Data Protection

Privacy statement & data protection officer

We appreciate your interest in our website.

 

This privacy statement informs you about the processing activities of your personal data in the context of our website.

 

The protection of your personal data and of your privacy is very important to us. Therefore, we process your data exclusively on the basis of the existing legal provisions [Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of data, and repealing Directive 95/46/EC (GDPR), Data Protection Act 2018 (DSG 2018), ePrivacy Directive, Telecommunications Act 2003 (TKG 2003)].

 

1.  Controller and data protection officer

 

Pursuant to Article 4 (7) of the GDPR, the controller for this website is VAMED Standortentwicklung & Engineering GmbH (VAMED).

 

If you have any questions about the processing of your data by VAMED, you can contact us as indicated below:

 

  • by mail to: VAMED Standortentwicklung & Engineering GmbH (VAMED), Sterngasse 5, 1230 Vienna, Austria
  • by email to: datenschutz@vitality-world.com

 

The contact details of the VAMED Data Protection Officer are:

Mag. Per-Oliver Gustavson

Sterngasse 5, 1230 Vienna, Austria

Tel: +43 1 60127 0

datenschutz@vitality-world.com
 

2.  Processing of personal data when visiting the website

2.1  Processing of access data

 

When you visit our website, we store the access data in so-called web server log files. In addition, log entries in the drupal system are created. We collect the following data from you:

 

  • IP address
  • Date and time of access
  • Browser
  • Language settings
  • Operating system
  • Referrer URL
  • Your Internet service provider

 

Purpose of data processing

These data are statistically evaluated to further improve our online offer and make it more user-friendly, to find and fix bugs faster, and to control server capacity. Only in case of a concrete indication of illegal use of our website, we will use this data in a personal form for the purpose of prosecution.

 

Duration of storage

Your data will only be stored for a period of 5 years.

 

Legal basis

The legal basis for the processing of access data is the legitimate interest of VAMED (online service offer & data security) pursuant to Article 6 (1) (f) of the GDPR.

2.2  Cookies

 

2.2.1  Use of technical cookies

 

In order to make the visit to our website as attractive as possible and to enable the use of certain functions, we use so-called cookies on various pages. These are small files that are stored on your device. They allow us to recognize your browser on your next visit. The cookies are set in accordance with EU and Austrian law (Art. 5 (3) E-Privacy Directive and Art. 96 (3) TKG 2003).

 

These are the following cookies:
 

name

description

duration of storage

gtm-disable-GTM-M5WPRB

Indication, if cookies have been deactivated

infinitely

 

cookie-agreed

Indication, if the cookies have been confirmed

100 days

_gid

Used to distinguish users.

24 hours

_ga

Used to distinguish users.

2 years

_utmz

Stores the traffic source or campaign that explains how the user reached your site.

6 months from set/update

_utma

Used to distinguish users and sessions.

2 years from set/update

 

You can set your browser in the way that you are informed about the setting of cookies and individually decide on their acceptance or exclude the acceptance of cookies for specific cases or in general. However, disabling cookies may limit the functionality of our site.

 

Legal basis
The legal basis for the setting of the technical cookies is the legitimate interest of VAMED (online service offer & data security) according to Art. 6 para. 1 f DSGVO.

 

 

2.2.2  Use of third-party cookies

 

VAMED uses various services for this website which also use cookies.

 

The following third-party cookies are set:

 

Hotel Champ

We use the services of Hotelchamp, a professional provider of online software and services, to help us improve our online booking process and to help us personalize and improve our interaction with you.

 

In providing this service to us and for you, Hotelchamp may process some of your personal data on our behalf. Both Hotelchamp and ourselves value and respect your privacy, and we process and protect your personal data in accordance with all applicable laws and regulations.

 

We have concluded a ‘data processing agreement’ with Hotelchamp to make specific arrangements about the processing and protection of your personal data.

 

We and Hotelchamp may process data such as your e-mail address, IP address, and browser fingerprint, in combination with your booking data and your other interactions on our website, in order to provide content and offers to you which we think will be most relevant and appealing to you. For example, if your booking dates are on Christmas, we may provide you with a special Christmas offering. Or if your booking data shows you are a family, we may provide you with a special family deal.

 

Hotelchamp’s services may involve the use of cookies on our website. By continuing to visit our website, you consent to the use of cookies to help us personalize and improve our interaction with you.

