Data Privacy Statement
City Air Terminal Betriebsgesellschaft m.b.H. (CAT GmbH)

We are aware that the careful handling of your personal data is important to you. Therefore, we appreciate the confidence you have in CAT GmbH to treat these data with due diligence.

We therefore have a policy setting out how your personal data will be processed and protected.

Who is responsible for your personal data?

City Air Terminal Betriebsgesellschaf m.b.H. is responsible for the personal data you submit to us under the Austrian Data Protection Act which implements the EU Data Protection Dir

What types of personal data do we collect?

We will collect personal data that you submit to us, for example, when you place orders, contact our customer service or participate in competitions. The personal data that you submit to us may for example include contact information, date of birth and payment information. In addition we may collect certain personal data from external sources such as credit information and address updates.

By accepting this Data Privacy Statement you agree that we may collect, process and use your personal data for the purposes stated herein.

• When you purchase a product of City Air Terminal Betriebsgesellschaft m.b.H. (for example, purchase of a ticket) for the fulfilment and processing of the order
• When you create an account on our website
• When claims are outstanding that have not been paid by a customer
• When the occasion may arise that contact with you is necessary
• When you would like to receive advertising (for example, newsletters, information on products and special offers, etc.) or other information from us or you would like to participate in our other activities and campaigns (for example, in promotional competitions, customer surveys, promotions or benefits, etc.)
• When you have submitted questions, requests, suggestions or criticism to Customer Service and we contact you for our internal quality assurance for continuous improvement of our service
• When you assert your rights as a passenger or in the case of an ex post fare claim
• For statistical research to improve our services or systems, whereby the results of these investigations will not give an indication of your identity under any circumstances

In accordance with the applicable data protection regulations, you have the right at any time to request (free of charge once a year) information about your data stored by us (request for information) as well as if necessary, where the legal requirements exist, to have your data corrected or deleted. For this purpose, send us an E-mail to info@cityairporttrain.com. We cannot remove your data when there is a legal storage requirement, such as book-keeping rules or when there are other legitimate grounds to keep the data, such as unsettled debts.

Data that is forwarded to third parties, is only used to provide you with the services mentioned above.

We reserve the right to disclose personal data in accordance with the legal provisions and, if we deem it necessary, for the protection of our rights or the compliance with a legal procedure.

If we should decide to change our data privacy principles, we will include these changes in the Data Privacy Statement, our homepage and any other areas, in which we deem this necessary. Thus you will always be informed about which data we collect, how we use it and under which circumstances we disclose it, if necessary. We reserve the right to change this Data Privacy Statement at any time. Therefore, we kindly ask you to regularly check this Data Privacy Statement. If we should make a comprehensive change to our data privacy policy, we will inform you about it with a note on our homepage.

This website uses an order form for customers requesting information, products or services. We commission other companies and individuals to perform tasks on our behalf.

These representatives process or assign orders, bill you for goods and services and support us with our marketing activities. They are provided access to personal data required for the performance of their tasks, but are not allowed to store, save or otherwise use such data.

We commission other service providers to provide support services for the analysis of the general data regarding the visitors of our website. This data, which is useful for the optimisation of our web site's user friendliness, is collected by cookies or log files of these service providers. We do not allocate any personal data to the general data.

We use cookies on this web site to guarantee the integrity of the registration procedure and to customise the web site to meet individual needs. A cookie is a small text file that is placed on your hard drive by a web page server. Cookies cannot be used to run programmes or deliver viruses to your computer. Cookies are uniquely assigned to you and can only be read by a web server in the domain that issued the cookie to you.

You have the ability to accept or decline cookies. Most web browsers automatically accept cookies, but you can usually modify your browser settings to decline cookies if you prefer. If you choose to decline cookies, you may not be able to fully experience the interactive features of this or other web sites you visit.

This web site contains links to other web sites. CAT GmbH is not responsible for the data privacy policy or the content of such web sites. Therefore, we recommend you to read the privacy statement published on such web sites.

We will not disclose any special information you transmitted to us without your express consent. We may disclose general demographic data to third parties. We will, however, not publish any of your personal data (including your name, email address, residential address and phone number) without obtaining your express consent.

