Data Privacy Statement

We appreciate your interest in our website.

In this privacy policy, we inform you about the processing activities of your personal data in the context of our website.

The protection of your personal data and your privacy is particularly important to us. For this reason, we process your data exclusively on the basis of the statutory provisions [Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (GDPR), Data Protection Act 2018 (DSG 20018), E-Privacy Directive, Telecommunications Act 2021 (TKG 2021)].

>> Click here to customise your privacy settings

Data controller and data protection officer

The data controller pursuant to Art 4(7) GDPR for this website is TBL Therme Laa a. d. Thaya – Betriebsgesellschaft m.b.H (hereinafter abbreviated to TBL).

If you have any questions about the processing of your data by TBL, you are welcome to contact us as follows:

• by letter to: For the attention of Mrs Mag. Agnes Buchner, Sterngasse 5, 1230 Wien
• by telephone under: 01 60127 0
• via e-mail to: datenschutz@therme-laa.at

The contact details of the TBL Data Protection Officer are as follows:

Mrs Agnes Buchner M.A.
Sterngasse 5, 1230 Wien
Phone: 01 60127 0
datenschutz@therme-laa.at

1. Processing of personal data when visiting our website

1.1. Processing of access data

For reasons of operational security, to compile access statistics, for error control, etc., web server log files are created. These log files are stored for a fortnight in compliance with the GDPR. The following data is recorded:

• the page called up (URL)
• the browser or browser version
• the operating system used
• the referrer URL (the previously visited page)
• host name and IP address of the accessing computer
• the time of the server request

purpose of data processing

This data is statistically analysed in order to improve the website and make it more user-friendly, to find and rectify errors more quickly and to manage server capacities. We will only use this data in personalised form for the purpose of legal prosecution if there is a concrete indication of illegal use of our website.

Storage period

Your data will only be stored for a period of 2 weeks.

Legal basis

The legal basis for the processing of access data is the legitimate interest of TBL (online service offer & data security) in accordance with Art. 6 (1) lit. f – GDPR.

1.2. Cookies

1.2.1 Use of technical cookies

In order to make the visit of our website attractive and to enable the use of certain functions, we use so-called cookies on various pages. These are small text files that are stored on your end device. Cookies enable us to recognise your browser the next time you visit our website. Cookies are set in accordance with the legal situation under EU and Austrian law (Art. 5 (3) ePrivacy Directive and Section 165 (3) TKG 2021).

These are the following cookies:

Name	Description	Storage period
_utma	Google Analytics Cookie to recognise visitors	360 days
_ga	Google Analytics Cookie to recognise visitors	26 months
_gid	Google Analytics Cookie to recognise visitors	24 hours
PHPSESSID	Session cookie from CMS Contao	24 hours
hc session	Hotelchamp Session Cookie	Session

You can set your browser so that you are informed about the setting of cookies and decide individually about their acceptance or you can exclude the acceptance of cookies for certain cases or in general. However, deactivating cookies may limit the functionality of our website.

Legal basis

The legal basis for the setting of technical cookies is the legitimate interest of TBL (online service offer & data security) in accordance with Art. 6 (1) f GDPR.

1.2.2. Use of third-party cookies

TBL uses various services for this website which also set cookies.

The following third-party cookies are set:

Name	Description	Storage period
_gcl_aw	Google Adwords Conversion Cookie	90 days

To avoid cookies being set by advertising providers, you can also block third-party cookies in your browser. Here you will find instructions for the most common browsers: Firefox, Chrome and Internet Explorer. In Apple’s Safari, third-party cookies are blocked by default.

TBL informs you about the use or setting of cookies by means of cookie banners. If you continue to navigate on the website after the information on our cookie banner, you agree to the setting of cookies.

You can access further information about the individual cookies via a link in the cookie banner. You can block the setting of individual or all cookies via your browser settings.

