• Salzburg
All Tours
All Tours

weTours Salzburg

Privacy Policy

weTours e.U. | Effective Date: [November 23 2025]

 

weTours e.U. (“weTours”, “we”, “our”, “us”) is committed to protecting your personal data and complying with all applicable European and Austrian data protection regulations, including the General Data Protection Regulation (GDPR) and the Austrian Telecommunications Act (TKG 2021).

 

This Privacy Policy explains how we collect, use, store, and protect your personal data when you visit our website, book a tour, subscribe to our newsletter, or interact with us through other channels.

 

You can use our website without providing personal information. When personal data is collected, it is processed fairly, transparently, and exclusively for the purposes described below.

1. Data Controller

weTours e.U.
Schmiedingerstraße 73c
5020 Salzburg
Austria
Telephone: +43 660 9493552
Email: privacy@wetours.net

2. Legal Bases for Processing (Art. 6 GDPR)

We process personal data only when one of the following legal bases applies:

(a) Consent – Art. 6(1)(a) GDPR
Example: newsletter subscription, consent to cookies, embedded third-party services.

(b) Contract performance or pre-contractual steps – Art. 6(1)(b) GDPR
Example: tour bookings via Bokun.

(c) Legal obligations – Art. 6(1)(c) GDPR
Example: tax retention obligations, accounting.

(d) Legitimate interests – Art. 6(1)(f) GDPR
Example: website security, fraud prevention, ensuring proper functionality. No other purposes are pursued without informing you in advance.

3. Categories of Personal Data We Process

We may process the following categories of data:
 
Data provided by you
– Title, first and last name
– Address and country
– Email address, phone number
– Booking details (tour type, participants, dates)
– Payment-related details processed exclusively by Bokun / its payment processors
– Newsletter registration details
 
Automatically generated data
 
Collected when visiting our website:
– IP address (anonymized if technically possible)
– Browser type/version
– Device information
– Operating system
– Referrer URL
– Date/time of access
– Pages visited
– Cookie preferences (via Complianz Consent Manager)
 
We do not profile users or make automated decisions producing legal effects.

4. Who Has Access to Your Data

Access is strictly limited to:
– weTours e.U. employees who require it for operational purposes
– Contracted service providers (hosting, analytics, consent management, etc.)
– Bokun (for bookings and payments)
– Direct Mail / e3 Software (for newsletters)
 
All service providers are contractually bound under Art. 28 GDPR (data processing agreements).
 
Data is shared with third parties only if:
– legally required (e.g., tax authorities), or
– necessary for defending legal claims.
 
Your data is never sold or shared for advertising purposes of third parties.

5. Direct Marketing to Existing Customers (Art. 6(1)(f) GDPR; § 174 TKG 2021)

If you have purchased services from us, we may contact you with information about similar offers unless you opt out.

This processing is based on our legitimate interest in presenting relevant updates to existing customers.

You may object at any time (see Section 8).

Retention period: 3 years after your last interaction, unless legal storage obligations require longer retention.

6. Your Rights

Under GDPR, you have the right to:
– Access (Art. 15)
– Rectification (Art. 16)
– Erasure (Art. 17)
– Restriction (Art. 18)
– Data portability (Art. 20)
– Object to processing (Art. 21)
– Withdraw consent at any time (Art. 7)
 
To exercise your rights, contact: privacy@wetours.net
 
If you believe your rights are violated, you may lodge a complaint with:
 
Austrian Data Protection Authority
Barichgasse 40–42
1030 Vienna
Email: dsb@dsb.gv.at
Tel: +43 1 52 152

7. Hosting & Security

Our website is hosted by:
 
Kinsta Inc. / Kinsta Ltd..
Data center location: European Union (EU). Kinsta processes IP addresses and technical data to ensure stability, performance, and security (Art. 6(1)(f) GDPR).
 
Cloudflare CDN & Security
We use Cloudflare (USA) for:
– Content delivery acceleration
– Protection against attacks (DDoS)
– SSL/TLS management
 
This may involve data transfers to the USA under Standard Contractual Clauses (SCCs).
Cloudflare’s privacy documentation:

8. Website Access Data (Server Logs)

For technical and security reasons, the following data is logged automatically:
– IP address
– Browser & version
– Operating system
– Referrer URL
– Date & time
– Pages viewed
 
Retention period: up to 30 days, unless longer required for security investigations.

