Privacy policy

Protecting your personal data is important to us. The following information explains the nature, scope and purposes of the processing of personal data in connection with our website under the EU General Data Protection Regulation (GDPR) and the Austrian Data Protection Act (DSG).

1. Data controller

VIA Information Allmedia GmbH
Geibelgasse 14–16, 1150 Vienna, Austria
Email: c.xell@viainfo.com
Telephone: +43 664 1599550

2. Your rights as a data subject

Under the GDPR, you have the following rights regarding the personal data we process, subject to the applicable legal conditions:

• Right of access (Art. 15 GDPR): To obtain confirmation of whether personal data is being processed and information about its purposes, categories and recipients.
• Right to rectification (Art. 16 GDPR): To have inaccurate personal data corrected without undue delay and incomplete data completed.
• Right to erasure (Art. 17 GDPR): To have stored personal data erased where no statutory retention obligation or other lawful ground for processing prevents this.
• Right to restriction of processing (Art. 18 GDPR): To restrict processing where the legal requirements are met.
• Notification obligation (Art. 19 GDPR): Notification to recipients of rectifications, erasures or restrictions in accordance with legal requirements.
• Right to data portability (Art. 20 GDPR): To receive data you have provided in a commonly used, machine-readable format where the legal requirements are met.
• Right to object (Art. 21 GDPR): To object to the processing of personal data, particularly where processing is based on legitimate interests or carried out for direct marketing.
• Right to withdraw consent (Art. 7(3) GDPR): To withdraw previously given consent informally at any time with effect for the future.

If you believe that the processing of your personal data infringes data protection law or violates your rights, you may lodge a complaint with the competent supervisory authority. In Austria, this is:

Austrian Data Protection Authority (Österreichische Datenschutzbehörde)
Barichgasse 40–42, 1030 Vienna, Austria
Telephone: +43 1 52 152-0
Email: dsb@dsb.gv.at
Website: https://www.dsb.gv.at/

3. Data security through transport encryption (TLS/HTTPS)

To help protect data transmitted to the website from unauthorised access, this website uses TLS/HTTPS transport encryption. You can recognise an encrypted connection by the “https://” prefix in your browser’s address bar.

4. Cookies and local storage

The public information pages do not themselves set cookies. Language selection uses the page URL and is not stored in a cookie or in local browser storage. Once enabled, the separate community area uses necessary security and session cookies (see section 10). The protected booking calendar and additional community functions are described in section 10. We use no analytics or marketing trackers and no cookie banner for such services. The external font described below is loaded when a page is opened.

5. Website delivery through Cloudflare

We use Cloudflare Workers and Workers Static Assets to deliver and protect this website. As the hosting and infrastructure provider, Cloudflare receives technical connection data, including the IP address, requested page address, time and technical request or browser information. This processing serves to provide the requested content, ensure reliable delivery and defend against technical attacks.

Processing is based on our legitimate interest in a secure, functioning website (Art. 6(1)(f) GDPR). Recipients include Cloudflare, Inc., the Cloudflare entities involved in providing the service and their subprocessors. Cloudflare operates a global network; processing outside the European Economic Area, in particular in the United States, is possible. Cloudflare describes processing and safeguards in its Privacy Policy and Data Processing Addendum. This does not imply a commitment to exclusively European data locations.

Retention and deletion of technical data depend on the Cloudflare services used and the applicable hosting and security configuration. Information about the retention periods and transfer safeguards applicable to this deployment can be requested from the controller.

6. External typeface through Adobe Fonts

We load the Loos typeface through https://use.typekit.net/vjf5btj.css from Adobe Fonts. Your browser therefore connects to Adobe servers when a page opens. Adobe receives the IP address to deliver the font. Adobe states that it does not store that address or use cookies for webfont delivery. It may also process technical information about the font project and the website serving it. Processing outside the EEA is possible.

The integration provides consistent, readable typography and relies on Art. 6(1)(f) GDPR. Further details appear in the Adobe Fonts privacy information.

7. Contact by email

Email links open your email application. If you contact us, we process the contact details and message content you provide to respond to your enquiry. Depending on its subject, processing is necessary for pre-contractual or contractual steps (Art. 6(1)(b) GDPR), or is based on our legitimate interest in answering other enquiries (Art. 6(1)(f) GDPR). Data is retained for as long as needed to handle the enquiry, subject to applicable statutory retention requirements.

Please use c.xell@viainfo.com for general legal and privacy matters. donxello@galeria-ideal.at remains the contact for event and special booking enquiries. The website itself does not send contact-form messages.

8. External links

TocaToca and other external services are provided as links only. No music players or maps are embedded. Your browser connects to a linked service when you follow its link; that provider’s privacy information then applies.

9. Further information

Please contact the controller above with questions about recipients, retention periods or the safeguards applicable to international transfers in a particular case. This information describes the current public website. Before additional Community features are activated, it will be updated to cover the processing actually introduced.

10. Registration, sign-in and community

Status and approval: Community functionality is prepared for a separate preview test. Registration and sign-in stay disabled without enabled feature flags, a database, security verification and email delivery. The following information applies when these functions are activated. The calendar and the C2 additions described below use the same community application. There is no public member directory.

