1. Responsible

With this data protection declaration, Verkehrsverbund Steiermark GmbH (VSTG), Metahofgasse 16, 8020 Graz would like to inform readers and users of the website (users) about the type, scope and purpose of the personal data processed. Furthermore, affected persons / users are informed about their rights by means of this data protection declaration.
We know that careful handling of your personal data is very important to you and we appreciate your trust that VSTG will handle this data conscientiously.

The VSTG is responsible for the use of personal data within the meaning of the GDPR.

2. Which personal data and information are processed for which purpose?

In principle, we collect information when you visit our website. This information is known as a "cookie". Together with the information that you have made available to us, we can tailor your visits to our website even better to your needs.
The decision to proceed with any activity that requires personal information is yours. However, if you do not want to provide us with the required personal information, you may not be able to carry out the relevant transaction and thus not be able to use our range of services.

3. How do we protect your personal data?

In order to guarantee the security of your personal data, we have introduced a number of technical and organizational measures within the meaning of Art. 32 GDPR. Your personal data is stored on secure networks that can only be accessed by a limited number of people who have special access rights and who undertake to respect and maintain the confidentiality of this data. Despite these measures, every time you make personal data available on the Internet, there is a risk that it will be intercepted and used by third parties beyond our control. Although we do everything in our power to protect your personal data and your privacy, we are unable to guarantee the security of the information you provide over the Internet.

4. Who has access to your personal data and how far does this access extend?

The VSTG can have the personal data processed by contract processors. The processing of personal data takes place exclusively for the purposes specified by you.

Apart from your personal data and the use of your personal data for the purposes described above, we do not sell or trade in your personal data and do not pass it on to third parties without informing you beforehand and in accordance with the currently applicable data protection law.

5. Deletion of personal data / storage period

The VSTG processes and stores personal data of the data subject exclusively for the period of time that is necessary to achieve the purpose of the storage or if this is provided for in laws or regulations to which the person responsible for processing is subject (e.g. statutory retention periods) is.

If the purpose for which the personal data was stored no longer applies or if a legally stipulated retention period expires, the personal data will be routinely blocked or deleted in accordance with the statutory provisions.
If you have subscribed to a newsletter, the data will be deleted after unsubscribing / revoking the newsletter.

6. Rights of the person affected by the processing of personal data

As a data subject, you have the following rights within the meaning of the GDPR, about which we would like to inform you.

• Right to information (Article 15 GDPR)
  The person affected by the processing of personal data has the right to receive free information from the person responsible at any time about the personal data stored about them as well as a copy of this information. If the person concerned makes excessive use of the right to information, in that excessive requests for information are directed to the person responsible, the VSTG can levy a local fee for the administrative costs of providing information to the person concerned.
• Right to rectification (right to rectification) (Article 16 GDPR)
  The data subject has the right to request the person responsible to correct any incorrect personal data relating to them without delay.
• Right to erasure (right to be forgotten) (Article 17 GDPR)
  The data subject has the right to demand that the person responsible erase the personal data concerning him / her immediately, provided that it is not necessary for the purposes for which it was collected or otherwise processed and the erasure does not conflict with any legal grounds. If the data subject requests deletion, the VSTG will review the aforementioned legal requirements and inform the data subject accordingly.
• Right to restriction of processing (Article 18 GDPR)
  The data subject has the right to request the controller to restrict processing.
• Right to data portability (Article 20 GDPR)
  The person concerned has the right to receive the personal data concerning them, which they have provided to a responsible person, in a structured, common and machine-readable format, and they have the right to transfer this data to another responsible person without hindrance from the responsible person to whom the personal data have been provided.
• Right to object (Article 21 GDPR)
  If the VSTG processes personal data that are based on a public interest or are carried out in the exercise of official authority or are required on the basis of a legitimate interest, the data subject has the right, due to their particular situation, to object to this processing of their data at any time. If the VSTG processes personal data in order to operate direct mail, the person concerned has the right to object to this processing of their data at any time. This also applies to profiling insofar as it is associated with such direct advertising.
• Right to withdraw consent (Article 7 (3) GDPR)
  Every person affected by the processing of personal data has the right to revoke a previously given consent to data processing at any time. Revoking your consent does not affect the legality of the processing carried out on the basis of your consent up to the point of revocation.
• Right to lodge a complaint (Article 77 GDPR)
  If the person concerned comes to the conclusion that the processing of their data violates data protection regulations or their data protection claims have been violated in any other way, they can complain to the supervisory authority. In Austria this is the data protection authority, Wickenburggasse 8, 1080 Vienna. If a user wishes to exercise this right, he can contact This email address is being protected from spambots. You need JavaScript enabled to view it. at any time.
• Exercise of a data subject's right
  For inquiries on the subject of data protection or to exercise the rights illustrated above, you can contact us using the following contact details:
  - by email to: This email address is being protected from spambots. You need JavaScript enabled to view it.*
  - by post to: Verkehrsverbund Steiermark GmbH, Metahofgasse 16, 8020 Graz*
  * please enclose a copy of an official ID
   

7. Data protection officer

Mag.^a Lisa Hoffelner
Verkehrsverbund Steiermark GmbH
Metahofgasse 16, 8020 Graz
This email address is being protected from spambots. You need JavaScript enabled to view it.