Datenschutz

This Privacy Policy informs users about the nature, scope and purposes of the collection and use of personal data by our company. The legal basis for data protection is set out in the Austrian Telecommunications Act (TKG), the Austrian Data Protection Act (DSG) and the General Data Protection Regulation (GDPR).

The controller responsible for operating the blaguss.com website, general enquiries, bus enquiries, the newsletter and the online booking of charter buses is:

Blaguss Reisen GmbH
Richard-Strauss-Straße 32
1230 Wien
Austria
Commercial Register number: FN 120323x
UID: ATU 21232609

Our Data Protection Officer can be contacted at datenschutz@blaguss.com.

Where another company is expressly identified as the provider or contracting party for a travel or tourism offering, that company is responsible for processing in connection with the respective offering and contract. This applies in particular to offerings of:

Blaguss Tour GmbH
Richard-Strauss-Straße 32
1230 Wien
Austria
Commercial Register number: FN 513883k
UID: ATU74552879

E-Mail: datenschutz@blaguss.com
The respective provider or contracting party is identified in the offering or before the booking is concluded.

When you access our website, the web server processes in particular:

• IP address;
• date and time of access;
• page or file accessed;
• referrer URL;
• browser type and browser version;
• operating system and end device;
• technical connection and protocol data.

We process these data in order to provide the website, ensure its stability and security, identify technical errors and prevent abusive access.
The legal basis is Art 6(1)(f) GDPR. Our legitimate interest lies in the secure and functional operation of the website and our IT systems.
Recipients may include our hosting, website, IT and security service providers.

Our website uses cookies and similar technologies. Information may be stored on or read from your end device in this context.
We use technically necessary services insofar as they are required to:

• provide the website and functions requested by you;
• store your privacy and cookie settings;
• operate forms and booking functions;
• protect the website against misuse and technical attacks.

We activate analysis, marketing and external services that are not technically necessary only after you have given your consent.

We use the consent management platform of Usercentrics GmbH to manage your selection. In particular, the following data may be processed:

• consent or refusal status;
• date and time of your selection;
• consent ID;
• language settings;
• browser and device information;
• IP address or technical information derived from it;
• version of the consent settings used.

The processing serves to implement and document your selection and to demonstrate compliance with legal requirements. The legal bases are Art 6(1)(c) and (f) GDPR. You can change your selection or withdraw your consent at any time via “Privacy Settings” in the website footer. Withdrawal does not affect the lawfulness of processing carried out before the withdrawal.

The current list of services technically activated on the website, their providers, purposes, data categories and storage periods can also be found under “Privacy Settings”. Information is stored on your end device or accessed from it - unless a statutory exception applies - only with your consent pursuant to Section 165(3) TKG 2021. The associated processing of personal data is based on your consent pursuant to Art 6(1)(a) GDPR. Depending on the respective purpose, technically necessary processing is based on Art 6(1)(b), (c) or (f) GDPR.

You can contact us by email, telephone or via the forms provided on the website. Depending on the nature of your enquiry, we process in particular:

• title, first name and surname;
• company, association or educational institution;
• email address and telephone number;
• address;
• pick-up location, destination and travel route;
• travel period and requested departure times;
• number of travellers;
• requested vehicle and requested services;
• school identification number;
• content of your enquiry and additional comments.

We process these data in order to answer your enquiry, contact you, prepare an offer and prepare or perform a contract. The legal basis is Art 6(1)(b) GDPR where your enquiry relates to a contract or pre-contractual measures. We process general enquiries on the basis of Art 6(1)(f) GDPR. Our legitimate interest lies in handling your enquiry and customer communication.
We require the information marked as mandatory fields in order to process your enquiry. Without this information, we may not be able to provide the requested service. Please do not enter special categories of personal data, in particular health data, in free-text fields unless such data are necessary for your enquiry.

Where necessary to process your enquiry, prepare an offer or provide the requested service, we may transmit your data in particular to the following recipients:

• responsible employees and business units;
• the company within the Blaguss group of companies responsible for the service;
• bus companies and other transport companies;
• subcontractors;
• tour operators, travel agents and tourism service providers;
• technical booking, payment and IT service providers.

