We, Falstaff Verlags-Gesellschaft m.b.H., Schottenring 2-6, A-1010 Vienna, Falstaff Deutschland GmbH, Cecilienallee 45, 40474 Düsseldorf, Falstaff Verlag Schweiz AG, Kirchenweg 8, CH-8008 Zurich, Falstaff Italia srl, Zona Industriale 1-5/A/3, I-39011 Lana, Falstaff LIVING Verlags GmbH, Schottenring 2-6, A-1010 Vienna, Falstaff Happy Life GmbH, Schottenring 2-6, A-1010 Vienna, Falstaff E-Commerce GmbH, Schottenring 2-6, A-1010 Vienna, Falstaff Circle GmbH, Schottenring 2-6, A-1010 Vienna, Falstaff Travel GmbH, Schottenring 2-6, A-1010 Vienna, Falstaff Profi GmbH, Schottenring 2-6, A-1010 Vienna, Falstaff International AG, Kirchenweg 8, CH-8008 Zurich, Falstaff Nordics ApS, Amaliegade 6, 2.tv., DK-1256 Copenhagen K, and Falstaff España Media S.L., Gran Via de les Corts Catalanes 583, E-08011 Barcelona (hereinafter jointly referred to as “Falstaff” or as “Falstaff Publishing Companies”) are pleased that you are using our websites www.falstaff.com including its country portals and subdomains, shop.falstaff.com, www.wein.de (operated by Falstaff Deutschland GmbH) and www.buehne-magazin.com (operated by Falstaff Verlags-Gesellschaft m.b.H.) (hereinafter “Websites”), as well as the associated applications Guide App and E-Paper App and all applications provided in the future (hereinafter “APP”). Depending on your operating system, you can obtain the APPs free of charge from the Google Play Store or the Apple App Store. With these APPs you can, among other things, find and contact restaurants directly, rate them and add photos, reserve tables, save favourites, or read the Falstaff magazine digitally as an e-paper.

Data protection and data security when using our APPs and our Websites are very important to us. We would therefore like to inform you here which of your personal data we collect when you use our APPs and our Websites and for which purposes it is used.

Since changes in the law or changes in our internal company processes may make it necessary to adapt this privacy policy, we ask you to read it regularly. The privacy policy can be accessed, saved and printed at any time at www.falstaff.com/en/data-protection.

§ 1 Controllers and scope

The Falstaff Publishing Companies are joint controllers within the meaning of the EU General Data Protection Regulation (hereinafter “GDPR”) and other national data protection laws of the member states as well as other data protection provisions. The Falstaff Publishing Companies jointly determine the purposes and means of the processing operations described in this privacy policy, in particular for the shared user account and the usage analysis across the Websites, and have concluded an arrangement pursuant to Art. 26 GDPR for this purpose. We will provide you with the essence of this arrangement on request at datenschutz@falstaff.com. You may exercise your rights against each of the companies named. All data protection obligations of the Falstaff Publishing Companies are fulfilled by:

Falstaff Verlags-Gesellschaft m.b.H., FN 97741 m
Schottenring 2-6
1010 Vienna

This privacy policy applies to the use of the Falstaff APPs, which can be downloaded from the Apple App Store and the Google Play Store, as well as to Falstaff’s general online offering at www.falstaff.com and its country portals and subdomains, including our online shop at shop.falstaff.com, as well as to www.wein.de and www.buehne-magazin.com.

§ 2 Data Protection Officer

The external group data protection officer of the companies named above is:

RA Dr Daniel Stanonik
Porzellangasse 37/13
1090 Vienna
Tel: +43 1 9043355
E-mail: dsb@stanonik.at

§ 3 Principles of data processing

Personal data is any information relating to an identified or identifiable natural person. This includes, for example, information such as your name, age, address, telephone number, date of birth, e-mail address, IP address or user behaviour. Information for which we cannot (or can only with disproportionate effort) establish a link to your person, e.g. by anonymising the information, is not personal data. The processing of personal data (e.g. collection, retrieval, use, storage or transmission) always requires a legal basis or your consent. Processed personal data is deleted as soon as the purpose of the processing has been achieved and no statutory retention obligations remain.

Where we process your personal data in order to provide certain offerings, we inform you below about the specific operations, the scope and purpose of the data processing, the legal basis for the processing and the respective storage period.

