Privacy policy

1. Controller

The controller for data processing on code43.at is Melur Destination Management GmbH, Bösendorferstraße 1/1/18-19, 1010 Wien, Austria, email: [email protected], phone: +43 1 000 00 00.

No data protection officer has been appointed as there is no legal obligation to do so. Please send privacy requests to [email protected].

2. Principles

We process personal data only as far as necessary to operate the website, your user account and the features you choose. Legal bases are Art. 6(1)(b) GDPR (contract or terms of use), (c) (legal obligations), (f) (legitimate interest in secure and stable operation) and, where stated, (a) (consent).

3. Visiting the website and server log files

When you visit the website, our server processes technically necessary data: IP address, date and time, requested address, browser and system information and error messages. This data is used to deliver pages, for security (e.g. to fend off attacks) and for error analysis (Art. 6(1)(f) GDPR). Logs are deleted after 14 days at the latest unless they are needed to investigate a security incident.

Hosting: [hosting provider and server location – to be added before publication]. The provider processes the data on our behalf (Art. 28 GDPR).

4. User account

For a user account we process your name, email address, an encrypted password (if set), your language setting and the favourites, place tracking and notification settings you create (Art. 6(1)(b) GDPR). This data is not public and is not sold to third parties.

You can delete your account yourself at any time in your profile (accounts with editorial access via the administration). The account, your favourites, followed places and notifications are then deleted immediately and permanently unless statutory retention obligations apply. Editorial content remains without reference to you.

5. Sign-in with Google

If you choose “Continue with Google”, you are redirected to Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. After you agree at Google, we receive your Google ID, name, email address and whether Google has verified the address. We do not store Google access tokens and do not request access to contacts or posts (Art. 6(1)(b) GDPR).

Google may also process data in the USA; Google LLC is certified under the EU-US Data Privacy Framework. Google’s privacy policy applies to processing by Google. You can disconnect Google at any time under “Sign-in methods” in your account, as long as another sign-in method remains.

6. Emails

We send emails that are necessary for your account (e.g. confirmation links, sign-in codes, security notices) and notifications about tracked places if you have explicitly enabled them. You can unsubscribe from notifications in every email and in your account. We do not send newsletters or advertising emails.

Email service provider: [email provider – to be added before publication], as a processor.

7. Images and media

Photos and media are stored with [storage provider and region – to be added before publication]. When public images are loaded, your IP address is technically transmitted to this service. We remove location and other metadata from published images.

8. Cookies

We only set cookies that are technically necessary for operation (§ 165(3) Austrian Telecommunications Act 2021). The “Cookies” page lists them and how long they are stored. We currently do not use analytics, profiling or advertising cookies; should this change, we will ask for your consent first.

9. Own reach measurement without cookies

To learn how many people view which pages, we count page views ourselves on our server. Nothing is stored on or read from your device (no cookies, no local storage) and no data is passed to third parties. When a page is opened, your browser only sends its address without parameters, the referring page and, if present, campaign details (utm_source, utm_medium, utm_campaign).

To count each visitor only once per day, we create an irreversible hash from your IP address and browser identifier together with a random value generated anew every day. The IP address and browser identifier themselves are not stored. The random value and the hashes are deleted when the day is over; after that the figures can no longer be linked to any person or to any other day. Only aggregated daily figures are kept (e.g. views per page type, language, content and traffic source). Search terms of the site search are kept in aggregated form for 90 days; terms that look like email addresses or phone numbers are discarded.

The legal basis is our legitimate interest in a data-minimising reach measurement to improve our service (Art. 6(1)(f) GDPR). You can object to this processing at any time ([email protected]).

10. Advertising

Advertising spaces on the homepage are labelled as “Advertisement” and are served by us. No scripts from advertising networks are loaded and no user profiles are created.

11. Retention

We store personal data only as long as necessary for the stated purposes or as required by statutory retention periods. Logs of user administration (e.g. role changes) contain no passwords or codes.

12. Your rights

You have the right to:

• access your data (Art. 15 GDPR),
• rectification (Art. 16) and erasure (Art. 17),
• restriction of processing (Art. 18),
• data portability (Art. 20),
• object to processing based on legitimate interests (Art. 21),
• withdraw consent at any time with effect for the future (Art. 7(3)).

13. Complaints

If you believe that we do not process your data lawfully, you can contact us ([email protected]) or lodge a complaint with the Austrian Data Protection Authority: Barichgasse 40–42, 1030 Vienna, www.dsb.gv.at.

14. Security and changes

Data is transmitted encrypted (HTTPS). Editorial access is protected by a second factor. We update this policy when features or the legal situation change; the version published here applies.