1. Restplatzbörse
  2. Data Protection

Restplatzbörse Privacy Policy

Important: This page is a translation for your convenience. Only the original German version is legally binding. Please refer to the German Privacy Policy for the official terms.

We take statutory data protection seriously and therefore inform you below about the processing of personal data.

When you book a trip with us, the personal data of the main traveler (booking applicant) and all travel participants are transferred to

Last Minute Tours – Reisen in letzter Minute Flugticket- und Restplatzbörse Ges.m.b.H., Neubaugasse 43, A-1070 Vienna

and processed by the aforementioned company for the purpose of travel processing and travel preparation. The aforementioned company is the data controller within the meaning of Art. 4 No. 7 GDPR, unless specified otherwise in the relevant section.

The following personal data are processed:

  • Master data (name, address, date of birth, email address, telephone number, customer number)
  • Payment methods (credit card, bank details)
  • Travel data
  • Special categories of data pursuant to Art. 9 GDPR (for example, health data, such as for special assistance or the processing of travel insurance)

By making a booking, you expressly consent to this data processing within the meaning of Art. 6 Paragraph 1 Lit. a GDPR.

In order to prepare the trip optimally for all travel participants, it is essential to pass on the relevant personal data of the main traveler and the travel participants to various recipients. You expressly consent to this transfer of data.

Furthermore, you agree to inform all travel participants about the disclosure of personal data as described in this Privacy Policy and in other applicable privacy policies, such as those of the tour operator.

Possible data recipients are:

  • Tour operators
  • Airlines
  • Accommodations
  • Cruise lines and shipping companies
  • Booking platforms
  • Travel review companies
  • Payment platforms (payment providers)
  • Travel insurance providers – The data protection information of HanseMerkur Reiseversicherung AG for Austria can be found at https://www.hansemerkur.at/datenschutz
  • Car rental companies
  • Transfer services
  • Employees and consultants of the online platforms
  • Company commissioned with providing the voucher system and processing vouchers: INCERT eTourismus GmbH & Co KG, Büro Lederfabrik Linz, Entrance East, Leonfeldnerstraße 328, A-4040 Linz
  • Service center commissioned with booking processing: travianet GmbH, Angermühle 8a, 94469 Deggendorf

Please note the privacy policies of the respective companies.

Please note that if a travel contract is concluded within the meaning of Art. 6 Paragraph 1 Lit. b GDPR, personal data concerning the main traveler and the travel participants will be transmitted to internal and external service providers. We explicitly point out that depending on the trip, the tour operator, and the destinations, personal data may leave the European Economic Area (EEA). We also explicitly point out that it is not possible for us to obtain the necessary guarantees within the meaning of the GDPR regarding compliance with statutory data protection regulations for all recipients of personal data outside the European Economic Area. By booking, you expressly consent to these conditions within the meaning of Art. 49 Paragraph 1 Lit. a GDPR.

By making an inquiry or booking, you confirm that you are authorized to grant us the necessary consents within the meaning of Art. 6 Paragraph 1 Lit. a GDPR regarding the transfer of personal data concerning you and all travel participants to insecure third countries.

Personal data concerning you, as well as the personal data of all travel participants, will be retained in our systems within the statutory retention periods and protected in accordance with the specifications of Art. 24 and 32 GDPR. However, to provide our customers with optimal support, please note that retention may occur beyond the statutory requirements. If you do not wish this, you can inform us at any time.

To tailor our online services optimally to your needs, we use systems that reflect your interests. Based on this, we prioritize offers that match your interests.

Rights of the Data Subject

Right of access (Article 15 GDPR) You have the right to obtain free information about the personal data stored about you at any time. If the right of access is excessively claimed by directing requests to the controller in an abusive or repetitive manner, a local standard fee may be charged to cover the administrative costs of providing the information.

Right to rectification (Article 16 GDPR) You have the right to demand without delay the rectification of inaccurate personal data concerning you.

Right to erasure (Right to be forgotten) (Article 17 GDPR) You have the right to demand that personal data concerning you be erased without delay, provided that they are no longer necessary for the purposes for which they were collected or otherwise processed, and that there are no legal grounds opposing erasure. If you request erasure, we will verify the aforementioned legal requirements and inform you accordingly.

Right to restriction of processing (Article 18 GDPR) You have the right to request the restriction of processing.

