Introduction and Overview

We have prepared this privacy policy (version 06.05.2026-113213544) to explain to you, in accordance with the requirements of the General Data Protection Regulation (EU) 2016/679 and applicable national laws, which personal data (hereinafter referred to as "data") we, as data controllers – and the data processors we have engaged (e.g., providers) – process, will process in the future, and what legal options you have. The terms used are to be understood as gender-neutral.

In short: We provide you with comprehensive information about the data we process about you.

Privacy policies usually sound very technical and use legal terminology. This privacy policy, however, aims to describe the most important aspects to you as simply and transparently as possible. Where it promotes transparency, technical terms are explained in a reader-friendly manner, links to further information are provided, and graphics are used. We are informing you in clear and simple language that we only process personal data in the course of our business activities when there is a corresponding legal basis for doing so. This is certainly not possible if one provides the briefest, unclear, and overly technical legal explanations that are so often standard practice on the internet when it comes to data protection. I hope you find the following explanations interesting and informative, and perhaps you will find some information here that you were not previously aware of.

If you still have questions, please contact the responsible party named below or in the legal notice, follow the provided links, and consult further information on third-party websites. Our contact details can, of course, also be found in the legal notice.

Scope of Application

This privacy policy applies to all personal data processed by us within our company and to all personal data processed by companies we have commissioned (data processors). Personal data, as defined in Article 4 No. 1 of the GDPR, refers to information such as a person's name, email address, and postal address. The processing of personal data enables us to offer and bill for our services and products, whether online or offline. This privacy policy applies to:

all online presences (websites, online shops) that we operate
social media presence and email communication
mobile apps for smartphones and other devices
In short: This privacy policy applies to all areas where personal data is processed in a structured manner within our company via the aforementioned channels. Should we enter into a legal relationship with you outside of these channels, we will inform you separately.

Legal Basis

In the following privacy policy, we provide you with transparent information about the legal principles and regulations, i.e., the legal bases of the General Data Protection Regulation (GDPR), that allow us to process personal data.

• With regard to EU law, we refer to REGULATION (EU) 2016/679 OF THE EUROPEAN PARLIAMENT AND OF THE COUNCIL of 27 April 2016. You can, of course, read this EU General Data Protection Regulation online at EUR-Lex, the access point to EU law, at eur-lex.europa.eu/legal-content/DE/ALL/.
• We only process your data if at least one of the following conditions applies:
• Consent (Article 6(1)(a) GDPR): You have given us your consent to process data for a specific purpose. An example would be the storage of the data you entered in a contact form.
• Contract (Article 6 paragraph 1 lit. b GDPR): We process your data to fulfill a contract or pre-contractual obligations with you. For example, if we conclude a purchase agreement with you, we require personal information beforehand.
• Legal obligation (Article 6 paragraph 1 lit. c GDPR): We process your data if we are subject to a legal obligation. For example, we are legally obligated to retain invoices for accounting purposes. These typically contain personal data.
• Legitimate interests (Article 6 paragraph 1 lit. f GDPR): In the case of legitimate interests that do not infringe your fundamental rights, we reserve the right to process personal data. For example, we need to process certain data to operate our website securely and efficiently. This processing is therefore a legitimate interest.

Other conditions, such as the performance of a task carried out in the public interest or in the exercise of official authority, as well as the protection of vital interests, do not generally apply to us. If such a legal basis should apply, it will be indicated accordingly.

In addition to the EU regulation, national laws also apply:

• In Austria, this is the Federal Act on the Protection of Natural Persons with regard to the Processing of Personal Data (Data Protection Act), abbreviated DSG.
• In Germany, the Federal Data Protection Act, abbreviated BDSG, applies.

If other regional or national laws apply, we will inform you about them in the following sections.

Contact details of the data controller

Should you have any questions regarding data protection or the processing of personal data, you will find the contact details of the data controller below, in accordance with Article 4, Paragraph 7 of the EU General Data Protection Regulation (GDPR):
Eslam Hassan Mostafa Mohamed
Qina_Qus_Hagaza, 84511 Hurghada
Authorized representative: Eslam Hassan Mostafa Mohamed
Email: eh11223311@gmail.com
Telephone: +20 110 460 5884
Legal notice: https://www.discover-your-trip.com/imprint

Data Retention Period

We generally store personal data only for as long as is absolutely necessary for providing our services and products. This means that we delete personal data as soon as the reason for processing it no longer exists. In some cases, we are legally obligated to retain certain data even after the original purpose has ceased, for example, for accounting purposes.

If you wish to have your data deleted or withdraw your consent to data processing, the data will be deleted as quickly as possible, provided there is no legal obligation to retain it.

We will inform you about the specific duration of the respective data processing below, if we have further information available.

