Data protection

1. Legal basis (General Data Protection Regulation and Austrian Data Protection Act 2018)
The General Data Protection Regulation (GDPR) is the foundation of data protection law in Europe. It protects the fundamental rights and freedoms of natural persons and, in particular, the processing of their personal data. Personal data is any information that relates to an identified or identifiable living individual.

2. Website owner and responsible for data processing:
Graz Tourismus und Stadtmarketing GmbH, Messeplatz 1/Messeturm, A-8010 Graz.
By visiting this website you are giving us consent to collect certain data. In return, we are committed to protecting  your data in line with the latest technology.
Your details are not passed on to third parties for advertising  purposes. Third parties only receive your personal data as stated within these listed regulations.

3. Cookies & plugins: Cookies are used to make www.graztourismus.at more user-friendly and to customise its content for visitors. None of the cookies used on this site collect information through which you could personally be identified. Almost all websites use cookie technologies and they are essential for the use of www.graztourismus.at.
Cookies are small text files, which enable visitors to be recognised and their website use to be analysed. Many cookies are extremely useful, as they  improve the user experience when revisiting a website. By using the same device and browser as in previous sessions, the cookies can, for example, remember your preferences and use of the site, making the displayed content more relevant to your personal interests and requirements. We only use cookies that are essential to the running of www.graztourismus.at and its optional tools (e.g. holiday enquiry, brochure request). In addition, cookies are used to save settings selected on a previous visit (e.g. language, interests). In all other instances, cookies are only used to save personal data after you have given consent.
To avoid the use of cookies in general, set your browser to only allows these to be placed after your active consent. The way you manage and delete cookies depends on which browser you are using. Use the integrated help function in your brower or visit www.aboutcookies.org for step-by-step guides to the most common browsers.
We do, however, advise that without the placement of cookies parts of our website can only partially or not be used at all. By accepting our cookies and plugins you are allowing the following:

• Facebook Pixel: With your consent, we use the Facebook Pixel on our website, provided by Meta Platforms, Inc., 1601 S. California Ave, Palo Alto, CA 94304, USA ("Facebook"). This service allows us to track users as they interact with our site after having clicked on a Facebook ad. Through this we can evaluate the effectiveness of Facebook ads and optimise future advertising measures. The collected data is anonymous to us and does not give any indication of the user’s identity. The details are, however, saved and processed by Facebook, meaning that there is a connection to the user profile. Facebook can use the details for advertising purposes, in line with its data policy (facebook.com/about/privacy). The collected data enables Facebook and its partners to place ads on and outside of Facebook, and cookies can be saved on your device for this purpose.
  You can reject the Facebook Pixel data capture and it being used to display Facebook advertisements within the Facebook ad settings: https://www.facebook.com/settings?tab=ads  
  Alternatively, you can object via the US site http://www.aboutads.info/choices/ or the EU site http://www.youronlinechoices.com. Settings are not platform-dependent, so will cover all devices such as desktop computers and mobile phones.

• Google Analytics 4: We use Google Analytics 4 by Google Inc., 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA ("Google") for web analysis. Google Analytics uses cookies that are saved your computer, allowing an analysis of website use. The generated information is usually transmitted to a Google server in the USA, where it is stored in line with the US Safe Harbour Privacy Principles.

  Google uses this information to evaluate your use of the website on our account, compile reports on website activity and provide site owners with further services relating to website and internet use.
  We only use Google Analytics with active IP anonymisation. This means that Google shortens the IP address of website visitors from the European Union and its other contracting states. Only in exceptions is the full IP address transmitted to a Google server in the USA and shortened there.
  To prevent the cookie-generated collection of website activity data and it being processing by Google, download and install the following browser add-on: tools.google.com/dlpage/gaoptout
  We use the Google Analytics features to analyse website use, e.g. through anonymous reports and graphs on page views and visits, for remarketing, reports on impressions within the Google Display Network, integration of the DoubleClick Campaign Manager and Google Analytics reports by demographic traits and interests.
  Google Analytics saves cookies in your web browser for the duration of two years since your last visit. These cookies contain a randomly generated User ID, which allows you to be recognised on future visits.
  The collected data is stored with the randomly generated User ID, enabling the evaluation of pseudonym user profiles. These user-related details are automatically deleted after 14 months. All other data remains stored indefinitely.
  You can find further information on the terms of use and data protection at http://www.google.com/analytics/terms/ and https://policies.google.com/?hl=en.

