Data protection

Thank you for your interest in our website.

This privacy notice explains how we process your personal data in connection with our site.

Protecting your personal data and your privacy is very important to us. This is why we process your data exclusively in accordance with the law (Regulation [EU] 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC [General Data Protection Regulation, GDPR]; Austrian Datenschutzgesetz [Data Protection Act] 2018; EU Privacy and Electronic Communications Directive; Austrian Telekommunikationsgesetz [Telecommunications Act] 2021).

Controller and data protection officer

The data controller for this website in accordance with Art. 4(7) GDPR is Therme Wien GmbH & Co KG represented by Therme Wien Ges.m.b.H (hereinafter referred to as THERME WIEN).

If you have any questions concerning the processing of your personal data by THERME WIEN, please contact us:

Post: Data protection offcier THERME WIEN, Sterngasse 5, 1230 Vienna
Telephone: +43-1-60127-0
E-mail: datenschutz@thermewien.at

The contact details of Therme Wien’s data protection officer are:

Data protection officer THERME WIEN
Sterngasse 5
1230 Vienna
Telephone: +43-1-60127-0
datenschutz@vamed.com

1.) Processing of your personal data when you visit our website
1.1.) Processing of access data

When you visit our website, we store access data in web server logfiles. The following personal data are recorded:

  • IP address (using the Wordfence security plug-in, version 7.1.4)

Purpose of data processing
These data are evaluated statistically in order to improve the services on our website and make them more user friendly, to identify and resolve errors more quickly, and to manage server capacity. We will use these personal data to take legal action only if we find specific indications of unlawful use of our website.

Retention period
The data are stored indefinitely in the WordPress database. They can only be viewed in the WordPress backend. Individual entries can be deleted on request, only using the phpMyAdmin database tool.

Legal basis
The legal basis for processing access data is THERME WIEN’s legitimate interest in accordance with Art. 6(1)(f) GDPR (online services and data security).

1.2.) Cookies
1.2.1.) Use of technical cookies

We use cookies on various pages on our site in order to make your visit to our website more attractive and to enable the use of certain functions. Cookies are small text files that are stored on your device. They enable us to recognise your browser when you return to our site. We use cookies in accordance with EU and Austrian law (Art. 5[3] EU Privacy and Electronic Communications Directive and section 165[3] Austrian Telecommunications Act 2021).

You can adjust your browser settings so that you are notified about the use of cookies and can decide whether to accept them, accept them in certain cases, or block all cookies. However, if you deactivate cookies, you may be unable to use some functions on our website.

Legal basis
The legal basis for the use of cookies that are essential in order to display the website and offer the services demanded by you is THERME WIEN’s legitimate interest in providing the website and related services in accordance with Art. 6(1)(f) GDPR (section 165[3] Austrian Telecommunications Act 2021). With all other cookies, data processing is based on your express consent as provided in the cookie banner (Art. 6[1][a] GDPR; section 165[3] Austrian Telecommunications Act 2021). You can amend or withdraw your consent at any time by clicking on the ‘My data protection settings’ link above. Click here for further information on the use of cookies on our website.

1.2.2.) Google Analytics

This website uses Google Analytics, a web analytics service provided by Google, Inc., 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA (“Google”). Google Analytics also uses cookies in order to analyse your use of our website. Information generated by the cookie about your use of the website is generally transmitted to and stored on a Google server in the United States. Your full IP address will only be transferred to a Google server in the USA and anonymised there in exceptional circumstances. Google uses the information generated on behalf of the operator of this website in order to evaluate use of the website, produce reports concerning activities on the site and provide the website operator with additional services associated with use of the website as well as internet use. The IP address transferred by your browser in connection with Google Analytics will not be combined with any other data held by Google. You can block the collection of data generated by the cookie in relation to your use of this website (including your IP address), the transfer of these data to Google and the processing of these data by Google by downloading and installing the browser plug-in available at https://tools.google.com/dlpage/gaoptout.

Legal basis
The legal basis for the use of Google Analytics is THERME WIEN’s legitimate interest in the evaluation of the website and analysis of activity on the site in accordance with Art. 6(1)(f) GDPR.

Recipients
These data will be transferred to Google and Blue Monkeys GmbH (website support provider) for the purposes specified above.

Retention period
Personal data will be stored for 28 months and then deleted.

