Data protection notice

This notice provides you with information on how your personal data are processed when you visit our website (www.acv.at).
It may be necessary to amend this notice due to development of the website or legal changes. The version published at www.acv.at/en/legal-notice/data-protection-notice/ applies.

1. Controller
2. Provision of the website and logfiles
2.1. Scope of data processing
2.2. Purposes
2.3. Legal basis
2.4. Recipient
3. Cookies
3.1. Essential cookies
3.1.1. Purposes
3.1.2. Legal basis
3.1.3. Cookies used
3.2. Marketing cookies
3.2.1. Purposes
3.2.2. Legal basis
3.2.3. Cookies used
3.3. Analytics and statistics cookies (performance cookies)
3.3.1. Purposes
3.3.2. Legal basis
3.3.3. Cookies used
4. Newsletter
4.1. Scope and purposes of data processing
4.2. Legal basis
4.3. Recipient
4.4. Retention period
5. Contact form and e-mail contact
6. Affiliate partners
7. ACV Chatbot
7.1. Scope and purposes of data processing
7.2. Legal basis
7.3. Retention period
8. Storage of lost property
9. Guest and visitor WLAN
10. Car park
11. General information
12. Your rights

1. Controller

Internationales Amtssitz- und Konferenzzentrum Wien, AG (IAKW-AG)
Bruno-Kreisky-Platz 1
A-1220 Vienna
Tel. +43 (1) 26069-0
Fax: +43 (1) 26069 303
E-mail: [email protected]
https://www.acv.at

Name and address of Data Protection Officer
If you have any questions regarding data protection in general, you can contact us using the contact details provided above, or at [email protected]

2. Provision of the website and logfiles

2.1. Scope of data processing

Every time a user visits our website, our system automatically records data and information from the computer on which the website is viewed.
The following data are collected and stored in the logfiles in our system:

The device’s IP address
Date/time of access
Type of device (PC, smartphone, etc.)
User’s operating system
Name of the internet provider
Name of the browser used
Browser software language
Type of request made by the user (name of requested file)
Quantity of data transferred
Access status (file transferred, file not found, etc.)
Contents of form

2.2. Purposes

Temporary storage of the IP address by the system is necessary in order to provide access to the website to the user’s computer. For this purpose, the user’s IP address must be stored for the duration of their visit. Data are stored in logfiles to ensure the proper functioning of the website. The data also enable us to optimise the website and safeguard the security of our IT systems.

2.3. Legal basis

The legal basis for the collection of these data and their temporary storage in logfiles is our legitimate interest in accordance with Article 6(1)(f) General Data Protection Regulation (GDPR). Data processing is based on our legitimate interest in achieving the purposes specified in section 2.2 above.

2.4. Recipient

We use an IT service provider for the provision of our website, namely functn GmbH, Mariahilfer Strasse 1b/Top 6, 1060 Vienna (the processor), as well as Internex GmbH, Lagerstrasse 15, A-3950 Gmünd. The processor processes the collected data in order to resolve technical problems.

3. Cookies

Cookies are small text files saved on your device (PC/laptop, tablet or smartphone). These text files are downloaded by your browser when you first visit our website. If you visit this website again using the same device and browser, the cookie and the information saved in it will either be sent back to the website that created the cookie (first-party cookie) or to a different website which it belongs to (third-party cookie). In this way, the website recognises the returning user and adapts the website content accordingly. Cookies “remember” your preferences, provide information on how you use a page, and in some cases personalise the content displayed.

Our website uses cookies and similar tools (collectively referred to below as “cookies”). These cookies enable us to ensure that the website functions properly (essential cookies), analyse the way in which our website is used (performance cookies) and optimise our marketing activities, in particular by displaying personalised advertisements (marketing cookies). We only use performance and marketing cookies with your consent.

3.1. Essential cookies

3.1.1. Purposes

We use essential cookies to enable basic website functions, ensure the security of our website and temporarily store your cookie settings.
Details of the specific purposes of the various cookies are provided in section 3.1.3.

3.1.2. Legal basis

The legal basis for processing your data using essential cookies is our legitimate interest in providing a fully functional website, safeguarding the security of our website and temporarily storing your cookie settings (in accordance with Article 6[1][f] GDPR).

3.1.3. Cookies used

Our website uses the following essential cookies:

a) __cfduid

Type of data
The user’s IP address

Purposes
The __cfduid cookie is loaded when you visit our website. The cookie is used by service provider Cloudflare to identify trusted internet traffic, manage load balancing and enhance the security of our website. The stored information is anonymised and encrypted.