Rights under the General Data Protection Regulation (GDPR)

In accordance with Articles 13 and 14 of the GDPR, we inform you about the following rights you have to ensure fair and transparent data processing:

• According to Article 15 of the GDPR, you have the right to access your personal data. If this is the case, you have the right to receive a copy of the data and the following information:
  • the purpose for which we process the data;
  • the categories, i.e., the types of data, that are processed;
  • who receives this data and, if the data is transferred to third countries, how security is guaranteed;
  • how long the data will be stored;
  • the existence of the right to rectification, erasure, or restriction of processing, and the right to object to processing;
  • that you can lodge a complaint with a supervisory authority (links to these authorities can be found below);
  • the origin of the data if we did not collect it from you;
  • whether profiling is carried out, i.e., whether data is automatically analyzed to create a personal profile of you.
• According to Article 16 of the GDPR, you have the right to rectification of your data, which means that we must correct any errors you find in your data.
• According to Article 17 of the GDPR, you have the right to erasure (“right to be forgotten”), which means that you can request the deletion of your data.
• According to Article 18 of the GDPR, you have the right to restriction of processing, which means that we may only store your data but not use it further.
• According to Article 20 of the GDPR, you have the right to data portability, which means that we will provide you with your data in a commonly used format upon request.
• According to Article 21 of the GDPR, you have the right to object, which, if exercised, will result in a change to the processing of your data.
  • If the processing of your data is based on Article 6(1)(e) (public interest, exercise of official authority) or Article 6(1)(f) (legitimate interest), you can object to the processing. We will then review your objection as quickly as possible to determine whether we can legally comply with it.
  • If your data is used for direct marketing purposes, you can object to this type of data processing at any time. We will then no longer be permitted to use your data for direct marketing.
  • If your data is used for profiling, you can object to this type of data processing at any time. We will then no longer be permitted to use your data for profiling.
• According to Article 22 of the GDPR, you may have the right not to be subject to a decision based solely on automated processing (e.g., profiling).
• According to Article 77 of the GDPR, you have the right to lodge a complaint. This means you can lodge a complaint with the data protection authority at any time if you believe that the processing of your personal data violates the GDPR.

In short: You have rights – don't hesitate to contact the data controller listed above!

If you believe that the processing of your data violates data protection law or that your data protection rights have been infringed in any other way, you can lodge a complaint with the supervisory authority. In Austria, this is the Data Protection Authority, whose website can be found at https://www.dsb.gv.at/. In Germany, there is a Data Protection Commissioner for each federal state. For more information, you can contact the Federal Commissioner for Data Protection and Freedom of Information (BfDI). The following local data protection authority is responsible for our company:

Data Processing Security

To protect personal data, we have implemented both technical and organizational measures. Where possible, we encrypt or pseudonymize personal data. This makes it as difficult as possible, within our means, for third parties to infer personal information from our data.

Article 25 of the GDPR refers to "data protection by design and by default," meaning that security must always be considered and appropriate measures implemented for both software (e.g., forms) and hardware (e.g., access to the server room). We will discuss specific measures below, if necessary.

TLS Encryption with HTTPS

TLS, encryption, and HTTPS sound very technical, and they are. We use HTTPS (Hypertext Transfer Protocol Secure) to transmit data securely over the internet.

This means that the entire transmission of all data from your browser to our web server is secure – no one can eavesdrop.

This adds an extra layer of security, allowing us to comply with data protection regulations by design (Article 25, Paragraph 1 GDPR). By using TLS (Transport Layer Security), an encryption protocol for secure data transmission on the internet, we can ensure the protection of confidential data.
You can recognize this secure data transmission by the small padlock icon in the top left corner of your browser, to the left of the web address (e.g., examplepage.com), and the use of the https protocol (instead of http) as part of our web address.
If you would like to learn more about encryption, we recommend searching Google for “Hypertext Transfer Protocol Secure wiki” to find helpful links to further information.

Communication

Communication Summary

Data Subjects: Everyone who communicates with us by phone, email, or online form

• Data Processed: e.g., phone number, name, email address, form data entered. More details can be found under the respective contact method.
• Purpose: Handling communication with customers, business partners, etc.
• Storage Period: Duration of the business transaction and legal requirements
• Legal Basis: Art. 6 para. 1 lit. a GDPR (Consent), Art. 6 para. 1 lit. b GDPR (Contract), Art. 6 para. 1 lit. f GDPR (Legitimate Interests)

When you contact us and communicate by phone, email, or online form, personal data may be processed.

The data is processed for handling your inquiry and the associated business transaction. The data is stored for as long as required by law.

Affected Persons

The processes mentioned above affect all individuals who contact us via the communication channels we provide.

Telephone

When you call us, call data is stored pseudonymously on the respective device and with the telecommunications provider. Data such as your name and telephone number may also be sent by email and stored for the purpose of responding to your inquiry. The data will be deleted as soon as the matter has been resolved and legal requirements permit.

Email

When you communicate with us by email, data may be stored on the respective device (computer, laptop, smartphone, etc.) and on the email server. The data will be deleted as soon as the matter has been resolved and legal requirements permit.

Online Forms

When you communicate with us using an online form, data is stored on our web server and may be forwarded to an email address provided by us. The data will be deleted as soon as the matter has been resolved and legal requirements permit.

Legal Basis

The processing of data is based on the following legal grounds:

• Art. 6 para. 1 lit. a GDPR (Consent): You give us your consent to store your data and use it for purposes related to the business transaction;
• Art. 6 para. 1 lit. b GDPR (Contract): Processing is necessary for the performance of a contract with you or a data processor, such as a telephone provider, or for pre-contractual activities, such as preparing a quotation;
• Art. 6 para. 1 lit. f GDPR (Legitimate Interests): We want to handle customer inquiries and business communication professionally. Certain technical infrastructure, such as email programs, Exchange servers, and mobile network operators, is necessary to ensure efficient communication.

Cookies

Cookies Summary

• Affected parties: Website visitors
• Purpose: Depends on the specific cookie. More details can be found below or on the website of the software provider that sets the cookie.
• Data processed: Depends on the specific cookie used. More details can be found below or on the website of the software provider that sets the cookie.
• Storage period: Depends on the specific cookie; can vary from hours to years.
• Legal basis: Art. 6 para. 1 lit. a GDPR (consent), Art. 6 para. 1 lit. f GDPR (legitimate interests)

What are cookies?