• Google Signals: As an extension to Google Analytics 4, Google Signals is used on this website to create cross-device reports. If your devices are linked to your Google account and have "personalized ads" activated, Google can analyze your usage behavior across devices, subject to your consent to the use of Google Analytics. We do not receive any personal data from Google, only statistics. If you wish to refuse cross-device analysis, you can disable the "Personalized advertising" function in your Google account settings. To do this, follow the instructions on this page. For more information about Google Signals, see this link.

• Google Adwords: Google uses the DoubleClick cookie on websites within its advertising network and services to support AdWords clients and publishers when posting and managing ads. If you visit a website and display or click on an ad from the Google advertising network, a DoubleClick cookie may be stored in your browser. The DoubleClick cookie identifier assigned to your browser is the same as that used on websites featuring DoubleClick ads. If your browser already has a DoubleClick cookie it should not store another one. Find further information on the use of DoubleClick cookies in association with DoubleClick ads in the DoubleClick data protection FAQs. Our website also uses Google Analytics remarketing for online advertising. This entails the use of cookies by third parties, including Google. The combined use of initial supplier (e.g. Google Analytics cookies) and third-party supplier cookies (e.g. DoubleClick cookies) based on previous website visits enables the optimisation and evaluation of the ads you see. Remarketing anonymously collects and stores information on your browsing habits for marketing purposes (targeting / retargeting). Cookies store these details on your computer, enabling an algorithm to display targeted product recommendations and advertising banners when you visit other websites (so-called publishers). This data cannot be used to identify you as a user on other websites. Its sole purpose is to improve the content you see.
• Setting and disabling options: Third-party vendors, including Google, use these cookies to serve ads based on a user's previous visits to our website. No personal data is stored in the process. Users of this website can disable Google's use of cookies by visiting the Google Ads Preferences page. Furthermore, users can deactivate the use of cookies by third-party providers by visiting the deactivation page of the "Network Advertising Initiative" and carrying out the corresponding settings there.

Google Ad Defaults: http://www.google.com/ads/preferences/?hl=de
Settings and unsubscribe options of the "Network Advertising Initiative": https://optout.networkadvertising.org/
 

4. Sharing and embedding of social media elements:
Share buttons for the social networks of Twitter Inc., 795 Folsom St., Suite 600, San Francisco, CA 94107, USA, Facebook, 1601 South California Avenue, Palo Alto, CA 94304, USA, YouTube by YouTube, LLC, 901 Cherry Ave, San Bruno, CA 94066, USA, Instagram by Instagram Inc., 1601 Willow Road, Menlo Park, CA, 94025, USA and GooglePlus by Google Inc., 1600 Amphitheatre Parkway, Mountain View, CA 94043, United States are embedded on our website.
All share buttons are installed in line with data protection laws. Only once you have clicked on the share button on our site is a direct connection established between your browser and the respective social network. According to the social network operators, no personal or business-related data is captured without clicking on the share button. It is only when users are logged in to their social network account that such data, including their IP address, is collected and processed. Should you not wish for a connection to be established between your visit to our website and a specific social network, please log out of its account.
As website operators, the content of the data transmitted to and from social networks and its use is not known to us. You can find further information on the use of data in the respective social network’s privacy statements.

5. Capturing anonymous data and information:
With each use of our website, i.e. whenever a file is accessed or attempted to be accessed from its server, details of the process are saved in a log file. This data is not related to an individual, so we cannot see which user accessed the file, and we do not attempt to.
Records that are saved:

•     Name of the file that was accessed
•     Date and time of access
•     Transferred data volume
•     Notification of whether the access was a success
•     Notification of why an error might have occurred
•     Name of the internet provider used to access the website
•     Where applicable, the operating system and browser software of your computer, and the website
•     from which you visited us

The above data is used for statistical purposes only by ourselves and those appointed by us. We use this data to improve our website for you.
Disclosure of campaign data to Graz Tourismus partners: In line with marketing campaigns, anonymised data is collected for remarketing purposes on the individual campaign landing pages and passed on to campaign partners. This is used to target ads for visitors of our own and our campaign partnersʼ websites.

6. Other collection and processing of personal data
Personal and business-related data (e-mail, name, address) is disclosed on a voluntary basis to access  the tools on our website (e.g. brochure request). If you send us an e-mail, your e-mail address and further details are only used for the correspondence with yourself. Where technically possible and acceptable, you can use and pay for services offered by ourselves without disclosing personal data or by using anonymised data or a pseudonym.

