Privacy Policy

We have written this privacy policy (version 12.10.2026-113241219) in accordance with the requirements of the General Data Protection Regulation (EU) 2016/679 and applicable national laws, in order to explain to you which personal data (data for short) we, as the controller – and the processors we have engaged (e.g. providers) – process, will process in the future, and what lawful options you have. The terms used are to be understood as gender-neutral.

In short: We inform you comprehensively about the data we process about you.

Legal Bases

In the following privacy policy, we give you transparent information about the legal principles and regulations – that is, the legal bases of the General Data Protection Regulation – that enable us to process personal data.

As far as EU law is concerned, we refer to REGULATION (EU) 2016/679 OF THE EUROPEAN PARLIAMENT AND OF THE COUNCIL of 27 April 2016. You can, of course, read this EU General Data Protection Regulation online on EUR-Lex, the access point to EU law, at https://eur-lex.europa.eu/legal-content/DE/ALL/?uri=celex%3A32016R0679.

We only process your data if at least one of the following conditions applies:

Consent (Article 6(1)(a) GDPR): You have given us your consent to process data for a specific purpose. One example would be the storage of the data you enter in a contact form.
Contract (Article 6(1)(b) GDPR): To fulfil a contract or pre-contractual obligations with you, we process your data. For example, if we conclude a purchase contract with you, we need personal information beforehand.
Legal obligation (Article 6(1)(c) GDPR): If we are subject to a legal obligation, we process your data. For example, we are legally required to retain invoices for accounting purposes. These usually contain personal data.
Legitimate interests (Article 6(1)(f) GDPR): In the case of legitimate interests that do not restrict your fundamental rights, we reserve the right to process personal data. For example, we have to process certain data in order to operate our website securely and economically efficiently. This processing is therefore a legitimate interest.

Other conditions, such as carrying out tasks in the public interest and exercising official authority, as well as protecting vital interests, do not usually apply to us. Should such a legal basis nevertheless be relevant, it will be indicated at the appropriate place.

In addition to the EU regulation, national laws also apply:

In Austria, this is the Federal Act on the Protection of Natural Persons with regard to the Processing of Personal Data (Data Protection Act), DSG for short.
In Germany, the Federal Data Protection Act (BDSG) applies.

Should further regional or national laws apply, we will inform you about them in the following sections.

Contact Details of the Controller

If you have any questions about data protection or the processing of personal data, you will find below the contact details of the controller pursuant to Article 4(7) of the EU General Data Protection Regulation (GDPR):
Villa Agricola
Astrid Totschnig-Wurzer, MBA
Eßreithweg 25
5710 Kaprun
Austria
Authorised representative: Astrid Totschnig-Wurzer
Email: agricola@kaprun.at
Phone: +43 6547 8550
Legal notice: https://www.agricola-urlaub.at/impressum/

Storage Period

The general criterion for us is that we store personal data only for as long as is strictly necessary for the provision of our services and products. This means that we delete personal data as soon as the reason for the data processing no longer exists. In some cases, we are legally obliged to store certain data even after the original purpose has ceased to apply, for example for accounting purposes.

If you wish to have your data deleted or withdraw your consent to data processing, the data will be deleted as quickly as possible, provided there is no obligation to retain it.

We will inform you about the specific duration of the respective data processing further below, where we have further information on this.

Rights under the General Data Protection Regulation

Pursuant to Articles 13 and 14 GDPR, we inform you about the following rights to which you are entitled, so that data is processed fairly and transparently:

Under Article 15 GDPR, you have the right of access to information about whether we process data about you. If so, you have the right to receive a copy of the data and to be informed of the following:
- the purpose for which we carry out the processing;
- the categories, i.e. the types of data, that are processed;
- who receives this data and, if the data is transferred to third countries, how security can be guaranteed;
- how long the data will be stored;
- the existence of the right to rectification, erasure or restriction of processing and the right to object to processing;
- that you can lodge a complaint with a supervisory authority (links to these authorities can be found below);
- the origin of the data, if we did not collect it from you;
- whether profiling is carried out, i.e. whether data is automatically evaluated in order to arrive at a personal profile of you.
Under Article 16 GDPR, you have the right to rectification of data, which means that we must correct data if you find errors.
Under Article 17 GDPR, you have the right to erasure (“right to be forgotten”), which specifically means that you may request the deletion of your data.
Under Article 18 GDPR, you have the right to restriction of processing, which means that we may only store the data but not use it further.
Under Article 20 GDPR, you have the right to data portability, which means that, upon request, we will provide you with your data in a commonly used format.
Under Article 21 GDPR, you have the right to object, which, once enforced, entails a change in processing.
- If the processing of your data is based on Article 6(1)(e) (public interest, exercise of official authority) or Article 6(1)(f) (legitimate interest), you can object to the processing. We will then check as soon as possible whether we can legally comply with this objection.
- If data is used for direct marketing, you can object to this type of data processing at any time. We may then no longer use your data for direct marketing.
- If data is used for profiling, you can object to this type of data processing at any time. We may then no longer use your data for profiling.
Under Article 22 GDPR, you may, under certain circumstances, have the right not to be subject to a decision based solely on automated processing (for example, profiling).
Under Article 77 GDPR, you have the right to lodge a complaint. This means that you can complain to the data protection authority at any time if you believe that the processing of personal data violates the GDPR.