Our website uses HTTP cookies to store user-specific data.
Below, we explain what cookies are and why they are used, so you can better understand the following privacy policy.

Whenever you browse the internet, you use a browser. Well-known browsers include Chrome, Safari, Firefox, Internet Explorer, and Microsoft Edge. Most websites store small text files in your browser. These files are called cookies.

One thing is undeniable: cookies are really useful tools. Almost all websites use cookies. More precisely, they are HTTP cookies, as there are other types of cookies for other applications. HTTP cookies are small files that our website stores on your computer. These cookie files are automatically placed in the cookie folder, essentially the "brain" of your browser. A cookie consists of a name and a value. When defining a cookie, one or more attributes must also be specified.

Cookies store certain user data, such as your language preferences or personal website settings. When you revisit our site, your browser sends user-related information back to us. Thanks to cookies, our website knows who you are and offers you your preferred settings. In some browsers, each cookie has its own file, while in others, such as Firefox, all cookies are stored in a single file.

The following graphic illustrates a possible interaction between a web browser, such as Chrome, and the web server. The web browser requests a website and receives a cookie from the server, which the browser then reuses whenever another page is requested.

https://www.adsimple.at/wp-content/uploads/2018/03/http-cookie-interaction.svg

There are both first-party and third-party cookies. First-party cookies are created directly by our website, while third-party cookies are created by partner websites (e.g., Google Analytics). Each cookie must be evaluated individually, as each cookie stores different data. The expiration time of a cookie also varies from a few minutes to several years. Cookies are not software programs and do not contain viruses, Trojans, or other malware. Cookies cannot access information on your computer.

Here's an example of what cookie data might look like:

Name: _ga
Value: GA1.2.1326744211.152113213544-9
Purpose: Differentiating website visitors
Expiration date: After 2 years

These are the minimum sizes a browser should support:

• At least 4096 bytes per cookie
  At least 50 cookies per domain
  At least 3000 cookies in total

What types of cookies are there?

The specific cookies we use depend on the services used and are explained in the following sections of the privacy policy. Here, we would like to briefly discuss the different types of HTTP cookies.

There are four main types of cookies:

Essential cookies
These cookies are necessary to ensure the basic functionality of the website. For example, these cookies are needed when a user adds a product to their shopping cart, continues browsing other pages, and only later proceeds to checkout. These cookies ensure that the shopping cart is not emptied, even if the user closes their browser window.

Performance cookies
These cookies collect information about user behavior and whether the user receives any error messages. They also measure loading times and the website's performance across different browsers.

Targeting cookies
These cookies improve user experience. For example, they save entered locations, font sizes, or form data.

Advertising cookies
These cookies are also called targeting cookies. They are used to deliver personalized advertising to the user. This can be very convenient, but also very annoying.

Typically, the first time you visit a website, you will be asked which of these cookie types you wish to allow. And, of course, this decision is also stored in a cookie.

If you would like to learn more about cookies and aren't afraid of technical documentation, we recommend datatracker.ietf.org/doc/html/rfc6265, the Internet Engineering Task Force (IETF) Request for Comments entitled “HTTP State Management Mechanism”.

Purpose of Processing via Cookies

The purpose ultimately depends on the specific cookie. You can find more details below or on the website of the software provider that sets the cookie.

What data is processed?

Cookies are small helpers for many different tasks. Unfortunately, it's not possible to generalize about which data is stored in cookies, but we will inform you about the processed and stored data in the following privacy policy.

Storage duration of cookies

The storage duration depends on the specific cookie and is specified below. Some cookies are deleted after less than an hour, while others can remain stored on a computer for several years.

You also have control over the storage duration. You can manually delete all cookies at any time via your browser (see also "Right to object" below). Furthermore, cookies based on consent are deleted at the latest after you withdraw your consent, although the lawfulness of the storage remains unaffected until then.

Right to object – how can I delete cookies?

How and whether you want to use cookies is entirely up to you. Regardless of the service or website the cookies originate from, you always have the option to delete, disable, or partially allow them. For example, you can block third-party cookies but allow all others.

If you want to see which cookies are stored in your browser, or if you want to change or delete cookie settings, you can find this information in your browser settings:

Chrome: Delete, enable, and manage cookies in Chrome
Safari: Manage cookies and website data with Safari
Firefox: Clear cookies to remove data that websites have stored on your computer
Internet Explorer: Delete and manage cookies
Microsoft Edge: Delete and manage cookies

If you generally do not want to allow cookies, you can configure your browser to always notify you when a cookie is about to be set. This allows you to decide whether to allow each individual cookie. The procedure varies depending on the browser. The best way to find instructions is to search on Google using the keywords "delete cookies Chrome" or "disable cookies Chrome" if you are using the Chrome browser.

Legal Basis

Since 2009, the so-called "Cookie Directive" has been in effect. It stipulates that storing cookies requires your consent (Article 6(1)(a) GDPR). However, reactions to this directive vary considerably within the EU. In Austria, this directive was implemented in Section 165(3) of the Telecommunications Act (2021). In Germany, the Cookie Directive was not transposed into national law. Instead, this directive was largely implemented in Section 15 Paragraph 3 of the German Telemedia Act (TMG), which was replaced by the Digital Services Act (DDG) in May 2024.