Right to data portability (Article 20 GDPR) You have the right to receive the personal data concerning you, which you have provided to a controller, in a structured, commonly used, and machine-readable format, and you have the right to transmit those data to another controller without hindrance from the controller to whom the personal data have been provided.

Right to object (Article 21 GDPR) If we process personal data based on public interest, in the exercise of official authority, or due to a legitimate interest, you have the right to object to this processing of your data at any time. We process personal data for direct marketing purposes. You have the right to object to this processing of your data at any time. This also applies to profiling, insofar as it is related to such direct marketing.

Right to withdraw consent (Article 7 Paragraph 3 GDPR) You have the right to withdraw any previously given consent to data processing at any time. The withdrawal of consent shall not affect the lawfulness of processing based on consent before its withdrawal.

Right to lodge a complaint (Article 77 GDPR) If you believe that the processing of your personal data violates data protection regulations or that your data protection rights have been violated in any other way, you can lodge a complaint with the supervisory authority. In Austria, this is the Data Protection Authority (Datenschutzbehörde), Wickenburggasse 8, 1080 Vienna. If you wish to exercise this right, you can contact them at dsb@dsb.gv.at.

 

Exercising Data Subject Rights

For inquiries regarding data protection or to exercise the rights illustrated above, you can reach us at the following contact details:

  • by post to: Last Minute Tours - Reisen in letzter Minute Flugticket- und Restplatzbörse Ges.m.b.H., Neubaugasse 43, A-1070 Vienna *
  • by email to:datenschutz@restplatzboerse.at *

* Please enclose a copy of an official ID and note the information on data security (see the following section).

Data Security

We ensure that you are secure!

You can feel completely safe on our website, from your initial search and booking right through to payment. We stand for verified security when handling sensitive personal data, such as credit card details, using secure encryption in line with the latest technical standards.

As you may know, security for communication over the internet can never be guaranteed 100%. This applies in particular to emails or social media platforms, which do not represent secure communication channels and should therefore not be used to transmit credit card information or copies of ID cards. If you wish to send your credit card details or copies of your ID to us electronically, we will gladly provide an option for an encrypted upload upon request.

What is a cookie and what do cookie warnings mean?

A cookie is a small package of information transferred between your browser and a website.

Restplatzbörse uses cookies to save travel offers in your shopping cart or to remember recently viewed hotels, for example. You can also use the website without cookies, but your experience will be much more convenient if cookies are enabled.

Most browsers accept cookies automatically. You can adjust your browser settings so that cookies are rejected or only accepted with your consent. If you do not want a warning to appear every time, you can also deactivate these notifications. You can disable the use of third-party cookies by visiting the Network Advertising Initiative opt-out page.

Use of Google Analytics

This website uses Google Analytics, a web analysis service provided by Google LLC ("Google"), which is integrated via Google Tag Manager. Google Analytics uses so-called "cookies", which are text files stored on your computer that allow an analysis of your use of the website. The information generated by the cookie about your use of this website is transmitted to a Google server in the USA and stored there. Google will use this information to evaluate your use of the website, to compile reports on website activity for website operators, and to provide other services related to website activity and internet usage. Google may also transfer this information to third parties if required by law or if third parties process this data on behalf of Google.

Google offers a browser add-on for all common browsers, which allows you to object to the use of Google Analytics.

Remarketing

Remarketing is conducted via this website. Remarketing is an advertising method where ads are displayed on other websites across the internet. Our partners use cookies so that our ads can be shown to you on other websites based on your previous visits to our website. The privacy policies of the respective companies apply. You can find information about the data protection practices of our remarketing partners as well as their settings for interest-based advertising on the following linked pages:

Use of Third-Party Content (Third-Party Services and Content)

Our website uses various services to offer you the most comprehensive content possible, making it easier for you to choose your next dream holiday. The legal basis for this is Art. 6 Paragraph 1 lit. f GDPR. Our legitimate interest lies in optimizing the functionality, quality, and security of our online presence.

The use of such services always requires that the providers of this content (third-party providers) receive the IP address of the users, as they would not be able to send the requested content to their browsers without the IP address. Therefore, the transmission of your IP address by your browser to the respective third-party provider is technically necessary for the display of this content.

If you do not wish to transmit your IP address to us or a third-party provider, you can mask your IP address, for example, by using a Virtual Private Network (VPN) privacy service. You can read more information about this topic on Wikipedia.