1.2.3. Google Analytics

This website uses Google Analytics, a web analytics service provided by Google Inc, 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA (“Google”). Google Analytics also uses cookies that enable your use of the website to be analysed. The information generated by the cookie about your use of this website is usually transmitted to a Google server in the USA and stored there. Only in exceptional cases will the full IP address be transmitted to a Google server in the USA and truncated there. Google will use this information on behalf of the operator of this website to analyse your use of the website, to compile reports on website activity and to provide the website operator with other services relating to website activity and internet usage. The IP address transmitted by your browser as part of Google Analytics will not be merged with other Google data. You can prevent Google from collecting the data generated by the cookie and relating to your use of the website (including your IP address) and from processing this data by Googleby downloading and installing the browser plug-in available at the following link (http://tools.google.com/dlpage/gaoptout?hl=de).

Alternatively, you can unsubscribe here:
Click here to be excluded from Google Analytics measurement.

Legal basis

The legal basis for the use of Google Analytics is the legitimate interest of TBL (Art 6 (1) (f) GDPR), which lies in the evaluation of the website and analysis of website activity.

Recipients of the data

This data is forwarded to Google for the stated purposes.

Storage period

The personal data will be stored for a period of 26 months and then deleted.

1.4. Social Plugins

Social plugins (“plugins”) are integrated on the TBL websites. These are the social networks:

• You Tube operated by YouTube, LLC, 901 Cherry Ave, San Bruno, CA 94066, USA
• TrustYou operated by TrustYou Headquarters, Munich Centre of Technology, Agnes-Pockels-Bogen 1, 80992 Munich, Germany

The plugins are labelled with a logo or the name of the operator. When you visit a TBL website that contains such a plugin, your browser establishes a direct connection with the operator’s servers. The content of the plugin is transmitted directly to your browser by the operator and integrated into the website. By integrating the plugins, the operator receives the information that you have accessed the corresponding TBL website. If you are logged in with the operator, the operator can assign the visit to your user account. If you interact with the plugins, for example by clicking on a plugin button, the corresponding information is transmitted directly from your browser to the operator and stored there. By logging out of your user account, you can prevent the operator from assigning the collected information to your user account.

The purpose and scope of the data collection and further processing as well as the use of the data by the operator, including your rights in this regard and setting options to protect your privacy, can be found in the respective data protection notices:

Youtube: https://policies.google.com/privacy?hl=de&gl=de

1.5. SEM powered by SEMINARGO

We have integrated components of the company seminargo GmbH, 1160 Vienna Liebhartsgasse 16 (“seminargo”) on our website.

If you make an online booking or a booking request via our website, we need your first and last name, e-mail address, company name and billing address for processing.

The dates of stay, the desired configuration and the number of participants are required to calculate the valid travel price.

The processing of your data for the online booking and the online booking request is based on Art. 6 para. 1 lit. b GDPR and serves the fulfillment of a contract or the implementation of pre-contractual measures.

The data you transmit to us will remain with us until the purpose for data storage no longer applies (e.g. after your request has been processed). Mandatory statutory provisions – in particular statutory retention periods – remain unaffected.

2. Linking

The website contains links to other websites. These links to websites of other Internet participants are provided as a service to meet the accessing party’s need for further information. TBL has no influence on their content. TBL takes no liability for this content. Exclusively the respective provider of the linked website is responsible for the content and accuracy of the information provided there.

3. Newsletter

You have the option of subscribing to our newsletter.

Data processing

When you register for the newsletter, TBL processes the personal data you provide for the newsletter services of the hotel, the Therme and the Silent Spa:

• Email*
• Form of address
• Title
• First name
• Surname
• ZIP Code
• Federal state / Region
• Country

Purpose of processing

The personal data you provide when registering to receive the newsletter will be used for the purpose of

• sending you important information and offers.
• Analysis of the e-mail recipient’s click behaviour to optimise the editorial offer using the statistics program of the E-mail Marketing Software Evalanche from SC-Networks

follow-up questions.

Legal basis

The data processing of your personal data by TBL is based exclusively on the consent for sending the newsletter given by you (Art 6 (1) (a) GDPR).

Storage period

The data processed for the aforementioned purposes will be stored until you withdraw your consent to receive the newsletter. In addition, only the absolutely necessary data will be stored on the basis of the applicable legal provisions or retention obligations for the purpose of proving your consent or your revocation.

Recipients of the data

For the purpose of sending the newsletter, your data will be transmitted to our service provider, which handles the newsletter mailings for us.