In short: You have rights – do not hesitate to contact the responsible body listed above!

If you believe that the processing of your data violates data protection law or that your data protection rights have been violated in some other way, you can lodge a complaint with the supervisory authority. In Austria, this is the Data Protection Authority, whose website you can find at https://www.dsb.gv.at/. In Germany, there is a data protection officer for each federal state. For more information, you can contact the Federal Commissioner for Data Protection and Freedom of Information (BfDI). The following local data protection authority is responsible for our company:

Austria – Data Protection Authority

Head: Dr. Matthias Schmidl
Address: Barichgasse 40-42, 1030 Vienna
Phone: +43 1 52 152-0
Email: dsb@dsb.gv.at
Website: https://www.dsb.gv.at/

Data Processing Agreement (DPA)

In this section, we would like to explain what a data processing agreement is and why it is needed. Because the term “data processing agreement” is quite a mouthful, we will often use the acronym DPA in the text. Like most companies, we do not work alone, but also make use of the services of other companies or individuals. By involving different companies or service providers, it may be the case that we pass on personal data for processing. These partners then act as processors, with whom we conclude a contract, the so-called data processing agreement (DPA). The most important thing for you to know is that the processing of your personal data takes place exclusively on our instructions and must be governed by the DPA.

Who are processors?

As a company and website owner, we are responsible for all data that we process about you. In addition to controllers, there can also be so-called processors. This includes any company or person who processes personal data on our behalf. More precisely, and according to the GDPR definition: any natural or legal person, public authority, agency or other body that processes personal data on our behalf is considered a processor. Processors can consequently be service providers such as hosting or cloud providers, payment or newsletter providers, or large companies such as Google or Microsoft.

To make the terminology easier to understand, here is an overview of the three roles under the GDPR:

Data subject (you as a customer or prospective customer) → Controller (we as the company and client) → Processor (service providers such as web hosts or cloud providers)

Content of a data processing agreement

As already mentioned above, we have concluded a DPA with our partners who act as processors. First and foremost, it stipulates that the processor processes the data to be handled exclusively in accordance with the GDPR. The contract must be concluded in writing, although an electronic contract is also deemed “written” in this context. The processing of personal data takes place only on the basis of the contract. The contract must contain the following:

Binding of the processor to us as the controller
Obligations and rights of the controller
Categories of data subjects
Type of personal data
Nature and purpose of the data processing
Subject matter and duration of the data processing
Place where the data processing is carried out

Furthermore, the contract contains all obligations of the processor. The most important obligations are:

to ensure data security measures
to take possible technical and organisational measures to protect the rights of the data subject
to maintain a record of processing activities
to cooperate with the data protection supervisory authority upon request
to carry out a risk analysis with regard to the personal data received
sub-processors may only be engaged with the written approval of the controller

You can find an example of what such a DPA looks like at https://www.wko.at/service/wirtschaftsrecht-gewerberecht/eu-dsgvo-mustervertrag-auftragsverarbeitung.html. A model contract is presented there.

Cookies

What data is processed?

Cookies are small helpers for many different tasks. Unfortunately, it is not possible to generalise about which data is stored in cookies, but we will inform you about the data processed or stored in the course of the following privacy policy.

Storage period of cookies

The storage period depends on the respective cookie and is specified further below. Some cookies are deleted after less than an hour, while others can remain stored on a computer for several years.

You can also influence the storage period yourself. You can manually delete all cookies at any time via your browser (see also “Right to object” below). Furthermore, cookies that are based on consent are deleted at the latest upon withdrawal of your consent, although the lawfulness of the storage up to that point remains unaffected.

Right to object – how can I delete cookies?

You decide for yourself how and whether you want to use cookies. Regardless of which service or website the cookies come from, you always have the option to delete cookies, deactivate them, or only partially allow them. For example, you can block third-party cookies but allow all other cookies.

If you want to find out which cookies have been stored in your browser, or if you want to change or delete cookie settings, you can do so in your browser settings:

Chrome: Clear, enable and manage cookies in Chrome

Safari: Manage cookies and website data with Safari

Firefox: Delete cookies to remove the information websites have stored on your computer

Internet Explorer: Delete and manage cookies

Microsoft Edge: Delete and manage cookies

If you generally do not want any cookies, you can set up your browser so that it always informs you when a cookie is about to be set. This allows you to decide for each individual cookie whether to allow it or not. The procedure differs from browser to browser. It is best to search for the instructions on Google using the search term “delete cookies Chrome” or “deactivate cookies Chrome” in the case of a Chrome browser.