The legal basis is Art 6(1)(b) GDPR. Where processing serves to comply with legal obligations or to establish, exercise or defend legal claims, it is additionally based on Art 6(1)(c) or (f) GDPR.

6.1 Busfinder
We use Busfinder for enquiries and online bookings of charter buses. In particular, the following data are processed:

• title, first name and surname;
• address;
• email address and telephone number;
• customer group;
• travel and booking data;
• requested services;
• user account and login data, if you create an account.

The processing serves to calculate, create and process your booking. The legal basis is Art 6(1)(b) GDPR. Blaguss Reisen GmbH receives access to the booking data transmitted via Busfinder.

6.2 Regiondo and Stripe
For certain shuttle, event and excursion offerings, we use the Regiondo booking system. In particular, the following data may be processed:

• title, first name and surname;
• address and country;
• email address and telephone number;
• company and VAT identification number, if provided for a tax receipt;
• booked service and number of participants;
• booking and payment status.

The contracting party is the provider identified in the respective offering. Payment processing is carried out via Stripe. The data required for payment are transmitted to Stripe as part of the payment process. Blaguss Reisen GmbH receives the booking and payment status information required to allocate and process the booking.
The legal basis is Art 6(1)(b) GDPR. Art 6(1)(c) GDPR additionally applies to booking and accounting records required by law. The privacy information of Regiondo and Stripe also applies.

6.2.1 Email advertising to existing customers
If we receive your email address in connection with a booking, we use it, within the framework of the statutory requirements, to inform you by email about our own similar bus, shuttle and transport offerings of Blaguss Reisen GmbH, in particular in connection with events.

We limit this use to twelve months after your last purchase. When your email address is collected, you are given a clear and simple opportunity to object to this use free of charge. In addition, you can object to any advertising email at any time via the unsubscribe link contained in it.

The legal basis for processing your email address for this purpose is Art 6(1)(f) GDPR; Section 174(4) TKG 2021 additionally applies to the sending of electronic mail. Our legitimate interest lies in informing existing customers about our own similar offerings.

After an objection, we no longer use your email address for this advertising. Where necessary, in order to permanently observe your objection, we store only blocking information to the minimum extent necessary, in particular the email address or a reliably matchable technical identifier, the blocking status, and the time and source or communication channel of the objection. Marketing profile, interest, opening and click data that are no longer required are not retained for this purpose.

6.3 Palisis and Adyen
For bookings of the Parndorf Shuttle, we use a booking function provided by Vienna Sightseeing Tours - Wiener Rundfahrten Gesellschaft m.b.H. & Co. KG. The contracting party for this service is:
Vienna Sightseeing Tours - Wiener Rundfahrten Gesellschaft m.b.H. & Co. KG
In particular, the following data may be processed during the booking process:

• name;
• email address;
• telephone number;
• nationality;
• details of the booked journey;
• voluntary comments;
• booking and payment information.

The booking is processed via the Palisis ticketing system used by Vienna Sightseeing Tours. Payment processing is carried out via Adyen. Blaguss Reisen GmbH has no access to the Palisis backend or the booking data stored there.  The privacy information of Vienna Sightseeing Tours and of the booking and payment service providers used by it applies to the processing of data collected as part of the booking. Where technical connection data are transmitted to external services for the display or use of the booking function, this is done in accordance with your selection in the “Privacy Settings”. Content that is not technically necessary is loaded only after you have given your consent.

You can subscribe to the BLAGUSS newsletter on our website. In particular, we process:

• email address;
• title, first name and surname;
• company and school identification number, if provided;
• selected topics or areas of interest;
• date and time of registration;
• date and time of confirmation;
• content and version of the consent;
• technical sending, delivery and unsubscribe data.

The name and title details are used for personal salutation. Company and school identification number enable content to be assigned to specific target groups. We use Brevo for sending and recipient management.

7.1 Double opt-in
After registration, we send you a confirmation email. Your address is added to the newsletter distribution list only after you click the confirmation link. In particular, the following are processed to document consent:

• email address;
• time of form submission;
• sending and content of the confirmation email;
• time of confirmation;
• data entered in the form;
• content and version of the declaration of consent.

The legal basis for sending the newsletter is your consent pursuant to Art 6(1)(a) GDPR and Section 174 TKG 2021.

