It is important for VERBUND Tourismus GmbH to protect your personal data and to explain to you how we handle them. This privacy statement contains the main data processing activities of VERBUND Tourismus GmbH.
1. Name and address of the Data Controller
Responsible for processing your data is VERBUND Tourismus GmbH, Europaplatz 2, 1150 Vienna ("VERBUND", "we", "us"), reachable on tel: +43 (0)50 313-23 201, email: tourismus@verbund.com. The contact details of the data protection officer: datenschutz@verbund.com.
2. Data processing in the context of "voucher ordering and processing"
2.1. What kind of personal data will we process?
In the course of ordering and processing your voucher, the following data will be collected: first name, last name, address, email address, phone number, voucher code, issue date, voucher value, bank details.
2.2. Legal basis and purpose of the data processing
The legal basis for the processing of data is Art. 6(1)(b) GDPR and therefore the processing for the fulfilment of a contract. The data will be processed by VERBUND for the purpose of ordering the voucher and for the further processing of the contract (conclusion of the contract, sending and redeeming the voucher, billing, etc.). The provision of contact data by you is voluntary; however, if you do not provide these data, VERBUND will not be able to process your voucher order accordingly or send you a voucher.
2.3. Retention period
We will process your data for as long as it is necessary to do so for processing the order and contract and beyond, and to the extent that statutory retention periods exist or warranty and limitation periods are still in force.
2.4. Data recipients
In order to process the personal data, we use service providers (e.g. IT service providers) as processors; in accordance with our orders and instructions, these processors may, under certain circumstances, also have access to personal data in order to be able to render the commissioned services. Your data will not be passed to any third parties for their own purposes without your voluntary consent. As required, we will transmit your personal data to external parties, e.g. auditors, insurers or legal representatives, to the extent necessary. Personal data will be rendered anonymous if possible.
3. Data processing in the context of "making contact/enquiries"
3.1. What kind of personal data will we process?
When you make contact with VERBUND and request information or make enquiries, the following data provided by you, depending on the matter in question, will be processed (this depends on the chosen manner of making contact (online, email, phone) and the nature of your enquiry): information about your person such as qualification, title, name, address, contact information such as email address, phone number, type of interest or information about your enquiry, and any other data collected or indicated as necessary when making contact/inquiries, depending on the nature of your enquiry. The provision of these data by you is voluntary. If you do not provide these data for the handling of your enquiry, VERBUND will not be able to process your enquiry accordingly.
3.2. What is our legal basis and purpose for processing personal data?
The legal basis for the processing of your personal data is our legitimate interest in accordance with Art. 6(1)(f) GDPR. If the reason for the enquiry/making contact is to conclude a contract, the fulfilment of (pre-)contractual obligations pursuant to Art. 6(1)(b) GDPR is the legal basis. The personal data provided by you will be processed for the purpose of making contact and providing information or handling your inquiry.
3.3. Retention period
We process your data in order to handle your enquiry and beyond that for a period of three months, so that we can respond appropriately to subsequent questions. A longer retention period will be applied only on the basis of statutory retention periods or for defence purposes in any legal disputes.
3.4. Data recipients
The data will be forwarded to third parties only where required for the fulfilment of (pre-)contractual or statutory obligations, or where justified for the maintenance of our legitimate interests. For example, as required, we will transfer your personal data to the external parties, e.g. auditors, insurers or legal representatives, to the extent necessary. Personal data will be rendered anonymous if possible.
The data may be transmitted to commissioned service providers (e.g. IT service providers) for order processing.
4. Data processing ‘Webshop’
4.1. Scope of personal data processing
When you visit shop.visit.verbund.com (‘website’), the following personal data is automatically collected about you:
• Date and time of access to a page on the website
• Data about your device (device ID)
• IP address
• Name and version of your web browser
• Session ID
For information on the cookies collected when you visit the websites, please refer to the cookie policy in section 5, which states that only necessary cookies are used.
4.2 Legal basis and purpose of data processing
With regard to the data relating to your visit to the website, we base the processing on our legitimate interest pursuant to Art. 6 (1) lit. f GDPR, which consists of designing the websites in a user-friendly manner and protecting them from attacks.
We process your data in connection with your visit to the web shop for the following purposes:
- to make the website, including its functions, available to you
- to further improve and develop the website
- to compile usage statistics for statistical analysis in anonymous form, and
- to detect, prevent and investigate attacks on the web shop.
4.3. Duration of storage
We will generally store your data for a period of five months after your visit to the website. Your data will only be stored for longer if this is necessary to investigate attacks on the websites and only until the expiry of the relevant limitation periods, statutory retention periods or any legal disputes.
