Data Protection Declaration
With this data protection declaration, we provide information about the type, scope and purpose of the personal data processed and inform the persons affected by the data processing about the rights to which they are entitled.
Your personal data will be protected in the best possible way during your visit to the Salzburg Festival or on our website, insofar as they are within your own area of responsibility. The processing of personal data is therefore carried out exclusively on the basis of legal provisions (GDPR, Austrian DSG, Austrian TKG 2003).
1. Name and address of the controller
Salzburg Festival Fund
Phone: +43 662 8045 500
2. Data processed from customers and website visitors
In the course of your visit to our website we collect the following information: The date and time you call up a page on our website, your IP address, name and version of your web browser, the website (URL) you visited before calling up this website, certain cookies (see below) and the information you yourself provide when registering and ordering tickets. The legal basis for the processing of data of a simple website visit is our overriding legitimate interest (in accordance with Art. 6 Para. 1 letter f GDPR), which is to achieve the purposes mentioned under 1.
Internet-based or wireless data transmissions generally have security gaps, which, despite extensive efforts, do not allow absolute protection to be guaranteed. Furthermore, the public – and thus also the website operators – is often unaware of the extent to which and for what purposes globally active companies such as Facebook, Google, Microsoft & Co. collect, store and use data.
This website contains applications and plug-ins as well as links to third party websites, which are outside our area of responsibility under data protection law. By clicking on a link, you will be directed to the websites of third parties who may process personal data when you access the website.
3. Purpose of data processing
We use your personal data mentioned under point 2 exclusively within the scope of your visit to our website, for processing your ticket order, your ticket purchase and your visit to the Salzburg Festival. Furthermore, to detect, prevent and investigate attacks of our website, and to compile usage statistics.
You can revoke your consent to this data processing at any time. Point 5 describes how this can be done.
The provision of your personal data within the framework of ordering / purchasing tickets or registration is voluntary. However, we will not be able to process your ticket order or you will not be able to use all the functions of the website if you do not provide your personal data.
We may be required by law to provide contact information to health authorities for contact tracing purposes.
In the course of an order or purchase, the visitor must register on the website with their personal data (name, address, telephone number, e-mail address, year of birth, user name). By registering on the website, you agree to the storage of the personal data as a user profile for later visits and the use of the data for the purpose of fulfilling the contract.
On our website with registration function, we store the personal data provided by you during registration as your personal profile with your consent, so that you can log in with your e-mail address and password during future visits. This has the advantage that you do not have to re-enter your address data every time you use the website. You can object to the storage of your data at any time. In this case, however, a new complete registration is required for each use.
Your customer-related data will be stored and processed for customer service purposes and will only be passed on to third parties if this is necessary for the fulfilment of the contract (see point “Transfer of your data to third parties”).
A user name and password chosen by you personally during the registration process ensures that only you have access to your user account. Your password cannot be viewed by us.
You always have access to your data stored with us. You can view and update the data in your profile, such as the addresses you entered, during the ordering process, but also at any time in the protected area under “My Account”.
5. Data storage for orders in the webshop
Your orders and purchases made in the web shop are stored by us and can be retrieved by you at any time for the current season under “My Account – Order History”.
6. Storage of credit card information
In the webshop you have the possibility to save your credit card information in your profile for future purchases. In order to offer you the highest possible security, the storage is carried out in the so-called “Tokenization” procedure. For this purpose, a number sequence generated by our external payment service provider is stored in the web shop as an identifier. The actual payment data is stored in encrypted form on the servers of WireCard GmbH without transmitting personal data from your personal user profile on our website.
The storage of credit card information at WireCard is carried out in compliance with the strict PCI-DSS guidelines. You will find more detailed information on the storage of credit card information and the tokenization procedure on the WireCard GmbH website (https://www.wirecard.de/produkte/zahlungsmethoden/tokenization/)
7. Transmission of your personal data
We do not share personal data with third parties, except to the following recipients for the following purposes:
- Contact tracing authorities in the event of infection with Covid-19: Where required by law, personal information may be disclosed to contact tracing authorities and relevant health and safety authorities.
- IT service providers used by us for support activities;
- the Austrian Postal Service as well as other mail-order companies used by us to send postal mailings, such as the annual programme;
- the respective credit card company selected by you, the payment service provider for payment of your order; the payment processing and storage of credit card information is handled exclusively by our payment service provider WireCard GmbH. The Salzburg Festival Fund does not process credit card data;
- For the purpose of processing and implementing joint events, your data will only be passed on to the respective co-organizer with your express consent.
These recipient groups are not permitted to use this data for other purposes and are also obliged to comply with data protection regulations. If processors receive your personal data, this will only be done to the extent that they need it to fulfil their respective tasks. All contract processors are obliged (based on data protection regulations and a contract processor contract in accordance with Art. 28 GDPR) to observe all applicable data protection regulations, to treat your data confidentially and to process it only within the scope of providing the service.