Third-party providers may also use so-called "web pixels" (implemented, among other things, through invisible graphics or scripts) for statistical or marketing purposes. Through these web pixels and the generated log files on the servers of the third-party providers, information such as the pages visited on this website, technical details about the browser and operating system, visiting times, and further details regarding the use of our online services can be analyzed. This information or a generated pseudonym (such as a user ID) which enables the third-party provider to merge this data, may also be stored in cookies on the user's device or linked to information from other sources. We have no influence on the processing of this data by the third-party provider. The privacy policies of the respective companies apply.

You can prohibit the setting of third-party cookies in your browser settings. In addition, depending on the browser, various add-ons are available to protect your privacy.

Please note that most of the third-party providers integrated into our website do not operate their data centers exclusively within the European Economic Area. However, some of the following US-based third-party providers have self-certified under the Privacy Shield framework. The Privacy Shield is an agreement developed in cooperation between the EU and the USA to enable a secure exchange of personal data. Following the adequacy decision of the EU Commission, as described in Article 45 GDPR, Privacy Shield provides an adequate level of protection for personal data at the time of the last update of this privacy policy.

  • Google Tag Manager: A tag management system. It allows the user to update measurement codes and associated code fragments, collectively referred to as tags, on the user's website or mobile app. For more information on the collection and processing of your data by Google, please refer to Google's Privacy Policy. Google is certified under the Privacy Shield agreement.
  • Usercentrics Consent Management Platform: A consent management service. Usercentrics GmbH is utilized on our website as a processor for consent management purposes. For more information on the collection and processing of your data by Usercentrics, please refer to Usercentrics' Privacy Policy.
  • Travel Audience: A digital advertising service for travelers with an integrated advertising platform based on AI technology and big data. A subsidiary of the Amadeus IT Group. For more information on the collection and processing of your data by Travel Audience, please refer to Travel Audience's Privacy Policy.
  • Facebook Pixel: A tracking technology offered by Facebook and used by other Facebook services. It is used to track visitor interactions with websites after they have clicked on an advertisement displayed on Facebook or other services provided by Meta. For more information on the collection and processing of your data by Facebook, please refer to Facebook's Privacy Policy. Facebook is certified under the Privacy Shield agreement.
  • Google Ads: An online advertising program by Google. For more information on the collection and processing of your data by Google, please refer to Google's Privacy Policy. Google is certified under the Privacy Shield agreement.
  • Microsoft Advertising: A tracking and advertising service that displays ads in search engines or partner websites. For more information on the collection and processing of your data by Microsoft, please refer to Microsoft's Privacy Policy. Microsoft is certified under the Privacy Shield agreement.
  • Criteo: A French company in the field of online marketing. They offer software solutions for personalized retargeting. For more information on the collection and processing of your data by Criteo, please refer to Criteo's Privacy Policy.
  • Google Maps: We use Google Maps to display geographical information visually. When using Google Maps, data about the use of the map functions by visitors is collected, processed, and utilized by Google LLC, Mountain View, USA. Your location data will only be provided to Google with your consent, which can also be granted device-wide or for the respective browser. If you are logged into your Google account while visiting our website, you enable Google to associate your page views directly with your personal profile. For more information on the collection and processing of your data by Google, please refer to Google's Privacy Policy. Google is certified under the Privacy Shield agreement.
  • GetYourGuide: A travel search tool necessary for the functionality of our website. When you search for a trip using this tool, personal data is forwarded to the service. This data is stored solely for the specified processing purposes and deleted thereafter. For more information on the collection and processing of your data by GetYourGuide, please refer to GetYourGuide's Privacy Policy.
  • Sentry: We use the services of Sentry for technical error analysis on our website. In the event of an error, relevant data such as browser version and operating system are sent to Sentry. This data is used by us exclusively for troubleshooting purposes. For more information, please refer to Sentry's Privacy Policy.
  • YouTube Video: A video player service. For more information on the collection and processing of your data by YouTube, please refer to Google's Privacy Policy. Google is certified under the Privacy Shield agreement.
  • Cloudflare: To improve the loading times of our website, we provide content such as images, videos, or technically necessary files for displaying the pages via a "Content Delivery Network" (CDN). Our utilized CDN is operated by Cloudflare, Inc., San Francisco, USA. When you access a page with content delivered via Cloudflare, these files are loaded from a Point of Presence (PoP) server operated by Cloudflare. For more information on the collection and processing of your data by Cloudflare, please refer to Cloudflare's Privacy Policy. Cloudflare is certified under the Privacy Shield agreement.
  • GIATA: When you access a page that contains images, videos, or texts from GIATA, this content is also loaded directly from the servers operated by GIATA GmbH, Berlin, Germany. For more information on the collection and processing of your data by GIATA, please refer to GIATA's Privacy Policy.
  • Amadeus: When you access a page that contains images, videos, or texts from Amadeus, this content or entire pages are also loaded directly from the servers operated by Amadeus Leisure IT GmbH, Würselen/Aachen, Germany. For more information on the collection and processing of your data by Amadeus, please refer to Amadeus' Privacy Policy.
  • Instagram Content: This is a plugin of the social media platform Instagram. For more information on the collection and processing of your data by Instagram, please refer to Instagram's Privacy Policy. Instagram is certified under the Privacy Shield agreement.
  • AdUp Technology: A demand-side platform for performance marketing. For more information on the collection and processing of your data by AdUp Technology, please refer to AdUp Technology's Privacy Policy.