§ 4 Individual processing operations

a) Provision and use of the Websites

Type and scope of data processing
When you access and use our Websites, we collect the personal data that your browser automatically transmits to our server. This information is temporarily stored in a so-called log file. We use Konzept IT for hosting our Websites. Further details on the service providers used can be found in § 5. When you use our Websites, we collect the following data, which is technically necessary for us to display our website and to ensure stability and security:

• IP address of the requesting computer
• Date and time of access
• Name and URL of the retrieved file
• Website from which access is made (referrer URL)
• Browser used and, if applicable, the operating system of your computer, as well as the name of your access provider

Legal basis
Art. 6 (1) (f) GDPR serves as the legal basis for the aforementioned data processing. The processing of the aforementioned data is necessary for the provision of a website and thus serves to safeguard a legitimate interest of our company.

Storage period
As soon as the aforementioned data is no longer required to display the Websites, it is deleted within 3 weeks. The collection of the data for the provision of the website and the storage of the data in log files is strictly necessary for the operation of the website. Consequently, the user has no possibility to object. Further storage may take place in individual cases if required by law.

b) User account

Type and scope of data processing
On our Websites we offer you the opportunity to register by providing personal data. With the processed data we create an individualised user account for you, with which you can use certain content and services on our Websites, such as saving favourites, rating restaurants and, if you have signed up for them, receiving newsletters. We process your e-mail address for the login and in order to send you information for restoring access to your account. Depending on the services you use and the information provided in the registration, profile or ordering process or arising technically, we process the following categories of data in the user account. For the registration itself we only need your e-mail address and a password. Salutation, first and last name and all other profile details are voluntary; they serve to address you personally and are only required once you use a service that depends on them, such as a subscription, an order or a membership. Mandatory details are marked as such in the respective process:

• Username and unique user identifiers, where applicable including migrated former user IDs
• Title or job title, first and last name as well as technical title references
• E-mail address and confirmation status of the e-mail address
• Billing and delivery address (street, city and, where applicable, a combined address and a technical country reference)
• Company name
• Telephone number
• Date of birth
• Date and time of the last login and a technical timestamp of the last update
• Gender and technical gender reference
• Preferred language
• Interests (e.g. wine and culinary topics), preferred destinations or wine regions as well as region of origin or home region
• Indication of professional activity in the gastronomy or hotel sector (B2B flag)
• Interest in a Club/Circle membership as well as start, status and origin or acquisition channel of such a membership
• Registration portal, login clients or portals and login methods used, as well as a technical portal/tenant identifier
• Membership of internal user groups
• Internal customer, contact and CRM identifiers
• Status and records of consents, of acknowledgement of this privacy policy and of acceptance of the terms of use
• Authentication and session data, in particular login identifiers, password verification data and authentication tokens; for social login, the identifiers and released profile details transmitted by the chosen provider
• Subscription and entitlement data for access to the services you use

For the central administration of the user account we use Piano ID as part of Piano Subscriptions. Piano serves as the central user database (“master user store”) for profile and subscription data. The Keycloak instance operated on servers of Konzept IT stores your e-mail address and your password verification data (passwords are stored exclusively as a cryptographic hash), acts as identity broker for the login and provides the login interface, session management and the issuing of authentication tokens. The e-mail address is synchronised between Keycloak and Piano. The shared login takes place via an identifier-first login, in which your user identifier is requested first, or via one of the social logins described below. The recipients of the data required for these functions are in particular Piano and Konzept IT; further details can be found in § 5.

The shared user account can be used for the connected brands and portals, including falstaff.com, wein.de and buehne-magazin.com. In doing so, the account data required for the respective login and entitlement check is processed. The operators of these portals are the jointly responsible Falstaff Publishing Companies named in § 1. The shared login does not include consent to cross-brand marketing tracking.

Alternatively, you can sign in with your Google or Apple account (social login). In this case we receive the unique user identifier provided by the chosen provider for the login and, depending on your release and the permissions requested, your e-mail address, its confirmation status and, where applicable, your name. With Apple, a relay address may be used instead of your personal e-mail address. We do not receive your password with the respective social login provider. The chosen provider learns that you use its login function for the respective portal and processes the technical connection data arising in this process. The choice of a social login is voluntary. The privacy notices of Google and Apple apply to the data processing they carry out under their own responsibility. A login via Facebook is not offered.