For strictly necessary cookies, even without consent, legitimate interests exist (Article 6 Paragraph 1 Letter f GDPR), which in most cases are of an economic nature. We want to provide website visitors with a pleasant user experience, and certain cookies are often essential for this.

If non-essential cookies are used, this only occurs with your consent. The legal basis for this is Article 6 Paragraph 1 Letter a GDPR.

In the following sections, you will find more detailed information about the use of cookies, provided that the software used employs cookies.

Web Hosting Introduction

Web Hosting Summary

• Data Subjects: Website visitors
• Purpose: Professional website hosting and operational security
• Data Processed: IP address, time of website visit, browser used, and other data. More details can be found below or on the website of your web hosting provider.
• Storage Period: Depends on the provider, but typically 2 weeks
• Legal Basis: Art. 6 para. 1 lit. f GDPR (Legitimate Interests)

What is web hosting?

When you visit websites these days, certain information—including personal data—is automatically generated and stored, and this website is no exception. This data should be processed as sparingly as possible and only with justification. By "website," we mean the entirety of all web pages on a domain, i.e., everything from the homepage to the very last subpage (like this one). By "domain," we mean, for example, example.com or example.com.

If you want to view a website on a computer, tablet, or smartphone, you use a program called a web browser. You're probably familiar with some web browsers by name: Google Chrome, Microsoft Edge, Mozilla Firefox, and Apple Safari. We simply call them browsers or web browsers.

To display the website, the browser must connect to another computer where the website's code is stored: the web server. Operating a web server is a complex and resource-intensive task, which is why it's usually handled by professional providers, the hosting providers. These providers offer web hosting and thus ensure the reliable and error-free storage of website data. There's a lot of technical jargon, but please bear with us, it gets better!

When your browser connects to a web server (desktop, laptop, tablet, or smartphone) and during data transfer to and from the web server, personal data may be processed. Your computer stores data, and the web server also needs to store data for a certain period to ensure proper operation.

A picture is worth a thousand words, so the following graphic illustrates the interaction between the browser, the internet, and the hosting provider.

www.adsimple.at/wp-content/uploads/2018/03/browser-und-webserver.svg

Why do we process personal data?

The purposes of data processing are:

1. Professional hosting of the website and ensuring its operation
2. to maintain operational and IT security
3. Anonymous analysis of access behavior to improve our services and, if necessary, for law enforcement or the pursuit of legal claims

What data is processed?

Even while you are currently visiting our website, our web server, the computer on which this website is stored, typically automatically saves data such as:

• the complete internet address (URL) of the accessed website
• browser and browser version (e.g., Chrome 87)
• the operating system used (e.g., Windows 10)
• the address (URL) of the previously visited page (referrer URL) (e.g., https://www.examplesourcesite.de/fromwhereIcame/)
• the hostname and IP address of the device accessing the site (e.g., COMPUTERNAME and 194.23.43.121)
• date and time
• in files called web server log files

How long is data stored?

As a rule, the data mentioned above is stored for two weeks and then automatically deleted. We do not share this data, but we cannot rule out the possibility that authorities may access it in the event of unlawful activity.

In short: Your visit is logged by our provider (the company that runs our website on dedicated computers (servers)), but we do not share your data without your consent!

Legal basis

The lawfulness of processing personal data in the context of web hosting is based on Article 6(1)(f) GDPR (legitimate interests), as the use of professional hosting from a provider is necessary to present the company securely and user-friendly on the internet and to be able to pursue any attacks and claims arising therefrom.

We generally have a data processing agreement with the hosting provider in accordance with Articles 28 et seq. GDPR, which ensures compliance with data protection regulations and guarantees data security.

World4You Privacy Policy

World4You Privacy Policy Summary

• Data Subjects: Website visitors
• Purpose: Website storage and accessibility on the internet
• Data Processed: IP address, but primarily also technical data
• Storage Period: Log files are deleted after 14 days
• Legal Basis: Art. 6 para. 1 lit. f GDPR (Legitimate Interests)

What is World4You?

You may have already heard of the web hosting provider World4You. It's particularly popular in Austria. The service provider is the Austrian company World4You Internet Services GmbH, Hafenstraße 35, 4020 Linz, Austria.

The company, based in the capital of Upper Austria, has been active in the web hosting sector since 1998. World4You operates several of its own data centers in Austria and relies on proprietary technology. This ensures reliable operation and fast server connections. As you may have already read in our introduction to web hosting, your data is also transferred to and processed on World4You's servers. This primarily involves technical data such as browser version and operating system, but your IP address, which is also considered personal data, is processed as well.

Why do we use World4You?

When it comes to a website, we, like you, probably value reliability, speed, and security. Even if you access our website in the middle of the night or we already have many visitors, it must function flawlessly. When you click on subpages, it shouldn't take forever for the page to load completely. And if problems do occur, there should be a good backup system that secures our content and protects all data. To ensure everything works to our satisfaction, we naturally need a reliable web host. With World4You, we believe we have found a partner who meets our requirements. World4You has its own data centers and therefore a fixed bandwidth, which makes a website quickly accessible. We also appreciate the company's personal support.

What data does World4You process?

World4You may also process your personal data. Our web server automatically stores data while you visit our website. This includes personal data such as your IP address, but above all, technical data such as the internet address of the accessed website, device information such as browser version, operating system, and the URL of the previously visited website. Furthermore, the time you accessed our website and, if applicable, location data are also recorded. The IP address can be used to enhance website security, identify potential errors, and conduct anonymous statistical analyses. Cookies may also be used for data storage.

How long and where is the data stored?