1.3. Social media plug-ins

Social media plug-ins are integrated into pages on THERME WIEN’s website. The plug-ins are for the following social media platforms:

Facebook, operated by Facebook Ireland Limited, 4 Grand Canal Square, Dublin 2, Ireland, FN 462932 / Facebook Inc., 1601 Willow Road, Menlo Park, CA 94025
Instagram, operated by Instagram LLC, 1601 Willow Rd, Menlo Park, CA 94025, USA
YouTube, operated by YouTube, LLC, 901 Cherry Ave., San Bruno, CA 94066, USA

The plug-ins are indicated by the respective operator’s logo or name. If you view a page containing one of these plug-ins on THERME WIEN’s website, your browser will connect directly to the operator’s servers. The content of the plug-in is transferred directly to your browser by the operator and integrated into the page. Integration of the plug-in provides the operator with information that you have accessed the relevant page on the THERME WIEN website. If you are logged into your user account on the respective social media platform, the operator can associate this visit with your account. If you interact with a plug-in, for example by clicking on the plug-in button, your browser will transmit the related information directly to the operator, which will store the information. You can prevent the operator associating the collected information with your user account by logging out of your account.

Information on the purpose and scope of data collection and further processing, as well as the operator’s use of data, including your rights in this regard and the settings available for protecting your privacy, can be found in the respective operator’s privacy policy:

Facebook: https://www.facebook.com/privacy/explanation
Instagram: https://help.instagram.com/155833707900388
YouTube: https://policies.google.com/privacy?hl=en&gl=de

1.4.) Online shops
1.4.1.) Gift cards (https://thermewien-shop.vitality-world.com/)

Data processing
When you purchase a VAMED Vitality World (VVW) gift voucher, THERME WIEN processes the following personal data that you provide (“the data”), for the purpose of processing the transaction:

  • First name
  • Last name
  • Address
  • E-mail address
  • Telephone number
  • Company (where applicable)
  • Payment details (encrypted)
  • Customer account details (orders placed: article, price, IP address)
  • Text and images/photos entered by the Customer for print-at-home vouchers
  • Gift card value queries (gift card number, date, IP address)

Purpose of data processing
The data are processed for the purpose of processing the transaction concerned and – provided that you have given your consent – for marketing communications regarding the VVW resorts’ products and services, special offers and events, and relevant news from the VVW resorts (including sending corresponding marketing materials by post, e-mail and, where applicable, text message, as well as contact by telephone where applicable).

Legal basis
Data processing for the purpose of processing the transaction is carried out pursuant to Art. 6(1)(b) GDPR (performance of the contract). Processing of the data for marketing purposes is performed in accordance with Art. 6(1)(a) GDPR (consent).

Data transmission
For the purpose of processing the transaction concerned, the data are transferred on THERME WIEN’s behalf to VAMED Standortentwicklung und Engineering GmbH (Sterngasse 5, A-1230 Vienna), INCERT eTourismus GmbH & Co KG (Leonfeldnerstrasse 328, 4040 Linz), mediasupport GmbH (Lerchenfelder Strasse 124/6, 1080 Vienna), Usercentrics GmbH (Sendlinger Str. 7, 80331 Munich), card complete Service Bank AG (Lassallestrasse 3, 1020 Vienna) and Datatrans AG (Kreuzbühlstrasse 26, CH-8008 Zurich), and for marketing purposes to hi.one digital marketing OG (Gurkgasse 43/2, 1140 Vienna). Data are not transmitted to any other third parties.

Retention period
The data are stored for the period required to process the transaction concerned and for marketing purposes, and for longer where required by statutory retention periods, if legal claims arising from the contractual relationship can be asserted, or on other legitimate grounds justifying storage for a longer period.

1.4.2.) Vouchers for services and ticket sales (https://shop.thermewien.at)

Data processing
When you purchase a voucher for services, THERME WIEN processes the following personal data that you provide (“the data”), for the purpose of processing the transaction:

  • Title
  • Academic title
  • First name
  • Last name
  • Address
  • E-mail address
  • Date of birth
  • Telephone number
  • Password
  • Customer account details (orders placed: article, price, IP address, VAMED VitalityClub card number, if available)

Purpose of data processing
The data are processed for the following purposes:

  • Processing the transaction concerned
  • Marketing communications regarding THERME WIEN’s products and services, special offers and events, and relevant news from THERME WIEN (including sending corresponding marketing materials by post, e-mail and text message, and contact by telephone), provided you have given your consent

Legal basis
Data processing for the purpose of processing the transaction is carried out pursuant to Art. 6(1)(b) GDPR (performance of the contract). Processing of the data for marketing purposes is performed in accordance with Art. 6(1)(a) GDPR (consent).