Retention period
7 days

Recipient
Cloudflare, Inc.
101 Townsend St
San Francisco, CA 94107
USA

Transfer to a third country
Transfer to the USA on the basis of standard contractual clauses.

b) Usercentrics

Types of data
The (personal) data collected by this service or as a result of its use are listed below:

Browser information
Opt-in and opt-out data
Requests for website URLs
Website page path
Geographical location
Date and time of visit
Device information

Purposes
The purposes of data collection and processing are listed below. Your consent only applies with regard to the purposes specified. The collected data may not be used or stored for purposes other than those listed below.

Compliance with statutory obligations
Storing consent

Retention period
The retention period is the length of time for which the collected data are stored for processing. The data are deleted as soon as they are no longer required for the specified purposes of processing.
Consent data (giving and withdrawing consent) are stored for three years. After this period, the data are deleted immediately, or transferred on request in the form of a data export to the person who gave their consent.

Recipient
Usercentrics GmbH
Sendlinger Strasse 7, 80331 Munich, Germany

c) measureUnit

Type of data
Unit of measurement

Purposes
When the unit of measurement is changed from metres to feet, the measureUnit cookie is created to ensure that the unit of measurement you selected is displayed when you view the website in future.

Retention period
1 year

3.2. Marketing cookies

3.2.1. Purposes

If you have given us your consent, we use marketing cookies in order to show you personalised online advertising and for the purpose of remarketing.
Information on how your personal data are processed in this regard is provided below.

3.2.2. Legal basis

The legal basis for processing your data by means of marketing cookies is your consent obtained in accordance with Article 6(1)(a) GDPR.
You can change your cookie settings at any time by clicking on the “Cookie settings” button and adjusting your preferences using the slider – visit Cookie settings/a>.
If you subsequently withdraw your consent for the use of certain cookies, they will no longer be used when you visit our website in future. However, please note that for technical reasons we cannot delete cookies stored previously in your system on the basis of your consent, so these cookies may remain on your device. We recommend that you delete these cookies manually in your web browser settings or using corresponding browser add-ons. You have the option of preventing the storage of cookies and use of the analytics service by selecting the appropriate browser settings.
You can also configure your browser so that cookies are not stored or cookies stored previously are deleted. All commonly used browsers allow you to block the storage of all cookies or those from third parties.

3.2.3. Cookies used

a) LinkedIn insight data

Types of data
When you use LinkedIn, your personal data may be processed by LinkedIn Technologies. The data collected are processed by LinkedIn in encrypted form. According to LinkedIn, the data are anonymised within 90 days or saved in a state that no longer allows conclusions to be drawn about individual persons.

We do not receive any personal data of individual users from LinkedIn. Instead, LinkedIn only provides us with aggregated, statistical analyses (reporting) that do not contain any references to individuals.

We also use the functions offered by LinkedIn for target group-based communication with users (retargeting). In this regard, we also do not receive any personal data of the data subjects concerned. The selection and display of corresponding content are carried out by LinkedIn on the basis of data processed by LinkedIn. We only receive anonymised and aggregated information on the effectiveness of the measures taken.

Purposes
Our website uses functions of the social media network LinkedIn, operated by LinkedIn Ireland Unlimited Company, 70 Sir John Rogerson’s Quay, Dublin 2, D02 R296, Ireland. When you view pages that use such functions, data (IP address, device and browser information, time stamp, referrer URL) are transferred to LinkedIn, stored and analysed. If you have a LinkedIn account and are logged into it, these data will be associated with your account and the data saved there. Details [J1.1]of the types of data that LinkedIn collects and how it processes this information can be found in LinkedIn’s Privacy Policy.
With your consent, we use the LinkedIn Insight Tag, a small piece of JavaScript code which is added to the website to enable the production of detailed campaign reports and gain insights into the website user experience. We use the Insight Tag to track conversions, retarget website users, gain information about advertisements, and reach out to individuals on LinkedIn who are similar to members of the target group.
LinkedIn encrypts and anonymises the data it collects. LinkedIn does not share any personal data with us, and we only receive reports on anonymised data (reporting). Although we use LinkedIn for retargeting activities, we only use anonymised data from LinkedIn.

Retention period
Up to 2 years

Recipient
LinkedIn Ireland Unlimited Company
70 Sir John Rogerson’s Quay
Dublin 2, D02 R296, Ireland

Transfer to a third country
We only use cookies from third parties domiciled in the USA (US providers) if you give us your consent to do so. In this case, your personal data will be transferred to the USA and processed there.

Where personal data are transferred to recipients in the United States of America, this is done on the basis of the adequacy decision of the European Commission for the EU-U.S. Data Privacy Framework, in accordance with Article 45 GDPR.

The recipients are certified under the EU-U.S. Data Privacy Framework, meaning that they are obliged to ensure an adequate level of protection in accordance with European Union regulations. The most recent certification can be viewed on the official website of the Data Privacy Framework Program.

