Privacy policy

1. Controllers

• FGBD GmbH, Nippongasse 8/2/50, 1220 Wien
• 2B Living GmbH, Mariahilfer Straße 126/20, 1070 Wien

Both companies run this website together and are joint controllers for the processing that takes place when the website is visited and used (Art. 26 GDPR). The company that operates the booked apartment is the controller for the processing needed to perform the accommodation contract; it is named on the apartment page and during checkout. Where FGBD GmbH runs technical services of the website for bookings of 2B Living GmbH as well, it acts on behalf of 2B Living GmbH.

Privacy requests can be sent to either company; both handle them together. Email address and phone number are listed in the imprint. No data protection officer has been appointed.

2. Visiting the website

When the website is accessed, technically necessary data are processed: IP address, date and time, the requested address, the previously visited page and information about the browser and device. The purpose is to deliver the website, keep it stable and protect it against misuse and attacks. The legal basis is our legitimate interest in a secure and working service (Art. 6(1)(f) GDPR).

The website runs at a hosting provider in a data centre in Germany and is maintained by an IT service provider. All requests pass through a delivery and security provider based in the USA; in the event of connection errors the browser may send technical error reports to this provider. To protect against overload, the IP address is stored as a counter for no more than 10 minutes. The website itself keeps no access logs.

3. Storage in the browser

The website sets no cookies. The browser's storage only holds information that is strictly necessary for the functions requested (§ 165(3) Austrian Telecommunications Act 2021):

• the most recent search details (travel dates, number of guests, filters) and a random identifier for the order of the apartments; both are deleted when the tab is closed,
• the selected language, until it is deleted in the browser.

4. Audience measurement

To improve the website, we use a cookie-free audience measurement service based in Canada. Each page view transmits the page visited, the previously visited page, campaign details from the address (for example utm parameters) and information about the browser and device, and the time spent when the page is left. In addition, individual interactions are counted, such as a submitted search, steps of the booking process, a click on the email address, phone number or external listings and the visit of pages that were not found, without names, contact details, travel dates or booking numbers. The script checks in the browser whether measurement has been switched off.

The IP address is made unrecognisable on servers in the EU before the data are processed further. The service keeps personal data for no more than 24 hours; after that only aggregated statistics remain. The legal basis is our legitimate interest in improving the website (Art. 6(1)(f) GDPR); this processing can be objected to at any time (section 10).

5. Map in the Vienna guide

The Vienna guide shows a map with the locations of the apartments. As soon as the map comes into view, the browser loads the map images directly from a map service based in the United Kingdom; the IP address and information about the browser and device are transmitted in the process. The legal basis is our legitimate interest in showing the locations clearly (Art. 6(1)(f) GDPR).

6. Direct booking

A booking requires first and last name, email address, phone number, address and country, travel dates, number of guests and the chosen rate; a message to the hosts is optional. Without the required details no booking is possible. For apartments rented for temporary residence, a confirmation that the stay is not for tourist purposes is also required; the wording, version and time of this confirmation are stored with the booking as evidence. Payment details are entered directly with the payment provider. The purpose is to conclude and perform the accommodation contract (Art. 6(1)(b) GDPR); records are kept to meet legal obligations (Art. 6(1)(c) GDPR).

When moving on to payment, the booking details are transmitted to the payment provider, even if the payment is not completed afterwards. The payment provider is based in Ireland and also processes data in the USA. In part it acts as a controller in its own right, in particular for fraud prevention and to meet legal obligations such as anti-money-laundering rules, and may decline payments automatically in that context.

After payment the booking is transferred to the booking software of the company that operates the apartment (a provider based in Germany), which also sends the booking confirmation. A connected pricing service based in the USA receives booking data without names or contact details. If a technical error occurs during processing, both companies receive a notification with the booking details through an email delivery service based in the USA so that the booking can be completed manually (Art. 6(1)(b) and (f) GDPR). Further recipients are tax advisers and authorities where required by law.

7. Contact by email or phone

When someone gets in touch, the contact details provided and the content of the enquiry are processed in order to answer it. The legal basis is the preparation or performance of a contract (Art. 6(1)(b) GDPR), otherwise our legitimate interest in answering enquiries (Art. 6(1)(f) GDPR). The mailboxes are run by an email provider; data may be transferred to the USA in the process.

8. Error monitoring

To detect and fix technical errors, we use an error monitoring service based in the USA that stores the data in the EU. When an error occurs, the error message, the requested address without search details and information about the browser and device are transmitted; IP address, cookies and form entries are removed beforehand, and reports from the browser pass through our own server. The service may derive an approximate country of origin from the connection. The legal basis is our legitimate interest in an error-free website (Art. 6(1)(f) GDPR).

9. Retention

• Bookings, invoices and booking-related correspondence: 7 years from the end of the calendar year (§ 132 Federal Fiscal Code, § 212 Commercial Code). Cancellations without a cancellation fee: likewise 7 years from the end of the calendar year, based on our legitimate interest in statistics and the defence of claims (Art. 6(1)(f) GDPR).
• Enquiries without a booking: 3 years after the last contact.
• Notifications at the email delivery service: 30 days.
• Error reports: no more than 90 days.
• Audience measurement: personal data no more than 24 hours.
• Overload protection: 10 minutes.
• Browser storage: until the tab is closed or until deleted in the browser.

The payment provider keeps data it processes as a controller in its own right in line with its own legal obligations.

10. Rights of data subjects

Data subjects have the right of access, rectification, erasure, restriction of processing and data portability (Art. 15 to 20 GDPR). These rights can be exercised against either company. We name the specific recipients on request.

Anyone who believes that the processing infringes data protection law can lodge a complaint with the Austrian Data Protection Authority: Barichgasse 40–42, 1030 Vienna, www.dsb.gv.at. We do not take automated decisions within the meaning of Art. 22 GDPR.

Right to object: where we process data on the basis of legitimate interests (sections 2, 4, 5, 6, 7, 8 and 9), this processing can be objected to at any time on grounds relating to the particular situation (Art. 21 GDPR).

11. Transfers to third countries

Providers based in the USA receive data on the basis of the EU-US Data Privacy Framework where they are certified under it, otherwise on the basis of the European Commission's standard contractual clauses. For Canada and the United Kingdom, adequacy decisions of the European Commission apply. A copy of the safeguards is available on request.

12. Changes

This privacy policy is updated when the website or the services used change. The version published on this page applies.