Revocation of your consent

You can revoke your consent to receive the newsletter at any time by sending an email to info@therme-laa.at. You can also cancel your newsletter subscription at any time by clicking on the “Newsletter abbestellen” (Unsubscribe newsletter) button at the end of each newsletter.

4. Facebook

TBL Therme Laa a.d. Thaya Betriebsgesellschaft m.b.H. operates a Facebook fan page on which your personal data is processed. As the operator of this fan page, TBL is also the controller within the meaning of data protection law.

Data about you may be collected via the fan page using cookies, regardless of whether you have a Facebook account or not. Facebook alone decides on the use of these cookies. TBL has no influence on this. Details on the use of cookies by Facebook can be found in Facebook’s data policy (https://www.facebook.com/privacy/explanation) and cookie policy(https://www.facebook.com/policies/cookies/). You can also download your own Facebook data directly from Facebook (download the so-called “extended archive” in your account settings).

Your data may be passed on to Facebook Inc. in the USA by the cookies. Facebook is certified for the EU-US Privacy Shield, i.e. Facebook must comply with a data protection standard for users in Europe that has been recognised by the European Commission as being comparable to the European standard. Besides this, Facebook can set cookies from third-party providers. These are listed here. Their cookie policies can be found on their respective websites.

You can revoke your consent to the storage, processing and use of your data by cookies in the context of using the fan page at any time with effect for the future. In this case, the processing carried out until the cancellation remains legally valid.

5. Get in touch with us

We would be delighted to hear from you.

Data processing

If you contact us using the form on the website or by e-mail, the data you provide will be stored by us for six months for the purpose of processing the enquiry and in the event of follow-up questions. We will not pass on this data without your consent.

Purpose of processing

The personal data you provide when contacting us will be processed for the purposes

• of establishing contact
• processing the enquiry and

follow-up questions.

Legal basis

The processing of your personal data in the context of contacting us is based on the implementation of pre-contractual measures in accordance with Art 6 (1) (b) GDPR.

Data transfer

Your data will not be transmitted to third parties.

Storage period

The data processed for the aforementioned purposes will be processed and stored for a period of 6 months.

6. Gift Card Shop

Data processing

As part of the business relationship, when purchasing a VAMED Vitality World gift card, TBL processes the following personal data that becomes known (in short: “the data”):

• First name
• Surname
• Address
• E-mail address
• Phone number
• Company name, if applicable
• Password
• Payment details (encrypted)
• Customer account data (orders placed, articles, prices, IP address)
• Text and images or photos entered for print at Home vouchers
• Prepaid card queries (voucher number, date, IP address)

Purpose of processing

The purposes of data processing are the completion of the respective business transaction and – if the CUSTOMER has consented – the marketing of products, services and services of the VVW resorts, promotions and events as well as news of the VVW resorts (including sending corresponding marketing materials by post, e-mail and, if applicable, SMS and contacting by telephone, if necessary).

Legal basis

Processing for the purpose of processing the business transaction is carried out on the basis of Art. 6 (1) b) EU General Data Protection Regulation (“GDPR”) (fulfilment of the contract). The processing of data for marketing purposes is based on Art. 6 (1) a) GDPR (consent).

Data transfer

The data is transmitted on behalf of TBL to TAC, The Assistant Company (Schildbach 111, 8230 Hartberg) and mPAY24 GmbH (Grüngasse 16, 1050 Vienna) for the purpose of processing the business transaction as well as for marketing purposes to EMARSYS eMarketing SystemsAG (Märzstraße 1, 1150 Vienna) and TravelClick (Via Augusta, 117, Barcelona 08006, Spain). The data will not be transferred to other third parties.

Storage period

The data is stored for the processing of the business transaction and for marketing purposes and in addition as long as statutory retention periods exist, legal claims from the contractual relationship can be asserted or other legitimate reasons justify further storage.

7. Shop for Service Vouchers

Data processing

As part of the business relationship when purchasing a service voucher, TBL processes the following personal data that becomes known (in short: “the data”):

• Form of address
• Title
• First name
• Surname
• Address
• E-mail address
• Date of birth
• Phone number
• Password
• Customer account data (orders placed, articles, prices, IP address)
• Texts entered for print at Home vouchers

Purpose of processing

The purposes of data processing are

• the processing of the relevant business transaction
• and – if the CUSTOMER has consented – the marketing of TBL products, services and services, promotions and events as well as news from TBL (including the sending of relevant marketing materials by post, e-mail, SMS and contact by telephone).

