Purpose of Data Processing

We process personal data collected through forms (booking requests) for the purpose of carrying out our business activities and fulfilling related legal and contractual obligations.

IP-address

When you visit our website, information is automatically stored on the web server. This includes the browser used, the operating system in use, the page that referred you to our website, the IP address, the time of access, and other information. From our perspective, this data is pseudonymized and cannot be associated with specific individuals without additional data sources. We do not analyze this data unless there is evidence of unlawful use of the website.

Cookies

Cookies are small text files that are sent when visiting a website and temporarily stored on the user’s hard drive. When the corresponding server of our website is accessed again by the user, the user’s browser sends the previously received cookie back to the server. The server can then evaluate the information obtained through this process in various ways. For example, cookies can be used to control advertising displays or to make navigating a website easier. If the user wishes to prevent the use of cookies, this can be done by changing the settings of the internet browser used on their computer — that is, the program used to open and display websites (such as Internet Explorer, Mozilla Firefox, Opera, or Safari).

Entering into a Data Processing Agreement

We have entered into a so-called “Data Processing Agreement” with MailChimp, under which we require MailChimp to protect our customers’ data and not disclose it to third parties. This agreement can be viewed at the following link: https://mailchimp.com/legal/forms/data-processing-agreement/sample-agreement/. You may revoke your consent to the storage of your data, your email address, and their use for sending the newsletter at any time, for example, via the “unsubscribe” link in the newsletter.

Web-Analysis (Google Analytics)

This website uses Google Analytics, a web analytics service provided by Google Inc. (“Google”).
Google Analytics uses so-called “cookies,” which are text files stored on the user’s computer that enable an analysis of how the website is used. The information generated by the cookie about the user’s use of this website (including the IP address) is transmitted to and stored on a Google server in the United States.
Google uses this information to evaluate website usage, to compile reports on website activity for website operators, and to provide other services related to website and internet usage. Google may also transfer this information to third parties where required by law or where such third parties process the information on Google’s behalf. Under no circumstances will Google associate the user’s IP address with other data held by Google.
Users can prevent the installation of cookies by adjusting the settings of their internet browser. However, in this case, not all features of this website may be fully usable. By using this website, users consent to the processing of data collected about them by Google in the manner and for the purposes described above.
You can prevent the storage of cookies by adjusting your browser software settings. Please note, however, that doing so may limit the full functionality of this website. In addition, you can prevent Google from collecting and processing data related to your use of the website (including your IP address) by downloading and installing the browser plugin available at the following link: http://tools.google.com/dlpage/gaoptout?hl=de. You can also prevent data collection by Google Analytics on this website by clicking the link below. An opt-out cookie will then be set to prevent the future collection of your data when visiting this website.

Further information about Google’s terms of use and Google’s privacy policy can be found at http://www.google.com/analytics/terms/de.html and https://www.google.at/intl/at/policies/.

Web-Analysis (Google Tag-Manager)

We use Google Tag Manager to efficiently manage tags on our website.
Google Tag Manager is a solution that allows website tags to be managed and deployed through a single interface. The service itself (the Tag Manager) does not process any personal data of users or businesses. However, it may trigger other tags that could collect personal data. Google Tag Manager does not access this data.
If a deactivation has been carried out at the domain or cookie level, it remains in effect for all tracking tags implemented via Google Tag Manager. For more information, please refer to the Google Tag Manager usage policy.

Web-Analysis (Microsoft Clarity)

We work with Microsoft Clarity and Microsoft Advertising to understand how users interact with our website.
This includes the use of behavioral metrics, heatmaps, and session recordings to help us improve and market our products and services. Website usage data is collected through first- and third-party cookies and other tracking technologies to determine the popularity of products, services, and online activities.
We also use this information to optimize the website, for fraud prevention and security purposes, and for advertising. For more information about how Microsoft collects and uses your data, please refer to the Microsoft Privacy Statement.

