Privacy
Policy

The protection of your personal data is of utmost importance to us. We process your data exclusively on the basis of the applicable legal provisions, in particular the General Data Protection Regulation (GDPR), the Austrian Data Protection Act (DSG) and the Austrian Telecommunications Act 2021 (TKG 2021). This privacy policy informs you comprehensively about which personal data we process in connection with our hotel operations and our website, for what purposes this processing takes place, on which legal bases it is based, how long we store data, to whom data is disclosed and which rights you have as a data subject.

Vienna Sporthotel –
Sportanlagenvermietungsgesellschaft m.b.H.

Baumgasse 83
1030 Vienna
Austria

+43 1 798 82 01-0
info@vienna-sporthotel.at

We are not legally required to appoint a data protection officer. For all questions concerning data protection, please contact us at the above contact details. We will treat your inquiry confidentially and respond as quickly as possible.

In the course of our hotel operations, we process personal data that you provide to us or that we require for the fulfillment of the contract. This includes in particular your name, address, date of birth, nationality, contact details as well as details from your travel documents such as passport number, date of issue and issuing authority. We also process your booking details, including date of arrival and departure, room category, booked services, car license plate number if you use our garage, as well as details of accompanying persons. Payment information such as credit card details or bank account data is also processed. If you provide us with special requests that reveal sensitive data within the meaning of Article 9 GDPR, such as allergies or health information, we will process such data only on the basis of your explicit consent.

The processing of data takes place in order to fulfill the accommodation contract with you, to carry out pre-contractual measures, to comply with legal obligations, in particular the Austrian Registration Act as well as tax and fiscal obligations, and to safeguard our legitimate interests, for example to ensure security in our operations or to defend against legal claims. Data will be stored for the duration of the contractual relationship and thereafter within the framework of statutory retention periods. Registration data must be stored for at least seven years. Tax and fiscal records are stored for seven years after the end of the financial year. Data processed on the basis of your consent will be stored until such consent is withdrawn, but for no longer than three years after the last contact.

For payment processing, we transmit the data you provide to the payment service provider selected by you. Depending on the payment method, this may include credit card companies, banks or other payment institutions. The processing takes place solely for the purpose of carrying out the payment transaction and is based on Article 6(1)(b) GDPR. The respective payment service providers process your data under their own responsibility. For further information, please refer to the privacy policies of the respective payment providers. We store payment data only to the extent required by statutory retention obligations, in particular under tax and commercial law.

If you contact us by telephone, email, post or via our contact form, we process the data you provide exclusively for the purpose of handling your request. The legal basis is Article 6(1)(b) GDPR if your inquiry is related to the conclusion or performance of a contract, or Article 6(1)(f) GDPR if it concerns general inquiries. We store your requests for three years after completion in order to respond to possible follow-up questions.

Our website is operated by:

Plantage.at
c/o HostEurope
Pantzergasse 12
1190 Vienna
Austria

www.plantage.at

Within the framework of hosting, all data arising from the use of the website is processed on the servers of the provider. A data processing agreement in accordance with Article 28 GDPR has been concluded with the hosting provider. When you visit our website, server log files are automatically processed, including IP address, date and time of access, browser type and version, operating system and the pages accessed. This data is processed solely to ensure technical operation and system security and is deleted after a maximum of 30 days.

We use cookies to make our website user-friendly and to enable certain functions. Technically necessary cookies are set on the basis of our legitimate interest in accordance with Article 6(1)(f) GDPR. All other cookies and comparable technologies are set only with your consent. To manage your consents, we use Borlabs Cookie, operated by Borlabs GmbH, Hamburger Str. 11, 22083 Hamburg, Germany. Borlabs Cookie stores your decision in a technically necessary cookie that documents which services you have permitted or denied. You can withdraw your consent at any time via the cookie banner. Further information can be found in Borlabs’ privacy policy:en.borlabs.io/privacy.

Our website is based on WordPress. We use various extensions that serve exclusively for the technical provision, security, performance and editorial management of the website. These plugins do not process personal data of visitors for their own purposes. Processing takes place exclusively within the scope of providing content and is based on our legitimate interest in a functional website in accordance with Article 6(1)(f) GDPR.