Further details on the processing of personal data by a particular recipient can be found in its privacy policy.

You can withdraw your consent at any time and/or subsequently change your cookie preferences by clicking on the “Cookie settings” button and adjusting your preferences using the slider – visit Cookie settings/a>.
If you subsequently withdraw your consent for the transfer of your data to the USA, these cookies will no longer be saved on your device. However, please note that for technical reasons we cannot delete cookies stored previously in your system on the basis of your consent, so these cookies may remain on your device. We recommend that you delete these cookies manually in your web browser settings or using corresponding browser add-ons.

b) Google remarketing

Types of data
The (personal) data collected by this service or as a result of its use are listed below:

- Click path
- IP address
- Information on cookies
- Browser information
- Device ID
- Internet service provider
- Demographic data
- Date and time of visit

Pages viewed

Providing domains
Hardware/software type
Location details
Search history
Interaction data
Advertisements viewed

Purposes
We use the ‘new interactions’ or ‘similar target groups’ remarketing features to enable us to show you interest-based, personalised advertisements for IAKW-AG (Austria Center Vienna) within the Google Display Network when you use the internet after having visited our website. The provider is Google Inc., 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA (Google). After you give your consent, Google saves cookies on your device in order to analyse your behaviour when using the website. Google pseudonymises the data and does not associate it with other data.

Retention period
1 year

Recipient
Google Inc.
1600 Amphitheatre Parkway, Mountain View
CA 94043
USA
The processor’s data protection officer can be contacted via the Google Privacy Help Center.

Further details on the processing of personal data by a particular recipient can be found in its privacy policy.

c) Facebook Custom Audience pixel (Meta)

Types of data
The personal data collected by this service or as a result of its use are listed below:

Advertisements viewed
Content viewed
Device information (device ID, browser type, operating system)
Geographical location
http header
Interaction with advertisements, services and products
IP address
Elements clicked on
Marketing information
Pages viewed
Pixel ID
Referrer URL
Usage data
User behaviour
Facebook cookie information
Facebook user ID
Usage/click behaviour
Browser information
Operating system
Device ID
User agent
Browser type

Purposes
In connection with the technologies described below, we use the Facebook pixel provided by Meta Platforms Ireland Ltd., 4 Grand Canal Square, Dublin 2, Ireland (“Facebook (by Meta)” or “Meta Platforms Ireland“). The Facebook pixel is used to automatically collect and store data (IP address, time of visit, device and browser information, and information regarding your use of the website based on events specified by us, e.g. visit to a particular page or registration for a newsletter), which are then used to create pseudonymised usage profiles. In addition, information is collected and stored in hashed form for comparative purposes, as part of what is called extended data reconciliation. This information can be used to identify specific individuals (e.g. name, e-mail addresses and telephone numbers). When you visit our website, the Facebook pixel places a cookie which automatically recognises your browser when you visit another website by means of a pseudonymised cookie ID. Facebook (by Meta) merges this information with other data from your Facebook account and uses the information to generate reports about website activity and to enable provision of other services associated with use of the website, in particular personalised and group-based advertising.

Facebook analysis
With Meta Business Tools, the data collected by the Facebook pixel regarding your use of our website are used to generate statistics about visitor activity on our site. Data processing is carried out by Facebook (by Meta) on the basis of a processing agreement. Facebook (by Meta)’s analysis supports the optimal presentation and marketing of our website.

Facebook Ads Manager
We use Facebook Ads to advertise our website on Facebook (by Meta) and other platforms. We set the parameters for each advertising campaign. Facebook (by Meta) is responsible for the detailed implementation, in particular decisions on the placement of advertisements for individual users. Unless otherwise specified for the various different technologies, data are processed on the basis of an agreement between joint controllers in accordance with Article 26 GDPR. Joint controllership only applies to the collection of data and their transfer to Meta Platforms Ireland. It does not apply to data processing by Meta Platforms Ireland.
We carry out group-based advertising on Facebook (by Meta) using Facebook Custom Audience by determining the characteristics of the various target groups based on statistics generated by the Facebook pixel regarding visitor activity on our website https://www.acv.at/. Facebook (by Meta) operates as our processor when performing extended data reconciliation (see above) in order to determine the various target groups.
We carry out personalised advertising by means of Facebook pixel remarketing using the pseudonymised cookie ID placed by the Facebook pixel, as well as the data collected with regard to your user behaviour on our website.
If you reach our website via a Facebook Ads advertisement, we use the Facebook pixel to measure conversions for the purpose of website analysis and to track events in your subsequent user behaviour. Data processing is carried out by Facebook (by Meta) on the basis of a processing agreement.