4.4. Recipients of data
We will not disclose your personal data collected on the basis of your use of the website to third parties unless this is necessary to fulfil our obligations or is required by law or by official authorities.
We regularly use IT service providers to operate and administer the website, who may also have access to personal data in order to provide the IT services commissioned by us, in accordance with our instructions and on our behalf.
We also transfer your personal data to the following recipients:
- to external third parties to the extent necessary on the basis of our legitimate interests (e.g. auditors, insurance companies in the event of a claim, legal representatives in the event of a dispute, etc.),
- to authorities and other public bodies to the extent required by law (e.g. tax authorities, courts, etc.).
Your data will not be passed on to any other third parties for their own purposes without your consent.
5. Cookies policy
5.1. Cookies and how they work
Our website uses cookies and similar web storage technologies, such as scripts, web beacons, tracking URLs, pixels or tags (hereinafter referred to as ‘cookies’). Cookies are small files that are stored on your device (e.g. PC, smartphone or tablet) when you visit our websites. Every time you visit our websites, the cookie and the respective website ‘communicate’ with each other so that your device can be recognised. This is useful for both you and us: cookies serve to enable the correct functioning of our websites, to extend the range of functions and to optimise the website functions. This allows a website to remember certain entries and settings (e.g. language, font size) for a certain period of time, so that you do not need to re-enter them each time you visit. We only use first-party cookies. These come directly from our websites and only send information to us.
In many cases, cookies do not identify you as a person, but rather your device. In the case of necessary cookies, data processing is required for the purpose of data security measures and to prevent misuse and is therefore based on our legitimate interests in accordance with Art. 6 para. 1 lit. f GDPR in conjunction with § 165 para. 3 TKG.
We currently only use cookies on our websites to provide you with an optimal website experience. Cookies that are technically necessary for the provision of services (‘necessary cookies’) are automatically activated on each visit based on our legitimate interests. The use of these necessary cookies is necessary for the operation of the website and enables basic functions to be ensured. The website cannot function properly without these cookies.
The necessary cookies used and their storage duration are listed here:
Name | Category | Duration | Purpose |
XTCsid | Necessary | Session | Session ID. Required to maintain the shopping cart and process orders. |
xxx_iframe (xxx is a system-specific abbreviation) | Necessary | Session | To recognise integration as an IFrame and required for displaying the shop. |
referrer_url | Necessary | Session | To calculate the height of the IFrame and required for displaying the shop. |
SRVID (depending on the server cluster used, therefore only set on certain systemst) | Necessary | Session | Server ID. Required for order processing in order to route to the correct server node within the server cluster via the load balancer. |
6. Your rights
You have the right to information, correction, deletion, restriction, data portability, revocation of consent and objection with regard to your data processed by us.
To exercise these rights, please contact us, e.g. by email at datenschutz@verbund.com. If you believe that the processing of your data violates data protection law or that your data protection rights have been violated in any other way, you can complain to the national supervisory authority of your place of residence. In Austria, the data protection authority (DSB, Barichgasse 40-42, 1030 Vienna [www.dsb.gv.at]) is responsible.
7. Updating of the data protection information
We reserve the right to make changes to this data protection information at any time. Changes will be published on this website.
as of July 2025
etracker
The provider of this website uses the services of etracker GmbH, Hamburg, Germany (www.etracker.com) to analyse usage data. We do not use cookies for web analysis by default. If we use analysis and optimisation cookies, we will obtain your explicit consent separately in advance. If this is the case and you agree, cookies are used to enable a statistical range analysis of this website, a measurement of the success of our online marketing measures and test procedures, e.g. to test and optimise different versions of our online offer or its components. Cookies are small text files that are stored by the Internet browser on the user's device. etracker cookies do not contain any information that could identify a user.
The data generated by etracker on behalf of the provider of this website is processed and stored by etracker solely in Germany by commission of the provider of this website and is thus subject tothe strict German and European data protection laws and standards. In this regard, etracker was independently checked, certified and awarded with theePrivacyseal data protection seal of approval.
The data processing is based on Art. 6 Section 1 lit f (legitimate interest) of the General Data Protection Regulation (GDPR). Our legitimate interest is the optimisation of our online offer and our website. As the privacy of our visitors is very important to us, the data that may possibly allow a reference to an individual person, such as IP address, registration or device IDs, will be anonymised or pseudonymised as soon as possible. etracker does not use the data for any other purpose, combine it with other data or pass it on to third parties.
You can object to the outlined data processing at any time. Your objection has no disadvantageous consequences.
Further information on data protection with etracker can be found here.