9. Cookies & Consent Management (Complianz)

We use Complianz (Complianz B.V., Netherlands) to manage cookie consent.
When you visit our site, you are shown a consent banner that:
– categorizes cookies
– allows acceptance, refusal, or granular choices
– prevents loading of non-essential cookies until consent is given
 
Legal basis:
– Essential cookies: Art. 6(1)(f) GDPR
– Analytics/marketing cookies: Art. 6(1)(a) GDPR
 
Complianz stores your consent preferences in a cookie.
 

10. Google Analytics 4 (GA4)

We use Google Analytics 4 to analyze website usage.
 
Provider:
Google Ireland Limited
Gordon House, Barrow Street, Dublin 4, Ireland
 
Data processed:
– Device & browser information
– IP address (shortened/anonymized)
– User behavior (pages viewed, time spent, clicks)
– Cookie identifiers (if consented)
 
Data transfer:
May be transferred to the USA under Standard Contractual Clauses (SCCs).
 
Legal basis: Consent, Art. 6(1)(a) GDPR
(Analytics only loads after you accept via Complianz)
 
Opt-out:
You may withdraw consent at any time in your cookie settings.

11. Embedded Third-Party Content

11.1 YouTube Videos
 
Provider: YouTube LLC / Google Ireland Ltd.
 
We embed YouTube videos using the Consent Mode of Complianz.
A connection to YouTube is established only after you provide consent.
 
Data processed may include:
– IP address
– Device/browser data
– Interaction with the video
– Cookies (if consented)
 
Legal basis: Consent, Art. 6(1)(a) GDPR.
 
Privacy policy:
 
 
11.2 Google Maps
 
We use Google Maps to display locations.
 
Maps are blocked until you give consent via Complianz.
 
Data processed:
– IP address
– Device/browser information
– Location interactions
 
Legal basis: Consent, Art. 6(1)(a) GDPR.

12. Booking System: Bokun (TripAdvisor LLC)

Bookings on our website are processed via:
 
Bokun ehf. (Iceland)
Owned by TripAdvisor LLC (USA)
 
Personal data processed for bookings:
– Name
– Email address
– Travel details
– Payment details (processed securely within Bokun)
 
Legal basis:
– Contract performance (Art. 6(1)(b) GDPR)
– Consent for third-country transfers (Art. 49) or SCCs
 
TripAdvisor/Bokun uses Standard Contractual Clauses (SCCs) for international transfers.
 
Privacy documentation:

13. Newsletter (Direct Mail / e3 Software)

We send newsletters using Direct Mail by e3 Software (USA).
 
Data processed:
– Email address
– Name
– IP address
– Analytics (opens, clicks)
 
Legal basis: Consent, Art. 6(1)(a) GDPR.
 
Because e3 Software is located in the USA, international transfers rely on:
– Standard Contractual Clauses (SCCs)
– Additional safety measures
 
Subscribers may unsubscribe at any time via link in each email.
 
Privacy information:

14. Email Communication

If you contact us via email, we store:
– your email address
– your message
– metadata (time, IP logs, routing information for security)
 
Legal basis:
Art. 6(1)(b) GDPR for inquiries;
Art. 6(1)(f) GDPR for security and spam prevention.
 
Email transmissions are not fully protected against unauthorized access. For highly sensitive information, we recommend encrypted communication.

15. External Links

Our website may contain links to external websites.
We are not responsible for the content or privacy practices of third-party sites.

No personal data is transmitted merely by clicking an external link.

16. Data Storage & Retention

We store personal data only as long as necessary:
– Booking data: up to 7 years (tax obligations)
– Customer inquiries: up to 12 months
– Server logs: up to 30 days
– Direct marketing data: 3 years after last contact
– Newsletter data: until consent is withdrawn

17. Updates to This Privacy Policy

We may update this Privacy Policy due to legal or technical changes.
The latest version is always available on this website.

Continued use of the website after changes constitutes acceptance of the updated policy.

18. Contact

For all data protection matters:
privacy@wetours.net