7. Your rights as data subject

• The right to confirmation:
  As data subject, you have the right to demand confirmation that your personal data is being processed by ourselves. You can contact us in line with this at any time at dsgvo@graztourismus.at.
• The right to be informed:
  As data subject, you have the  right to obtain free information on the personal data we hold of you and a copy of this. You can contact us in line with this at any time at dsgvo@graztourismus.at.
  Your right to be informed entails the following:
  • Intended purpose
  • The personal data categories that are processed
  • The recipients or recipient categories that personal data has or will be disclosed to
  • Where possible, the planned duration your personal data will be stored for, or the criteria that determines this
  • Your right to have personal data corrected or erased, limited to use by ourselves or not be processed at all
  • Your right to file a complaint with the Austrian data protection authorities as regluatory body and, if they do not hold this, your right to all available information on where the data was obtained

We use software providers and agencies to help run our website, who may gain access to personal data in line with their work. They have committed themselves to upholding our data protection regulations. You can request further information on our service providers from idsgvo@graztourismus.at.

As data subject, you also have the right to know whether your personal data has been passed on to a third country or international organisation. Should this be the case, you have the right to find out whether the transmitted information is being stored / processed in a legitimate manner.

• The right to rectification:
  As data subject, you have the right ask to us to amend any incorrect personal data. You can contact us in line with this at any time at dsgvo@graztourismus.at.
• The right to erase (be forgotten):
  As data subject, you have the right to ask us to to delete your personal data with immediate effect where the following applies and a further processing is not required:
  Your personal data is no longer necessary in relation to the purpose for which it was collected / processed.
  As data subject, you object to the processing in line with GDPR Article 6, paragraph 1, letter a or  GDPR Article 9, paragraph 2, letter a, and there are no overriding legitimate grounds for the processing.
  As data subject, you object to the processing in line with GDPR Article 21, paragraph 1 and there are no overriding legitimate grounds for the processing, or you object to the processing in line with GDPR Article 21, paragraph 2.
  Your personal data was unlawfully processed.
  Your personal data must be deleted in line with Austrian or European Union law.
  Should one of the above apply and you wish to have your personal data held by the Graz Tourismus und Stadtmarketing GmbH deleted, contact us at any time at dsgvo@graztourismus.at.
• The right to restrict processing:
  As data subject, you have the right to restrict the processing of data held by us where:
  You have contested the accuracy of personal data held on yourself and given us adequate time to review this.
  Processing is unlawful and you have declined the erasure of your personal data, but wish to restrict its processing.
  We no longer need the data, but you require it to establish, exercise or defend a legal claim.
  You have objected to the processing in line with GDPR Article 21, paragraph 1 and it is not yet clear whether there is a legitimate ground to override this.
  Should one of the above apply and you wish to have the processing of your personal data held by the Graz Tourismus und Stadtmarketing GmbH restricted, contact us at any time at dsgvo@graztourismus.at.
• The right to data portability:
  As data subject, you have the right to receive the personal data that has been provided to us in a structured, commonly used and machine-readable format. You also have the right to share this data without hindrance if its processing is in line with GDPR Article 6, paragraph 1, letter a or GDPR Article 9, paragraph 2, letter a or another contract in line with GDPR Article 6, paragraph 1, letter b. Processing must be carried out by automated means and the data must not be required for the performance of a task carried out in the public interest or in the exercise of official authority.
  Furthermore, as data subject in line with the right to data portability of GDPR Article 20, paragraph 1, you have the right to request that we transmit your personal data directly to another controller where technically possible and the rights and freedoms of others are not impaired.
  To make use of the right to data portability, contact us at any time at dsgvo@graztourismus.at.
• The right to object:
  As data subject, you have the right to object to the processing of your personal data in line with GDPR Article 6, paragraph 1, letter e or f  in certain circumstances. You can contact us in regards to this at any time at dsgvo@graztourismus.at.
  You have an absolute right to stop your data being used for direct marketing purposes at any time.

8. Catalogue and brochure request:
We require certain information to despatch catologues and brochures ordered via our website. These details are solely used to send the requested material, and are not passed on to third parties unless they are involved in delivery. Once the request has been processed, your details are deleted.
 

9. Electronic enquiries:
When you send an enquiry via info@graztourismus.at, we save your information and contact details to process this and, if necessary, pass them on to other contact partners for further processing. Your details are deleted once we have successfully responded to the enquiry.