Legal basis

Processing for the purpose of processing the business transaction is carried out on the basis of Art. 6 (1) b) EU General Data Protection Regulation (“GDPR”) (fulfilment of the contract). The processing of data for marketing purposes is based on Art. 6 (1) a) GDPR (consent).

Data transfer

The data is transmitted on behalf of TBL to TAC, The Assistant Company (Schildbach 111, 8230 Hartberg) and mPAY24 GmbH (Grüngasse 16, 1050 Vienna) for the purpose of processing the business transaction as well as for marketing purposes to EMARSYS eMarketing SystemsAG (Märzstraße 1, 1150 Vienna) and TravelClick (Via Augusta, 117, Barcelona 08006, Spain). The data will not be transferred to other third parties.

Storage period

The data is stored for the processing of the business transaction. In addition, the data will only be stored for as long as statutory storage periods exist, legal claims arising from the contractual relationship can be asserted or other legitimate reasons justify further storage.

8. Data security

The security of your personal data is a matter of particular importance to us.

Taking into account the state of the technology, the costs of implementation and the nature, scope, context and purposes of processing as well as the likelihood and severity of the risk to the rights and freedoms of natural persons, TBL shall implement appropriate technical and organisational measures in accordance with Article 32 GDPR.

In this sense, the following measures, among others, are taken to protect your data and secure it against loss, destruction, access, modification and dissemination by unauthorised persons:

• Ensuring the confidentiality, integrity, availability and resilience of the systems and services related to processing;
• Ensuring rapid recovery of the availability of personal data in the event of a physical or technical incident;
• Implementation of procedures to regularly review, assess and evaluate the effectiveness of technical and organisational measures for ensuring the security of processing.

Please note that we accept no liability for the publication of information due to errors in data transmission not caused by us or attributable to us and/or unauthorised access by third parties.

9. Your rights

As a user of our website, you have the following rights:

• Right to information(Art 15 GDPR): You have the right to request confirmation from TBL as to whether your personal data is being processed. In addition, you have the right to request further information about specific processing purposes, categories of personal data, recipients or categories of recipients of personal data, storage duration, the existence of a right to erasure or rectification of your personal data or to restriction of processing and the right to object, the existence of a right to lodge a complaint and regarding all available information about the origin of your data.
• Right to correction (Art 16 GDPR): You have the right to obtain from TBL without undue delay the correction of your personal data. This right includes the correction of incorrect data and the completion of incomplete personal data.
• Right to deletion (Art 17 GDPR): You have the right to demand that TBL delete your personal data immediately if the reasons set out in Art. 17 (1) (a) to (f) GDPR apply (e.g. the purpose for processing is no longer given) and the processing of your personal data is not necessary.
• Right to limitation of processing (Art 18 GDPR): In the cases specified in Art. 18 GDPR (e.g. inaccuracy of the processed personal data, unlawfulness of the processing, etc.), you also have the right to demand that TBL restricts the processing.
• Right to data portability (Art 20 GDPR): You have the right to receive the personal data concerning you, which you have provided to TBL, in a structured, commonly used format and to demand that TBL transmit those data to another controller (e.g. to another law firm).
• Right to object (Art 21 GDPR): You have the right to object at any time to the processing of your personal data processed in the context of this website.
• Right to revoke declarations of consent (Art 7 GDPR): You have the option to withdraw your consent from TBL at any time.
• Right to appeal: You can also submit a complaint at any time to

Österreichische Datenschutzbehörde (Austrian Data Protection Authority),

Wickenburggasse 8
1080 Wien

Phone: +43 1 521 52-25 69
e-mail: dsb@dsb.gv.at

You can assert your rights as a data subject – with the exception of the right to lodge a complaint with the Austrian Data Protection Authority – against TBL at the following address:

• by letter to: For the attention of Mr Per-Oliver Gustavson M.A., Sterngasse 5, 1230 Wien
• by telephone under: 01 60127 0
• via e-mail to: datenschutz@therme-laa.at