Data transmission
For the purpose of processing the transaction concerned, data are transferred on THERME WIEN’s behalf to HKS Systeme GmbH (Friedrich-List-Straße 89, 33100 Paderborn), Usercentrics GmbH (Sendlinger Str. 7, 80331 München), Adyen N.V. German Branch (Jägerstraße 27, 10117 Berlin), PayPal (Europe) S.à r.l. et Cie, S.C.A. (22-24 Boulevard Royal, L-2449 Luxemburg). The data are not transmitted to any other third parties.

Retention period
Data are stored for the period required to process the transaction. The data are only stored for longer when required by statutory retention periods, if legal claims arising from the contractual relationship can be asserted, or on other legitimate grounds that justify storage for a longer period.

1.5.) Contact by telephone to arrange appointments for trial training sessions

When you visit our website, you have the option of entering your telephone number.

Data processing
THERME WIEN processes the following personal data that you provide for the purpose of arranging an appointment for a free trial training session:

  • Name
  • Telephone number

Purpose of data processing
The personal data you provide are processed to enable us to contact you for the purpose of arranging an appointment for a free trial training session.

Legal basis
Processing of your personal data by THERME WIEN is based solely on your consent for us to use your telephone number in order to contact you (Art. 6[1][a] GDPR).

Retention period
Data processed for the purpose specified above are stored until you withdraw your consent. Essential data will only be stored for longer in accordance with the applicable statutory requirements and retention obligations for the purpose of demonstrating that you have given or withdrawn your consent.

Recipients
Your data will be transferred to THERME WIEN and our service providers Blue Monkeys GmbH (website support) and Digimagical GmbH (website hosting) for the purpose of arranging an appointment for a free trial training session.

Withdrawal of consent
You can withdraw your consent to the use of your telephone number for the purpose of arranging an appointment for a free trial training session at any time by e-mailing us at datenschutz@thermewien.at.

2.) Links

This website contains links to other sites. These references to sites of other internet participants are provided as a service in order to enable visitors to our website to obtain additional information. THERME WIEN has no influence over the content of such linked sites and does not assume any liability for this content. The respective provider of a linked website is solely responsible for the content and the accuracy of information provided on its site.

3.) Newsletter

You have the option of subscribing to our newsletter.

Data processing
When you subscribe to our newsletter, THERME WIEN processes the following personal data that you provide:

  • E-mail address
  • Time of subscription or, if you have already subscribed, the time of the most recent change to your subscription

Purpose of data processing
The data you provide when you subscribe to the newsletter are processed for the following purposes:

  • Sending information on promotions, special offers, events and news related to THERME WIEN
  • Evaluating e-mail recipients’ click behaviour using web analytics in order to optimise editorial content

Legal basis
Processing of your personal data by THERME WIEN is based solely on your consent for us to send you our newsletter (Art. 6[1][a] GDPR).

Retention period
Data processed for the purpose specified above are stored until you withdraw your consent to receive the newsletter. Essential data will only be stored for longer in accordance with the applicable statutory requirements and retention obligations for the purpose of demonstrating that you have given or withdrawn your consent.

Recipients
For the purpose of sending you our newsletter, your data will be transferred to our service provider ONELOGIN Business & Technology Consulting GmbH, which handles newsletter deliveries on our behalf.

Withdrawal of consent
You can withdraw your consent to receive our newsletter at any time by e-mailing us at newsletter@thermewien.at. You can also unsubscribe from our newsletter at any time by clicking the “Unsubscribe” link at the end of each newsletter.

4.) Online competitions

You have the option of entering online competitions and, in the process, subscribing to the THERME WIEN newsletter. Further details regarding newsletter subscriptions can be found in section 3.

Data processing
When you enter an online competition, THERME WIEN processes the following personal data that you provide:

  • E-mail address
  • Date of entry

Purpose of data processing
The data you provide when you enter an online competition will be processed for the purpose of contacting you in the event that you win the competition.

Legal basis
Processing of your personal data by THERME WIEN is based solely on the consent you provide when you enter an online competition (Art. 6[1][a] GDPR).

Retention period
Data processed for the purpose specified above are stored until the end of the online competition concerned.

Recipients
For the purpose of processing your entry to a particular online competition, your data will be transferred to THERME WIEN and our service provider ONELOGIN Business & Technology Consulting GmbH (newsletter tool operator).

Withdrawal of consent
You can withdraw your consent to enter an online competition at any time by e-mailing us at marketing@thermewien.at.