The data is stored on World4You's own servers. The exact data retention period depends heavily on the type of data and individual configurations. Generally, World4You stores data for as long as necessary to fulfill its obligations. Data collected solely for the purpose of providing the website is deleted after the end of each session. Data stored in log files is deleted after a maximum of 14 days. However, data may be stored for longer periods, for example, to provide evidence for potential legal disputes.

How can I delete my data or prevent data storage?

You have the right to access, rectify, erase, and restrict the processing of your personal data at any time. You can also withdraw your consent to data processing at any time.

If you do not want these cookies to be set and data to be stored, you can prevent cookies from being set in your browser. You can manage, disable, or delete cookies in your browser. The process varies slightly depending on your browser.

In the "Cookies" section, you will find links to the instructions for the most common browsers.

Legal Basis

We have a legitimate interest in using World4You to provide our online service. The corresponding legal basis for this is Article 6(1)(f) GDPR (Legitimate Interests).

You can, of course, also use this support if you have specific questions about data protection at World4You. We also recommend reviewing the website's privacy policy, which you can find at www.world4you.com/de/unternehmen/datenschutzerklaerung.html. The FAQs at www.world4you.com/faq/de/dsgvo.html also have a dedicated GDPR section where you can find a wealth of useful information.

Web Analytics Introduction

Web Analytics Privacy Policy Summary

• Data Subjects: Website Visitors
• Purpose: Analysis of visitor information to optimize the website.
• Data processed: Access statistics, including data such as access locations, device data, access duration and time, navigation behavior, click behavior, and IP addresses. More details can be found with the respective web analytics tool used.
• Storage period: Depends on the web analytics tool used
• Legal basis: Art. 6 para. 1 lit. a GDPR (consent), Art. 6 para. 1 lit. f GDPR (legitimate interests)

What is web analytics?

We use software on our website to analyze the behavior of website visitors, also known as web analytics or web analysis. This involves collecting data that is stored, managed, and processed by the respective analytics tool provider (also called a tracking tool). This data is used to create analyses of user behavior on our website and made available to us as the website operator. Most tools also offer various testing options. For example, we can test which offers or content are most popular with our visitors. For a limited time, we will show you two different offers. After the test (so-called A/B test), we will know which product or content our website visitors find more interesting. For such testing procedures, as well as for other analytics methods, user profiles can be created and the data stored in cookies.

Why do we use web analytics?

With our website, we have a clear goal in mind: to provide the best online offering on the market for our industry. To achieve this goal, we want to offer the best and most interesting products and services while also ensuring that you feel completely comfortable on our website. Web analytics tools allow us to examine the behavior of our website visitors more closely and then improve our website accordingly, both for you and for ourselves. For example, we can see the average age of our visitors, where they come from, when our website is most visited, and which content or products are particularly popular. All this information helps us optimize the website and thus best adapt it to your needs, interests, and preferences.

What data is processed?

The exact data stored depends, of course, on the analytics tools used. However, it typically includes information such as which content you view on our website, which buttons or links you click, when you access a page, which browser you use, which device (PC, tablet, smartphone, etc.) you use to visit the website, and which computer system you are using. If you have consented to the collection of location data, this may also be processed by the web analytics tool provider.

Your IP address is also stored. According to the General Data Protection Regulation (GDPR), IP addresses are considered personal data. However, your IP address is usually stored in pseudonymized form (i.e., in an unidentifiable and shortened form). For the purposes of testing, web analytics, and web optimization, no direct data such as your name, age, address, or email address is stored. All such data, if collected, is stored in pseudonymized form. This ensures that you cannot be identified as an individual.
In addition, your IP address is stored in a pseudonymized form. The following example schematically illustrates how Google Analytics works as an example of client-based web tracking using JavaScript code.

www.adsimple.at/wp-content/uploads/2021/04/google-analytics-dataflow.svg

How long the respective data is stored always depends on the provider. Some cookies only store data for a few minutes or until you leave the website, while other cookies can store data for several years.

Duration of Data Processing

We will inform you about the duration of data processing below, provided we have further information on this. Generally, we only process personal data for as long as it is absolutely necessary for the provision of our services and products. If legally required, as in the case of accounting, for example, this storage period may be exceeded.

Right to Object

You also have the right and the option to withdraw your consent to the use of cookies or third-party providers at any time. This can be done either via our cookie management tool or via other opt-out functions. For example, you can also prevent data collection by cookies by managing, disabling, or deleting cookies in your browser.

Legal Basis

The use of web analytics requires your consent, which we obtained via our cookie popup. According to Article 6(1)(a) GDPR (consent), this consent constitutes the legal basis for processing personal data, such as that collected by web analytics tools.

In addition to consent, we have a legitimate interest in analyzing website visitor behavior to improve our services both technically and economically. Web analytics helps us identify website errors, detect attacks, and improve efficiency. The legal basis for this is Article 6(1)(f) GDPR (legitimate interests). However, we only use these tools if you have given your consent.

Since web analytics tools use cookies, we also recommend that you read our general privacy policy on cookies. To learn exactly which of your data is stored and processed, you should read the privacy policies of the respective tools.

Information on specific web analytics tools, if available, can be found in the following sections.

Google Analytics Privacy Policy

Google Analytics Privacy Policy Summary

• Data Subjects: Website visitors
• Purpose: Analysis of visitor information to optimize the website.
• Data Processed: Access statistics, including data such as access locations, device data, access duration and time, navigation behavior, and click behavior. More details can be found below in this privacy policy.
• Storage Period: Individually configurable; by default, Google Analytics 4 stores data for 14 months.
• Legal Basis: Art. 6 para. 1 lit. a GDPR (Consent), Art. 6 para. 1 lit. f GDPR (Legitimate Interests)

What is Google Analytics?

