1. General

The protection of your personal data is of particular importance to us. We therefore process your data exclusively in a lawful manner in accordance with statutory provisions (in particular the GDPR, the Data Protection Act 2018 and the Telecommunications Act 2021). In this privacy notice, we inform you about the most important aspects of data processing – the nature, scope and purposes of the collection and use of personal data – which you provide to us as part of your membership.

1.1. Data controller

The data controller (within the meaning of Article 4(7) of the GDPR) responsible for the processing of your personal data (personal data within the meaning of Article 4(1) of the GDPR) is:

Quellenviertel Tourist Board
Promenade 2
A-4701 Bad Schallerbach
Tel. +43 (0)7249/420710
Email: info@quellenviertel.at

Data Protection Officer:
We take the protection of personal data seriously and, as a public body subject to these obligations, have appointed an external Data Protection Officer. Our Data Protection Officer is MMag. Martin Zeppezauer, Thurnbichlweg 54, A-6353 Going am Wilden Kaiser (www.zepedes.com). You can contact our Data Protection Officer at the email address martin@zepedes.com .

1.2. Purposes, categories of data and legal bases for the processing of personal data

Purposes of processing

The purposes for which we process your personal data generally stem from our role as a tourism board: the development and marketing of tourism offerings in our region.

• Presenting your services on our website and all other systems operated by us (e.g. FREEDA Quellenviertel)
• Enabling bookings for your services on our website, including the transfer (where agreed) of your data to external booking platforms
• Forwarding your contact details in response to enquiries from customers/guests
• Presenting your services in our printed materials to promote our region
• Processing your data in connection with the mandatory registration of your guests (guest registration scheme) on behalf of the registration authority responsible for you (the mayor of your locality)
• Processing of your data in connection with our accounts (e.g. settlement of local tourist tax, booking commissions, etc.)
• Processing of your data for various services such as support with data maintenance, staff training, digital coaching, etc.

General data categories

• Personal details of owners and contact persons (e.g. name and address)
• Contact details (e.g. email address, telephone number, fax number)
• Communication data (time and content of communication)
• Detailed data on your range of tourism services
• Turnover data relating to bookings made at your establishment via our website and affiliated booking portals, as well as the number of registered guests
• Information about your guests for bookings made via our website
• Payment details (e.g. account number, ATU number)
• Contract data (contents of contracts of any kind, e.g. online booking facilities)

Special categories of data (‘sensitive data’) in accordance with Article 9 of the GDPR

• We do not process any sensitive data relating to our members

Legal bases for processing

The legal basis for the processing of your personal data as a member of our tourism association is, in principle, in accordance with Article 6(1)(e) of the GDPR, our public-interest mandate to develop and market tourism offerings in our region in accordance with the Upper Austrian Tourism Act. In this context, you are obliged to provide the data. Our tasks in the public interest also include informing our members about our activities (marketing campaigns, events for members, etc.) (e.g. via email newsletters to member businesses).

The legal basis for the processing of your personal data may also be, in accordance with Article 6(1)(b) of the GDPR, the performance of a contract with you or a request made by you to us (e.g. participation in our booking platform, guest card, etc.).

Where the processing of personal data is necessary for us to comply with a legal obligation (accounting obligations, bookkeeping obligations, the Digital Platforms Reporting Act (DPMG) or other statutory documentation obligations), Article 6(1)(c) of the GDPR serves as the legal basis.

Where we have no other legal basis for processing your personal data, as explained above, we will ask for your consent to the data processing, in which case we will rely on Article 6(1)(a) of the GDPR as the legal basis. We would do this, for example, if we were to use your business as a case study in presentations. You may withdraw this consent at any time, free of charge, without this affecting the lawfulness of the processing carried out on the basis of your consent prior to its withdrawal.

