Privacy Policy

1. Controller

The controller for the processing described here is the company named in the Impressum, contactable at the email address given there. We have not appointed a data protection officer, as we are not required to.

Ahmed Wezza
Rüdigergasse 18/5, 1050 Wien
hello@viennagrandtours.com

2. Data we process when you book

The booking form collects your name, email address, telephone number, the tour you selected, the date and departure time, the number of guests, your narration language, and anything you write in the notes field — please share health or mobility details only if you want us to plan around them. We need these data to perform the contract with you (Art. 6 (1) (b) GDPR); any special category data you volunteer in the notes is processed on the basis of your consent (Art. 9 (2) (a) GDPR).

3. Data we process when you contact us

If you write to us by email, we process your address, your message and any details you include, in order to answer you (Art. 6 (1) (b) and (f) GDPR — our legitimate interest in responding to enquiries).

4. Data collected automatically

Our hosting provider records standard server log data — IP address, date and time, requested page, referring page, browser and operating system — for the security and stability of the site (Art. 6 (1) (f) GDPR). These logs are deleted after a short period and are not merged with other data.

5. Cookies and analytics

We set one essential item in your browser’s local storage to remember your cookie choice; it contains no personal data and no tracking identifier. Analytics load only after you accept them in the banner (Art. 6 (1) (a) GDPR), and you can withdraw that consent at any time by clearing your browser storage for this site or writing to us. No advertising or profiling cookies are used.

6. Processors and recipients

We use carefully selected service providers, each bound by a data processing agreement under Art. 28 GDPR where applicable: Netlify (website hosting and delivery), Supabase (booking database, hosted in the EU), SumUp (online card payments via hosted checkout), and our email provider for confirmation messages. Payment card details are entered only on SumUp’s systems, not on this website. Data is transferred to third countries only on the basis of EU standard contractual clauses or an adequacy decision. Beyond that, we pass data to third parties only where we are legally obliged to — for instance to tax authorities.

7. How long we keep your data

Booking and invoicing data are retained for seven years under Austrian tax and commercial law (§ 132 BAO, § 212 UGB). Enquiries that do not lead to a booking are deleted once the matter is closed, at the latest after twelve months. Server logs are deleted after a few days. Consent-based data is deleted when you withdraw consent.

8. Your rights

You have the right to access your data, to have it corrected or erased, to have processing restricted, to object to processing based on legitimate interests, and to receive your data in a portable format. Where processing rests on consent, you may withdraw it at any time with effect for the future. Write to the email address in the Impressum and we will respond within one month.

9. Right to complain

If you believe we handle your data unlawfully, you may complain to the Austrian Data Protection Authority (Österreichische Datenschutzbehörde, Barichgasse 40–42, 1030 Vienna, dsb.gv.at) or to the supervisory authority where you live.

10. Photographs

We publish photographs showing recognisable guests only with express consent, given in writing or clearly on the day. Consent may be withdrawn at any time; write to us and we will remove the image from our website and social channels.

11. Changes to this policy

We update this policy whenever our tools or processes change. The version published here is the one that applies.