Legal basis

Since 2009, there have been the so-called “Cookie Directives”. They stipulate that storing cookies requires your consent (Article 6(1)(a) GDPR). Within the EU countries, however, reactions to these directives still vary greatly. In Austria, this directive was implemented in Section 165(3) of the Telecommunications Act (2021). In Germany, the Cookie Directives were not implemented as national law. Instead, the directive was implemented largely in Section 15(3) of the Telemedia Act (TMG), which has been replaced since May 2024 by the Digital Services Act (Digitale-Dienste-Gesetz, DDG).

For strictly necessary cookies, even where no consent has been given, there are legitimate interests (Article 6(1)(f) GDPR), which in most cases are of an economic nature. We want to give website visitors a pleasant user experience, and for this, certain cookies are often strictly necessary.

Insofar as cookies that are not strictly necessary are used, this is only done with your consent. The legal basis in this respect is Art. 6(1)(a) GDPR.

In the following sections, you will be informed in more detail about the use of cookies, insofar as the software used employs cookies.

Web Hosting Introduction

What data is processed?

Even while you are visiting our website right now, our web server – that is, the computer on which this website is stored – usually stores data automatically, such as

the complete internet address (URL) of the accessed web page
browser and browser version (e.g. Chrome 87)
the operating system used (e.g. Windows 10)
the address (URL) of the previously visited page (referrer URL) (e.g. https://www.beispielquellsite.de/vondabinichgekommen/)
the host name and the IP address of the device from which access is made (e.g. COMPUTERNAME and 194.23.43.121)
date and time
in files, the so-called web server log files

How long is data stored?

As a rule, the above data is stored for two weeks and then automatically deleted. We do not pass this data on, but we cannot rule out that this data may be viewed by authorities in the event of unlawful conduct.

In short: Your visit is logged by our provider (the company that runs our website on special computers (servers)), but we do not pass on your data without consent!

Legal basis

The lawfulness of the processing of personal data in the context of web hosting arises from Art. 6(1)(f) GDPR (protection of legitimate interests), because the use of professional hosting with a provider is necessary in order to present the company on the internet in a secure and user-friendly way and, where applicable, to pursue attacks and claims arising from them.

As a rule, there is a contract on data processing between us and the hosting provider pursuant to Art. 28 et seq. GDPR, which ensures compliance with data protection and guarantees data security.

World4You Privacy Policy

What data is processed by World4You?

World4You may also process personal data about you. Our web server automatically stores data while you visit our website. This includes personal data such as your IP address, but above all also technical data such as the internet address of the accessed website, device information such as browser version, operating system and the URL of the previously visited website. In addition, the time at which you accessed our website and, where applicable, location data are also recorded. The IP address can be used to increase the security of the website, to detect possible errors and also to carry out anonymous statistical analyses. Cookies may also be used for data storage.

How long and where is the data stored?

The data is stored on World4You’s own servers. The exact retention period of the data depends heavily on the type of data and on individual configurations. In principle, World4You stores the data for as long as is necessary to fulfil its obligations. Data that is collected only to provide the website is deleted after the respective session ends. For data stored in so-called log files, deletion takes place after 14 days at the latest. However, it may also happen that data is stored for longer, for example in order to have evidence in the event of possible legal disputes.

How can I delete my data or prevent data storage?

You have the right at any time to access, rectification or erasure, and restriction of the processing of your personal data. You can also withdraw your consent to the processing of data at any time.

If you do not want these cookies to be set and data to be stored, you can also prevent the setting of cookies in your browser. In your browser, you can manage, deactivate or delete cookies. Depending on your browser, this always works slightly differently.

Under the section “Cookies”, you will find the corresponding links to the instructions for the best-known browsers.

Legal basis

On our part, there is a legitimate interest in using World4You in order to be able to offer our online service. The corresponding legal basis is Art. 6(1)(f) GDPR (legitimate interests).

You can, of course, also use this support if you have special questions about data protection at World4You. The website’s privacy policy, which you can find at https://www.world4you.com/de/unternehmen/datenschutzerklaerung.html, is also recommended. The FAQs at https://www.world4you.com/faq/de/dsgvo.html have their own GDPR section, where you will also find a lot of useful information.

Data Processing Agreement (DPA) World4You

In accordance with Article 28 of the General Data Protection Regulation (GDPR), we have concluded a data processing agreement (DPA) with World4You (World4You Internet Services GmbH, Hafenstraße 35, 4020 Linz, Austria). You can read what exactly a DPA is and, above all, what a DPA must contain in our general section “Data Processing Agreement (DPA)”.