Legal basis
Insofar as the processing is necessary for setting up and providing your user account, for the login method you have chosen and for managing your contractual memberships, subscriptions and access entitlements, it is based on Art. 6 (1) (b) GDPR. We process technical security data, insofar as this is not already necessary for the performance of the contract, on the basis of our legitimate interest in secure operation free of misuse pursuant to Art. 6 (1) (f) GDPR.

Insofar as voluntary profile details are not required for a service you have requested, we process them on the basis of your separate consent pursuant to Art. 6 (1) (a) GDPR. § 4 (e) applies to newsletters and commercial e-mails; §§ 6 and 8 apply to tracking requiring consent and to processing by Piano Audience. Acknowledging this privacy policy or accepting the terms of use does not replace separate consent to such processing. You may withdraw any consent given at any time with effect for the future, in particular by e-mail to widerruf@falstaff.com; tracking consents can also be changed in the Cookie Settings. The lawfulness of processing carried out up to the withdrawal remains unaffected. The necessary account functions remain unaffected by the withdrawal of consent to additional processing.

Storage period
We store the data required to provide the user account for the duration of the registration. If the user account is deleted, this data is also deleted in the systems used for account administration, unless continuing contractual purposes, statutory retention obligations or necessary evidential purposes prevent this. If individual profile details are changed, the data concerned is corrected; this does not lead to the deletion of the entire user account. Voluntary details are deleted when their purpose ceases to apply or the underlying consent is withdrawn. User accounts in which no login has taken place for a period of 40 months are reviewed regularly: we notify you at the e-mail address on file and delete the account if you do not use it again within the period stated in that notice and no continuing contractual purposes or statutory retention obligations prevent this. We keep records of consent and withdrawal in a form with restricted access only for as long as necessary to demonstrate the lawfulness of the processing, at most three years after withdrawal or termination of the processing concerned. For subscriptions and newsletters, the respective storage periods under § 4 (d) and (e) apply in addition.

Cancelling the registration
As a user, you have the option of cancelling your registration at any time. You can change or delete the data stored about you yourself at any time. To do so, proceed as follows: log in to the Falstaff website with your user data and click on the menu item “Edit profile” or “Delete profile” in your user profile. If, in particular, the delete function is not available for your profile, please send an e-mail to widerruf@falstaff.com and explain which personal data Falstaff has stored incorrectly or which personal data Falstaff should delete.

However, if the processed data is required for the performance of a contract or for the implementation of pre-contractual measures, early deletion of the data is only possible insofar as no contractual or statutory obligations prevent this.

c) Prize draws

Type and scope of personal data
We offer users the opportunity to take part in prize draws by providing personal data. The data required for this is entered into an input form, transmitted to us and stored. We are entitled to transmit the data of the winner (name and e-mail address) to any cooperation partners in order to enable delivery of the prize (if delivery is not carried out by us). These companies may only use your data for processing the order and not for any other purposes. If, when registering for the prize draw, you agree (by ticking the corresponding checkbox in the registration process) that your data may be transmitted to third parties in the course of the prize draw, this takes place exclusively to cooperation partners of Falstaff (see § 3 (c) mutatis mutandis).

In connection with participation in prize draws, the personal data listed is additionally processed for the purpose of sending you further content. In particular, you will receive additional information from us about products that we assume, in connection with the prize draw, are of interest to you.

The following data is collected in the course of participation in a prize draw:

• First and last name
• Address
• E-mail address

Legal basis
When processing your personal data required for carrying out the prize draw, Art. 6 (1) (b) GDPR serves as the legal basis. This also applies to processing operations necessary for the implementation of pre-contractual measures.

The processing of your personal data in this context also serves to carry out direct marketing measures and direct advertising for content or products that are thematically related to the respective prize draw. The legal basis for this is the legitimate interest of Falstaff Verlags-Gesellschaft m.b.H. pursuant to Art. 6 (1) (f) GDPR.

Storage period
Once the prize has been delivered in full, your data is blocked for further use and deleted after expiry of the retention periods under tax and company law, unless you have expressly consented to further use of your data. Further storage may take place in individual cases if required by law.

The personal data for sending further content is stored for a period of one year or until the data subject objects.

d) Magazine subscription and orders in the online shop

Type and scope of data processing
On our Websites we offer users the opportunity to subscribe to magazines or to place orders via shop.falstaff.com by providing personal data. The data required for this is entered in an input form, transmitted to Falstaff and stored. Your data is passed on to the shipping company commissioned with the delivery insofar as this is necessary for the delivery of the magazines. For the processing of payments we pass on your payment data to the financial institution commissioned with the payment. These companies may only use your data for processing the order and not for any other purposes.