Retention period
Information on the respective retention periods for the cookies used can be found in
Meta’s Cookies Policy
and Meta’s Privacy Policy Datenschutzrichtlinie.

Recipient
The recipients of the data collected are:
Meta Platforms Ireland Ltd., Meta Platforms Inc.

The information collected automatically by Facebook (by Meta) about your use of our website is generally transmitted to a server of Meta Platforms, Inc., 1 Hacker Way, Menlo Park, California 94025, USA and stored there. See Meta’s Privacy Policy for more details.

Click here to read Meta’s Cookies Policy.

Further details on the processing of personal data by a particular recipient can be found in its privacy policy.

d) YouTube

Types of data
The (personal) data collected by this service or as a result of its use are listed below:

Device information
IP address
Referrer URL
Videos viewed

Purposes
Our website uses services provided by YouTube, a video sharing platform, in order to display videos on our website.
Processor:
Google Ireland Limited
Google Building, Gordon House, 4 Barrow St, Dublin, D04 E5W5, Ireland

Retention period
Information on the respective retention periods for YouTube cookies used can be found here.

PREF
This cookie stores your preferences and other information, in particular the preferred language, the number of search results to be displayed on a page, and whether you would like to activate the Google SafeSearch filter.
Type: cookie
Retention period: 2 years

VISITOR_INFO1_LIVE
This cookie measures the bandwidth of your internet connection, in order to determine whether the new or old player interface will be displayed.
Type: cookie
Retention period: 6 months

use_hitbox
This cookie increases the number of views on the counter of the YouTube video.
Type: cookie
Retention period: session

YSC
This cookie is set on pages with embedded YouTube videos.
Type: cookie
Retention period: session

Recipients
The recipients of the data collected are:

Alphabet Inc.
Google LLC
Google Ireland Limited

Click here to view YouTube’s Privacy Policy.

YouTube’s cookies policy can be found here.

You can withdraw your consent to processing on all YouTube domains here.

Further details on the processing of personal data by a particular recipient can be found in its privacy policy.

3.3. Analytics and statistics cookies (performance cookies)

3.3.1. Purposes

If you give us your consent, we use analytics and statistics cookies in order to analyse use of the website, generate usage statistics and, in turn, improve our website (performance cookies).

3.3.2. Legal basis

The legal basis for processing your data by means of analytics and statistics cookies is your consent obtained in accordance with Article 6(1)(a) GDPR.
You can change your cookie settings at any time by clicking on the “Cookie settings” button and adjusting your preferences using the slider – visit Cookie settings/a>.
If you subsequently withdraw your consent for the use of certain cookies, they will no longer be used when you visit our website in future. However, please note that for technical reasons we cannot delete cookies stored previously in your system on the basis of your consent, so these cookies may remain on your device. We recommend that you delete these cookies manually in your web browser settings or using corresponding browser add-ons.
You can also configure your browser so that cookies are not stored or cookies stored previously are deleted. All commonly used browsers allow you to block the storage of all cookies or those from third parties.

Our website uses the Google Signals web analytics service from Google LLC, 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA, to obtain reports on cross-device user numbers, as well as on different user groups based on different device combinations (“cross-device tracking”). In the process, user data are collected if the user has activated the ‘personalised advertising’ option in their Google account settings. A defined threshold for the reporting data ensures that, in principle, no conclusions can be drawn about the identity of an individual user.

Further information on Google’s Privacy Policy and terms of use is available here.

To prevent the use of Google Signals, deactivate the personalised ads option in your Google account.

3.3.3. Cookies used

a) Google Analytics 4

Types of data
The (personal) data collected by this service or as a result of its use are listed below:

Account data
Gender
Age
Interests
Anonymised IP address
Bounce rates
Browser information
Click path
Date and time of visit
Device information
Downloads
Duration of visit
Location details
Internet service provider
Mouse movements
Screen resolution
Behaviour data
Referrer URL
App updates

Purposes
This service enables us to analyse and constantly improve the use of our website.
Processor: Google Ireland Limited, Google Building, Gordon House, 4 Barrow St, Dublin, D04 E5W5, Ireland

Privacy Inquiry form

Retention period
Information on the cookies used and their respective retention periods is provided below.
This service stores information on the user’s device in various ways, as described below.

Google
Used to distinguish between visitors.
Type: cookie
Retention period: 2 years

Google
Used to distinguish between visitors.
Type: cookie
Retention period: 1 day

Google
Used to maintain the session status.
Type: cookie
Retention period: 2 years

Google
Contains campaign-related information. If you have linked your Google Analytics and Google Ads accounts, the Google Ads website conversion tags read this cookie, provided you do not log out.
Type: cookie
Retention period: 2 months, 29 days

Recipients
The recipients of the data collected are:
Alphabet Inc., Google LLC, Google Ireland Limited

Click here to read Google’s Privacy Policy.