Fraud Detection System

To prevent and detect fraudulent activities, we utilize a so-called Fraud Detection System. The provider of this Fraud Detection System is Ypsilon Abrechnungs GmbH, Vilbeler Landstraße 203, 60388 Frankfurt am Main, Germany. The outcome of this assessment determines how the booking will be processed further. For the evaluation of fraud detection, the data entered during your booking (salutation, title, first name, last name, date of birth, address, telephone number, email, IP address, travel details/booked products, data of accompanied travelers, and payment data of the end consumer) is processed, with the exception of health data. Automated decision-making or automated rejection of contracts or payment methods does not take place. In the event of a negative score, the booking request is handed over to an employee with a note for manual review of the booking inquiry. Thus, the automated booking process is converted into a manual one. In the case of a positive score, the booking is executed independently by the system. Only if an employee is unable to reach you as a customer, if the address is obviously incorrect, or if there have been prior fraud attempts associated with this customer data in the past, may a booking potentially be rejected until the matter is fully clarified.

The data processing is based on a business purpose in accordance with Art. 6 Paragraph 1 lit. f GDPR. The controller has a legitimate interest in implementing measures for fraud detection and prevention. We have concluded a data processing agreement with the provider of the Fraud Detection System in accordance with Art. 28 GDPR. Your data will be transmitted to the internal employees of the controller for verification. The verified data is stored for 6 months. If the system indicates fraud detection, the data remains stored in the system until the facts of the matter are resolved. Privacy Policy of Ypsilon Payment Solutions

Log Files

When you visit our website, so-called server log files are recorded and archived for twelve months. The collection of this data is based on Section 96 Paragraph 3 of the Austrian Telecommunications Act (TKG) as well as Art. 6 Paragraph 1 lit. f GDPR. We use the generated log files to optimize our online presence and to detect and prevent attacks on our digital environment. They include data automatically transmitted by your device: IP address, date and time of the request, time zone difference to GMT, content of the request (specifically accessed page), access status/HTTP status code, the amount of data transferred in each case, the requesting website, browser, operating system and interface, as well as the language and version of the browser software.

Reviews

As part of your booking, you have the opportunity to review both our company on Trustpilot (Privacy Policy) and your trip itself. These reviews are entirely voluntary. If you choose to submit a review, we would like to thank you in advance, as every piece of feedback helps us to continuously improve our service for you.

By submitting a review of our company, you consent to us publishing your review on Trustpilot and across our online presence. A few days after your booking, you will receive an email from Trustpilot asking you to rate our performance. For this purpose, we transmit your email address and your name to Trustpilot.

Regarding the review of your trip, you consent to your travel review being integrated into various travel websites as part of the Trusted Reviews program (Privacy Policy). To submit a review, you will receive an email from Traveltainment a few days after your booking, asking you to rate the hotel. If you have any questions about your review on Trusted Reviews, please contact the responsible operator directly via email at hotelbewertung@traveltainment.de. Alternatively, we are also happy to forward your requests to them. The option to review a trip is only available for bookings made online.

Newsletter

With the following information, we explain the content of our newsletter as well as the registration, dispatch, and statistical evaluation procedures, alongside your rights of objection. By subscribing to our newsletter, you agree to receive it and consent to the procedures described.