Google Analytics

Provider: Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. Purpose of processing is the analysis of user behavior to optimize our website. The data processed includes usage data, anonymized IP addresses and technical information. The legal basis is your consent pursuant to Article 6(1)(a) GDPR and Sec. 165(3) TKG 2021. Data is stored for up to 14 months. Data may be transferred to Google LLC, 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA. Google is certified under the EU-US Data Privacy Framework. Further information: policies.google.com/privacy

Google Tag Manager

Provider: Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. The purpose is to manage and control tracking and marketing tags. Technical information such as IP addresses may be transmitted. The service is activated only with your consent and is used on the basis of Article 6(1)(a) GDPR. Further information: policies.google.com/privacy

Google Maps

Provider: Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. The purpose is to display interactive maps. When maps are accessed, information including your IP address may be transmitted to Google. Use takes place only with your consent pursuant to Article 6(1)(a) GDPR. Data may be transferred to Google LLC in the USA. Further information: policies.google.com/privacy

Google reCAPTCHA v3

Provider: Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. The purpose is to protect our forms against abuse and spam. Behavioral and device data, including IP addresses, are processed. The service is used only with your consent. The legal basis is Article 6(1)(a) GDPR. Further information: policies.google.com/privacy

SiteMinder

Provider: SiteMinder Limited, Bond Store, 3/30 Windmill Street, Millers Point NSW 2000, Australia. The purpose of processing is the provision of a booking engine for reservations made via our website. Personal data such as name, address, contact details, booking details and payment information is processed. The legal basis is contract performance pursuant to Art. 6(1)(b) GDPR. Data may be transferred to Australia as well as to other third countries. Such transfers are safeguarded by appropriate guarantees, in particular EU Standard Contractual Clauses. Further information can be found in SiteMinder’s privacy policy: www.siteminder.com/legal/privacy

MaxMind

Provider: MaxMind Inc., 14 Spring Street, Waltham, MA 02451, USA. The purpose is fraud prevention and geolocation. Data processed includes IP addresses and technical information. The legal basis is our legitimate interest pursuant to Article 6(1)(f) GDPR. Data is transferred to the USA based on EU Standard Contractual Clauses and the EU-US Data Privacy Framework. Privacy policy: www.maxmind.com/en/privacy-policy

Eversports

Provider: Eversports GmbH, Heiligenstädter Straße 31/2/5, 1190 Vienna, Austria. The purpose is booking of sports and course offers. Data processed includes name, address, contact details, booking details and payment information. The legal basis is contract performance pursuant to Article 6(1)(b) GDPR. Privacy policy: www.eversports.at/h/privacy

Flatpickr (CDN)

Providers: jsDelivr (Prospect One, ul. Krolweska 65A, 30-081 Kraków, Poland) and Cloudflare Inc., 101 Townsend St., San Francisco, CA 94107, USA. The purpose is to provide calendar functions. Data processed includes IP address and browser information. The legal basis is our legitimate interest pursuant to Article 6(1)(f) GDPR. Privacy policies: www.jsdelivr.com/terms/privacy-policy-jsdelivr-net www.cloudflare.com/privacypolicy

Your personal data will only be disclosed to those recipients who are necessary for the fulfillment of the aforementioned purposes. This includes IT and hosting service providers, booking system providers, payment service providers, analytics and marketing providers, and public authorities where there is a legal obligation. All external service providers are contractually bound by data processing agreements or other appropriate safeguards to comply with the GDPR.

Personal data will only be transferred to third countries if the European Commission has issued an adequacy decision for the respective country or if appropriate safeguards are in place within the meaning of Articles 46 et seq. GDPR, such as Standard Contractual Clauses or participation in the EU-US Data Privacy Framework.

We store personal data only for as long as necessary to fulfill the stated purposes. Beyond that, we retain data as required by statutory retention obligations. After the expiry of these periods, the data will be deleted.

You have the right to request information about the data we process about you, to have inaccurate data corrected or deleted, and to have processing restricted or objected to. You also have the right to data portability and the right to withdraw consent at any time with effect for the future.

Complaints can be lodged with the following authorities:

Austrian Data Protection Authority
Barichgasse 40–42, 1030 Vienna, Austria

www.dsb.gv.at
dsb@dsb.gv.at

European Data Protection Board (EDPB)
Rue Wiertz 60, B-1047 Brussels, Belgium

edpb.europa.eu