Privacy Policy

1. Scope

This privacy policy applies to personal data processed through officialavec.com, the newsletter form and the contact channels described below. It does not apply to third-party websites or services that we merely link to.

2. Controller

3. How and why we process data

We receive personal data when you provide it to us, for example by email or through the newsletter form, and automatically where it is technically necessary to operate and secure this website. We only process the data required for a clearly defined purpose and do not sell personal data.

Depending on the processing operation, the legal basis is your consent (Art. 6(1)(a) GDPR), steps relating to a contract (Art. 6(1)(b)), a legal obligation (Art. 6(1)(c)) or our legitimate interest in operating a secure and reliable website and responding to enquiries (Art. 6(1)(f)). Where information is stored on or read from your device, § 165(3) of the Austrian Telecommunications Act 2021 (TKG 2021) also applies.

Data is deleted or anonymised once it is no longer needed for the stated purpose, unless statutory retention duties or the establishment, exercise or defence of legal claims require longer storage. More specific retention information is provided in the relevant sections below.

4. Web hosting and server data

This website is hosted by Hetzner Online GmbH, Industriestr. 25, 91710 Gunzenhausen, Germany, on a server in Falkenstein, Germany. Hetzner acts as our processor under an Art. 28 GDPR data-processing agreement.

Each request requires the technical processing of data including your IP address, date and time, requested address, amount of data transferred, referrer, browser and operating system information. This is necessary to deliver the website to your device and protect it against attacks. The legal basis is our legitimate interest in a secure and reliable website (Art. 6(1)(f) GDPR).

The application does not currently keep a permanent general visitor or audience log. Technical error and security information may be processed where an incident requires it and is deleted when it is no longer needed for error analysis, security or legal claims.

5. Cookies and consent management

We use CookieShield, a service provided by Codivities GmbH, Austria, to manage your choices. CookieShield blocks services that require consent until you allow them and records your decision. It may process a normalised page address without query parameters or fragments, the time, browser identifier, language, approximate location, a shortened or hashed IP identifier, a random session or consent identifier, configuration and banner versions, and the categories and services you allowed or blocked.

The strictly necessary cookie cookieshield_consent is stored on your device for up to one year so that your choice can be respected on future visits. Its storage is necessary to provide the consent management you expressly request. Server-side records are deleted according to the retention period configured in the CookieShield account once they are no longer required to provide the service, demonstrate your choice or prevent abuse. The legal bases are Art. 6(1)(f) GDPR and, where evidence is legally required, Art. 6(1)(c) GDPR.

CookieShield uses services from Cloudflare, Inc. for secure delivery and protection against attacks. Cloudflare may process connection and security data. Where Cloudflare processes data in the United States, the transfer is based on Cloudflare's certification under the EU-US Data Privacy Framework. Cloudflare's standard data-processing agreement also incorporates the EU Standard Contractual Clauses.

We currently use no analytics or marketing cookies on this website. Consent-dependent external content is loaded only after you make an active choice. You can change or withdraw your consent at any time with effect for the future:

Open Cookie Settings

6. YouTube videos

Video previews are initially displayed as locally stored images. Only when you press the play button is a video loaded from YouTube's privacy-enhanced domain, youtube-nocookie.com. Your click constitutes consent under Art. 6(1)(a) GDPR and § 165(3) TKG 2021. Until then, no data is sent to Google.

Once activated, your IP address, device and browser information, referrer, time and interactions with the video may be sent to Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland, and affiliated Google companies. If you are signed in to Google, Google may associate your use with your account. We do not retain your activation beyond the current page view.

Google may also process data in the United States. Where Google LLC is a recipient, the transfer is based on its certification under the EU-US Data Privacy Framework. Further information is available in the Google Privacy Policy.

7. Newsletter

If you subscribe to the AVEC newsletter, we process your email address, optional name, subscription time, IP address and the version of the consent wording. We use double opt-in: your address is added to the mailing list only after you confirm the link in the confirmation email. The legal basis for sending the newsletter is your consent (Art. 6(1)(a) GDPR). Preventing misuse and documenting valid consent are based on Art. 6(1)(f) and, where required, Art. 6(1)(c) GDPR.

We use Brevo, a service of Sendinblue SAS, 106 Boulevard Haussmann, 75008 Paris, France, as our processor for subscriptions and delivery. Brevo also processes technical delivery information, unsubscribes and undeliverable addresses. According to Brevo, its principal databases are located in the European Union. Where support services or subprocessors outside the EEA are involved, Brevo uses the safeguards provided for in its data-processing agreement under Art. 44 et seq. GDPR. Personalised open or click tracking is not covered by the consent given in this website's subscription form and would require separate consent.

You can withdraw your consent at any time with effect for the future, in particular through the unsubscribe link in every newsletter or by contacting us. Delivery data is processed until you unsubscribe. As a rule, we retain proof of consent for three years from the end of the year in which consent ended. A minimal suppression record may be kept for as long as necessary to ensure that no further messages are sent. Further information is available in the Brevo Privacy Policy.

8. Live dates and external links

The live dates shown on this website are retrieved server-side from the website of töchtersöhne ts gmbh. This does not create a direct connection between your browser and the tour feed. Links to ticket shops, streaming services and social networks open third-party websites only after you click them. From that point, the respective provider processes data under its own responsibility and privacy policy.

9. Contacting us by email

If you contact us by email, we process the contact details and message you provide to respond to your enquiry. The legal basis is Art. 6(1)(b) GDPR for pre-contractual or contractual communication; otherwise, it is our legitimate interest in responding to enquiries under Art. 6(1)(f). The email providers involved are used for technical delivery. We delete correspondence when it is no longer required to handle the enquiry and reasonable follow-up questions, unless statutory retention duties apply.

10. Recipients and processors

Within our organisation, personal data is accessible only to people who need it for their work. We also use hosting, IT support, consent management, email and newsletter providers. Where they act as processors, they are contractually bound to data protection and confidentiality. We disclose data to other recipients only with your consent, to perform a contract, to comply with a legal obligation or to protect overriding legitimate interests.

11. Your rights

Subject to the statutory requirements, you have the right of access (Art. 15 GDPR), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), notification of recipients (Art. 19) and data portability (Art. 20). You may object to processing based on legitimate interests for reasons arising from your particular situation and may object to direct marketing at any time (Art. 21). Where processing is based on consent, you may withdraw it at any time with effect for the future (Art. 7(3)). The lawfulness of processing before withdrawal is unaffected. No solely automated decision-making with legal or similarly significant effects takes place on this website.

We respond to requests without undue delay and normally within one month. Where necessary due to complexity or the number of requests, this period may be extended by up to two further months; we will inform you within the first month. To exercise your rights, contact office@toechtersoehne.org or use the postal address above. We may need to verify your identity.

12. Right to lodge a complaint

If you believe that the processing of your personal data infringes data protection law, you may lodge a complaint with the competent supervisory authority. In Austria this is:

You may also complain to the competent authority in the EU or EEA state of your habitual residence, place of work or the place of the alleged infringement.

13. Security

We use appropriate technical and organisational measures to protect personal data against loss, manipulation and unauthorised access. This website is transmitted over encrypted HTTPS/TLS. Despite all care, transmission over the internet can have security gaps and complete protection against third-party access is not possible.

14. Changes and questions

We may update this policy when legal requirements, our processing activities or technical features change. If you have questions about this policy or how we process personal data, please contact us at office@toechtersoehne.org.

Last updated: 2 September 2026