We use the Google Analytics tracking tool, version 4 (GA4), from the American company Google Inc. on our website. For the European Economic Area, Google Ireland Limited (Gordon House, Barrow Street, Dublin 4, Ireland) is responsible for all Google services. Google Analytics collects data about your activity on our website. By combining various technologies such as cookies, device IDs, and login information, you as a user can be identified across different devices. This allows your actions to be analyzed across platforms.

For example, when you click a link, this event is stored in a cookie and sent to Google Analytics. The reports we receive from Google Analytics help us to better tailor our website and services to your needs. Below, we explain the tracking tool in more detail, focusing on what data is processed and how you can prevent this.

Google Analytics is a tracking tool used to analyze website traffic. These measurements and analyses are based on a pseudonymous user identification number. This number does not contain any personal data such as name or address, but rather serves to assign events to a specific device. GA4 uses an event-based model that captures detailed information about user interactions, such as page views, clicks, scrolling, and conversions. Furthermore, various machine learning functions have been integrated into GA4 to better understand user behavior and certain trends. GA4 uses machine learning to create models. This means that, based on the collected data, missing data can be extrapolated to optimize analysis and generate forecasts.

For Google Analytics to function correctly, a tracking code is embedded in our website's code. When you visit our website, this code records various actions you perform on our site. Using GA4's event-driven data model, we, as website operators, can define and track specific events to analyze user interactions. This allows us to track not only general information like clicks and page views, but also specific events that are important to our business. These specific events might include submitting a contact form or purchasing a product.

As soon as you leave our website, this data is sent to and stored on Google Analytics servers.

Google processes the data, and we receive reports about your user behavior. These reports may include:

• Audience reports: Audience reports help us better understand our users and identify who is interested in our services.
• Advertising reports: Advertising reports allow us to analyze and improve our online advertising.
• Acquisition reports: Acquisition reports provide us with valuable insights into how we can attract more people to our services.
• Behavioral reports: Here we learn how you interact with our website. We can track your path on our site and which links you click.
• Conversion reports: A conversion is a process where you perform a desired action as a result of a marketing message. For example, when you go from being a website visitor to a customer or newsletter subscriber. These reports help us understand how our marketing efforts are resonating with you. This is how we aim to increase our conversion rate.
• Real-time reports: Here we always know immediately what's happening on our website. For example, we can see how many users are currently reading this text.

In addition to the analytics reports mentioned above, Google Analytics 4 also offers the following features:

• Event-based data model: This model captures very specific events that can occur on our website. For example, playing a video, purchasing a product, or subscribing to our newsletter.
• Advanced analytics features: These features allow us to better understand your behavior on our website and identify certain general trends. This allows us to segment user groups, conduct comparative analyses of target groups, or track your journey on our website.
• Predictive modeling: Based on collected data, machine learning can extrapolate missing data to predict future events and trends. This helps us develop better marketing strategies.
• Cross-platform analysis: Data collection and analysis are possible from both websites and apps. This allows us to analyze user behavior across platforms, provided you have consented to the data processing.

Why do we use Google Analytics on our website?

Our goal with this website is clear: We want to offer you the best possible service. The statistics and data from Google Analytics help us achieve this goal.

The statistically analyzed data gives us a clear picture of our website's strengths and weaknesses. On the one hand, we can optimize our site so that it is more easily found by interested people on Google. On the other hand, the data helps us to better understand you as a visitor. We therefore know exactly what we need to improve on our website to offer you the best possible service. The data also helps us to make our advertising and marketing measures more personalized and cost-effective. After all, it only makes sense to show our products and services to people who are interested in them.

What data does Google Analytics store?

Using a tracking code, Google Analytics creates a random, unique ID that is linked to your browser cookie. This allows Google Analytics to recognize you as a new user and assign you a user ID. The next time you visit our site, you will be recognized as a returning user. All collected data is stored together with this user ID. This is the only way to analyze pseudonymous user profiles.

To analyze our website with Google Analytics, a property ID must be inserted into the tracking code. The data is then stored in the corresponding property. The Google Analytics 4 property is the default for every newly created property. Data is stored for varying lengths of time depending on the property used.

Your interactions are measured across platforms using identifiers such as cookies, app instance IDs, user IDs, or custom event parameters, provided you have consented. Interactions are all types of actions you perform on our website. If you also use other Google systems (such as a Google account), data generated via Google Analytics may be linked to third-party cookies. Google does not share Google Analytics data unless we, as the website operator, authorize it. Exceptions may occur if required by law.

According to Google, Google Analytics 4 does not log or store IP addresses. Google uses IP address data to derive location data and deletes it immediately afterward. Therefore, all IP addresses collected from users in the EU are deleted before the data is stored in a data center or on a server.

Since Google Analytics 4 focuses on event-based data, the tool uses significantly fewer cookies compared to earlier versions (such as Google Universal Analytics). Nevertheless, there are some specific cookies used by GA4. These include, for example:

Name: _ga
Value: 2.1326744211.152113213544-5
Purpose: By default, analytics.js uses the _ga cookie to store the user ID. It is primarily used to distinguish website visitors.