This contract is required by law because World4You processes personal data on our behalf. It clarifies that World4You may only process data it receives from us on our instructions and must comply with the GDPR. You can find the link to the data processing agreement (DPA) at https://www.world4you.com/faq/de/dsgvo/faq.stellt-world4you-eine-vereinbarung-zur-auftragsverarbeitung-zur-verfuegung.html.

Website Builder Systems Introduction

What data is stored by a website builder system?

Which data exactly is stored naturally depends on the website builder system used. Each provider processes and collects different data of the website visitor. As a rule, however, technical usage information is collected, such as the operating system, browser, screen resolution, language and keyboard settings, hosting provider and the date of your website visit. In addition, tracking data (e.g. browser activity, clickstream activity, session heatmaps, etc.) may be processed. Personal data may also be collected and stored. This is mostly contact data such as email address, telephone number (if you have provided it), IP address and geographic location data. You can find out exactly which data is stored in the provider’s privacy policy.

How long and where is the data stored?

We inform you about the duration of data processing further below in connection with the website builder system used, where we have further information on this. You will find detailed information about this in the provider’s privacy policy. In general, we process personal data only for as long as is strictly necessary for the provision of our services and products. It is possible that the provider stores data about you according to its own rules, over which we have no influence.

Right to object

You always have the right to access, rectification and erasure of your personal data. If you have any questions, you can also contact those responsible for the website builder system used at any time. You can find contact details either in our privacy policy or on the website of the respective provider.

You can delete, deactivate or manage cookies that providers use for their functions in your browser. Depending on which browser you use, this works in different ways. Please note, however, that in this case not all functions may work as usual.

Legal basis

We have a legitimate interest in using a website builder system in order to optimise our online service and to present it to you efficiently and in a user-friendly way. The corresponding legal basis is Art. 6(1)(f) GDPR (legitimate interests). Nevertheless, we only use the builder insofar as you have given your consent.

Insofar as the processing of data is not strictly necessary for the operation of the website, the data is only processed on the basis of your consent. This applies in particular to tracking activities. The legal basis in this respect is Art. 6(1)(a) GDPR.

With this privacy policy, we have brought you closer to the most important general information about data processing. If you would like to inform yourself more precisely about this, you will find further information – where available – in the following section or in the provider’s privacy policy.

WordPress.com Privacy Policy

What data is processed by WordPress?

Non-personal data includes, for example, technical usage information such as browser activity, clickstream activity, session heatmaps and data about your computer, operating system, browser, screen resolution, language and keyboard settings, internet provider and the date of the page visit.

In addition, personal data is also collected. This is primarily contact data (email address or telephone number, if you provide them), IP address or your geographic location.

WordPress may also use cookies to collect data. These often capture data about your behaviour on our website. For example, it may be recorded which subpages you particularly like to view, how long you stay on individual pages, when you leave a page again (bounce rate), or which preferences (e.g. language selection) you have set. On the basis of this data, WordPress can also better adapt its own marketing measures to your interests and your user behaviour. The next time you visit our website, our website will consequently be displayed to you as you set it up beforehand.

WordPress may also use technologies such as pixel tags (web beacons) in order, for example, to clearly identify you as a user and possibly to offer interest-based advertising.

How long and where is the data stored?

How long the data is stored depends on various factors. That is, it depends above all on the type of data stored and the specific settings of the website. In principle, data at WordPress is deleted when it is no longer needed for its own purposes. There are, of course, exceptions, especially where legal obligations require data to be retained for longer. Web server logs containing your IP address and technical data are deleted by WordPress or Automattic after 30 days. For that long, Automattic uses the data to analyse traffic on its own websites (for example, all WordPress sites) and to fix possible problems. Deleted content on WordPress websites is also kept in the trash for 30 days to allow restoration; after that, it may remain in backups and caches until these are deleted. The data is stored on Automattic’s American servers.

How can I delete my data or prevent data storage?

You have the right and the possibility at any time to access your personal data and to object to its use and processing. You can also lodge a complaint with a state supervisory authority at any time.

In your browser, you also have the option to manage, delete or deactivate cookies individually. Please note, however, that deactivated or deleted cookies may have negative effects on the functions of our WordPress site. Depending on which browser you use, managing cookies works slightly differently. Under the section “Cookies”, you will find the corresponding links to the instructions for the best-known browsers.

Legal basis

If you have consented to WordPress being used, the legal basis for the corresponding data processing is this consent. According to Art. 6(1)(a) GDPR (consent), this consent is the legal basis for the processing of personal data as may occur during collection by WordPress.

In addition, we have a legitimate interest in using WordPress in order to optimise our online service and to present it nicely to you. The corresponding legal basis is Art. 6(1)(f) GDPR (legitimate interests). Nevertheless, we only use WordPress insofar as you have given your consent.

