Cookies

Version June 2026

1. Introduction

This cookie policy explains how we use cookies, local storage, pixels/web beacons and similar technologies to enable optimal use of our website. We distinguish between technically necessary technologies and technologies based on your consent, such as analytics, marketing or social media cookies.

2. Website operator and controller

VPG Vienna Pass GmbH

Opernring 3-5, Top 508-529, 1010 Vienna, Austria

Phone: 0043 (0)1 50 33 033

Web: www.viennapass.de and www.viennapass.info

E-mail: info(at)viennapass.com

Further information about our company is available in the legal notice on our website. No data protection officer has been appointed because this is not required by law.

3. Purposes of processing

We use the Usercentrics cookie banner. There you can give or withdraw your consent for each category. We use cookies and similar technologies in particular for the following purposes:

• Strictly necessary functions: operation of the website, booking process, shopping cart functions, language settings, security functions, fraud and misuse prevention. Legal basis: § 165(3) TKG 2021 and Art. 6(1)(f) GDPR.
• Analytics: measurement and analysis of website use, e.g. Google Analytics or Hotjar. Legal basis: consent under Art. 6(1)(a) GDPR.
• Marketing and advertising: personalised advertising, retargeting and campaign measurement, e.g. Google Ads or Meta Pixel. Legal basis: consent.
• Social media: integrations and functions of social networks. Legal basis: consent.
• Payments: third-party providers for payment processing, e.g. PayPal and Adyen. Technically necessary payment cookies are essential; any additional cookies are used only where the required consent has been given.

4. Collection and processing of data on our website

4.1 Legal bases

The use of cookies and similar technologies is generally based on § 165(3) TKG 2021. Technically necessary storage and access take place without consent where they are strictly required for the operation of the website or booking process. All other storage and access are based on your consent under Art. 6(1)(a) GDPR. The GDPR and the Austrian Data Protection Act (DSG) apply to the processing of personal data.

4.2 Server log files

When you access our website, your browser automatically transmits technical data to our web server, in particular date and time of the request, name and URL of the requested file, referrer URL, access status, browser and operating system information, IP address and amount of data transferred. We process these data for system security, technical administration and error analysis. The legal basis is Art. 6(1)(f) GDPR.

4.3 Cookies

Our website uses cookies, local storage and similar technologies. Session cookies are deleted at the end of your visit; persistent cookies remain until deleted by you or your browser. Strictly necessary cookies enable essential functions such as shopping cart, language settings, booking and security functions. Analytics and marketing cookies are processed only with your consent. Details of names, providers, purposes and retention periods are available in the Usercentrics banner; there you can change or withdraw your settings at any time.

5. Consent management via Usercentrics

We use the consent management service Usercentrics of Usercentrics GmbH, Sendlinger Str. 7, 80331 Munich, Germany. Usercentrics enables us to obtain, manage and document consents.

• Data processed by Usercentrics: opt-in and opt-out data, referrer URL, user agent, user settings, consent ID, time and type of consent, template version, banner language, IP address and geographic location.

Usercentrics acts as our processor. Processing generally takes place within the European Union; the data are deleted after 3 years. You can adjust or withdraw your preferences at any time via the banner.

6. Integration of further tools and services

6.1 AVS

We use AVS Abrechnungs- und Verwaltungs-Systeme GmbH, Josephsplatz 8, 95444 Bayreuth, Germany, as technical service provider for the AVS card platform. Further information is available in the privacy policy of AVS (link).

6.2 PayPal and Adyen

For payment processing we use PayPal (PayPal (Europe) S.à r.l. et Cie, S.C.A.) and Adyen (Adyen N.V., Netherlands). Depending on the payment method, you are redirected or a hosted payment form or iframe is opened. Technically necessary payment cookies are essential; other payment cookies are used only where the required consent has been given. Details are available in the privacy and cookie notices of the respective payment service providers.

6.3 Cloudflare

Cloudflare is used to protect our website against DDoS attacks and to improve security. Further information is available in the Cloudflare privacy policy (link). Cloudflare is certified under the EU-U.S. Data Privacy Framework.

6.4 Google tools

Google Tag Manager is used for central management of tags on our website. Where consent-based services are controlled via Google Tag Manager, those services are triggered only after consent has been given. Google Analytics, Google Ads, remarketing and Enhanced Conversions are used only in accordance with your consent. Transfers of data to Google Ireland Limited may take place on the basis of the European Commission adequacy decision C(2023) 4745.

6.5 Social media functions and widgets

Our website may contain social media functions such as Meta Pixel. These services collect in particular device information, IP address, click behaviour and interaction data and are used only on the basis of your consent.

6.6 Hotjar

Hotjar helps us better understand user behaviour on the website and improve our services. Hotjar may use cookies and similar technologies and processes, among other data, IP address in de-identified form, screen size, device type, browser information, country-level location, preferred language and user behaviour. The legal basis is your consent under Art. 6(1)(a) GDPR. The provider is Hotjar Ltd, Dragonara Business Centre, 5th Floor, Dragonara Road, Paceville St Julian's STJ 3141, Malta. Further information is available in the Hotjar privacy policy (link).

7. Sharing of non-personal data

We aggregate and share non-personal data, such as visitor numbers or demographic statistics, solely for statistical purposes. We do not disclose information that could identify individual persons.

8. User rights

As a data subject, you have statutory rights in particular to access, rectification, erasure, restriction of processing, data portability, withdrawal of consent and objection to certain processing. To exercise your rights, please contact us by e-mail at info(at)viennapass.com, by telephone at 0043 (0)1 50 33 033 or by post at the address stated above. You may also contact the Austrian Data Protection Authority at www.dsb.gv.at.

9. Final provisions and currentness

This policy is regularly reviewed and adapted to legal and technical developments. Please note that all third-party links listed in this policy should be checked regularly for currentness.