Expiration date: after 2 years

Name: _gid
Value: 2.1687193234.152113213544-1
Purpose: This cookie is also used to distinguish website visitors.
Expiration date: after 24 hours

Name: _gat_gtag_UA_<property-id>
Value: 1
Purpose: Used to throttle the request rate. If Google Analytics is deployed via Google Tag Manager, this cookie is named _dc_gtm_<property-id>.

Expiration date: after 1 minute

Note: This list is not exhaustive, as Google frequently changes its cookie selection. GA4 also aims to improve data privacy. Therefore, the tool offers several options for controlling data collection. For example, we can define the storage duration ourselves and also control data collection.

Here is an overview of the most important types of data collected with Google Analytics:

Heatmaps: Google creates so-called heatmaps. Heatmaps show precisely which areas you click on. This gives us information about where you are on our site.

Session duration: Google defines session duration as the time you spend on our site without leaving the page. If you are inactive for 20 minutes, the session ends automatically.

Bounce rate: A bounce occurs when you view only one page on our website and then leave.

Account creation: When you create an account or place an order on our website, Google Analytics collects this data.

Location: IP addresses are not logged or stored in Google Analytics. However, inferences for location data are used shortly before the IP address is deleted.

Technical information: Technical information includes, among other things, your browser type, your internet service provider, and your screen resolution.

Source: Google Analytics, and we ourselves, are naturally interested in which website or advertisement led you to our site.

Other data includes contact information, any ratings, media playback (e.g., when you play a video on our site), sharing content via social media, or adding items to your favorites. This list is not exhaustive and serves only as a general overview of data storage by Google Analytics.

How long and where is the data stored?

Google has distributed its servers around the world. You can find out exactly where Google's data centers are located here: datacenters.google

Your data is distributed across various physical storage devices. This has the advantage of making the data faster to access and better protected against manipulation. Each Google data center has corresponding emergency protocols for your data. Even if, for example, Google's hardware fails or natural disasters disable servers, the risk of a service interruption at Google remains low.

The data retention period depends on the properties used. The storage duration is always set individually for each property. Google Analytics offers four options for controlling the storage duration:

• 2 months: this is the shortest storage period.
• 14 months: by default, data is stored for 14 months in GA4.
• 26 months: you can also store the data for 26 months.
• Data is only deleted when we delete it manually.

Additionally, there is also the option to have data deleted only if you do not visit our website within the period we have selected. In this case, the retention period is reset each time you visit our website again within the specified period.

Once the specified period has expired, the data is deleted once a month. This retention period applies to your data that is linked to cookies, user recognition, and advertising IDs (e.g., cookies from the DoubleClick domain). Report results are based on aggregated data and are stored separately from user data. Aggregated data is a combination of individual data points into a larger unit.

How can I delete my data or prevent data storage?

Under European Union data protection law, you have the right to access, update, delete, or restrict the processing of your data. You can prevent Google Analytics 4 from using your data by using the browser add-on to deactivate Google Analytics JavaScript (analytics.js, gtag.js). You can download and install the browser add-on at tools.google.com/dlpage/gaoptout. Please note that this add-on only deactivates data collection by Google Analytics.

If you wish to generally deactivate, delete, or manage cookies, you will find the corresponding links to the instructions for the most common browsers in the "Cookies" section.

Legal basis

The use of Google Analytics requires your consent, which we obtained via our cookie popup. According to Article 6(1)(a) GDPR (consent), this consent constitutes the legal basis for processing personal data, such as that collected by web analytics tools.

In addition to consent, we have a legitimate interest in analyzing the behavior of website visitors and thus improving our services both technically and economically. With the help of Google Analytics, we can identify website errors, detect attacks, and improve efficiency. The legal basis for this is Article 6(1)(f) GDPR (legitimate interests). However, we only use Google Analytics if you have given your consent.

Google also processes your data in the USA. Google is an active participant in the EU-US Data Privacy Framework, which regulates the correct and secure transfer of personal data of EU citizens to the USA. You can find more information at commission.europa.eu/document/fa09cbad-dd7d-4684-ae60-be03fcb0fddf_en.

In addition, Google uses so-called Standard Contractual Clauses (Article 46, paragraphs 2 and 3 of the GDPR). Standard Contractual Clauses (SCCs) are model clauses provided by the European Commission and are designed to ensure that your data complies with European data protection standards even when it is transferred to and stored in third countries (such as the USA). Through the EU-US Data Privacy Framework and the Standard Contractual Clauses, Google commits to maintaining European data protection standards when processing your relevant data, even if the data is stored, processed, and managed in the USA. These clauses are based on an implementing decision of the European Commission. You can find the decision and the corresponding standard contractual clauses here: eur-lex.europa.eu/eli/dec_impl/2021/914/oj

The Google Ads Data Processing Terms, which refer to the standard contractual clauses, can be found at business.safety.google/intl/de/adsprocessorterms/.

We hope we have provided you with the most important information regarding data processing by Google Analytics. If you would like to learn more about the tracking service, we recommend these two links: marketingplatform.google.com/about/analytics/terms/de/ and support.google.com/analytics/answer/6004245.

If you would like to learn more about data processing, please refer to the Google Privacy Policy at https://policies.google.com/privacy?hl=de.

Explanation of Terms Used

We always strive to make our privacy policy as clear and understandable as possible. However, this isn't always easy, especially when dealing with technical and legal topics. It often makes sense to use legal terms (such as personal data) or certain technical expressions (such as cookies, IP address). We don't want to use these without explanation. Below you will find an alphabetical list of important terms used that we may not have adequately addressed in the previous privacy policy. If these terms are taken from the GDPR and are definitions, we will also include the GDPR texts here and, where necessary, add our own explanations.