WordPress or Automattic also processes data about you in the USA, among other places. As the basis for data processing at recipients based in third countries (outside the European Union, Iceland, Liechtenstein and Norway, i.e. in particular in the USA) or for a transfer of data there, Automattic uses standard contractual clauses approved by the EU Commission (Art. 46(2)(c) GDPR). These clauses oblige Automattic to comply with the EU level of data protection when processing relevant data, even outside the EU. These clauses are based on an implementing decision of the EU Commission. You can find the decision and the corresponding standard contractual clauses, among other places, here: https://eur-lex.europa.eu/eli/dec_impl/2021/914/oj?locale=de.

You can find more details on the privacy policy and on which data is processed by WordPress and in what way at https://automattic.com/privacy/.

Data Processing Agreement (DPA) WordPress.com

In accordance with Article 28 of the General Data Protection Regulation (GDPR), we have concluded a data processing agreement (DPA) with WordPress.com. You can read what exactly a DPA is and, above all, what a DPA must contain in our general section “Data Processing Agreement (DPA)”.

This contract is required by law because WordPress.com processes personal data on our behalf. It clarifies that WordPress.com may only process data it receives from us on our instructions and must comply with the GDPR. You can find the link to the data processing agreement (DPA) at https://wordpress.com/support/data-processing-agreements/.

Web Analytics Introduction

What data is processed?

Which data exactly is stored naturally depends on the analytics tools used. As a rule, however, what is stored is, for example, which content you view on our website, which buttons or links you click, when you access a page, which browser you use, which device (PC, tablet, smartphone, etc.) you use to visit the website or which computer system you use. If you agreed that location data may also be collected, this too may be processed by the web analytics tool provider.

In addition, your IP address is also stored. Under the General Data Protection Regulation (GDPR), IP addresses are personal data. However, your IP address is usually stored in pseudonymised form (that is, in an unrecognisable and shortened form). For the purposes of testing, web analytics and web optimisation, no direct data, such as your name, age, address or email address, is generally stored. All of this data, where it is collected, is stored in pseudonymised form. This means you cannot be identified as a person.

The following example shows schematically how Google Analytics works, as an example of client-based web tracking with JavaScript code.

How long the respective data is stored always depends on the provider. Some cookies store data only for a few minutes or until you leave the website again, while other cookies can store data for several years.

Duration of data processing

We inform you about the duration of data processing further below, where we have further information on this. In general, we process personal data only for as long as is strictly necessary for the provision of our services and products. Where, as in the case of accounting, for example, retention is required by law, this storage period may also be exceeded.

Right to object

Legal basis

The use of web analytics requires your consent, which we have obtained via our cookie pop-up. According to Art. 6(1)(a) GDPR (consent), this consent is the legal basis for the processing of personal data as may occur during collection by web analytics tools.

In addition to consent, we have a legitimate interest in analysing the behaviour of website visitors and thus improving our offering technically and economically. With the help of web analytics, we detect errors on the website, can identify attacks and improve cost-effectiveness. The legal basis for this is Art. 6(1)(f) GDPR (legitimate interests). Nevertheless, we only use the tools insofar as you have given your consent.

Since cookies are used with web analytics tools, we also recommend that you read our general privacy policy on cookies. To find out exactly which data about you is stored and processed, you should read the privacy policies of the respective tools.

You will receive information on specific web analytics tools – where available – in the following sections.

Google Maps Privacy Policy

What data is stored by Google Maps?

In order for Google Maps to be able to offer its service in full, the company has to record and store data about you. This includes, among other things, the search terms entered, your IP address and also the latitude and longitude coordinates. If you use the route planner function, the start address entered is also stored. However, this data storage takes place on the Google Maps websites. We can only inform you about it but have no influence on it. Since we have embedded Google Maps in our website, Google sets at least one cookie (name: NID) in your browser. This cookie stores data about your user behaviour. Google uses this data primarily to optimise its own services and to provide you with individual, personalised advertising.

The following cookie is set in your browser due to the integration of Google Maps:

Name: NID
Value: 188=h26c1Ktha7fCQTx8rXgLyATyITJ113241220-5
Purpose: NID is used by Google to tailor advertisements to your Google search. With the help of the cookie, Google “remembers” your most frequently entered search queries or your previous interaction with ads. This way, you always receive tailor-made advertisements. The cookie contains a unique ID that Google uses to collect your personal preferences for advertising purposes.
Expiry date: after 6 months

Note: We cannot guarantee the completeness of the information on the stored data. Especially when cookies are used, changes can never be ruled out. To identify the NID cookie, a separate test page was created on which only Google Maps was embedded.

How long and where is the data stored?