7.2 Sending and delivery information 

Brevo processes technical information about sending, delivery, undeliverable messages and unsubscribes. We use these data to ensure proper delivery, identify errors and keep our recipient lists up to date. The legal basis is Art 6(1)(f) GDPR. Our legitimate interest lies in the secure and efficient operation of newsletter delivery.

7.3 Personalised opening and click measurement
If you have separately consented to this, we can use Brevo, tracking pixels and individualised links to record on a personal basis whether you open a newsletter and which links contained in it you click.

We can assign this information to your recipient profile and use it to tailor newsletter content and sending processes to identifiable interests.

Where opening and click measurement stores information on or reads information from your end device, this takes place - unless a statutory exception applies - only with your consent pursuant to Section 165(3) TKG 2021. The associated processing of personal data is based on your consent pursuant to Art 6(1)(a) GDPR. Consent to opening and click measurement is voluntary and is not a prerequisite for receiving the newsletter.

You can withdraw this consent at any time with effect for the future. On the basis of these evaluations, we do not make solely automated decisions that produce legal effects concerning you or similarly significantly affect you.

7.4 Unsubscription, withdrawal and suppression list
You can withdraw your consent to the newsletter at any time, in particular:

• via the unsubscribe link in every newsletter;
• via the unsubscribe page on our website;
• by email to datenschutz@blaguss.com.

After unsubscribing, we no longer use your data to send the newsletter. Where necessary, in order to permanently observe your withdrawal, we store only blocking information to the minimum extent necessary, in particular the email address or a reliably matchable technical identifier, the blocking status, and the time and source or communication channel of the withdrawal. Marketing profile, interest, opening and click data that are no longer required are not retained for this purpose.

We retain evidence of consent for the duration of the consent and, as a rule, for a further three years after your withdrawal or the end of the use based on it, unless longer retention is required due to a specific legal dispute or statutory obligation.

After you have given your consent, we use Google Analytics, an analytics service provided by Google Ireland Limited. In particular, the following data may be processed:

• IP address;
• browser and device information;
• operating system;
• language settings;
• cookie and online identifiers;
• pages accessed;
• source of the website visit;
• date and time;
• length of stay;
• clicks, interactions and navigation behaviour;
• approximate geographic region.

We use these data to evaluate the use of our website, identify errors and barriers to use, and further develop content and functions. Google Analytics is activated only after you have given your consent. Information is stored on your end device or accessed from it - unless a statutory exception applies - with your consent pursuant to Section 165(3) TKG 2021. The associated processing of personal data is based on your consent pursuant to Art 6(1)(a) GDPR.
You can withdraw your consent at any time via “Privacy Settings”.
Further details on the configuration used, storage periods and recipients can also be found under “Privacy Settings”.

We use the services listed below to measure the success of our advertising measures, create target groups and display interest-based advertising. The services are activated only after you have previously given your consent via “Privacy Settings”. We use Google Tag Manager for the technical management and triggering of these services. Tags that are not technically necessary are activated only in accordance with your consent decision.

9.1 Google Ads, remarketing and conversion measurement
We use services of Google Ireland Limited for Google Ads, remarketing, conversion tracking and the technical linking of ad clicks with conversions. In particular, we use Google Ads, Conversion Linker, DoubleClick and Google Syndication as technical components.

In particular, the following data may be processed:

• IP address;
• cookie, advertising and online identifiers;
• browser and device information;
• pages accessed and interactions;
• origin via an advertisement;
• time and type of a conversion, such as an enquiry or booking;
• approximate location information.

We use these data to measure the success of advertisements, create target groups for advertising and display interest-based advertising to users.

Information is stored on your end device or accessed from it - unless a statutory exception applies - with your consent pursuant to Section 165(3) TKG 2021. The associated processing of personal data is based on your consent pursuant to Art 6(1)(a) GDPR. Further information on the respective Google service can be found under “Privacy Settings”. Where the Google advertising services we use are subject to the Google Controller-Controller Data Protection Terms, we and Google process the respective personal data as independent controllers.

