Imprint & Privacy Policy

1. Controller

The controller within the meaning of the General Data Protection Regulation (GDPR) is:

Mag. Tristan Feichtner, Barnabitengasse 3/16, 1060 Vienna, Austria
Email: office@amadeusconcertsvienna.com

We are not legally required to appoint a data protection officer and have not appointed one.

2. Overview

We process personal data in three contexts: when you simply visit the site (server log files), when you buy tickets through our booking system, and for statistics and advertising.

Without your consent, no analytics or advertising service is loaded. In that case only technically necessary cookies are set.

3. Cookies and consent

Cookies are small text files stored on your device. We distinguish five groups:

The legal basis for technically necessary cookies is our legitimate interest in a functioning and secure service (Art. 6(1)(f) GDPR) together with § 165(3) of the Austrian Telecommunications Act 2021, under which technically necessary storage requires no consent.

The legal basis for every other group is your consent (Art. 6(1)(a) GDPR, § 165(3) TKG 2021). Consent is voluntary; without it you can still read the entire website. Without the „Booking“ group the embedded booking calendar is unavailable — you can still buy tickets through our partners GetYourGuide and Viator, or at the box office.

Your choice is stored for 182 days in a cookie on your own device and is not transmitted to us. You can change or withdraw it at any time through „Cookie settings“ in the footer of this website. Withdrawal takes effect for the future and does not affect the lawfulness of processing carried out beforehand.

4. Booking and ticket purchase (Bókun)

We sell tickets through the Bókun booking system, operated by Bókun ehf., Höfðatorg, Katrínartún 2, 105 Reykjavík, Iceland. Bókun is part of the Tripadvisor group.

The booking calendar is embedded as a widget and is loaded only after you have allowed the „Booking“ group or pressed the „Load the booking calendar“ button. Before that, no connection to Bókun is made and no data is sent there.

Loading the widget causes session-related data and your IP address to be processed by Bókun. That processing operation is based on Art. 6(1)(a) GDPR. Processing of the data you enter for the purpose of booking — such as name, email address, the number and type of tickets and payment details — is by contrast necessary in order to take steps prior to entering into a contract. The legal basis for that processing operation is therefore Art. 6(1)(b) GDPR.

Iceland is part of the European Economic Area, so no third-country transfer takes place in this respect. Further information on data processing by Bókun can be found here.

5. Google Ads and conversion measurement

We advertise our concerts through Google Ads. Once you consent to the „Advertising“ group, the Google tag (ID AW-17837861407) is loaded. It measures whether a visit came from one of our adverts and led to a booking, and enables further adverts to be shown to you (remarketing).

This sets a cookie and transmits your IP address, information about your browser and device, and the pages you view to Google.

We use Google Consent Mode v2. Until you consent, every storage type (ad_storage, ad_user_data, ad_personalization, analytics_storage) is set to „denied“ and data transmission is reduced (ads_data_redaction). Only your consent releases them.

The legal basis is your consent (Art. 6(1)(a) GDPR). The provider is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. Further information can be found here.

6. Google Analytics

Where enabled, and after you consent to the „Statistics“ group, we use Google Analytics 4 to evaluate in aggregate form which pages are viewed. The legal basis for this processing is Art. 6(1)(a) GDPR. The provider is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland.

7. Google reviews

On the homepage we display our Google rating and individual review texts. These are fetched by our own server through the Google Places API, cached, and served from our own storage.

Your browser makes no connection to Google for this. No data about you is transmitted to Google and no cookies are set to display the reviews. This content is therefore visible without consent.

8. Tripadvisor rating widget

The Tripadvisor rating is embedded as a widget of Tripadvisor LLC, 400 1st Avenue, Needham, MA 02494, USA, and is assigned to the „Ratings“ group. It is loaded only after your consent; your IP address and browser data are then transmitted to Tripadvisor. The legal basis for this processing is accordingly Art. 6(1)(a) GDPR.

Further information on data processing by Tripadvisor can be found here.

9. Server log files

When you visit the site, our hosting provider stores technically necessary access data in log files: IP address, date and time, page requested, volume of data transferred, referrer and user agent.

This processing serves secure and uninterrupted operation and the defence against attacks. The legal basis for this is Art. 6(1)(f) GDPR.

10. Contacting us

If you write to us by email, we process the data you send in order to deal with your enquiry. The legal basis is Art. 6(1)(b) GDPR for contract-related enquiries and otherwise Art. 6(1)(f) GDPR.

The data is deleted once your enquiry has been dealt with, unless statutory retention periods apply.

11. Recipients and transfers to third countries

Recipients of personal data are our hosting provider, Bókun ehf. (Iceland, EEA) as well as Google Ireland Limited and Tripadvisor LLC. Google and Tripadvisor may transfer data to their parent companies in the United States. Google LLC is certified under the EU-US Data Privacy Framework. Where data is transferred to Google LLC, the transfer therefore takes place on the basis of the European Commission’s adequacy decision under Art. 45 GDPR. For transfers not covered by the EU-US Data Privacy Framework, Google states on its own account that it uses the standard contractual clauses approved by the European Commission. Tripadvisor states on its own account that it bases transfers to countries without an adequate level of data protection on the European Commission’s standard contractual clauses under Art. 46(2)(c) GDPR.

12. Retention periods

Server log files: 30 days
Consent cookie: 182 days
Booking data: 7 years
Analytics and advertising cookies: see the table in section 3

13. Your rights

You have the right of access (Art. 15 GDPR), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20) and objection to processing based on legitimate interests (Art. 21 GDPR).

You may withdraw any consent at any time with effect for the future — most easily through „Cookie settings“ in the footer of this website.

To exercise your rights, a message to office@amadeusconcertsvienna.com is sufficient.

You also have the right to lodge a complaint with the supervisory authority:
Austrian Data Protection Authority, Barichgasse 40–42, 1030 Vienna, dsb@dsb.gv.at

14. Encryption

This website is served over HTTPS/TLS so that your data is protected in transit.

15. Changes to this policy

We update this privacy policy whenever the services we use or the legal position change. The version published on this page is the one that applies.