Cookies

Cookie Policy

Vienna Sightseeing Tours

Version: June 2026

1. Introduction

This Cookie Policy informs you about how we use cookies, local storage, pixels/web beacons and similar technologies to provide you with optimal use of our website. We distinguish between technically necessary technologies and technologies based on your consent, for example analytics, marketing and advertising, social media, and payments.

2. Website operator and data controller

VIENNA SIGHTSEEING TOURS - Wiener Rundfahrten GmbH & Co. KG

Opernring 3-5, Top 508-529, 1010 Vienna, Austria

Phone: 0043 (0)1 712 46 83 - 0

Fax: 0043 (0)1 714 11 41

Website: www.viennasightseeing.at

Email: office(at)viennasightseeing.at

Further information about our company can be found in the legal notice on our website.

No data protection officer has been appointed because this is not required by law.

3. Purposes of processing operations

We use the Usercentrics cookie banner. There you can give or withdraw your consent by category:

Essential (required): core functions such as shopping cart, login and storage of your cookie settings. Legal basis: § 165(3) TKG 2021 / Article 6(1)(f) GDPR.

Analytics: measurement and evaluation of use, for example Google Analytics. Legal basis: consent (Article 6(1)(a) GDPR).

Marketing & advertising: personalised advertising/retargeting, for example Google Ads, Meta Pixel. Legal basis: consent.

Social media: integrations/plugins of social networks. Legal basis: consent.

Payments / payment: third-party providers for payment processing, for example PayPal, Adyen. Technically necessary payment cookies are essential; other cookies, such as analysis/fraud prevention cookies of third parties, only with consent.

4. Data collection and data processing on our website

4.1 Legal bases

The use of cookies and similar technologies is generally based on § 165(3) TKG 2021.

For technically necessary cookies: storage and processing take place to provide our services properly, without requiring your consent.

For all other purposes: processing is based on your consent (Article 6(1)(a) GDPR). You may withdraw this consent at any time with effect for the future.

When you use our website, information may be accessed (e.g. IP address) or stored (e.g. cookies) on your device. Where these data are strictly necessary for operating the website, processing takes place without consent; otherwise only after consent.

The provisions of the GDPR and the Austrian Data Protection Act (DSG) apply to the processing of your personal data.

4.2 Cookies

Our website uses cookies, which are small files placed on your device.

Session cookies: temporary and automatically deleted after the end of your visit.

Persistent cookies: remain until deleted by you or your browser.

Functions of cookies:

Technically necessary cookies: enable essential functions, for example shopping cart function and language settings.

Analytics and marketing cookies: record user behaviour, serve to optimise our website and display personalised advertising; these are processed only after your consent.

Technically necessary cookies are processed on the basis of our legitimate interest (Article 6(1)(f) GDPR).

Other cookies are processed exclusively with your consent (Article 6(1)(a) GDPR), which you may withdraw at any time.

Details such as name, provider, purpose and retention period for each service/category are available at any time in the Usercentrics banner; there you can change or withdraw your settings at any time.

To control, update or restrict the use of cookies, please follow the instructions of your browser, for example Google Chrome, Microsoft Edge, Safari, Firefox or Opera.

HopPlay - technically necessary cookies and local storage

For HopPlay we use technically necessary cookies and/or local storage. These technologies are required for HopPlay to function on a web-based basis, for a game session to be continued, to prevent multiple or abusive use, to analyse technical errors and to ensure that use remains billable.

In particular, an access code or a pseudonymised ticket or session ID, technical session information, activation times, language settings, information on game progress, questions played and redemption of coupons displayed in the game, as well as technical error and log data may be processed. No registration, email address or user account is required for using HopPlay.

The cookies and local storage used in connection with HopPlay are not used for advertising purposes, cross-site tracking or the creation of personal user profiles.

Storage or access to information on the device takes place on the basis of § 165(3) TKG 2021 because these technologies are technically necessary for providing HopPlay. The related processing of personal data takes place, where HopPlay is part of the booked ticket or was purchased as an add-on, for contract performance pursuant to Article 6(1)(b) GDPR. Where processing is necessary for system security, error analysis, stability, misuse prevention and technical administration, we rely on our legitimate interest pursuant to Article 6(1)(f) GDPR.

Pseudonymised ticket and session data relevant for billing are generally stored until 90 days after the end of the month. Technical security and error logs are generally stored for up to 90 days. Longer storage takes place only where this is necessary to clarify specific technical incidents, establish, exercise or defend legal claims, or comply with statutory obligations.