 

Only your interactions with us and our website are used to personalize our content and offers to you, not your behavior on other websites or elsewhere.

 

To prevent cookies from being set by advertisers, you can also block third-party cookies in your browser. Here are instructions for the most common browsers: Firefox, Chrome and Internet Explorer. In Apple's Safari, third-party cookies are blocked by default.

 

1.2.3  Google Analytics

 

This website uses Google Analytics, a web analytics service provided by Google Inc., 1600 Amphitheater Parkway, Mountain View, CA 94043, USA ("Google"). Google Analytics also uses cookies that allow the analysis of your use of the website. The information generated by the cookie about your use of this website is usually transmitted to a Google server in the USA and stored there. Only in exceptional cases will the full IP address be sent to a Google server in the US and shortened there. On behalf of the operator of this website, Google will use this information to evaluate your use of the website, to compile reports on website activity and to provide other services related to website activity and Internet usage to the website operator. The IP address provided by Google Analytics will not be merged with other Google data. You can prevent the collection by Google of the data (including your IP address) generated by the cookie and related to your use of the website by downloading and installing the browser plug-in available at the following link: (http://tools.google.com/dlpage/gaoptout?hl=de).

 

Legal basis

The legal basis for the use of Google Analytics is the legitimate interest of VAMED (Art. 6 (1) (f) GDPR), which involves the evaluation of the website and analysis of website activities.

 

Recipients of the data

These data are forwarded to Google for the stated purposes.

 

Duration of storage

The personal data is stored for a period of 14 month and then deleted.
 

2.3  Social Plugins

This website includes social plugins ("plugins") which are the following:
 

  • facebook, betrieben von Facebook Irland Limited, 4 Grand Canal Square, Dublin 2, Irland, FN 462932 / Facebook Inc., 1601 Willow Road, Menlo Park, CA 94025

The plugins are marked with a logo or the name of the operator. When you you visit a VAMED website that contains such a plugin, your browser establishes a direct connection to the server of the operators. The operator transmits the content of the plugin directly to your browser and integrates it into the website. By integrating the plugins, the operator receives the information that you entered the corresponding VAMED website. If you are logged in to your user account of the operator, he can assign the visit to your user account. If you interact with the plugins, for example by clicking on a plugin button, the corresponding information is transmitted directly from your browser to the operator and stored there. By logging out of your user account, you can prevent the operator from assigning the collected information to your user account.

The purpose and scope of the data collection and the processing of the data as well as the use of the data by the operator including your related rights and setting options for the protection of your privacy can be found in the respective privacy policy:
 

• facebook: https://www.facebook.com/privacy/explanation

3. Facebook
 

VAMED is operating a Facebook fanpage, where personal data is processed. [company] as operator of this fanpage is also responsible in the sense of the data protection law.

 

Your data can be processed through cookies of the fanpage, regardless of whether you have a Facebook account or not. Only Facebook is responsible for the usage of the cookies. VAMED has no influence in this regard. Details about the usage of the cookies can be found on (https://www.facebook.com/privacy/explanation) and (https://www.facebook.com/policies/cookies/). You can further download your own Facebook data directly on Facebook (download of the so called “extended archive” in your account settings). 

 

Via the cookies your data can be forwarded to Facebook Inc. into the USA. Facebook is certified for the EU-US-Privacy-Shield, which means Facebook has to maintain a data protection standard towards users in Europe, which has been approved by the European Commission as being comparable to European standards. Apart from that Facebook might also apply cookies from third-party-providers. Those are listed here: https://www.facebook.com/policies/cookies/ . Their respective Cookie-guidelines can be found on the their respective websites.     

You can revoke your declaration of consent regarding the storage, processing and usage of your data via cookies in the course of the usage of the fanpage anytime with effect to the future. In this case the processing of your data until the revocation remains legal.
 

4.  Linking

The website includes links to other websites. These references to websites of other Internet users are provided as a service to cover wider information needs of the accessing party. VAMED has no influence on their content. VAMED assumes no liability for this content. The provider of the linked website is exclusively responsible for the content and correctness of the information provided there.