Google’s servers are located in data centres around the world. Most servers, however, are located in America. For this reason, your data is also increasingly stored in the USA. You can read exactly where the Google data centres are located here: https://datacenters.google/

Google distributes the data across various data carriers. As a result, the data can be retrieved more quickly and is better protected against possible manipulation attempts. Each data centre also has special emergency programmes. If, for example, there are problems with Google’s hardware or a natural disaster knocks out the servers, the data is still very likely to remain protected.

Google stores some data for a fixed period of time. For other data, Google only offers the option of deleting it manually. In addition, the company anonymises information (such as advertising data) in server logs by deleting part of the IP address and cookie information after 9 or 18 months.

How can I delete my data or prevent data storage?

With the automatic deletion function for location and activity data introduced in 2019, location information and web/app activity are stored for either 3 or 18 months – depending on your decision – and then deleted. In addition, this data can be deleted manually from the history at any time via your Google account. If you want to prevent location tracking entirely, you must pause the “Web & App Activity” category in your Google account. Click “Data & personalisation” and then the “Activity controls” option. Here you can switch the activities on or off.

In your browser, you can also deactivate, delete or manage individual cookies. Depending on which browser you use, this always works slightly differently. Under the section “Cookies”, you will find the corresponding links to the instructions for the best-known browsers.

Legal basis

If you have consented to Google Maps being used, the legal basis for the corresponding data processing is this consent. According to Art. 6(1)(a) GDPR (consent), this consent is the legal basis for the processing of personal data as may occur during collection by Google Maps.

In addition, we have a legitimate interest in using Google Maps in order to optimise our online service. The corresponding legal basis is Art. 6(1)(f) GDPR (legitimate interests). Nevertheless, we only use Google Maps insofar as you have given your consent.

Google also processes data about you in the USA, among other places. Google is an active participant in the EU-US Data Privacy Framework, which governs the correct and secure transfer of personal data of EU citizens to the USA. You can find more information on this at https://commission.europa.eu/document/fa09cbad-dd7d-4684-ae60-be03fcb0fddf_en.

In addition, Google uses so-called standard contractual clauses (= Art. 46(2) and (3) GDPR). Standard contractual clauses (SCC) are model templates provided by the EU Commission and are intended to ensure that your data complies with European data protection standards even when it is transferred to third countries (such as the USA) and stored there. Through the EU-US Data Privacy Framework and through the standard contractual clauses, Google undertakes to comply with the European level of data protection when processing your relevant data, even if the data is stored, processed and managed in the USA. These clauses are based on an implementing decision of the EU Commission. You can find the decision and the corresponding standard contractual clauses, among other places, here: https://eur-lex.europa.eu/eli/dec_impl/2021/914/oj?locale=de

You can find the Google Ads Data Processing Terms, which refer to the standard contractual clauses, at https://business.safety.google/intl/de/adsprocessorterms/.

If you want to learn more about Google’s data processing, we recommend the company’s own privacy policy at https://policies.google.com/privacy?hl=de.

Google Analytics Privacy Policy

What data is stored by Google Analytics?

Google Analytics uses a tracking code to create a random, unique ID that is linked to your browser cookie. In this way, Google Analytics recognises you as a new user and a user ID is assigned to you. The next time you visit our site, you will be recognised as a “returning” user. All collected data is stored together with this user ID. This is what makes it possible to evaluate pseudonymous user profiles in the first place.

In order to be able to analyse our website with Google Analytics, a property ID must be inserted into the tracking code. The data is then stored in the corresponding property. For every newly created property, the Google Analytics 4 property is the default. Depending on the property used, data is stored for different lengths of time.

Through identifiers such as cookies, app instance IDs, user IDs or custom event parameters, your interactions are measured across platforms, provided you have given your consent. Interactions are all types of actions that you perform on our website. If you also use other Google systems (such as a Google account), data generated via Google Analytics can be linked to third-party cookies. Google does not share Google Analytics data unless we, as the website operator, approve it. Exceptions may occur where this is legally required.

According to Google, no IP addresses are logged or stored in Google Analytics 4. However, Google uses the IP address data to derive location data and deletes it immediately afterwards. All IP addresses collected from users in the EU are therefore deleted before the data is stored in a data centre or on a server.

Since Google Analytics 4 focuses on event-based data, the tool uses significantly fewer cookies than earlier versions (such as Google Universal Analytics). Nevertheless, there are some specific cookies that are used by GA4. These include, for example:

Name: _ga
Value: 2.1326744211.152113241219-5
Purpose: By default, analytics.js uses the cookie _ga to store the user ID. Basically, it serves to distinguish website visitors.
Expiry date: after 2 years

Name: _gid
Value: 2.1687193234.152113241219-1
Purpose: This cookie also serves to distinguish website visitors.
Expiry date: after 24 hours

Name: _gat_gtag_UA_<property-id>
Value: 1
Purpose: Used to throttle the request rate. If Google Analytics is deployed via Google Tag Manager, this cookie is named _dc_gtm_<property-id>.
Expiry date: after 1 minute

Note: This list cannot claim to be complete, as Google changes its choice of cookies from time to time. The goal of GA4 is also to improve data protection. The tool therefore offers several options for controlling data collection. For example, we can set the storage period ourselves and also control data collection.

