Privacy policy

Privacy

Vienna Pass

1. Privacy notice

Version June 2026

Your privacy is important to us. This notice explains how VPG Vienna Pass processes personal data. Our aim is to provide you with a secure and reliable booking and usage experience in relation to the Vienna PASS and the FLEXI Pass.

2. Controller

VPG Vienna Pass GmbH

Opernring 3-5, Top 508-529, 1010 Vienna, Austria

Phone: 0043 (0)1 50 33 033

Web: www.viennapass.de and www.viennapass.info

E-mail: info(at)viennapass.com

Further information about our company is available in the legal notice on our website. No data protection officer has been appointed because this is not required by law.

3. General information on data processing

This privacy notice informs you about the key aspects of data processing in the course of our activities as a provider of sightseeing cards for Vienna, in particular:

  • administration, sale and processing of the Vienna PASS and the FLEXI Pass;
  • reimbursement and settlement with attractions and service partners;
  • management of clients, suppliers and distribution partners;
  • public relations and marketing for our own purposes;
  • image processing at events;
  • website functions, booking process and payment processing;
  • newsletter and customer surveys.

3.1 Data minimisation

We collect and process only those personal data that are necessary for the respective purpose. Data that are no longer required are deleted or anonymised unless statutory retention obligations or legitimate interests prevent this.

3.2 Retention periods

We retain personal data only for as long as this is necessary for the respective purpose or required by law. In particular, the following reference periods apply:

  • booking and contract data: generally 7 years due to tax and fiscal retention obligations;
  • payment information: where required, until the end of the year following completion of the transaction, unless longer statutory obligations apply;
  • contact form enquiries: generally 1 year after final processing;
  • newsletter data: generally 3 years after the last active contact unless consent is withdrawn earlier.

4. Purposes and legal bases of processing

We process personal data in particular for the following purposes:

  • sale, administration and processing of the Vienna PASS and the FLEXI Pass;
  • reimbursement to attractions and settlement with service partners;
  • supplier, customer and distribution partner management;
  • handling contact and service enquiries;
  • call centre and customer service activities;
  • contact database based on public sources or contact data provided to us;
  • public relations;
  • marketing and customer surveys based on consent or within the scope of legally permitted existing-customer communication;
  • newsletters for customers, prospects and B2B contacts;
  • operation, security and optimisation of our website.

When you make a booking, we process in particular your first and last name, e-mail address, billing address, hotel name where applicable and payment information. We need these data for booking, payment, queries, service performance and customer support.

Depending on the purpose, processing is based on Art. 6(1)(b) GDPR (performance of a contract or pre-contractual measures), Art. 6(1)(c) GDPR (legal obligations), Art. 6(1)(a) GDPR (consent) or Art. 6(1)(f) GDPR (legitimate interest).

4.1 Website operation and server log files

When you access our website, your browser automatically transmits technical data to our web server. These include in particular IP address, date and time, URL accessed, referrer URL, browser and operating system information, HTTP status code and amount of data transferred. We process these data to establish the connection, ensure system security, prevent misuse and fraud, analyse errors and perform technical administration. The legal basis is Art. 6(1)(f) GDPR. Server log files are generally retained only for as long as this is necessary for security and error analysis.

5. Categories of recipients

In the course of processing, personal data may in particular be transferred to the following categories of recipients:

  • business partners and third parties involved in business processing, such as tax advisers, auditors, insurers, notaries, translators and lawyers;
  • banks, credit card companies and payment service providers, in particular PayPal, Adyen, VISA, Mastercard, Maestro, Google Pay, Apple Pay, Alipay, JCB, EPS, SEPA, UnionPay, Discover, Diners Club and WeChat Pay;
  • processors in the fields of IT, website, booking and card platform, communications, newsletter and marketing, in particular AVS Abrechnungs- und Verwaltungs-Systeme GmbH, hosting/software providers, marketing service providers, e-mail and telephone service providers and CleverReach;
  • authorities, courts and other public bodies where required by law or necessary for the establishment, exercise or defence of legal claims.

We do not intend to transfer personal data to international organisations. Where a transfer to recipients in third countries is required, it is made on the basis of an adequacy decision or appropriate safeguards, in particular standard contractual clauses.

6. Public forums, blog and reviews

Our website may offer publicly accessible content such as blog posts or reviews. Please note that published information may be read, stored and reused by third parties. By submitting a contribution, you consent to its publication where this is provided for in the relevant form. The legal basis is Art. 6(1)(a) GDPR.

For technical provision, moderation and security, we rely on our legitimate interest under Art. 6(1)(f) GDPR. Please send deletion or moderation requests to info(at)viennapass.com and identify the specific contribution.

7. How we protect your data

We implement technical and organisational measures under Art. 32 GDPR to protect the confidentiality, integrity and availability of personal data. These include transport encryption, access restrictions, role-based permissions, regular security updates, backups and organisational security measures. We conclude agreements under Art. 28 GDPR with processors used by us. No data transmission over the internet is completely secure; however, we use appropriate and economically reasonable safeguards.

8. Opt-out options

You can object to the use of personal data for certain purposes or withdraw consent. Transaction-related e-mails that are necessary for contract processing cannot be unsubscribed from. Location or push functions can be disabled in your device settings.

9. Newsletter

9.1 Newsletter subscription

Our newsletter can only be received if you have a functioning e-mail address and register for the newsletter. We generally use a double opt-in procedure to confirm registration.

9.2 Newsletter dispatch and analysis

When sending our newsletter, we process in particular e-mail address, contact data, data for creating usage statistics, website usage data and data on openings and clicks in the newsletter. Our newsletters may contain tracking pixels that allow us to determine whether and when a newsletter was opened and which links were clicked.

9.3 Legal basis

The legal basis is your consent under Art. 6(1)(a) GDPR in conjunction with § 174(4) TKG 2021 or, for existing B2B contacts, our legitimate interest in providing information to existing customers within the legally permitted scope. You can withdraw your consent at any time with effect for the future. Each newsletter contains an unsubscribe link.

9.4 Processor and retention period

For newsletter dispatch we use CleverReach GmbH & Co. KG, Schafjückenweg 2, 26180 Rastede, Germany, as processor. The data provided during registration are generally stored for up to 3 years after the last active contact unless you unsubscribe earlier.

10. Your rights as a data subject

We do not create profiles of data subjects and do not make solely automated decisions within the meaning of Art. 22 GDPR. Subject to statutory requirements, you have in particular the rights of access, rectification, erasure, restriction, data portability, withdrawal of consent and objection to certain processing. These rights may be restricted where statutory reasons, rights of third parties or business and trade secrets prevent their exercise.

To exercise your rights, please contact info(at)viennapass.com, call 0043 (0)1 50 33 033 or write to VPG Vienna Pass GmbH, Opernring 3-5, Top 508-529, 1010 Vienna. We generally respond to requests within one month of receipt; in the case of complex or numerous requests, the period may be extended under Art. 12(3) GDPR.

If you believe that the processing of your personal data infringes data protection law, you may lodge a complaint with the Austrian Data Protection Authority. Its website is www.dsb.gv.at.

11. Contact

If you have questions or concerns regarding data protection or security on our website, please contact us at info(at)viennapass.com.