Data and purposes

Membership applications require first name, last name, a normalised email address and phone number. We also process language preference, registration and verification dates, approval status and internal role. These details serve application review, personal approval, communication and membership administration. Only administrators can access member lists and contact details. Applicants awaiting approval can only view their own status after sign-in.

Email verification and passwordless sign-in use one-time six-digit email codes. Only cryptographic checksums protected with a secret key, purpose, expiry and attempt counts are stored. Codes expire in ten minutes and permit at most five attempts. Unknown or blocked accounts may also receive a neutral code message to avoid revealing membership; this never grants access. Requests are limited.

Sessions use random tokens validated server-side against stored checksums. The __Host-gi_session cookie is HttpOnly, Secure and SameSite=Strict, lasts at most 30 days and becomes invalid server-side after seven days without use. Sign-out revokes the session. The similarly protected __Host-gi_csrf cookie (at most one hour) and origin checks protect against unwanted cross-site actions. Confidential details and codes are not placed in Local Storage or Session Storage. Personalised community responses must not enter public caches.

Abuse protection stores temporary, secret-key-pseudonymised checksums of email addresses and IP addresses with request counters, without additional plain-text application IP logs. An internal audit trail records internal member identifiers, timestamps and key actions such as verification, sign-in and status changes, without codes, session tokens or message contents.

Services and recipients

Cloudflare Workers runs the application; Cloudflare D1 stores membership data. The operator will configure this database separately. EU jurisdiction is intended but cannot be promised until confirmed. That setting does not cover all Worker, email, support or security processing.

Cloudflare Turnstile loads only on the separate registration and sign-in forms to prevent abuse. Cloudflare processes technical browser, device and connection information. The application validates tokens server-side. See the Cloudflare Turnstile Privacy Addendum.

Cloudflare Email Sending is intended for verification and sign-in codes, administrative application notices and approval notifications. The operator must enable it separately. Processing includes recipient addresses, subjects, message contents and delivery information; recipient email providers participate in delivery. The sender is community@galeria-ideal.at, with replies to donxello@galeria-ideal.at. Local development uses fictional data, local D1 and a non-sending in-memory test inbox only. Brevo is not integrated.

Deletion and retention

The implemented cleanup removes unverified applications after seven days, pending applications after 90 days, declined applications after 30 days and suspended memberships after 365 days from the last status change. Active approved memberships are retained for administration; ending a membership or requesting erasure requires a separate review and deletion by the operator.

Expired codes are removed at the next cleanup after one further day. The same applies to expired, revoked or inactivity-invalid sessions and expired request counters. Audit records are limited to 180 days and notification jobs to 30 days. Cleanup runs when configured community pages are accessed; ongoing operation requires a documented daily operator run. There is no timed deletion guarantee without a page access or maintenance run. Cloudflare backups, provider logs and delivered emails follow separate provider/mailbox rules that still require confirmation.

Community bookings, invitations and closure

Bookings store responsibility, Vienna local dates and times, purpose, expected attendance, event title and description, optional information link and any agreed special terms. Approved members see the community calendar. Public output contains only explicitly confirmed event titles, descriptions, dates and times, information links and venue. Publication is optional and can be withdrawn or administratively suppressed; it does not grant general permission to attend. Publishing preferences from the initial calendar release require fresh explicit confirmation.

Responsible members or administrators may explicitly send personal invitations, updates or cancellation notices after reviewing a preview. We process normalised recipient addresses, booking and version references, initiating actor, attempt time and sending status. Invitations contain the responsible person’s name, title, date, time and venue. Each recipient receives a separate bilingual message through the Cloudflare Email Sending service described above, without revealing other recipients. Provider acceptance does not guarantee delivery. An invitation does not create membership, confirmed attendance, newsletter subscription or marketing consent. Invitation addresses are not used for general advertising.

Closure stores actual attendance (including zero), final amount, chosen external payment method, condition confirmation or problem description, responsible person and timestamp. A separate administrative confirmation records actual payment receipt, administrator and time. Choosing a payment method does not confirm payment. There is no payment service, banking or invoicing integration. Approved members can only see whether a booking has been closed in the calendar. Planned and actual attendance, amounts, payment methods and receipts, problem flags and problem descriptions are restricted to the responsible person and administrators. Payment administration, monthly CSV and administrative correction records are administrator-only. Public event output contains no contact, invitation, attendance, closure or payment data.

C2 has no automatic deletion or legally approved retention period for bookings, sending claims, closure, correction or payment records yet. The earlier retention periods for membership codes and Package B notifications do not define periods for this additional data. Before activating C2, the operator must confirm purposes, legal bases, information duties toward invited non-members, retention and a documented deletion procedure. After an event has ended, invitation addresses and sending details can be removed following this review without resetting active one-time claims. Any statutory retention duties for financial records need separate review. The application cannot erase delivered messages from recipients’ mailboxes.

Legal approval still required

Before public activation, legal review must confirm legal bases, the necessity of phone numbers, balancing of interests for security and Turnstile, cookie classification, retention periods, data-processing arrangements, actual jurisdiction and international-transfer safeguards. Art. 6(1)(b) GDPR is a proposed basis to review for applications/membership and Art. 6(1)(f) GDPR for technical abuse prevention. This proposal is not legal approval. No compulsory marketing consent or newsletter subscription is required. Contact c.xell@viainfo.com for access, correction, termination and erasure requests.