9.2 Brevo website tracking
We use the Brevo tracker, after you have given your consent, to record interactions with our website and evaluate marketing and automation processes. In particular, cookie and visitor identifiers, pages accessed, times, interactions and technical browser and device information may be processed. If a website visitor has already been identified as a contact in Brevo, website activities may be assigned to that contact subject to Brevo’s technical requirements.

We use these data in particular to analyse customer journeys, for segmentation and to control marketing automations. Information is stored on your end device or accessed from it - unless a statutory exception applies - with your consent pursuant to Section 165(3) TKG 2021. The associated processing of personal data is based on your consent pursuant to Art 6(1)(a) GDPR. Identification for marketing purposes and the subsequent processing take place only within the scope of the consent you have given.

9.3 Meta Pixel
We use the Meta Pixel of Meta Platforms Ireland Limited, after you have given your consent, to measure the use of our website in connection with advertisements on Facebook and Instagram, create target groups and display advertising on Meta platforms.  In particular, IP address, browser and device information, cookie and online identifiers, pages accessed, interactions and information about conversions may be processed and transmitted to Meta. Information is stored on your end device or accessed from it - unless a statutory exception applies - with your consent pursuant to Section 165(3) TKG 2021. The associated processing of personal data is based on your consent pursuant to Art 6(1)(a) GDPR. Further details on the respective service can be found under “Privacy Settings”.

Where we and Meta Platforms Ireland Limited jointly determine the purposes and means of processing in connection with the collection and transmission of event data via the Meta Pixel, we are joint controllers for this purpose pursuant to Art 26 GDPR. The respective responsibilities are governed by Meta’s Controller Addendum. Further information on processing by Meta and on the essential content of this agreement can be found in Meta’s privacy information.

9.4 LinkedIn Insight Tag
We use the LinkedIn Insight Tag of LinkedIn Ireland Unlimited Company, after you have given your consent, to measure the success of LinkedIn campaigns, statistically evaluate website visits and create target groups for advertising.

In particular, IP address, browser and device information, cookie and online identifiers, pages accessed, interactions and information about conversions may be processed and transmitted to LinkedIn. LinkedIn processes the personal data received in connection with the LinkedIn Insight Tag for the relevant LinkedIn Marketing Solutions as an independent controller in accordance with the applicable contractual terms. Further information can be found in LinkedIn’s privacy information.

Information is stored on your end device or accessed from it - unless a statutory exception applies - with your consent pursuant to Section 165(3) TKG 2021. The associated processing of personal data is based on your consent pursuant to Art 6(1)(a) GDPR. Further details on the respective service can be found under “Privacy Settings”.

External content and technical services are integrated into our website. These include in particular Google Maps, YouTube videos, virtual bus tours from VIVIS3D, reCAPTCHA to protect forms, Adobe Fonts and Google Fonts, as well as technical libraries and content delivery networks such as Google AJAX or technical Google resources, Cloudflare and jsDelivr.

When such services are loaded, the following data may be processed in particular:

• IP address;
• browser and device information;
• page accessed;
• date and time;
• interactions with the embedded content;
• cookie and online identifiers, where the respective service uses such identifiers.

External content and services that are not necessary are loaded only after you have given your consent. Information is stored on your end device or accessed from it - unless a statutory exception applies - with your consent pursuant to Section 165(3) TKG 2021.  The associated processing of personal data is based on your consent pursuant to Art 6(1)(a) GDPR.

Where a service is strictly necessary for the security or technical provision of a function expressly requested by you and there is no access to your end device requiring consent, the processing is based, depending on the purpose, on Art 6(1)(b) or (f) GDPR. 
Technical host names and resources that are merely components of a higher-level service are not each presented as a separate processing operation in the Privacy Policy. The services currently technically activated and further details can be found under “Privacy Settings”.

Our website also contains links to our profiles on social networks and platforms, in particular Facebook, Instagram, YouTube and LinkedIn. The icons serve exclusively as external links. Merely accessing our website does not cause any data to be transmitted to the respective platform through these links.

Only when you click a link do you establish a connection to the platform operator. The respective platform operator is responsible for the subsequent data processing. If you are logged in to the platform, the operator may associate the visit with your user account. These links to our social media profiles are distinct from the marketing technologies described in Section 9, in particular the Meta Pixel and LinkedIn Insight Tag.

