Privacy Policy

Controller

Free Walking Tour Salzburg e.U., owner Gerhard Reus,
Ignaz-Härtl-Straße 8, 5020 Salzburg, Austria
Email: [email protected]

The enquiry form

When you request a tour, we process the details you provide: name, email address, accommodation, party size, preferred date and your notes.

The legal basis is Art 6(1)(b) GDPR: processing for pre-contractual steps taken at your request. Providing your name and email address is necessary for handling your enquiry; without them we cannot reply. All other fields are voluntary.

Your details are stored in our own booking system and are not passed to third parties, except for payment processing through Stripe if a booking follows (see below). When an enquiry arrives, a notification email is sent to our team.

Storage period: at most 730 days, after which enquiries are deleted.

If a booking follows, the related booking and invoicing records are subject to statutory retention obligations, in particular the seven-year period under § 132 of the Austrian Federal Fiscal Code. Those periods take precedence over the storage period above.

Payment processing (Stripe)

If a booking follows, payment happens through a payment link provided by our payment processor Stripe Payments Europe Ltd, Dublin, Ireland. You enter your card details directly with Stripe; we never store them. Stripe receives the details needed for processing (name, email address, amount). The legal basis is Art 6(1)(b) GDPR. Where data is transferred to Stripe Inc. in the USA, Stripe is certified under the EU-US Data Privacy Framework.

Spam protection (Cloudflare Turnstile)

To protect the enquiry form against automated submissions we use Cloudflare Turnstile, a check that works without puzzles and without tracking cookies. Cloudflare, Inc. processes technical connection data from your browser for this purpose and may set a technically necessary security cookie. The legal basis is Art 6(1)(f) GDPR: our legitimate interest in protecting the form against automated requests. We ourselves store no data from this check.

Analytics

This website uses Cloudflare Web Analytics, a cookie-free measurement without cross-device tracking.

The analytics beacon measures visited pages and technical values (such as load time and browser type) without setting a persistent identifier and without following you across websites. The legal basis is Art 6(1)(f) GDPR: our legitimate interest in a data-minimal measurement of how this website is used.

Hosting

This website is hosted by Hetzner Online GmbH on servers in Germany. Visiting the website produces server logs (IP address, time, requested page, user agent), which are kept for operational security and deleted after at most 14 days. Cloudflare, Inc. sits in front of the site as a DNS and security service. Cloudflare is certified under the EU-US Data Privacy Framework; where data is transferred to the USA, this constitutes an adequacy decision by the EU Commission. The legal basis is Art 6(1)(f) GDPR: our legitimate interest in secure and stable operation.

Your rights

You have the rights to access, rectification, erasure, restriction of processing, data portability and objection. Just write to the email address above.

You also have the right to lodge a complaint with the Austrian data protection authority: dsb.gv.at.