Content of the Newsletter

We send newsletters, emails, and other electronic notifications containing promotional information (hereinafter referred to as the "newsletter") only on the basis of Art. 6 Paragraph 1 lit. a and f GDPR.

Double Opt-In and Logging

Registration for our newsletter takes place via a so-called double opt-in procedure. This means that after registering, you will receive an email asking you to confirm your subscription.

Registrations for the newsletter are logged in order to be able to verify the registration process in accordance with legal requirements. This includes storing the time of registration and confirmation, as well as the IP address.

Use of the Distribution Service Provider "CleverReach"

The newsletter is dispatched using "CleverReach", a newsletter distribution platform provided by the German company CleverReach GmbH & Co KG – www.cleverreach.com.

The email addresses of our newsletter recipients, as well as their other data described in this information, are stored on CleverReach's servers in Germany. CleverReach uses this information to send and evaluate the newsletters on our behalf. Furthermore, CleverReach may use this data to optimize or improve its own services, e.g., for the technical optimization of dispatch and the display of the newsletters, or for economic purposes to determine which countries the recipients come from. However, CleverReach does not use the data of our newsletter recipients to write to them directly or to pass the data on to third parties.

We trust in the reliability, IT security, and data security of CleverReach.

Registration Data

To register for the newsletter, it is sufficient to provide your email address.

Optionally, we ask you to provide your first and last name. This information is solely used to personalize the newsletter. We only use this information to adapt the content of the newsletter to the interests of our readers.

Statistical Collection and Analysis

When the newsletter is accessed, technical information such as details about your browser and system, as well as your IP address and the time of retrieval, are initially collected. This information is used for the technical improvement of the services based on technical data, or targeting specific audiences and analyzing reading behavior based on retrieval locations (which can be determined using the IP address) or access times.

Statistical surveys also include determining whether the newsletters are opened, when they are opened, and which links are clicked. For technical reasons, this information can be assigned to individual newsletter recipients. However, it is neither our intention nor that of CleverReach to monitor individual users. Rather, the evaluations help us to recognize the reading habits of our users and to adapt our content to you, or to send different content according to the interests of our users.

Online Access and Data Management

There are cases where we direct newsletter recipients to the CleverReach websites. For example, our newsletters contain a link that allows recipients to retrieve the newsletter online (e.g., in the event of display problems in the email client). Similarly, CleverReach's privacy policy can only be accessed on their website.

In this context, we point out that cookies are used on the CleverReach websites, meaning that personal data is processed by CleverReach, its partners, and utilized service providers (such as Google Analytics). We have no influence on this data collection. You can find further information in the Privacy Policy of CleverReach.

Cancellation / Revocation

You can cancel the receipt of our newsletter at any time, which means revoking your consent. This simultaneously voids your consent to its dispatch via CleverReach and the statistical analyses. A separate revocation of the dispatch via CleverReach or the statistical evaluation is unfortunately not possible.

You will find a link to cancel the newsletter at the end of each newsletter.

Legal Basis General Data Protection Regulation

In accordance with the requirements of the GDPR, we inform you that consent to the dispatch to the email addresses is based on Art. 6 Paragraph 1 lit. a. The use of the distribution service provider CleverReach, the performance of statistical surveys and analyses, and the logging of the registration process are based on our legitimate interests in accordance with Art. 6 Paragraph 1 lit. f GDPR. Our interest is focused on the use of a user-friendly and secure newsletter system that serves both our business interests and meets the expectations of our users.

Furthermore, we point out that you can object to the future processing of your personal data at any time in accordance with the legal requirements of Art. 21 GDPR. The objection can be made, in particular, against processing for the purposes of direct marketing.

Social Media Presence

To offer you travel inspiration, our social media channels provide updates, offers, and information about beaches, hotels, regions, and much more. Please also note the privacy policies of the respective platforms.

Notice for Travel to the USA or Transit Through US Airspace

All airlines are legally required to disclose the flight and reservation data of all passengers traveling to, from, or through the United States to the US Customs and Border Protection authority. This data is required for security purposes and is treated with strict confidentiality.

For further questions, please send us an email at datenschutz@restplatzboerse.at.

Vienna, November 7, 2018

Important: This page is a translation for your convenience. Only the original German version is legally binding. Please refer to the German Privacy Policy for the official terms.