Here we show you an overview of the most important types of data collected with Google Analytics:

Heatmaps: Google creates so-called heatmaps. Heatmaps show exactly those areas that you click on. In this way, we get information about where you “move around” on our site.

Session duration: Google defines session duration as the time you spend on our site without leaving it. If you were inactive for 20 minutes, the session ends automatically.

Bounce rate: A bounce occurs when you view only one page on our website and then leave our website again.

Account creation: If you create an account or place an order on our website, Google Analytics collects this data.

Location: IP addresses are not logged or stored in Google Analytics. However, shortly before the IP address is deleted, derivations for location data are used.

Technical information: Technical information includes, among other things, your browser type, your internet provider or your screen resolution.

Source of origin: Google Analytics – and of course we – are also interested in which website or which advertising brought you to our site.

Other data includes contact data, any ratings, the playing of media (e.g. if you play a video via our site), the sharing of content via social media or adding it to your favourites. This list does not claim to be complete and serves only as a general orientation regarding data storage by Google Analytics.

How long and where is the data stored?

Google has distributed its servers around the world. You can read exactly where the Google data centres are located here: https://datacenters.google/

Your data is distributed across various physical data carriers. This has the advantage that the data can be retrieved more quickly and is better protected against manipulation. In every Google data centre, there are corresponding emergency programmes for your data. If, for example, the hardware at Google fails or natural disasters knock out servers, the risk of a service interruption at Google nevertheless remains low.

The retention period of the data depends on the properties used. The storage period is always determined separately for each individual property. Google Analytics offers us four options for controlling the storage period:

2 months: this is the shortest storage period.
14 months: by default, data in GA4 is stored for 14 months.
26 months: it is also possible to store the data for 26 months.
Data is only deleted when we delete it manually

In addition, there is also the option that data is only deleted if you do not visit our website again within the period we have chosen. In this case, the retention period is reset each time you visit our website again within the specified period.

Once the specified period has expired, the data is deleted once a month. This retention period applies to your data that is linked to cookies, user recognition and advertising IDs (e.g. cookies of the DoubleClick domain). Report results are based on aggregated data and are stored independently of user data. Aggregated data is a merging of individual data into a larger unit.

How can I delete my data or prevent data storage?

Under the data protection law of the European Union, you have the right to obtain information about your data, to update it, to delete it or to restrict it. With the help of the browser add-on for deactivating Google Analytics JavaScript (analytics.js, gtag.js), you prevent Google Analytics 4 from using your data. You can download and install the browser add-on at https://tools.google.com/dlpage/gaoptout?hl=de. Please note that this add-on only deactivates data collection by Google Analytics.

If you generally want to deactivate, delete or manage cookies, you will find the corresponding links to the instructions for the best-known browsers under the section “Cookies”.

Legal basis

The use of Google Analytics requires your consent, which we have obtained via our cookie pop-up. According to Art. 6(1)(a) GDPR (consent), this consent is the legal basis for the processing of personal data as may occur during collection by web analytics tools.

In addition to consent, we have a legitimate interest in analysing the behaviour of website visitors and thus improving our offering technically and economically. With the help of Google Analytics, we detect errors on the website, can identify attacks and improve cost-effectiveness. The legal basis for this is Art. 6(1)(f) GDPR (legitimate interests). Nevertheless, we only use Google Analytics insofar as you have given your consent.

You can find the Google Ads Data Processing Terms, which refer to the standard contractual clauses, at https://business.safety.google/intl/de/adsprocessorterms/.

We hope we have been able to give you the most important information about the data processing of Google Analytics. If you want to learn more about the tracking service, we recommend these two links: https://marketingplatform.google.com/about/analytics/terms/de/ and https://support.google.com/analytics/answer/6004245?hl=de.

If you want to learn more about data processing, use the Google privacy policy at https://policies.google.com/privacy?hl=de.

Data Processing Agreement (DPA) Google Analytics

In accordance with Article 28 of the General Data Protection Regulation (GDPR), we have concluded a data processing agreement (DPA) with Google. You can read what exactly a DPA is and, above all, what a DPA must contain in our general section “Data Processing Agreement (DPA)”.