Google’s cookies policy can be found here.

You can withdraw your consent to processing on all Google domains here.

Transfer to a third country
Where personal data are transferred to recipients in the United States of America, this is done on the basis of the adequacy decision of the European Commission for the EU-U.S. Data Privacy Framework, in accordance with Article 45 GDPR.

Further details on the processing of personal data by a particular recipient can be found in its privacy policy.
If you subsequently withdraw your consent for the transfer of your data to the USA, these cookies will no longer be saved on your device. However, please note that for technical reasons we cannot delete cookies stored previously in your system on the basis of your consent, so these cookies may remain on your device. We recommend that you delete these cookies manually in your web browser settings or using corresponding browser add-ons.

b) Google Tag Manager

Our website uses Google Tag Manager, a service provided by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland.

Scope of processing
Google Tag Manager is used solely for the centralised management and integration of website tags. The service itself does not place any cookies and, according to Google, does not process any personal data. It only enables other tags to run, which themselves may process personal data. Information on the processing of personal data by a particular integrated service can be found in the corresponding section of this data protection notice.

Purpose of processing
Google Tag Manager enables the efficient technical management and control of the services used on our website, as well as simplified implementation of tracking, analytics and marketing technologies.

Retention period
Google Tag Manager does not store any personal data. In cases where services integrated via Google Tag Manager process personal data, the type and duration of storage is in accordance with the privacy policies of the services concerned.

Legal basis
The use of Google Tag Manager is based on our legitimate interest in ensuring the efficient technical management and control of the services used on our website, in accordance with Article 6(1)(f) GDPR. Where services that require consent for their use are integrated via Google Tag Manager, activation of these services takes place exclusively on the basis of your consent in accordance with Article 6(1)(a) GDPR.

Data transmission
Google Tag Manager does not process any personal data. In cases where integrated Google services transmit personal data to Google LLC, USA, via Google Tag Manager, data transmission is based on the adequacy decision of the European Commission in accordance with Article 45 GDPR, under the EU-U.S. Data Privacy Framework, as Google is certified accordingly.

Additional information
Visit https://support.google.com/tagmanager for further details.
Information on how Google processes personal data is available at https://policies.google.com/privacy.

c) Google consent mode

Our website uses Google consent mode, a service provided by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland.

Scope of processing
Google consent mode enables measurement of the use of our website in accordance with data protection regulations, on the basis of your consent. Only anonymised and aggregated information is processed for statistical purposes, as well as for data modelling.

In particular, the following information may be processed:

Time stamp
User agent
Referrer URL
Information on whether the current page or a previous page contains indications of ad clicks in the URL
Information on the consent status
Randomly generated page identifier

The IP address is not saved or analysed. It is used exclusively for technical data transmission within the European Union.

Purpose of processing
Processing takes place in order to carry out statistical analysis of the use of our website, as well as modelling of conversions on the basis of aggregated data. This enables visitor flows to be analysed, without allowing conclusions to be drawn about individual user behaviour. In addition, Google consent mode supports the analysis of consent and rejection rates (opt-in and opt-out).

Retention period
Information processed in Google consent mode is only processed to the extent necessary for the purposes described above. Google consent mode itself does not store any personal data.

Legal basis
Data processing takes place on the basis of your consent in accordance with Article 6(1)(a) GDPR, provided that consent is necessary for the type of processing in question. Consent is obtained through our consent management system. You can withdraw your consent at any time, with effect from the time of withdrawal.

Data transmission
Personal data may be transmitted to Google LLC, USA. Data are transferred on the basis of the adequacy decision of the European Commission in accordance with Article 45 GDPR, under the EU-U.S. Data Privacy Framework, as Google is certified accordingly.

Additional information
For further information on Google consent mode, visit https://support.google.com/google-ads/answer/10000067.
Information on how Google processes personal data is available at https://policies.google.com/privacy.

d) Microsoft Clarity

Our website uses the Microsoft Clarity analytics tool, provided by Microsoft Ireland Operations Ltd., One Microsoft Place, South County Business Park, Leopardstown, Dublin 18, Ireland.

Scope of processing
Microsoft Clarity enables us to analyse the behaviour of website users by means of session recordings and heatmaps. The data processed include:

IP address (truncated/anonymised)
Times when the website is accessed
Mouse movements, scrolling behaviour
Interaction with the website (e.g. clicks)

Purpose of processing
Data are processed in order to optimise the user-friendliness of our website, and to carry out the statistical analysis of user behaviour.

Retention period
Data collected by Microsoft Clarity (e.g. mouse movements, scrolling behaviour, interactions) are used to analyse user behaviour. Session recordings are stored for 30 days, and favoured sessions and heatmaps for up to 13 months. Microsoft automatically deletes the data after these retention periods expire.