Web-Analysis (Leadfeeder)

We use Leadfeeder, a website analytics platform, to improve and market our products and services.
Website usage data is collected through first- and third-party cookies and other tracking technologies to determine the popularity of products, services, and online activities.
We also use this information to optimize the website, for fraud prevention and security purposes, and for advertising. For more information about how Leadfeeder collects and uses your data, please refer to the Leadfeeder Privacy Policy.

Payment Processing (Stripe)
We use Stripe to facilitate the processing of payments. Stripe offers a service called “Link,” which allows customers to store their payment methods securely with Stripe. In this context, transaction data, contact details, email addresses, payment method information, and identification document details may be transmitted.

Contacting Information

If you contact us via the form on the website or by email, the data you provide will be stored for six months for the purpose of processing your inquiry and in case of follow-up questions. We do not share this data without your consent.

Principles for the Processing of Personal Data

The processing of personal data is based on strict principles that regard the protection and security of data, as well as the rights of the individuals concerned, as top priorities.

Lawfulness and Transparency

The processing of data is carried out lawfully and in good faith.
Data subjects are informed, at the time of data collection, about the intended processing and handling of their data. In particular, they are informed at least about the following points:

Purpose Limitation

Data is collected and processed for specified, explicit, and legitimate purposes.
The processing of data is not carried out in any manner that is incompatible with those purposes.

Data Minimization

Only the data that is strictly necessary for the specified purposes is collected and processed.
Whenever possible and reasonable in relation to the intended purpose, only anonymized data is processed.

Storage Limitation and Deletion

Personal data is deleted as soon as the purpose for which it was originally collected no longer applies and no legal retention requirements prevent its deletion.
If, in individual cases, there are legitimate interests in retaining this data, it will continue to be stored until such interests have been legally resolved.

Data Security

All personal data is subject to data confidentiality.
Such data must be handled with strict confidentiality and is protected by appropriate organizational and technical measures against unauthorized access, unlawful manipulation or disclosure, as well as against loss and destruction.

Accuracy

Personal data must be accurate, complete, and kept up to date.
Appropriate measures are taken to correct any data that is outdated, inaccurate, or incomplete.

Obligation to Data Confidentiality

All our employees are contractually bound to confidentiality and are regularly instructed and trained on the secure handling of personal and other sensitive data.

Rights of Data Subjects

Every data subject whose personal data is processed by us has the right to invoke and exercise their data subject rights at any time.
To exercise these rights, you may contact us in writing at any time by email at info@zflys.at.

Right of Access
Data subjects have the right to request information at any time about the personal data processed about them and the purposes for which this processing takes place.

Right to Rectification

Data subjects have the right to request the immediate rectification of inaccurate personal data concerning them.

Right to Restriction of Processing

Data subjects have the right to request the restriction of processing if the accuracy of their personal data is contested, if the processing is unlawful, if the data is no longer required for the purpose of processing, or if the data subjects have objected to the processing.

Right to Withdraw Consent

Data subjects have the right to object at any time to the processing of their personal data.

Data Portability

Data subjects have the right to receive the personal data concerning them that they have provided to us in a structured, commonly used, and machine-readable format.
They also have the right to request that this data be transmitted to another controller, where technically feasible. This right to data portability applies only to personal data processed by automated means.

Erasure – Right to be Forgotten

The data subject has the right to request the immediate deletion of their personal data if there is no legal basis for processing, if the legal basis no longer applies, if an objection to processing has been raised, or if the processing is unlawful and no statutory retention obligations prevent deletion.
Data security also plays an important role in the exercise of data subject rights. Therefore, such rights can only be exercised after the clear identification of the data subject.
In addition, you have the right to lodge a complaint with the data protection authority at any time.

Data Transfer

The transfer of personal data to recipients outside the company, as well as to recipients in non-EU countries, is carried out only in accordance with applicable laws and on a lawful basis, while maintaining the highest standards of confidentiality and data security.
We make use of various processors for certain types of data processing. All processors are contractually bound by a data processing agreement to comply with the data protection regulations applicable by law.