Data protection notice

for the competition „One ticket. Two holidays“

in accordance with Art. 13 and 14 of the General Data Protection Regulation (GDPR)

1. responsible person

Joint controllers within the meaning of Art. 26 GDPR are the tourism regions named in § 1 of the conditions of participation (Saalfelden Leogang Touristik GmbH, Zell am See-Kaprun Tourismus GmbH, Wagrain-Kleinarl Tourismus, Tourismusverband Seefeld, Tourismusverband Wildschönau and Tourismusverband Ausseerland Salzkammergut). The central point of contact for exercising the rights of data subjects is

Saalfelden Leogang Touristik GmbH
Mittergasse 21a
A-5760 Saalfelden
T +43 6582 70660
E-Mail: datenschutz@saalfelden-leogang.at

2. what data is processed?

The following personal data will be processed as part of your participation in the competition:

• First name and surname
• E-mail address
• Any address in your home municipality or postcode of your home municipality
• Name of the booked accommodation
• Date of arrival
• Means of transport used
• Uploaded files: Photo/scan of accommodation invoice, photo/scan/PDF of public transport ticket
• Technical data: Date of submission
• In the event of a win and only with the corresponding separate consent: First name/surname or first name for naming, text or experience contributions as well as photo/image material in the context of reporting on the prize.

3. purpose of the processing

The data mentioned under 2. will be processed by us for the purpose of conducting and handling the competition, including checking eligibility to participate, the prize draw, contacting winners and organising the prize.

If you as the winner give your separate consent, we will also process your data for the purpose of public relations work for the mobility campaign, namely editorial reporting on your winning holiday (blog, press, social media).

4. legal basis

The competition is to be qualified as a unilateral legal transaction in the sense of an offer. If you do not provide us with your data, we regret that we will not be able to allow you to take part in the competition.

The processing of the aforementioned technical data is based on our legitimate interest pursuant to Art. 6 para. 1 lit. f GDPR in secure platform operation and the prevention of misuse.

Insofar as it is necessary to store your personal data beyond the processing of the prize for tax reasons, this is based on Art. 6 para. 1 lit. c GDPR.

Reporting on your winning holiday and any publication of photos will be based exclusively on your consent in accordance with Art. 6 para. 1 lit. a GDPR. The granting of this consent is voluntary and is not a prerequisite for participation or receipt of the prize. You can withdraw your consent at any time with effect for the future. This does not affect the lawfulness of the processing carried out prior to the revocation.

5. recipient of the data

The following recipients or categories of recipients receive access to your personal data:

• Vionmo GmbH: As a technical service provider and processor pursuant to Art. 28 GDPR. It operates the submission platform and stores and processes the data on behalf of the controller. To provide the service, vionmo uses AWS Rekognition for the automated preliminary check of the uploaded documents (image classification). Processing in the context of image classification takes place within the European Economic Area. A transfer of your data to third countries outside the European Economic Area is not intended in the context of this competition. Should such a transfer become necessary in individual cases, it will only take place on the basis of suitable guarantees in accordance with Chapter V GDPR.
• Participating destinations: They only receive the data of the submissions that relate to their destination. Data will not be passed on to other destinations.
• In the case of published reporting (only with your consent): Operator of the social media platforms used in each case.

Your data will not be transferred to third countries outside the European Economic Area as part of the competition process. If you, as the winner, consent to publication on social media, data may be transferred to third countries (in particular the USA), depending on the platform selected. In this case, the transfer takes place on the basis of your express consent (Art. 49 para. 1 lit. a GDPR) or the guarantees provided by the respective platform operator (Art. 46 GDPR). Otherwise, any transfer will be carried out exclusively on the basis of suitable guarantees in accordance with Chapter V GDPR.

6. storage period

Your personal data is stored as follows:

• During the competition: For the duration of the participation period and the subsequent prize processing.
• After prize realisation: Your data will be deleted no later than 6 months after the last prize has been redeemed (probably in September 2027).
• Uploaded files: These are deleted at the same time as the personal data.
• Tax retention obligations: Insofar as tax-relevant data is generated (e.g. profit notification), the statutory retention periods apply (7 years in accordance with § 132 BAO).
• Content published as part of the reporting (text/photo): This will remain published for the duration of the mobility campaign or until you revoke your consent. After cancellation, the content available to us will be removed.

7. further processing of the data

Your data may be further processed to the extent necessary for accounting and controlling purposes and to fulfil tax obligations. Automated statistical analysis of the participation data to measure the impact of the mobility campaign is carried out exclusively in a form that does not allow any conclusions to be drawn about your person.

8. automated decision-making

Your personal data will not be processed for automated decision-making within the meaning of Art. 22 GDPR, nor do we carry out so-called „profiling“. The image classification of the uploaded documents is used exclusively for technical pre-filtering; the final evaluation is carried out manually.

9. your rights

You have the right to:

• Information (about the personal data stored about you, Art. 15 GDPR)
• Rectification (of incorrect data, Art. 16 GDPR)
• Erasure (of your data, Art. 17 GDPR)
• Restriction of processing (Art. 18 GDPR)
• Data portability (Art. 20 GDPR)
• Objection to the processing (Art. 21 GDPR)
• Revocation of consent at any time with effect for the future. The revocation does not affect the legality of the processing carried out up to that point.

To exercise your rights, please contact: datenschutz@saalfelden-leogang.at

If you believe that the processing of your data violates your right to confidentiality or that your data protection rights have been violated in any other way, you can lodge a complaint with the competent supervisory authority. In Austria, the competent authority is the Austrian Data Protection Authority, Barichgasse 40-42, 1030 Vienna.

This does not affect the possibility of bringing an action before the regional court in accordance with Section 29 (2) DSG and any other legal remedies, in particular the assertion of claims for damages in the event of unlawful processing.