Legal basis
Data processing takes place solely on the basis of your consent in accordance with Article 6(1)(a) GDPR. We obtain this consent via our cookie banner. You can withdraw your consent at any time.

Data transmission
Personal data may be transmitted to the parent company, Microsoft Corporation, USA. Data are transferred on the basis of the adequacy decision of the European Commission in accordance with Article 45 GDPR, under the EU-U.S. Data Privacy Framework, as Microsoft is certified accordingly.
You can find further information in Microsoft’s Privacy Statement at https://privacy.microsoft.com/en-us/privacystatement.

4. Newsletter

4.1. Scope and purposes of data processing

When you register for our newsletter, we process your personal data for the purpose of sending you the newsletter. For this purpose, we require the e-mail address that the newsletter will be sent to, your preferred form of address, and your first and last name. You also have the option of receiving the newsletter in a particular language. For this purpose, we use a service provider (processor), namely Microsoft Corporation, One Microsoft Way, Redmond, WA 98052-6399, USA. You can choose which newsletter(s) you would like to subscribe to. You can select one or more of the following options:

The Austria Center Vienna newsletter – a monthly look at all the latest news on the venue and our innovative services and offerings.
Local residents newsletter – do you live close to the conference centre? We aim to give you all the latest details about upcoming major events or building work.

When you subscribe to our newsletter using the online form, we record the following data (mandatory fields are marked ‘*’):

Title
First name*
Last name*
E-mail*
Language*

In the course of distributing the newsletter, we collect statistical data with a view to optimising our newsletter service. Newsletter tracking enables us to analyse the use of our newsletters. For instance, we can see whether a newsletter e-mail has been opened and which links have been clicked on. This allows us to analyse and improve our newsletter campaigns.
We also use newsletter tracking to monitor which links in a newsletter e-mail have been clicked on, so that we can optimise distribution of the newsletter and align the content of future newsletters more closely with your interests.
These data are not transferred to third parties. Data subjects can withdraw their declaration of consent provided separately through the double opt-in procedure at any time by unsubscribing from the newsletter. After you have withdrawn your consent, no further data will be collected and you will no longer receive the newsletter. It is possible to subscribe to our newsletter again.
We use the double opt-in procedure for newsletter subscriptions. After registering for the newsletter, we will send you an e-mail. We will only send you the newsletter if you confirm your e-mail address using the link included in the e-mail within 30 days. This ensures that only you are able to subscribe for the newsletter using your e-mail address. You must confirm your address promptly after receiving the e-mail, otherwise your registration and e-mail address will be deleted from our database.
You can unsubscribe from the newsletter at any time, either using the link at the end of every newsletter or by contacting us using the contact details contained in section 1 Controller, above.

4.2. Legal basis

The legal basis for processing your personal data related to distribution of our newsletter, including newsletter tracking, is your consent obtained in accordance with Article 6(1)(a) GDPR.

4.3. Recipient

Data recorded when you subscribe to our newsletter will not be transferred to external service providers or third parties.

4.4. Retention period

We store your contact details until you unsubscribe from the newsletter. When you do so, your decision is automatically recorded. This ensures that you no longer receive the newsletter from the time you unsubscribe.

5. Contact form and e-mail contact

5.1. Scope and purposes of data processing

Our website contains contact forms that can be used to contact us electronically. If you use such a form, the data you enter will be transmitted to us and stored. When you contact us using the contact form, the following data may be collected; please note that fields marked with an asterisk (*) must be completed.

Reason for contacting us*
First name*
Last name*
Company*
Position
Telephone number
E-mail*
Country
Website

You provide these details voluntarily and on your own initiative. If the data you provide are for the purpose of contacting us, we will use these channels in order to contact you and address the matter you have raised. When you submit the form, you will be asked to give your consent to processing of your data and referred to this data protection notice. Alternatively, you can write to us using the e-mail address provided on our website. In this case, the personal data provided in the e-mail will be stored. The data will only be used to handle your query or deal with the matter you have contacted us about. If you contact us in this way, your personal data will not be transferred to third parties without your prior consent.

5.2. Legal basis

The legal basis for processing the data is your consent obtained in accordance with Article 6(1)(a) GDPR.
The legal basis for processing data provided in the course of sending an e-mail is Article 6(1)(f) GDPR.
If an e-mail is sent with a view to entering into a contract, the legal basis for data processing is Article 6(1)(b) GDPR.

5.3. Retention period

If circumstances indicate that the matter in question has been resolved and the purpose of data processing has been achieved, your data will be deleted, provided that deletion is not in breach of any other statutory retention period.

