1. General / Responsible

With this data protection declaration, Verkehrsverbund Steiermark GmbH (VSTG), Metahofgasse 16, 8020 Graz would like to inform readers and users of the website (users) about the type, scope and purpose of the personal data processed. Furthermore, affected persons / users are informed about their rights by means of this data protection declaration.
We know that careful handling of your personal data is very important to you and we appreciate your trust that VSTG will handle this data conscientiously.
The VSTG is responsible for the use of personal data within the meaning of the GDPR.

2. Which personal data/information is processed for which purpose?

In principle, we collect information when you visit our website. This information is known as a "cookie". Together with the information that you have made available to us, we can tailor your visits to our website even better to your needs.
The decision to proceed with any activity that requires personal information is yours. However, if you do not want to provide us with the required personal information, you may not be able to carry out the relevant transaction and thus not be able to use our range of services.

3. How do we protect your personal data?

In order to guarantee the security of your personal data, we have introduced a number of technical and organizational measures within the meaning of Art. 32 GDPR. Your personal data is stored on secure networks that can only be accessed by a limited number of people who have special access rights and who undertake to respect and maintain the confidentiality of this data. Despite these measures, every time you make personal data available on the Internet, there is a risk that it will be intercepted and used by third parties beyond our control. Although we do everything in our power to protect your personal data and your privacy, we are unable to guarantee the security of the information you provide over the Internet.

4. Who has access to your personal data and how far does this access extend?

The VSTG can have the personal data processed by contract processors. The processing of personal data takes place exclusively for the purposes specified by you.
Apart from your personal data and the use of your personal data for the purposes described above, we do not sell or trade in your personal data and do not pass it on to third parties without informing you beforehand and in accordance with the currently applicable data protection law.

5. Deletion of personal data / storage period

The VSTG processes and stores personal data of the data subject exclusively for the period of time that is necessary to achieve the purpose of the storage or if this is provided for in laws or regulations to which the person responsible for processing is subject (e.g. statutory retention periods) is.
If the purpose for which the personal data was stored no longer applies or if a legally stipulated retention period expires, the personal data will be routinely blocked or deleted in accordance with the statutory provisions.
If you have subscribed to a newsletter, the data will be deleted after unsubscribing / revoking the newsletter.

6. Use of cookies / web analysis

"Cookies" are small files that enable the VSTG to store specific information related to you, the user, on your PC or digital device while you are visiting the website. The website uses or sets cookies in accordance with EU and Austrian law (Art 5 Paragraph 3 E-Privacy-RL and Section 96 Paragraph 3 TKG 2003). Cookies help to determine the frequency of use and the number of users of the Internet pages, as well as to make the offers as convenient and efficient as possible for you. The content of the cookies used is usually limited to an identification number and usage data that do not allow any personal reference to the user.
Our offers can also be used without cookies, but this may restrict them.

When using or setting cookies that contain personal data or affect privacy, the VSTG will obtain your consent in advance, via its active behavior by asking for information about the purposes of the cookies used through and via our cookie Navigate the banner on our website and thereby give your consent to the setting of cookies.
For us, data protection is an essential contribution to customer satisfaction. You can therefore deactivate the storage of cookies in your browser, restrict them to certain websites or set your browser to notify you as soon as a cookie is sent. You can also delete cookies from your PC's hard drive at any time. Please note, however, that in this case you will have to reckon with a restricted display of the page and restricted user guidance.

You can stop tracking your visit by clicking here.

7. Use of Google reCAPTCHA

We use the reCAPTCHA service from Google Inc. (Google) to protect your queries via the feedback form. The query is used to distinguish whether the input is made by a person or improperly by automated, machine processing. The query includes the sending of the IP address and any other data required by Google for the reCAPTCHA service to Google. For this purpose, your input will be transmitted to Google and used there. However, your IP address will be shortened beforehand by Google within member states of the European Union or in other contracting states of the Agreement on the European Economic Area. The full IP address will only be sent to a Google server in the USA and shortened there in exceptional cases. On behalf of the operator of this website, Google will use this information to evaluate your use of this service. The IP address transmitted by your browser as part of reCaptcha will not be merged with other Google data. The different data protection provisions of Google apply to this data. Further information on Google's data protection guidelines can be found at:

8. Rights of the person affected by the processing of personal data

As a data subject, you have the following rights within the meaning of the GDPR, about which we would like to inform you.

  • Right to information (Article 15 GDPR)
    The person affected by the processing of personal data has the right to receive free information from the person responsible at any time about the personal data stored about them as well as a copy of this information. If the person concerned makes excessive use of the right to information, in that excessive requests for information are directed to the person responsible, the VSTG can levy a local fee for the administrative costs of providing information to the person concerned.
  • Right to rectification (right to rectification) (Article 16 GDPR)
    The data subject has the right to request the person responsible to correct any incorrect personal data relating to them without delay.
  • Right to erasure (right to be forgotten) (Article 17 GDPR)
    The data subject has the right to demand that the person responsible erase the personal data concerning him / her immediately, provided that it is not necessary for the purposes for which it was collected or otherwise processed and the erasure does not conflict with any legal grounds. If the data subject requests deletion, the VSTG will review the aforementioned legal requirements and inform the data subject accordingly.
  • Right to restriction of processing (Article 18 GDPR)
    The data subject has the right to request the controller to restrict processing.
  • Right to data portability (Article 20 GDPR)
    The person concerned has the right to receive the personal data concerning them, which they have provided to a responsible person, in a structured, common and machine-readable format, and they have the right to transfer this data to another responsible person without hindrance from the responsible person to whom the personal data have been provided.
  • Right to object (Article 21 GDPR)
    If the VSTG processes personal data that are based on a public interest or are carried out in the exercise of official authority or are required on the basis of a legitimate interest, the data subject has the right, due to their particular situation, to object to this processing of their data at any time. If the VSTG processes personal data in order to operate direct mail, the person concerned has the right to object to this processing of their data at any time. This also applies to profiling insofar as it is associated with such direct advertising.
  • Right to withdraw consent (Article 7 (3) GDPR)
    Every person affected by the processing of personal data has the right to revoke a previously given consent to data processing at any time. Revoking your consent does not affect the legality of the processing carried out on the basis of your consent up to the point of revocation.
  • Right to lodge a complaint (Article 77 GDPR)
    If the person concerned comes to the conclusion that the processing of their data violates data protection regulations or their data protection claims have been violated in any other way, they can complain to the supervisory authority. In Austria this is the data protection authority, Wickenburggasse 8, 1080 Vienna. If a user wishes to exercise this right, he can contact This email address is being protected from spambots. You need JavaScript enabled to view it. at any time.
  • Exercise of a data subject's right
    For inquiries on the subject of data protection or to exercise the rights illustrated above, you can contact us using the following contact details:
    - by email to: This email address is being protected from spambots. You need JavaScript enabled to view it.*
    - by post to: Verkehrsverbund Steiermark GmbH, Metahofgasse 16, 8020 Graz*
    * please enclose a copy of an official ID

9. Data protection officer

Mag.a Lisa Hoffelner
Verkehrsverbund Steiermark GmbH
Metahofgasse 16, 8020 Graz
This email address is being protected from spambots. You need JavaScript enabled to view it.

Verkehrsverbund Steiermark GmbH