At events organised or co-organised by us, we may make photo, video and audio recordings or have such recordings made by photographers, camera crews or other service providers commissioned by us.

We use these recordings for documentation and for press and public relations purposes. Selected recordings may in particular be published on our websites, on social media and in our own print and online media and may be transmitted to media outlets as part of our press activities.

The legal basis is Art 6(1)(f) GDPR. Our legitimate interest lies in documenting our events and informing the public about our activities and offerings.

When selecting and using recordings, we take into account the interests, rights and freedoms of the persons depicted. If you do not wish to appear in recordings arranged by us, you can contact our event staff at the event. You may also subsequently object to the processing, on grounds relating to your particular situation, by contacting datenschutz@blaguss.com. We will assess the objection in accordance with the statutory requirements.

Recipients may include, in particular, photo, video, event, media and IT service providers commissioned by us, operators of the websites and social media platforms we use, and media outlets.

Media representatives present who independently make recordings for their own journalistic purposes act under their own responsibility under data protection law in this respect. The storage period is determined according to the criteria set out in Section 15.

Depending on the respective processing operation, in particular the following recipients or categories of recipients may receive data:

• responsible employees and business units;
• the respective identified provider or contracting party;
• affiliated companies of the Blaguss group of companies, insofar as this is necessary for the respective purpose;
• bus companies, subcontractors and other service providers;
• booking and payment service providers;
• newsletter, analytics, marketing and consent management service providers;
• photo, video, event and media service providers as well as media outlets;
• hosting, website, IT and security service providers;
• tax advisers, auditors and legal advisers;
• courts and authorities, where there is a legal obligation.

Processors may process personal data only in accordance with our instructions and for the agreed purposes.

Individual providers may also process personal data outside the European Union or the European Economic Area. Such a transfer takes place only if the statutory requirements are met, in particular on the basis of:

• an adequacy decision of the European Commission;
• appropriate safeguards pursuant to Art 46 GDPR, in particular Standard Contractual Clauses;
• another statutory basis for transfer.

Further information on the individual services, recipients and bases for transfer can be found under “Privacy Settings” and in the privacy information of the respective providers.

We store personal data for as long as necessary for the respective processing purpose, to comply with statutory retention obligations or to establish, exercise or defend legal claims. In particular, the following criteria apply:

• contact and enquiry data are stored for the duration of processing and thereafter for as long as follow-up questions, a continuation of the business relationship or the assertion of claims can be expected;
• if a contract is concluded, booking, contract and accounting data are stored for the duration of contract performance and the statutory retention and limitation periods;
• data for advertising to existing customers are used for no longer than twelve months after the last purchase, provided that you do not object earlier and the statutory requirements continue to be met; necessary blocking information may be stored beyond this period to the minimum extent described;
• newsletter data are processed until consent is withdrawn or you unsubscribe; necessary blocking information may be stored beyond this period to the minimum extent described;
• evidence of consent is stored for the duration of the respective consent and, as a rule, for a further three years after withdrawal or the end of the use based on it, unless longer retention is required due to a specific legal dispute or statutory obligation;
• analytics, marketing, cookie and similar data are deleted or anonymised in accordance with the storage periods specified under “Privacy Settings”.

Emails deleted from active systems may remain in backup copies for up to 365 days. As a rule, these data are accessed only as part of a necessary system restoration.

In connection with this website, we do not make any solely automated decisions within the meaning of Art 22 GDPR that produce legal effects concerning you or similarly significantly affect you.

Subject to the statutory requirements, you have in particular the right to:

• access the personal data processed by us;
• rectification of inaccurate or incomplete data;
• erasure;
• restriction of processing;
• data portability;
• object to processing based on Art 6(1)(e) or (f) GDPR;
• withdraw consent with effect for the future;
• lodge a complaint with a data protection supervisory authority.

To exercise your rights, please contact: datenschutz@blaguss.com

We may request additional information to establish your identity if there are reasonable doubts concerning the identity of the applicant. You may object at any time to the processing of your data for direct marketing purposes.