 

5.  VAMED Vitality Club
 

Data processing
The issuing Vamed Vitality World Resort (in this chapter referred to as "VVW-Resort") processes the customers‘ personal club membership data (i.e., name, title, academic degree, number household members, address, e-mail address, telephone number, date of birth, language, information regarding the newsletter, VAMED VitalityClub (in this chapter referred to as "VVW Club") account data, the VVW Resort where the customer has registered, date of registration – all jointly referred to as “data”). The issuing VVW Resort also shares these data with other VVW Resorts participating in the VVW Club, i.e., Aqua Dome Tirol Therme Längenfeld GMBH & CO KG, TAUERN SPA WORLD Betriebs GmbH & Co KG, TBG Thermenzentrum Geinberg BetriebsgmbH, TBL Therme Laa a.d. Thaya – Betriebsgesellschaft m.b.H,  Therme Wien GmbH & Co KG, Heilbad Sauerbrunn Betriebsgesellschaft m.b.H., Therme Seewinkel Betriebsgesellschaft m.b.H., Gesundheitsresort Gars Betriebs GmbH, Aquaworld Hotel és Élményfürdő Szolgáltató Zártkörű Részvénytársaság (based in Hungary) and VAMED Standortentwicklung und Engineering GmbH. The management of the VVW Club participation program and customers’  VVW Club accounts requires the electronic processing of the respective  data and their exchange with other VVW resorts (e.g. for crediting bonus points, for customers using them at other VVW resorts).  If these data are not provided, membership in the VVW Club is not possible.

Purpose of data processing
The purpose of the electronic data processing are

  • the management of the customers’ VVW Club accounts,
  • the administration of benefits from the VVW Club Card
  • customer care
  • and  - provided the customer has agreed to it – the marketing of VVW Resorts’ products and services, special offers and events, including the VVW Resorts’ news (by means of marketing material sent by regular mail, e-mail, text message, and telephone calls).


Legal basis
The processing of data for the membership administration of the VVW Club is based on Art. 6 (1) (b) of the EU General Data Protection Regulation (performance of a contract). The processing of data for marketing purposes is based on Art. 6 (1) (a) of the Regulation (consent by data subject).

Data transmission
Upon instructions by the respective VVW Resort, the data are processed for the purpose of providing an electronic VVW Club card system and for marketing purposes, by Cards & Systems EDV-Dienstleistungs GmbH, mediasupport GmbH, kb-endlos Kroiss & Bichler GmbH, and AUSTRIACARD AG, protel hotelsoftware GmbH, TravelClick, Inc., Emarsys North America Inc. The data are not transferred to third parties other than the ones above.

Duration of storage
The data are saved during the membership period with the VVW Club, and exceeding this period, if there are legally required storage periods, or for the period during which any legal claims can be lodged in connection with the subject contractual relationship, or in the event of other reasonable circumstances justifying further storage of these data.
 

6.  Online-Shop
 

Data processing
The Customer agrees that all data generated on account of his / her business relationship, which are first name, last name, address, e-mail address, telephone number, fax number, Customer account data (orders placed, articles, prices, IP address), any texts entered in Print-at-Home vouchers, value card queries (voucher number, date, IP address), (in short, the "data") are automatically processed by VAMED Standortentwicklung and Engineering GmbH (in this chapter referred to as "Seller").
 

Purpose of data processing
The purpose of processing data are

  • the handling of the respective business transactions
  • and - if the Customer has agreed - the marketing of products, services and services of the VAMED Vitality World resorts, special offers and events, as well as the distribution of VVW resorts’ news (including the dispatch of appropriate marketing materials by post, e-mails, text message, and contact by phone).


Legal basis
The processing of data for the handling of the respective business transaction is based on Art. 6 (1) (b) of the EU General Data Protection Regulation (performance of a contract). The processing of data for marketing purposes is based on Art. 6 (1) (a) of the Regulation (consent by data subject).

Data transmission
Upon instructions by the Seller, the data are processed and transferred to styleflasher GmbH (KR Martin Pichler-Str. 1, A-6300 Wörgl), Cards & Systems EDV-Dienstleistungs GmbH (Landstraßer Hauptstraße 5, 1030 Vienna) and mediasupport GmbH (Lerchenfelder Straße 124/Top 6, 1080 Vienna), and mPAY24 GmbH (Grüngasse 16, 1050 Vienna) for the purpose of handling the respective business case, as well as for marketing purposes to EMARSYS eMarketing SystemsAG (Märzstraße 1, 1150 Vienna) und travelClick (Via Augusta, 117, Barcelona 08006). The data are not transferred to third parties other than the ones above.