1.3. Disclosure of data to data processors and third parties

We process your personal data with the assistance of data processors who support us in providing our services. These data processors are bound by a corresponding agreement within the meaning of Article 28 of the GDPR to strictly protect your personal data and may not process your personal data for any purpose other than the provision of our services. Examples of this include the booking software used to display your bookable services on our website or to charge the local tax and booking commission, as well as a newsletter service for sending information to our member businesses.

Our main data processors responsible for processing your personal data in connection with your membership with us are:

• TTG Tourismus Technologie GmbH (Freistädter Str. 119, A-4040 Linz); Tourdata database, general database server, general email communication, TTG newsletter tool, website)
• feratel Media Technologies AG (Maria-Theresien-Straße 8, A-6020 Innsbruck); (online booking system – Feratel Deskline database and Feratel guest registration system)
• GEMDAT Upper Austria GmbH & Co KG (Schiffmannstraße 4, A-4020 Linz); k5 guest registration system
• INCERT eTourismus GmbH & Co KG (Leonfeldner Strasse 328, A-4040 Linz); INCERT voucher system

Your personal data may be disclosed to service providers typical for the industry, such as banks, tax advisers or auditors, other than our data processors. Personal data is only transferred to state institutions and authorities where required by mandatory national legislation.

We may also pass on your personal data to other member businesses of our tourism association (e.g. for collaborations with other member businesses), provided we are satisfied that this is beneficial to the promotion of your business and thus forms part of our remit to promote tourism offerings in the region. Your data will not be passed on to external commercial enterprises (non-members) that wish to use it to market their own products (e.g. media companies for the purpose of sending promotional offers).

1.4. Transfers to third countries

In principle, we process your personal data within the EU. Where we process data in a third country (i.e. outside the European Union (EU) or the European Economic Area (EEA)), or where this occurs in connection with the use of services provided by our data processors or third parties, this will only take place if the conditions set out in Articles 44 et seq. of the GDPR for transfers to third countries are met: that is, on the basis of specific safeguards, such as an officially recognised determination that a level of data protection equivalent to that of the EU exists, or in accordance with officially recognised contractual obligations, the so-called ‘EU Standard Contractual Clauses’. If we rely on the EU Standard Contractual Clauses as the legal basis for the transfer of your personal data, we will also assess the lawfulness of this data transfer as part of a comprehensive risk assessment. Should we reach a negative conclusion in this regard, we will not transferthis data to a third countrywithout your explicit consent in accordance with Article 49(1)(a) of the GDPR.

1.5. Data erasure and retention period

We will only store your data for as long as is necessary to fulfil our tasks in the public interest or to comply with our legal obligations. We will erase your personal data as soon as the purpose for which we collected it no longer applies.

1.6. Data sources

We generally collect your personal data directly from you. We also receive personal data from the Office of the Upper Austrian Provincial Government – Tourism Levy Office, e.g. lists of voting groups for the purpose of holding the annual general meeting.

1.7. Profiling

We do not use any automated decision-making or profiling procedures that have legal effects on you or similarly significantly affect you.

1.8. Safeguarding your data protection rights

In accordance with the GDPR, you generally have the right to access, rectify, erase and restrict the processing of your personal data. If the legal basis for the processing of your personal data is your consent or a contract concluded with you, you also have the right to data portability. You have the right to withdraw any consent you may have given to the processing of your personal data. This does not affect the lawfulness of the processing of your personal data up to the time of withdrawal. You have the right to object to the processing of your personal data for the purposes of direct marketing. In the event of an objection, your personal data will no longer be processed for the purposes of direct marketing. A detailed explanation of these rights can be found here in Chapter III.

Right to lodge a complaint

If you believe that the processing of your data infringes data protection law or that your data protection rights have otherwise been infringed, you may lodge a complaint with the competent supervisory authority. In Austria, this is the Data Protection Authority (Barichgasse 40–42, A-1030 Vienna, email: dsb@dsb.gv.at).

Current version of the privacy policy dated 26 January 2026