6. Affiliate partners

Our website includes links to the websites of other providers, including partners under our affiliate programmes (e.g. Vienna City Card). If you click on one of these links, you will be directed to the external website concerned. You can see this, for instance, from the change in the URL in your browser.

Please note that the data protection policies of the respective provider apply from the time you access the external website. We have no influence over data processing by these third-party providers, meaning that we cannot assume any responsibility for the handling of your personal data on the third-party websites.

We recommend that you read the respective provider’s data protection notice carefully – this will explain the type, scope and purposes of data processing on that site.

7. ACV chatbot

7.1. Scope and purposes of data processing

Your personal data are processed for the purpose of supporting our customers with event planning and preparing offers. The personal data you provide (e.g. name, address, telephone number, e-mail address, contact details, and details of the enquiry) as well as a chat ID are processed. Please note that the chatbot function is also available without providing personal data. No automated decision-making takes place, and all enquiries are forwarded to [email protected] for further processing. Chat data are not transferred to third countries.

7.2. Legal basis

The legal basis for processing is Article 6(1)(b) GDPR (performance of a contract or steps taken prior to entering into a contract).

7.3. Retention period

Chat data (i.e. generated enquiries) will be stored for two months.

8. Storage of lost property

Why and how your data are processed
If an item of lost property that allows us to identify you (e.g. an official ID) is handed in to us at the Austria Center Vienna, we will process your personal data.
Processing is carried out for administrative purposes and in connection with the storage and return of the lost property. We will process data that can be obtained from the lost property, and which are necessary for the return of the lost property to the owner, or for the transfer of the item to the City of Vienna’s lost property office.
Legal basis: safeguarding your and our legitimate interests regarding our ability to return lost property to you on site (Article 6[1][f] GDPR). The transfer of lost property to the City of Vienna’s lost property office is necessary for compliance with a legal obligation (Article 6[1][c] GDPR in conjunction with sections 390 and 391 Allgemeines Bürgerliches Gesetzbuch [Austrian Civil Code]).

How we store your data
Lost property is transferred to the City of Vienna’s lost property office once a week. As a result, your personal data will be stored for up to one week and then immediately deleted.

Who receives your data
ACV staff responsible for handling lost property internally. If the lost property is not collected from us: the City of Vienna’s lost property office.

9. Guest and visitor WLAN

Why and how your data are processed
When a mobile device (smartphone, tablet, laptop, etc.) is connected to the WiFi network provided by IAKW-AG for visitors and guests, the following data relating to this device are processed:

The device’s MAC address
Operating system/manufacturer
Connection quality/strength/bandwidth
Movement data (when the mobile device moves within the IAKW-AG site)
Host name (name of the mobile device)
IP address (this is assigned to the device for the use of the WLAN)
WLAN SSID (the WLAN that the device is connected to)
Access point name and MAC address (access point the device is connected to)
Session traffic (amount of data generated by the device during a session – bytes transmitted and received).

Processing is carried out for the purpose of providing the WLAN as a voluntary service offered by IAKW-AG for guests and visitors. In doing so, the MAC address of the mobile device is required to establish the connection to the WLAN. Data relating to the operating system and the manufacturer of the mobile device, and data on the connection quality/strength/bandwidth are processed in order to optimise the quality and coverage of the WLAN. Movement data are processed for the purpose of optimising the general IAKW-AG infrastructure, e.g. to better direct visitor flows in the future. The analysis of the movement data is not automated, but only performed as required. Only anonymised data are processed, exclusively for statistical purposes.

Legal basis
Use of the WLAN is based on your consent in accordance with Article 6(1)(a) GDPR. Additional data is processed to protect our legitimate interest in optimising our services (WLAN coverage, WLAN quality, optimisation of visitor flows; see Article 6 [1][f] GDPR).

How we store your data
Depending on the number of devices connected to the WLAN and the resulting data volume, data are stored for between 7 and 30 days.

Who receives your data
We use a service provider (processor), namely H82 medientechnik GmbH, Tech Gate Vienna, Donau-City-Strasse 1, 1220 Vienna, Austria (H82) in order to provide the WLAN. H82 processes the data specified above for the purpose of providing the WLAN. However, H82 does not use the data for its own purposes, nor does it transfer such personal data to third parties. Anonymised statistical analyses are made available internally to authorised staff at IAKW-AG as required.

10. Car park

The protection of your personal data is very important to us. We only process your data in accordance with the relevant statutory regulations (GDPR, Austrian Datenschutzgesetz [Data Protection Act] and Austrian Telekommunikationsgesetz [Telecommunications Act] 2021). This notice provides you with information on the most important aspects of data processing in connection with our business relationship.[FCK2.1]

10.1. Purposes of data processing

We process the personal data specified under point 2 below for the following purposes:

Implementation and performance of contracts with short-stay and long-stay parking customers

The required data are either provided by you, or the vehicle registration number is captured by an automatic number-plate recognition system upon entry to the car park and is stored for the period specified in point 4 below. Processing is explicitly not for the purpose of surveillance or of establishing the identity of a registered vehicle owner.