Duration of storage
The data are saved for the processing of the respective business case, for marketing purposes, and exceeding this period, if there are legally required storage periods, or for the period during which any legal claims can be lodged in connection with the subject contractual relationship, or in the event of other reasonable circumstances justifying further storage of these data.

 

7.  Request form for seminars

We look forward to hearing from you.
 

Data processing
When you contact us using the request form, VAMED processes your personal information indicated below:

  • resort
  • number of participants
  • company
  • date
  • e-mail adress
  • notes (optional)

 

Purpose of data processing
The personal data that you provide when you contact us processed for the purposes of

  • contacting you and,
  • preparing an offer based on the given data.
     

Legal basis
The processing of your personal data for the purpose of contacting you is based on taking the necessary steps prior to entering into a contract pursuant to Article 6 (1) (b) of the GDPR.


Duration of storage
The data processed for the above-mentioned purposes will be processed for the duration of the business relationship and/or beyond that, up to the expiration of all legal storage periods.
 

8.  Data security

The security of your personal data is very important to us.

 

Taking into account the state of the art in terms of technology, the implementation costs and the nature, scope, circumstances and purposes of the data processing, as well as the likelihood and severity of the risk to the rights and freedoms of natural persons, VAMED implements appropriate technical and organizational measures within the meaning of Article 32 of the GDPR.

 

In this sense, the following measures, inter alia, are taken to protect your data and to protect against loss, destruction, access, modification and distribution by unauthorized persons:

 

  • Ensuring the confidentiality, integrity, availability and resilience of systems and services related to data processing;
  • Ensuring rapid restoration of the availability of personal data in the event of a physical or technical incident;
  • Implementation of procedures for the periodic review, assessment and evaluation of the effectiveness of the technical and organizational measures to ensure the safety of the data processing.

 

Please note that we do not accept any liability for the disclosure of information due to errors that are not attributable or attributable to us in data transmission and/or unauthorized access by third parties.

 

9.  Your rights

You have the following rights as a user of our website:

 

  • Right of access to information (Article 15 of the GDPR): You have the right to obtain confirmation from VAMED as to whether your personal data are being processed. In addition, you have the right to further information about the specific purposes of the processing, the categories of the personal data concerned, the recipients or categories of recipients of the personal data concerned, the storage period, the right to erasure or rectification of your personal data or restriction of processing and the right to object to such processing, the right to lodge a complaint and the right to any available information as to their source.
  • Right to rectification (Article 16 of the GDPR): You have the right to obtain from VAMED the immediate rectification of your personal data. This right includes the rectification of inaccurate data and the completion of incomplete personal data.
  • Right to erasure (Article 17 of the GDPR): You have the right to obtain from VAMED the immediate erasure of your personal data, provided that the reasons stated in Article 17 (1) (a) to (f) of the GDPR (e.g. the purpose for processing no longer applies) and the processing of your personal data is no longer required.
  • Right to restriction of processing (Article 18 of the GDPR): In the cases mentioned in Article 18 of the GDPR (e.g. inaccuracy of the processed personal data, unlawfulness of the processing, etc.), you also have the right to obtain from VAMED the restriction of processing.
  • Right to data portability (Article 20 of the GDPR): You have the right to receive your personal data that you have provided to VAMED in a structured and commonly used format and to have VAMED transmit this data to another controller (e.g. to another law firm).
  • Right to object (Article 21 of the GDPR): You have the right to object at any time to the processing of your personal data on this website.
  • Withdrawal of consent (Article 7 of the GDPR): You have the option of withdrawing any consent given to VAMED at any time.
  • Right to lodge a complaint In addition, you can lodge a complaint at any time with the

    Austrian Data Protection Authority at:
    Österreichische Datenschutzbehörde [Austrian Data Protection Authority)
    Wickenburggasse 8
    1080 Vienna, Austria

    Telephone: +43 1 521 52-25 69
    E‑mail: dsb@dsb.gv.at

    With the exception of the right to lodge a complaint with the Austrian Data Protection Authority, you can assert your rights with VAMED at the following address:
    datenschutz@vitality-world.com