8. Data processing and legal basis of processing
To protect our legitimate interests, your data will be processed in the following cases:
- In the area of answering enquiries and correspondence, data processing is carried out not only on the basis of the implementation of (pre-)contractual measures (Art. 6 para. 1 lit. b GDPR) but also because of the legitimate interest of the controller in answering enquiries and initiating business relations.
- In the field of advertising and marketing, the processing of personal data is based on the legitimate interest of the data controller in the targeted addressing of interested parties and users, user acquisition and retention as well as sales promotion and increasing the efficiency of sales strategies.
- In the area of data protection, data processing is carried out not only to fulfil legal obligations (Art. 6 Para. 1 lit. c GDPR), but also because of the legitimate interest in protecting property, system security, access and access restrictions.
When processing personal data on the basis of our legitimate interest in accordance with Art. 6 Para. 1 letter f GDPR or when processing data for direct marketing purposes, we have the right to object in accordance with Art. 21 GDPR. You can exercise this right of objection at any time by notifying us.
If you have given your consent to the processing of your personal data in connection with advertising and marketing measures, the data will only be processed
- in accordance with the purposes specified in the declaration of consent,
- to the extent agreed therein, and
- by the recipients described in the declaration of consent, and
- is subject to the specified storage period.
Any consent granted can be revoked at any time with future effect by e-mail, letter or in any other way in writing or orally to the controller named in the declaration of consent. Revocation of consent does not affect the lawfulness of the processing carried out on the basis of the consent until revocation.
9. Storage period
We will retain your personal data only for as long as permitted by applicable law and as reasonably deemed necessary by us to achieve the purposes set out in point 1. In any event, we will store your personal data for as long as statutory retention obligations exist or the limitation periods for potential legal claims have not yet expired.
10. Special privisions for processing and transfer of personal data in connection with the Covid-19 pandemic
Since Covid-19 is a notifiable disease within the meaning of the Austrian Epidemic Law 1950, the Salzburg Festival is obliged under Paragraph 5(3) to cooperate with the district administrative authority and, in the event of an infection, to provide information on the contact details of the person concerned at the request of the authority.
Data processing is justified under Art. 6 Para. 1 letter f GDPR in terms of the balancing of interests required there, as the health protection of the contact persons in terms of rapid accessibility outweighs the intervention to disclose the relevant contact data in the case of a voluntarily attended event.
The personal data will be stored for at least 28 days after the last performance visit. The storage period may be extended beyond this if there is another reason for storage. (See also point 9).
11. Your rights in connection with personal data
Under applicable law, you are entitled (if the legal requirements are met) to, among other things
- to check whether and which personal data we have stored about you and to receive copies of the data (right to confirmation and information)
- to demand the correction, completion or deletion of your personal data which is incorrect or not processed in accordance with the law (right to correction and deletion);
- require us to limit the processing of your personal data (right to limit processing).
- to object, under certain circumstances, to the processing of your personal data or to withdraw the consent previously given for the processing (right to object to processing);
- demand data transferability (right to data transferability);
- to know the identity of third parties to whom your personal data are transmitted and
- lodge a complaint with the competent authority (Austrian Data Protection Authority (DSB), Barichgasse 40-42, 1030 Vienna).
If you do not wish this, you can set up your browser to inform you about the setting of cookies and to allow this only in individual cases. The settings required for this differ depending on the browser and terminal device; you can usually find corresponding instructions in the “Help” of the device or browser.
If cookies are deactivated, the functionality of our website may be limited.
13. Google analytics
In order to duly improve our website and our offer for you and to correct errors, we use the web analysis tool Google Analytics.
On our website, analysis tools are used to collect general information about the usage behaviour of visitors. This includes, for example, pages called up, length of stay, referring pages and general information about your computer system such as operating system, screen resolution, browser used, etc. All collected data is stored anonymously and does not allow any assignment to your person. The IP address transmitted by your browser within the framework of Google Analytics is not merged with other data from Google. If you do not agree with this anonymous recording of your usage behaviour, you can prevent this by deactivating cookies in your browser.
The information generated by the cookie about your use of this website is usually transferred to a Google server in the USA and stored there. However, if IP anonymisation is activated on this website, your IP address will be shortened by Google within member states of the European Union or in other states which are party to the Agreement on the European Economic Area. Only in exceptional cases will the full IP address be transferred to a Google server in the USA and shortened there.
You can object to the anonymous data processing by the aforementioned web analysis tools at any time, so that your visits to our website will not be recorded in the future.