This website uses an order form for customers requesting information, products or services. We commission other companies and individuals to perform tasks on our behalf. Examples for this are the processing of credit card payments, the processing of orders, the sending of emails and letters as well as the analysis of data for data cleansing purposes and for marketing support. They are provided access to personal data required for the performance of their tasks, but are not allowed to use such data for other purposes. Our users may unsubscribe from receiving our messages at any time; for this purpose, please refer to our unsubscribing procedure.

If you have agreed to receiving our newsletter, we will send information from City Air Terminal Betriebsgesellschaft m.b.H or our cooperation partners to your E-mail address.

Our newsletter, in particular, contains information:

• For administrative purposes,
• About the latest special offers,
• About continuing promotions, promotional competitions, discounts and benefits, and
• About City Air Terminal Betriebsgesellschaft m.b.H. and
• About other cooperation partners.

Your E-mail address will only be used by us and will not be forwarded to cooperation partners. You can revoke your consent at any time. In this case your E-mail address will no longer be used for sending the newsletter.

Once you have successfully completed a payment transaction, you can save your payment data as a preferred payment method for future convenient and quick purchase of tickets without re-entering your data. Your payment details are stored by our Payment Service Provider, which processes your payment data using the international standard PCI-DSS. The preferred payment method you have created can be deleted at any time by you.

By payment information we mean the information we need for processing payment. We ourselves store payment information only to a limited extent, namely:

• If a cancellation cannot be carried out automatically by us, but we have to subsequently transfer the cancellation amount (in this case we store the name of the claimant, IBAN, BIC, name of the bank and the address (postcode, city, country, street and house number));
• For a specific booking only the card type (VISA, MasterCard, etc.) and the last 4 digits of the means of payment.

In all other cases, payment information (e.g., expiration date or Card Validation Code (CVC) is processed and used by an inspected and certified payment service provider (Terminal Service Provider and Payment Service Provider).

Terminal Service Providers and Payment Service Providers are only used to securely process the payment process if they have the PCI certifications required for payment transactions.

The safety of your personal data is important for us. We have taken technical and organisational measures to protect your data from loss, manipulation, unauthorised access.

If you enter any sensitive data in our registration or order forms (for example your credit card and/or insurance number), we encrypt this data using Secure Sockets Layer (SSL) technology.

We comply with the generally recognised industry standards for the protection of personal data both during the transmission and the receipt of your personal data (such as firewalls, encryption, safety tests, system checks and ongoing monitoring).

However, no transmission method on the Internet and no electronic security method is 100% safe. Although we do strive to use all economically reasonable means to protect your personal data, we cannot guarantee complete safety.

If you have any questions regarding the safety on our web site, please send us an email to info@cityairporttrain.com

We use Google Analytics in ordert to analyze how many people visit our website and how often. We do not use this software to collect individual personal information or individual IP addresses. The data will be used only in anonymous and summarized form for statistical purposes and for the further development of the website.

This site uses adform retargeting technology. This makes it possible to specifically target web users of our partners to those users who have already taken an interest in our website and our products. The insertion of the advertising material takes place during the retainer on the basis of a cookie-based analysis of the previous user behavior. This is a temporary cookie that expires after 60 days. If you do not want to receive interest - based advertising from Adform, you can opt out of data collection and storage at any time for the future here.

By using this website, you consent to the processing of data about you in the manner and for the purposes set out above.

Data is stored by us only to the extent strictly necessary, and always deleted after the expiry of the statutory limitation periods or statutory retention periods.

If we wish to use data for a purpose that requires your consent in accordance with the law, we ask for your express consent beforehand. You can revoke this consent at any time, thereby preventing your data from being used for this purpose in the future.

The term “service provider” within the meaning of the Data Protection Act refers to natural persons and legal entities who are entrusted by us with the provision of a specific service, for example, the maintenance of our databases.

We only use service providers for lawfully processed data. We always make sure ourselves in advance that the individual service provider is suitable for providing the service, and in particular that it offers sufficient guarantee for a lawful and secure use of the data.

Service providers receive personal data from us only to the extent absolutely necessary.

Controller of personal data
City Air Terminal Betriebsgesellschaft m.b.H.
Postfach 1
1300 Wien-Flughafen
Österreich

Published May 2018