We use Shopify to operate our online shop at shop.falstaff.com. The contact, billing, delivery, order and payment information required for operating the shop and processing orders is processed by Shopify for this purpose. Further details on this service provider can be found in § 5.

The following data is collected during the ordering process:

• First and last name
• Company
• Address
• Date of birth
• E-mail address
• Payment information
• Order and contract data (in particular selected products or subscriptions, time of order, price as well as order and payment status)

We use the data you provide for ordering a magazine subscription or other products in the online shop, without your separate consent, exclusively for fulfilling and processing your order. Once the contract has been fully performed and the amount paid in full, your data is blocked for further use and deleted after expiry of the retention periods under tax and company law, unless you have expressly consented to further use of your data.

Legal basis
When processing your personal data (cf. § 4 (d)) that is necessary for the performance of a subscription or purchase contract concluded with us, Art. 6 (1) (b) GDPR serves as the legal basis. This also applies to processing operations necessary for the implementation of pre-contractual measures.

Storage period
Once the contract has been fully performed and the respective subscription or purchase prices have been paid in full, your data is blocked for further use and deleted after expiry of the retention periods under tax and commercial law, unless you have expressly consented to further use of your data or Falstaff has an (overriding) legitimate interest within the meaning of recital 47 GDPR in further processing this data. Further storage may take place in individual cases if required by law.

e) Newsletter/e-mails

Type and scope of data processing
On our Websites you have the option of subscribing to a free newsletter. In order to send you the newsletter regularly, we need the following data from you:

• E-mail address
• First and last name (optional)
• Salutation (optional)
• Title (optional)

We use Mailjet for sending newsletters; for commercial e-mails we use Microsoft Dynamics 365 Customer Insights. These service providers process the recipient and content data required for the respective dispatch, including the personalisation details you have provided, as well as sign-up, consent, unsubscribe and dispatch information. A personal evaluation of opens and clicks only takes place with corresponding separate consent. Further details on the service providers can be found in § 5.

In order to sign up for our e-mail newsletter service, we require, in addition to your consent, at least your e-mail address to which the newsletter is to be sent. Any further details are voluntary and are used to address you personally, to personalise the content of the newsletter and to clarify queries regarding the e-mail address. It is at your discretion whether you provide us with this data.

For sending the newsletter we generally use the so-called double opt-in procedure, i.e. we will only send you the newsletter once you have confirmed your registration via the link contained in a confirmation e-mail sent to you for this purpose. In this way we want to ensure that only you, as the owner of the e-mail address provided, can sign up for the newsletter. Your confirmation must be given promptly after receipt of the confirmation e-mail; otherwise your newsletter registration is automatically deleted from our database.

Should you explicitly wish not to receive any further e-mails from us, we keep your e-mail address in a list to ensure that no further e-mails are sent to you by us. A newsletter may also be sent, among other things, if a partner lawfully provides us with e-mail addresses for sending our newsletter. This list allows us to ensure that you no longer receive a newsletter from us, even if your address was lawfully provided for our newsletter by a third party.

Our newsletters and comparable e-mails also contain so-called tracking pixels. With your consent, we use tracking pixels within the newsletter. This allows your behaviour in relation to our newsletter to be tracked after you have been redirected to our Websites by clicking on a photo or link. This procedure serves to evaluate the effectiveness of our newsletter for statistical and market research purposes and can help to optimise future advertising measures.

Legal basis
The processing of your e-mail address and the personalisation details you have provided for sending the newsletter is generally based on your voluntary consent pursuant to Art. 6 (1) (a) GDPR in conjunction with § 174 (3) of the Austrian Telecommunications Act (TKG 2021). For a personal evaluation of opens and clicks by means of tracking pixels we obtain separate voluntary consent. The following declaration of consent applies to the newsletter registration:

By clicking the “Send” button, I agree that Falstaff Verlags-Gesellschaft m.b.H. may store and process my personal data (first and last name, e-mail address) for the newsletter(s) ticked above for the purpose of sending these newsletters. I may withdraw this consent informally at any time with effect for the future and without any adverse consequences for me. I can send my declaration of withdrawal by post to Falstaff Verlags GmbH, Schottenring 2-6, 1010 Vienna or by e-mail to widerruf@falstaff.com. Further information on the processing of personal data can be found in the privacy policy.