This requires the activation of so-called “opt-out cookies”. Please click on the following links if you wish to object to the pseudonymous data processing: Opt-Out for Google Analytics https://tools.google.com/dlpage/gaoptout?hl=de
14. Google ads
Our website uses Google Ads, an online advertising service of Google Inc. (“Google”). Google Ads uses “cookies”, which are text files placed on the user’s computer, to help the website analyse how users use the site and also imports this data from Google Analytics (see “Google Analytics”). Google Ads also uses so-called web beacons (invisible graphics). Through these web beacons, information such as visitor traffic on the pages of this offer can be evaluated.
The information generated by cookies and web beacons about the use of this website (including the user’s IP address) and the delivery of advertising formats is transferred to a Google server in the USA and stored there. However, in the event that IP anonymisation is activated on this website, your IP address will be shortened by Google within member states of the European Union, or in other signatory states to the Agreement on the European Economic Area, before this happens. Only in exceptional cases will the full IP address be transferred to a Google server in the USA and shortened there. This information may be passed on by Google to contractual partners of Google. However, Google will not merge your IP address with other data stored about you.
Users can prevent the installation of cookies from Google Ads in various ways:
a) through a corresponding setting in the browser software;
b) by deactivating interest-based ads on Google;
c) by disabling interest-based ads from providers that are part of the About Ads self-regulatory campaign;
d) by permanently deactivating them through a browser plug-in.
The settings under b) and c) are deleted when cookies are deleted in the browser settings.
In the following we specify the services we use in the context of Google Ads:
15. Google remarketing
16. Google Conversion Tracking
As a Google Ads customer we use Google Conversion Tracking, an analysis service of Google Inc. (“Google”). Google stores a conversion cookie on your computer if you have reached our site via an ad from the Google Ads and AdSense advertising networks or conversions are analysed by linking our Google Ads account to our Google Analytics account. We use an individual conversion cookie as an ad customer, and this cookie can only be tracked by us and not by other ad customers. Through the cookie and/or the link to Google Analytics, we have the possibility to get information about how many users saw an ad from us in the Google advertising network, which and how many subpages of our website were visited and which purchases (product types, items and sales) users made on our pages. Also, actions like filling out the newsletter or buying a ticket can be retrieved. You can disable cookies for conversion tracking by setting your browser to block cookies from the domain “googleadservices.com”.
17. Facepook pixel
We use on this website the Facebook pixel of Facebook, a social media network of Facebook Ireland Ltd, 4 Grand Canal Square, Grand Canal Harbour, Dublin 2, Ireland.
The code implemented on this page can evaluate the behaviour of visitors who have come to this website from a Facebook advertisement. This can be used to improve Facebook Ads and this data is collected and stored by Facebook. The collected data is not visible to us, but can only be used in the context of ad placements. By using the Facebook pixel code, cookies are also set.
By using the Facebook pixel, the visit of this website is communicated to Facebook, so that visitors to Facebook can see suitable ads. If you have a Facebook account and are logged in, your visit to this website is assigned to your Facebook user account.
You can find out how the Facebook pixel is used for advertising campaigns at https://www.facebook.com/business/learn/facebook-ads-pixel.
You can change your settings for ads in Facebook at https://www.facebook.com/ads/preferences/?entry_product=ad_settings_screen provided you are logged in to Facebook.
http://www.youronlinechoices.com/de/praferenzmanagement/ you can manage your preferences for usage-based online advertising. You can deactivate or activate many providers at once or set the settings for individual providers.
For more information about Facebook’s data policy, please visit https://www.facebook.com/policy.php.
On our website you have the possibility to register for our newsletter. For this purpose we collect and use your name and e-mail address and your specific interests. No other data is collected in connection with the newsletter. Your e-mail address is not visible to other recipients of the newsletter.
The dispatch of the newsletter, as well as the associated data handling, is only carried out on the basis of your consent. You can revoke this consent at any time. For this purpose, there is an unsubscribe link in the newsletter or you can write us an e-mail: firstname.lastname@example.org.
For the dispatch of our newsletter we use the service MailChimp. This is an offer of The Rocket Science Group, LLC, 512 Means Street, Suite 404, Atlanta, GA 30318. With the registration for our newsletter, the data given during the registration will be transferred to MailChimp and stored there. The data will also be transferred to our customer database where it will be compared with existing data sets and merged with existing data sets if they match.
19. Contact details
You can exercise all rights by sending an email to email@example.com, by contacting us personally by telephone or by sending a message by post. This may require you to identify yourself or contribute to your identification.
Box office of the Salzburg Festival
43 662 8045 500
Salzburg Festival Fund
Hofstallgasse 1, 5020 Salzburg
If you have any further questions, you can contact the data protection officer of the Salzburg Festival Fund at firstname.lastname@example.org or at our postal address.
Last updated in June 2020