5.) Facebook fan page

THERME WIEN operates a Facebook fan page where your personal data are processed. As the operator of the fan page, THERME WIEN is also the controller in the meaning of data protection legislation.

Your personal data can be collected on the fan page using cookies, regardless of whether you have a Facebook account or not. Facebook is solely responsible for decisions regarding the use of these cookies. THERME WIEN has no influence over these decisions. See Facebook’s Privacy Policy (https://www.facebook.com/privacy/explanation) and Cookies Policy (https://www.facebook.com/policies/cookies/) for details of Facebook’s use of cookies. You can also download your personal Facebook data directly from Facebook (by downloading the expanded archive in your account settings).

The cookies may forward your data to Facebook Inc. in the USA. Facebook is certified under the EU-US Privacy Shield. Consequently, with regard to users in Europe, Facebook must comply with data protection standards that the European Commission has deemed to be comparable with European standards. Facebook may also use third-party cookies – a list can be found at https://www.facebook.com/policies/cookies/. The cookie policies of these third parties are posted on their websites.

You can withdraw your consent to the future storage, processing and use of your data by means of cookies at any time while visiting the THERME WIEN Facebook fan page. This does not affect the lawfulness of processing carried out before you withdraw your consent.

6.) Data security

The protection of your personal data is very important to us.

THERME WIEN implements appropriate technical and organisational measures in the meaning of Art. 32 GDPR that take into account the state of the art, the costs of implementation and the nature, scope, context and purposes of processing as well as the risk of varying likelihood and severity for the rights and freedoms of natural persons.

In this regard, the following measures are taken in order to protect your personal data against loss, destruction, alteration, and unauthorised disclosure of and access to data:

  • Ensuring the ongoing confidentiality, integrity, availability and resilience of processing systems and services
  • Ensuring the ability to restore the availability of personal data quickly in the event of a physical or technical incident
  • Implementation of processes for regularly testing, assessing and evaluating the effectiveness of technical and organisational measures for ensuring the security of the processing

Please note that we do not assume any liability for the disclosure of information due to errors in transmission not caused by us or for which we are not responsible, and/or due to unauthorised access by third parties.

7.) Your rights

As a user of our website you have the following rights:

  • Right of access (Art. 15 GDPR): you have the right to obtain confirmation from THERME WIEN as to whether or not your personal data are being processed. You also have the right to information regarding the specific purposes of processing, the categories of personal data concerned, recipients or categories of recipient of personal data, retention periods, the existence of a right to request erasure or rectification of your personal data or restriction of processing and the right to object, the existence of a right to lodge a complaint, as well as any available information as to the source of data concerning you.
  • Right to rectification (Art. 16 GDPR): you have the right to demand rectification of your personal data by THERME WIEN without undue delay. This includes the rectification of inaccurate data and the completion of incomplete personal data.
  • Right to erasure (Art. 17 GDPR): you have the right to demand that THERME WIEN delete your personal data without undue delay, provided that the one of the grounds in Art. 17(1)(a)-(f) GDPR applies (e.g. the purpose of processing no longer applies) and your personal data are no longer necessary for the purpose for which they were collected.
  • Right to restriction of processing (Art. 18 GDPR): you have the right to demand the restriction of processing by THERME WIEN if one of the grounds in Art. 18 GDPR applies (e.g. the accuracy of the processed personal data is contested, processing is unlawful, etc.).
  • Right to data portability (Art. 20 GDPR): you have the right to receive the personal data concerning you, which you provided to THERME WIEN, in a structured, commonly used format, and to demand that THERME WIEN transmit these data to another controller (e.g. to another law firm).
  • Right to object (Art. 21 GDPR): you have the right to object to the processing of your personal data in connection with this website at any time.
  • Withdrawal of consent (Art. 7 GDPR): you can withdraw consent given to THERME WIEN at any time.
  • Right to lodge a complaint with a supervisory authority (Art. 77 GDPR): you can also lodge a complaint at any time to:

Austrian Data Protection Authority
Wickenburggasse 8
1080 Vienna
Tel. +43-1-521522569
E-mail: dsb@dsb.gv.at

You can exercise your rights as a data subject – with the exception of the right to lodge a complaint with the Austrian Data Protection Authority – by contacting THERME WIEN at one of the following addresses:

By post: Therme Wien GmbH & Co KG, Data Protection, Kurbadstrasse 14, 1100 Vienna
By e-mail: datenschutz@thermewien.at