1. Overview and Scope
This Privacy Policy governs the processing of personal data collected through the web application operated by Festivalvaultvista Expeditions Ltd. (hereinafter referred to as "the Organization", "we", "us", or "our"), registered under Austrian corporate jurisdiction (Company No. HRB-894120) with offices situated at Donaupromenade 14, 1020 Vienna, Austria. We are fully committed to compliance with Regulation (EU) 2016/679 of the European Parliament and of the Council (General Data Protection Regulation or GDPR) and applicable national data protection frameworks across the European Union.
2. Data Controller & Data Protection Officer Contact
The designated Data Controller responsible for all processing activities on festivalvaultvista.bond is:
Festivalvaultvista Expeditions Ltd.
Attn: Data Protection Officer (DPO)
Donaupromenade 14, 1020 Vienna, Austria
Electronic Inquiries: [email protected]
3. Categories of Personal Data Processed
We process personal data strictly to the extent necessary to deliver our hydrographic research guides, river voyage telemetry, and editorial services. Categories of data collected include:
- Directly Provided Information: Full name, electronic mail address, organization, telephone numbers, and inquiry descriptions submitted via our expedition inquiry contact forms.
- Automated Telemetry and Technical Metadata: Internet Protocol (IP) addresses (anonymized at edge nodes), browser user-agent tokens, referring URLs, device operating system parameters, viewport dimensions, and session timestamps.
- Interactive River Preference Logs: Route parameters, waypoint filter selections, and cookie consent preferences stored locally in your browser storage.
4. Legal Grounds for Data Processing
We process personal information under the following legal bases pursuant to Article 6(1) of the GDPR:
- Art. 6(1)(a) Consent: Where you have granted explicit consent for specific telemetry analytics, newsletter communications, or optional functional cookies.
- Art. 6(1)(b) Contractual Performance: Necessary for responding to and executing bespoke river expedition consultations or navigational inquiries.
- Art. 6(1)(c) Legal Obligation: Necessary to comply with statutory accounting, tax, or maritime reporting obligations.
- Art. 6(1)(f) Legitimate Interests: Necessary for maintaining server network security, defending against distributed denial-of-service (DDoS) attempts, and optimizing the structural delivery of our 3D spatial WebGL interfaces.
5. Third-Party Data Processors & Cross-Border Transfers
We do not sell, rent, or trade your personal data. We utilize reputable European and international technical infrastructure partners under strict Data Processing Agreements (DPAs) incorporating standard contractual clauses (SCCs):
- Edge CDN & Web Hosting Infrastructure Providers within the European Economic Area (EEA).
- Transactional Email Delivery Services conforming to ISO/IEC 27001 security standards.
- Privacy-centric anonymous map telemetry servers.
6. Retention Schedules
We retain personal data only for the duration necessary to fulfill the underlying collection purposes. Inquiries received via the contact desk are retained for twenty-four (24) months following the conclusion of communication unless statutory fiscal retention periods mandate extended preservation. Server access telemetry logs are purged automatically every ninety (90) days.
7. Your Statutory Rights Under the GDPR
As a data subject within the EEA or relevant international jurisdictions, you possess the following actionable rights:
- Right of Access (Art. 15 GDPR): The right to obtain confirmation as to whether your data is being processed and receive a copy thereof.
- Right to Rectification (Art. 16 GDPR): The right to correct inaccurate or incomplete personal records.
- Right to Erasure / "Right to be Forgotten" (Art. 17 GDPR): The right to demand deletion of your records under statutory qualifying grounds.
- Right to Restriction of Processing (Art. 18 GDPR): The right to limit data usage during pending disputes or verifications.
- Right to Data Portability (Art. 20 GDPR): The right to receive your personal data in a structured, machine-readable format.
- Right to Object (Art. 21 GDPR): The right to object at any time to processing predicated upon legitimate interest grounds.
To exercise any of the aforementioned rights, transmit your authenticated request to [email protected]. Furthermore, you maintain the right to lodge a formal complaint with the Austrian Data Protection Authority (Österreichische Datenschutzbehörde, Barichgasse 40-42, 1030 Vienna, [email protected]).