Privacy Policy Controller pursuant to Art. 4 para. 7 EU General Data Protection Regulation (GDPR): Goldmark Musikverein Wiedner Hauptstraße 35/2/8a 1040 Vienna, Austria Tel: +43 660 6055409 Email: contact@goldmark-musikverein.at Data Processing in a Business Context Data Processing under Art. 13 GDPR We process personal data that individuals voluntarily provide to us, such as through email inquiries, in the context of initiating or concluding a contract or business relationship. Data Processing under Art. 14 GDPR We also process personal data of individuals who may be part of a contractual relationship, obtained lawfully from third-party sources (e.g., organizers providing us with participants’ names, companies sending employee information). Data Subjects We may process the following data from customers, members, and event guests if necessary: title, customer name, contact person for corporate clients, date of birth, email address, address, and payment data. From suppliers and external event organizers: company, title and names of contact persons, business address and contact details, bank information, and contract data. From artists: names and image data. Disclosure of Data Personal data is only disclosed to third parties when necessary for contract execution or fulfillment, or when legally required. Data Retention and Deletion Data is deleted when it is no longer required or permitted to be stored, or when legal retention periods expire. If processing is based on consent, we will restrict processing or delete the data upon revocation of consent, unless legal obligations require otherwise. Contact via Email for Information Purposes If you contact us by email, we store the data you provide in order to respond to your inquiry. Such data will be deleted once processing is no longer necessary, or restricted if legal retention obligations apply. Publication of Author Names We are legally required to publish the names of image authors (photos or videos) when using such materials. This personal data is automatically deleted when the use ends or upon a valid deletion request. Legal Basis The legal bases for data processing are: - Contract initiation and performance pursuant to Art. 6(1)(b) GDPR (e.g., ticket sales) - Legal obligations pursuant to Art. 6(1)(c) GDPR (e.g., mandatory retention and documentation requirements, copyright law) - Legitimate interests pursuant to Art. 6(1)(f) GDPR (e.g., software use, email correspondence) - Consent pursuant to Art. 6(1)(a) GDPR (e.g., use of image data, marketing) Contact Form for Special Tours To register for special tours via our web form, we require name, address, email address, and optionally a phone number. This data is used for event registration, execution, and billing. Data is deleted after the expiry of statutory retention periods. Use of Google Forms We use Google Forms (Google Ireland Ltd., Dublin) for registrations. Data may be transferred to the USA, over which we have no control. Data Transfers to the USA The GDPR requires appropriate safeguards under Art. 46 for transfers to third countries—these do not exist for the USA. Risks include: - Access to your data by U.S. authorities - Limited enforceability of your rights - Insufficient data protection standards By providing consent, you agree to the transfer of data to the USA. Legal basis: Art. 6(1)(a) and (b) GDPR Newsletter & Information on Offers To register for our newsletter, we require your first and last name and email address; additional information is optional. You can unsubscribe at any time; after that, your data will no longer be processed. Legal basis: Art. 6(1)(a) GDPR If you have an existing business relationship with us, we may also inform you about similar offers (§ 174 TKG). Legal basis: Art. 6(1)(f) GDPR Data Processing When Visiting Our Website Informational Use We only store technically necessary data (server log files): IP address, date/time, page request, status code, browser data, etc. This data is used to ensure system security and stability. Legal basis: Art. 6(1)(f) GDPR Cookies We use technical cookies and—if you consent—analytical/marketing cookies. Legal basis: Art. 6(1)(f) GDPR (technical), Art. 6(1)(a) GDPR (others) Google Gstatic To optimize performance, we load content via Google Gstatic. This may involve data transfers to the USA. Legal basis: Art. 6(1)(a) GDPR Social Media Presence We maintain profiles on YouTube, Facebook, and Instagram. These providers process your data independently. We use these platforms for communication and information purposes. Legal basis: Art. 6(1)(f) GDPR Your Rights You have the right to: - Access, rectification, deletion - Restriction of processing - Object to processing - Data portability - Lodge a complaint with the data protection authority (Barichgasse 40–42, 1030 Vienna, Tel. +43 1 52 152-0, Email: dsb@dsb.gv.at) Changes to this Privacy Policy We reserve the right to update this policy. Please refer to the latest version on our website.