You have the right to lodge a complaint with a data protection supervisory authority.
In Austria, this is:

Austrian Data Protection Authority
Barichgasse 40–42
1030 Wien
Austria
E-Mail: dsb@dsb.gv.at

We take appropriate technical and organisational measures to protect personal data against loss, unauthorised access, alteration and unauthorised disclosure.
The website is transmitted in encrypted form. We review and update our security measures in line with technical developments and the risks associated with processing.

The following section applies to prize draws organised by BLAGUSS REISEN Gesellschaft m.b.H. (“Blaguss”) on its official Facebook and Instagram business profiles, where participation takes place by posting a comment and prize fulfilment is handled via private messages. The terms and conditions of participation are available at blaguss.com.

This section does not apply to prize draws organised by other companies within the Blaguss Group. Where different procedures apply, we will provide separate information about any additional processing of personal data.

Data Controller and Contact Details

The data controller responsible for processing personal data in connection with the organisation and administration of these prize draws is BLAGUSS REISEN Gesellschaft m.b.H., Richard-Strauss-Straße 32, 1230 Vienna, Austria, email: datenschutz@blaguss.com.

Personal Data Processed and Purposes of Processing

When participating by posting a comment under a prize draw post, we process the publicly visible profile name, the platform-specific profile identifier and the comment. To select and notify the winners, we additionally process the results of the prize draw and, where applicable, the content of private messages exchanged via Facebook Messenger or Instagram Direct. Only where there are specific doubts regarding a participant's eligibility may we request confirmation or appropriate proof of age or residence.

We use this data exclusively to verify eligibility, conduct the prize draw, notify the winners, provide digital voucher or discount codes, prevent misuse and maintain the necessary documentation. Personal data collected in connection with the prize draws will not be used for newsletters or any other form of direct marketing.

Legal Bases for Processing

Insofar as the processing of personal data is necessary for participation in the prize draw and prize fulfilment, it is based on Article 6(1)(b) of the General Data Protection Regulation (GDPR). The prevention of fraudulent multiple entries and the temporary documentation of the proper conduct of the prize draw are based on our legitimate interests in ensuring a fair prize draw and in defending against or enforcing legal claims (Article 6(1)(f) GDPR).  Where statutory retention obligations apply in individual cases, processing is based on Article 6(1)(c) GDPR.

Recipients and Data Processing by Meta

The prize draw is conducted via Facebook and Instagram, services provided by Meta Platforms Ireland Limited. Comments and private messages are processed within the respective platforms. Meta also processes personal data in its own capacity as a data controller in accordance with its privacy policies. This may include the processing of personal data outside the European Economic Area (EEA). Further details and information on the applicable safeguards can be found in Meta's Privacy Policy:

https://www.facebook.com/privacy/policy/

Where prizes are provided in the form of digital voucher or discount codes, we do not disclose participants' personal data to the respective prize or voucher provider for the purpose of delivering these codes. Winners redeem the codes directly with the respective provider. The provider's own privacy policy applies to the relevant booking or redemption process.

Any further disclosure of personal data collected in connection with the prize draw will take place only where necessary for conducting the respective prize draw or where required by law. Where applicable, we will provide additional information about such disclosures in the relevant terms and conditions of participation.

Data Retention Period

As a general rule, we process the personal data required for the prize draw until the prize draw and prize delivery have been completed. Where we create our own prize draw lists or other internal prize draw documentation, we generally delete these records no later than three months after completion of prize fulfilment, unless specific legal claims or statutory retention obligations require a longer retention period. Publicly visible comments and private messages stored on the platforms are also subject to the retention and deletion policies of Facebook and Instagram. We do not have full control over the independent storage of such data by these platforms.

Rights of Data Subjects

In accordance with the GDPR, data subjects have, in particular, the right of access, rectification, erasure, restriction of processing and, where applicable, data portability. They also have the right to object to processing based on legitimate interests pursuant to Article 21 GDPR.

Requests concerning the exercise of these rights may be sent to datenschutz@blaguss.com.

Data subjects also have the right to lodge a complaint with the Austrian Data Protection Authority (www.dsb.gv.at). Participation is voluntary. However, participation in the respective prize draw is not possible without submitting a valid comment on Facebook or Instagram. As a general rule, no additional contact details are required for the prize draw procedure described above.

We amend this Privacy Policy if the website, the services used, the data processing operations or the legal requirements change materially. We publish the current version on this website.