +43 152152-0
Email: dsb@dsb.gv.at
23. Version
Due to technical developments, changes to processes and/or changes in the legal situation, it may be necessary to revise this privacy notice.
Last updated: July 2026