Where HopPlay integrates Google Maps or other external services for map or location functions, these services are shown separately in our cookie information or in Usercentrics. Services that are not technically necessary are used only in accordance with the required consent.

5. Consent management via Usercentrics

We use the consent management service Usercentrics provided by Usercentrics GmbH, Sendlinger Str. 7, 80331 Munich, Germany.

Usercentrics enables us to obtain, manage and document your consents to data processing (processing purpose).

Data processed by Usercentrics:

opt-in and opt-out data;

referrer URL;

user agent;

user settings;

consent ID, time and type of consent;

template version, banner language;

IP address and geographical location.

The functionality of the website is not guaranteed without this processing.

Usercentrics acts as our processor.

Further information can be found in the privacy policies of Usercentrics.

Processing takes place within the European Union, and the data are deleted after 3 years.

You can adjust or withdraw your preferences at any time via the banner.

6. Integration of further tools and services

6.1 TourCMS & Palisis

Vienna Sightseeing works with Palisis AG (Switzerland), which licenses the TourCMS software for reservation services. These functions are essential/payment-relevant (booking/reservation functions).

Further information can be found in the privacy policies of Palisis (link) and TourCMS (link).

6.2 PayPal & Adyen (payments)

For payment processing we use PayPal (PayPal (Europe) S.à r.l. et Cie, S.C.A.) and Adyen (Adyen N.V., Netherlands). Depending on the payment method, you will be redirected for payment processing (redirect) or a hosted payment form/iFrame will be opened. In both cases, cookies or similar technologies may be set by the payment service provider. Technically necessary payment cookies (session/transaction/security) are essential; other payment cookies, such as third-party analysis/fraud prevention cookies, are set only after your consent and are listed in the banner. For redirect flows, the cookie notices of the respective provider (PayPal/Adyen) apply. Details and privacy policies can be found at PayPal and Adyen.

6.3 Cloudflare (essential/security)

Cloudflare is used to protect our website against DDoS attacks and improve security.

Further information can be found in Cloudflare's privacy policy (link). Cloudflare is certified under the EU-U.S. Data Privacy Framework.

6.4 Google tools

Google Tag Manager:

Purpose: central management of tags (small code snippets) to control further tools on our website. Container tool that triggers other tags only after consent has been given.

Legal basis: your consent (Article 6(1)(a) GDPR) or our legitimate interest (Article 6(1)(f) GDPR).

Data transfer: to Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland.

Note: Data transfers to the USA take place on the basis of the European Commission's adequacy decision C(2023) 4745.

Google gtag / Analytics / Ads / Remarketing:

Google Analytics (analytics category): collects data such as pages viewed, clicks, location and technical information. IP anonymisation is activated; the full IP address is transmitted only in exceptional cases. Data are automatically deleted after 14 months; aggregated data remain for longer. Processing is based on your consent (Article 6(1)(a) GDPR), which you may withdraw at any time.

Google Ads and Remarketing / Enhanced Conversions (marketing category): collect data such as cookie ID, device information and interaction data to enable personalised advertising. Further details and the legal basis (consent) can be found in the respective sections.

For all Google tools: data transfers to third countries take place in accordance with the applicable data protection requirements and the EU adequacy decision.

6.5 Social media functions and widgets (marketing/social media category)

Our website contains social media features such as the Meta Pixel (formerly Facebook Pixel).

Purpose: enables tracking of interactions to optimise advertisements on Facebook and Instagram.

Data processing: records, among other things, device information, IP address, click behaviour and interaction data.

Legal basis: your consent (Article 6(1)(a) GDPR).

Data transfer: to Meta Platforms Ireland Ltd., 4 Grand Canal Square, Dublin 2, Ireland.

Note: You may alternatively deactivate interest-based advertising via your Facebook settings.

7. Sharing of non-personal data

We aggregate and share non-personal data, such as visitor numbers and demographic statistics, exclusively for statistical purposes.

We do not share information that could identify individual persons.

8. User rights

As a data subject, you have the following rights:

access, rectification, erasure, restriction of processing and data portability;

withdrawal of consent: if you have given us consent to process your data, you may withdraw it at any time with effect for the future without affecting the lawfulness of processing carried out before withdrawal;

right to object, in particular to processing for direct marketing purposes.

How to exercise your rights:

Contact us by email at [email protected], by telephone at 0043 (0)1 712 46 83 - 0 or by post to the above address.

If you believe that the processing of your data violates data protection laws, you may contact the Austrian Data Protection Authority (www.dsb.gv.at).

9. Final provisions and current status

This policy is reviewed regularly and adapted to legal and technical developments.

Please note that all third-party links listed in this policy should be checked regularly to ensure they are up to date.