Privacy policy

1. Data controller

The controller responsible for data processing within the meaning of the General Data Protection Regulation (GDPR) is:
Post Now e.U., owner Ali Aktas, BSc
Strubergasse 49, 5020 Salzburg, Austria
Email: info@discover-salzburg.at, Phone: +43 670 3084907

2. Inquiry form

When you use our inquiry form, we collect and process the data you enter: name, email address, phone number and your message (including any details on the tour, date and number of people). This data is transmitted by email to info@discover-salzburg.at in order to process your inquiry and get in touch with you.

The legal basis for this processing is Art. 6(1)(b) GDPR (steps prior to entering into, or performance of, a contract) and Art. 6(1)(f) GDPR (legitimate interest in processing and responding to your inquiry).

2a. Protection of the inquiry form (Google reCAPTCHA Enterprise)

To protect our inquiry form against abuse by automated programs (bots, spam), we use Firebase App Check with Google reCAPTCHA Enterprise, a service of Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland, when the form is submitted. Only at the moment of submission — not when merely visiting the page — a Google script is loaded that evaluates technical signals (e.g. device information, IP address, interaction patterns) and derives a risk score. We do not receive any information that would identify individual persons.

The legal basis is Art. 6(1)(f) GDPR (legitimate interest in preventing spam and abusive use of our form). Further information is available at policies.google.com/privacy.

3. Hosting and technical infrastructure

This website and the server-side processing of the inquiry form (Cloud Function) are operated via Firebase Hosting and Firebase Cloud Functions, a service of Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland (and/or Google LLC, USA) acting as processor. The Cloud Function that receives your form data and forwards it by email runs in the europe-west1 (Belgium) server region.

A data processing agreement under Art. 28 GDPR is in place with Google. Further information on Google's data protection practices is available at policies.google.com/privacy.

4. WhatsApp contact

Our website optionally offers a button to contact us via WhatsApp. If you use this button, your data (e.g. phone number and message content) is transmitted directly to WhatsApp / Meta Platforms Ireland Limited, 4 Grand Canal Square, Dublin 2, Ireland, and processed there according to Meta's privacy policies. We have no influence over this processing. Using the WhatsApp button is voluntary; you can also use our website and inquiry form without WhatsApp.

5. Server log data

When you access this website, our hosting provider automatically records technical connection data (e.g. IP address, date and time of access, page requested, browser type) in server log files. This data is used solely to ensure trouble-free operation and IT security and is not combined with other data sources. The legal basis is Art. 6(1)(f) GDPR (legitimate interest in the secure and stable operation of the website).

6. Web analytics with your consent

Only if you choose "Accept all" in our consent banner do we use the following analytics services to understand how our website is used and to keep improving it. Without your consent no analytics cookies are set and the website works without restriction.

Google Analytics 4 (Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland): records pages visited, time spent, origin (country/region), device type and interactions such as clicks and scrolling. IP addresses are processed in truncated form. Data may be transferred to Google LLC in the USA; Google is certified under the EU-US Data Privacy Framework. Analytics data is retained for a maximum of 14 months.

Microsoft Clarity (Microsoft Ireland Operations Limited, One Microsoft Place, Dublin 18, Ireland): creates pseudonymised session recordings (clicks, scrolling and mouse movement) and heatmaps. Data may be transferred to Microsoft Corporation in the USA; Microsoft is certified under the EU-US Data Privacy Framework.

The legal basis is your consent (Art. 6(1)(a) GDPR, Section 165(3) of the Austrian Telecommunications Act 2021). You can withdraw your consent at any time with effect for the future via the "Cookie settings" link in the footer. Details on the cookies used can be found in our cookie policy.

7. Retention period

Data you submit via the inquiry form is stored only as long as necessary to process your inquiry and to fulfil any contractual or statutory retention obligations (e.g. tax law requirements). Server log data is automatically deleted or anonymised after a short rotating period, unless a statutory retention obligation requires otherwise.

8. Your rights as a data subject

Under the GDPR you have the following rights:

• Right of access (Art. 15 GDPR)
• Right to rectification (Art. 16 GDPR)
• Right to erasure (Art. 17 GDPR)
• Right to restriction of processing (Art. 18 GDPR)
• Right to object to processing (Art. 21 GDPR)
• Right to data portability (Art. 20 GDPR)

To exercise these rights, an informal message to info@discover-salzburg.at is sufficient. You also have the right to lodge a complaint with the Austrian data protection authority:

Österreichische Datenschutzbehörde (Austrian Data Protection Authority)
Barichgasse 40-42, 1030 Vienna, Austria
www.dsb.gv.at

9. Changes to this privacy policy

We reserve the right to update this privacy policy to reflect changes in the legal situation or in our services. The current version can always be found on this page.