This contract is required by law because Google processes personal data on our behalf. It clarifies that Google may only process data it receives from us on our instructions and must comply with the GDPR. You can find the link to the data processing terms at https://business.safety.google/intl/de/adsprocessorterms/

Google Analytics Reports on Demographics and Interests

We have switched on the advertising reporting features in Google Analytics. The reports on demographics and interests contain information on age, gender and interests. This allows us – without being able to assign this data to individual persons – to get a better picture of our users. You can find out more about the advertising features at https://support.google.com/analytics/answer/3450482?hl=de_AT&utm_id=ad.

You can stop the use of the activities and information of your Google account under “Ad settings” at https://adssettings.google.com/authenticated by means of a checkbox.

Cookie Consent Management Platform Introduction

What data is processed?

With our cookie management tool, you can manage each individual cookie yourself and have complete control over the storage and processing of your data. The declaration of your consent is stored so that we do not have to ask you again on every new visit to our website and so that we can also prove your consent where legally required. This is stored either in an opt-in cookie or on a server. Depending on the provider of the cookie management tool, the storage period of your cookie consent varies. This data (such as a pseudonymous user ID, time of consent, details on the cookie categories or tools, browser, device information) is usually stored for up to two years.

Duration of data processing

We inform you about the duration of data processing further below, where we have further information on this. In general, we process personal data only for as long as is strictly necessary for the provision of our services and products. Data stored in cookies is stored for different lengths of time. Some cookies are deleted as soon as you leave the website, while others may be stored in your browser for several years. The exact duration of data processing depends on the tool used; you should usually expect a storage period of several years. In the respective privacy policies of the individual providers, you will generally receive precise information about the duration of data processing.

Right to object

You also have the right and the possibility at any time to withdraw your consent to the use of cookies. This works either via our cookie management tool or via other opt-out functions. For example, you can also prevent data collection by cookies by managing, deactivating or deleting cookies in your browser.

You will receive information on specific cookie management tools – where available – in the following sections.

Legal basis

If you consent to cookies, personal data about you is processed and stored via these cookies. If we are permitted to use cookies through your consent (Article 6(1)(a) GDPR), this consent is at the same time the legal basis for the use of cookies and the processing of your data. In order to be able to manage cookie consent and to enable you to give consent, cookie consent management platform software is used. The use of this software enables us to operate the website in an efficient and legally compliant manner, which constitutes a legitimate interest (Article 6(1)(f) GDPR).

Web Design Introduction

What data is stored by web design tools?

When you visit our website, web design elements that can also process data may be embedded in our pages. Which data exactly is involved depends heavily on the tools used. Further below, you can see exactly which tools we use for our website. For more detailed information about data processing, we also recommend reading the respective privacy policy of the tools used. There you will usually find out which data is processed, whether cookies are used and how long the data is retained. Fonts such as Google Fonts, for example, also automatically transmit information such as language settings, IP address, browser version, browser screen resolution and browser name to Google’s servers.

Duration of data processing

How long data is processed is very individual and depends on the web design elements used. If cookies are used, for example, the retention period can be only one minute, but also a few years. Please inform yourself about this. For this purpose, we recommend, on the one hand, our general text section on cookies and, on the other, the privacy policies of the tools used. There you will usually find out exactly which cookies are used and which information is stored in them. Google font files, for example, are stored for one year. The aim of this is to improve the loading time of a website. In principle, data is always kept only for as long as is necessary for the provision of the service. Where required by law, data may also be stored for longer.

Right to object

You also have the right and the possibility at any time to withdraw your consent to the use of cookies or third-party providers. This works either via our cookie management tool or via other opt-out functions. You can also prevent data collection by cookies by managing, deactivating or deleting cookies in your browser. With web design elements (mostly fonts), however, there is also data that cannot be deleted quite so easily. This is the case when data is collected automatically directly upon a page view and transmitted to a third-party provider (such as Google). Please then contact the support of the respective provider. In the case of Google, you can reach support at https://support.google.com/?hl=de.

Legal basis

If you have consented to web design tools being used, the legal basis for the corresponding data processing is this consent. According to Art. 6(1)(a) GDPR (consent), this consent is the legal basis for the processing of personal data as may occur during collection by web design tools. In addition, we have a legitimate interest in improving the web design on our website. After all, this is the only way we can provide you with an attractive and professional web offering. The corresponding legal basis is Art. 6(1)(f) GDPR (legitimate interests). Nevertheless, we only use web design tools insofar as you have given your consent. We would like to emphasise this once again here.

You will receive information on specific web design tools – where available – in the following sections.

Google Fonts (Local) Privacy Policy

On our website, we use Google Fonts from the company Google Inc. For the European area, the company Google Ireland Limited (Gordon House, Barrow Street Dublin 4, Ireland) is responsible. We have embedded the Google fonts locally, i.e. on our web server – not on Google’s servers. As a result, there is no connection to Google servers and therefore no data transfer or storage.

All texts are protected by copyright.

Source: Privacy policy created with the Data Protection Generator for Austria by AdSimple