10.2. Categories of data processed and legal basis for processing

We process your personal data solely in order to take steps prior to entering into a contract or in order to perform a contract, in accordance with Article 6(1)(b) GDPR.

This relates to the following categories of data:

Long-stay parking customers: name, telephone number, e-mail address, vehicle registration number, duration of the contractual relationship, company (in the case of long-stay parking customers[J3.1])
Short-stay parking customers: vehicle registration number

10.3. Transfer of your personal data

Your personal data will not be shared, unless this is essential for performance of the contract (technical service provider for barriers), for contract performance and billing purposes (payment services provider), or if you have given your consent for us to do so. Where necessary, your data may be transferred to law enforcement agencies.

10.4. Retention period

We will only store your personal data for as long as is necessary to perform the contract, or for tax reasons, or for as long as is permitted.

Short-stay and long-stay parking customers:
vehicle registration numbers will only be processed for the purpose of recording the duration of parking, preventing improper use, assessing utilisation of capacity and documenting accidents in the parking decks. Vehicle registration numbers will only be saved in unencrypted form for 24 hours after entry to the car park and then encrypted.
Automatic barrier system:
when you use our car park, your vehicle registration number will be stored for the purpose of using the automatic barrier system for the duration of the contract.

11. General information

Unless otherwise stated in this data protection notice, we (or our processors) obtain your personal data directly from you and not from third parties.
We appreciate how important your data are and therefore we do not transfer them to third countries or international organisations. However, if some processing involves transferring your data to a third country, we will explicitly notify you of this in this data protection notice and inform you of the measures taken in order to ensure that your data are adequately protected.
You are not under any obligation to provide us with your personal data. In case of a statutory or contractual obligation to disclose your personal data, or if disclosure is required in order to conclude a contract with us, this is expressly stated in this data protection notice. In this case, we will also inform you of the potential consequences of not disclosing your data.
We do not use any form of automated decision-making including profiling within the meaning of Article 13(2)(f) and Article 14(2)(g) GDPR.
Your personal data will only be processed for the purpose for which they were collected. However, if processing of certain types of data involves processing for other purposes, we will inform you in this data protection notice.

12. Your rights

As a data subject, you have the following rights with regard to processing of your personal data:

Right to withdraw consent
If we process your data on the basis of your consent, you have the right to withdraw your consent at any time. The data will no longer be processed when we receive notification of withdrawal of your consent. Withdrawing your consent does not affect the lawfulness of processing of your data carried out prior to withdrawal.

Right of access
You can demand information on the origins and categories of the data we process in connection with you and your transactions, the retention period, the recipients to which we disclose/have disclosed your personal data, as well as the purpose and form of such processing. Please note that under section 4(6) Austrian Data Protection Act 2018, no information can be provided if this endangers business or trade secrets.

Right to rectification and erasure
If we process personal data that are inaccurate or incomplete, you can demand rectification or completion of the data. You can also demand that unlawfully processed data be deleted. Please note that this only applies to inaccurate, incomplete and unlawfully processed data. These rights are mutually complementary, meaning that you can only demand either the rectification or completion, or the erasure of your data.

Right to restriction of processing
If it is unclear whether your processed personal data are inaccurate or incomplete, or have been unlawfully processed, you can demand that processing of your data be restricted until the matter is finally clarified.

Right to object
If your personal data are accurate and complete and are being lawfully processed by us, you can submit a reasoned objection to processing of the data in certain cases. You can also submit an objection if you receive direct advertising from us and no longer wish to receive it in future.

Right to data portability
If we process personal data that you have provided, under certain circumstances you have the right to demand that these data are transferred to you in a machine-readable format. You can also request that we transfer these data directly to a third party selected by you, provided this is technically feasible.

Right to lodge a complaint with a supervisory authority
Although we make every effort to ensure the protection and integrity of your data, differences of opinion may still arise regarding the ways in which we use your data. If you believe that we are using your data in a prohibited manner, you can contact us directly, but you are also entitled to lodge a complaint with the Austrian Data Protection Authority, Barichgasse 40-42, 1030 Vienna, tel. +43 (0)1 52152-0, e-mail: [email protected].

If you have any questions regarding data protection in general or the exercise of your rights, you can contact us using the contact details provided in section 1 Controller, above. If there are reasonable doubts regarding your identity, please send us a copy of an official photo ID so we can ensure that personal data are not being disclosed to an unauthorised third party.

Last updated: October 2026

Data protection notice