Data Processor

Definition according to Article 4 of the GDPR

For the purposes of this Regulation, the term:

• “Data processor” means a natural or legal person, public authority, agency or other body which processes personal data on behalf of the controller;

Explanation: As a company and website owner, we are responsible for all data we process about you. In addition to controllers, there may also be so-called data processors. This includes any company or person who processes personal data on our behalf. Data processors can therefore include, in addition to service providers such as tax advisors, hosting or cloud providers, payment or newsletter providers, or large companies such as Google or Microsoft.

Consent

Definition according to Article 4 of the GDPR

For the purposes of this Regulation, the term:

• “Consent” of the data subject means any freely given, specific, informed and unambiguous indication of the data subject’s wishes by which he or she, by a statement or by a clear affirmative action, signifies agreement to the processing of personal data relating to him or her;

Explanation: Websites typically obtain such consent via a cookie consent tool. You're probably familiar with this. Whenever you visit a website for the first time, you are usually asked via a banner whether you agree to or consent to the processing of your data. In most cases, you can also adjust your settings and thus decide for yourself which data processing you allow and which you do not. If you do not consent, no personal data may be processed. Of course, consent can also be given in writing, i.e., not via a tool.

Recipient

Definition according to Article 4 of the GDPR

For the purposes of this Regulation, the term:

• “Recipient” means a natural or legal person, public authority, agency or other body, to which personal data are disclosed, whether a third party or not. However, public authorities which may receive personal data in the framework of a particular inquiry in accordance with Union or Member State law shall not be regarded as recipients; the processing of those data by those public authorities shall be in compliance with the applicable data protection rules according to the purposes of the processing.

Explanation: Any person or company that receives personal data is considered a recipient. Therefore, we and our data processors are also considered recipients. Only public authorities that have a mandate to conduct an inquiry are not considered recipients.

Personal Data

Definition according to Article 4 of the GDPR

For the purposes of this Regulation, the term:

• “Personal data” means any information relating to an identified or identifiable natural person (hereinafter referred to as “data subject”); an identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person;

Explanation: Personal data is therefore all data that can identify you as an individual. This typically includes data such as:

• Name
• Address
• Email address
• Postal address
• Telephone number
• Date of birth
• Identification numbers such as social security number, tax identification number, identity card number or matriculation number
• Bank details such as account number, credit information, account balances, etc.

According to the European Court of Justice (ECJ), your IP address also falls under the category of personal data. IT experts can use your IP address to determine at least the approximate location of your device and, consequently, you as the internet connection owner. Therefore, storing an IP address also requires a legal basis under the GDPR. There are also so-called "special categories" of personal data that are particularly sensitive. These include:

• racial and ethnic origin
• political opinions
• religious or philosophical beliefs
• trade union membership
• genetic data, such as data obtained from blood or saliva samples
• biometric data (information relating to psychological, physical, or behavioral characteristics that can identify a person)
• health data
• data concerning sexual orientation or sex life

Profiling

Definition according to Article 4 of the GDPR

For the purposes of this Regulation, the term:

• “Profiling” means any form of automated processing of personal data consisting of the use of personal data to evaluate certain personal aspects relating to a natural person, in particular to analyze or predict aspects concerning that natural person’s performance at work, economic situation, health, personal preferences, interests, reliability, behavior, location, or movements;

Explanation: Profiling involves collecting various pieces of information about a person to learn more about that person. In the online sphere, profiling is frequently used for advertising purposes or credit checks. Web analytics programs, for example, collect data about your behavior and interests on a website. This results in a specific user profile, which can then be used to target advertising to a specific audience.

Controller

Definition according to Article 4 of the GDPR

For the purposes of this Regulation, the term:

• “Controller” means the natural or legal person, public authority, agency or other body which, alone or jointly with others, determines the purposes and means of the processing of personal data; where the purposes and means of such processing are determined by Union or Member State law, the controller or the specific criteria for its designation may be provided for by Union or Member State law;

Explanation: In our case, we are responsible for the processing of your personal data and are therefore the “controller”. If we transfer collected data to other service providers for processing, these are “processors”. A “Data Processing Agreement (DPA)” must be signed for this.

Processing

Definition according to Article 4 of the GDPR

For the purposes of this Regulation, the term:

• “Processing” means any operation or set of operations which is performed on personal data or on sets of personal data, whether or not by automated means, such as collection, recording, organisation, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure or destruction;

Note: When we refer to processing in our privacy policy, we mean any type of data processing. As mentioned above in the original GDPR statement, this includes not only the collection but also the storage and processing of data.

Closing Remarks

Congratulations! If you're reading this, you've really made it through our entire privacy policy, or at least scrolled this far. As you can see from the length of our privacy policy, we take the protection of your personal data very seriously.

It's important to us to inform you about the processing of personal data to the best of our knowledge and belief. We want to tell you not only which data is processed, but also explain the reasons for using various software programs. Privacy policies usually sound very technical and legal. Since most of you aren't web developers or lawyers, we wanted to take a different approach and explain things in simple and clear language. Of course, this isn't always possible due to the subject matter. Therefore, the most important terms are explained in more detail at the end of the privacy policy.

If you have any questions about data protection on our website, please don't hesitate to contact us or the responsible party. We wish you all the best and hope to welcome you back to our website soon.

All texts are protected by copyright.

Source: Privacy policy created with the privacy policy generator for Austria by AdSimple