Without prior consent we only send electronic direct marketing if all requirements of the existing-customer exception under § 174 (4) TKG 2021 are met: the contact information was collected in connection with a sale or a service to you, the advertising concerns our own similar products or services, you were able to refuse such use when the data was collected and can refuse it free of charge and without difficulty with every message, and you have not refused the dispatch from the outset. In this case the data processing is based on our legitimate interest in permissible existing-customer marketing pursuant to Art. 6 (1) (f) GDPR. This does not legitimise a personal evaluation of opens or clicks by means of tracking pixels; this requires the separate consent mentioned above.

Storage period
Your e-mail address and your first and last name are stored for as long as you are subscribed to the newsletter. After you unsubscribe, the dispatch data is deleted unless it is still required for other communication you have requested, for the necessary proof of your consent or withdrawal, or for honouring your unsubscription in the block list described above. Further storage may take place in individual cases if required by law.

Tracking pixel data is only stored for as long as necessary for the stated evaluation purpose and as long as the separate tracking consent has not been withdrawn. Further storage may take place in individual cases if required by law.

f) Contact address

Type and scope of data processing
On our Websites we offer you the opportunity to contact us via an e-mail address provided. If you use the contact address, the following personal data is processed:

• E-mail address
• First and last name
• Individual message

When you use the contact address, your personal data is not passed on to third parties.

It is at your discretion whether you provide us with this data. However, we cannot fulfil your contact request without this information.

The data processing described for the purpose of contacting us is carried out pursuant to Art. 6 (1) (f) GDPR.

Storage period
As soon as your enquiry has been dealt with and the matter in question has been conclusively clarified, your processed personal data is deleted. Further storage may take place in individual cases if required by law.

g) Trial subscription

Type and scope of data processing
On our Websites you have the opportunity to obtain a free trial subscription. In order to send you these trial issues, we need the following data from you:

• First and last name
• Address
• E-mail address
• Telephone number

Your data is passed on to the shipping company commissioned with the delivery insofar as this is necessary for the delivery of the magazines.

We use the data you provide for ordering the trial subscription, without your separate consent, exclusively for fulfilling and processing your order. Once the contract has been fully performed, your data is blocked for further use and deleted after expiry of the retention periods under tax and company law, unless you have expressly consented to further use of your data.

Legal basis
When processing your personal data (cf. § 4 3. a.) that is necessary for the performance of a trial subscription contract concluded with us, Art. 6 (1) (b) GDPR serves as the legal basis. This also applies to processing operations necessary for the implementation of pre-contractual measures.

Storage period
Once the trial issues have been sent, your data is blocked for further use and deleted after expiry of the retention periods under tax and commercial law, unless you have expressly consented to further use of your data or Falstaff has an (overriding) legitimate interest within the meaning of recital 47 GDPR in further processing this data. Further storage may take place in individual cases if required by law.

h) Processing of photos at events

Type and scope of data processing
We organise events and similar occasions. At these events, we may take photos and video recordings of participants in connection with the respective event. These (moving) images are then used or processed to present the event. This takes place online as well as offline (for example in the magazine, on social media or on the website).

Legal basis
Art. 6 (1) (f) GDPR and § 12 (2) no. 4 of the Austrian Data Protection Act (DSG 2018) serve as the legal basis for the aforementioned data processing. The processing of the aforementioned data is necessary for presenting the event or Falstaff and thus serves to safeguard a legitimate interest of our company.

Storage period
Photos and videos are deleted as soon as there is no longer a legitimate interest in presenting the respective event. Online, this is usually the case when the respective event is no longer visible online.

i) Falstaff Auction

Type and scope of data processing
In the Falstaff auction, a bidder can purchase certain products from a dealer via Falstaff. The dealer thereby receives an advertising credit with Falstaff. In order to carry out the auction, Falstaff must process personal data of the bidder and the dealer. The following personal data is collected and processed by Falstaff in the course of the auction:

From the dealer:

1. Company
2. Address
3. Telephone/fax
4. E-mail address
5. Managing director (name)
6. Contact person (name and e-mail)
7. Amount of the advertising credit
8. Validity period of the advertising credit

From the bidder:

1. Name
2. Address
3. Telephone
4. E-mail address
5. Bids

This personal data is processed for the following purposes:

• Operation of a platform for online auctions and processing of the transactions brokered via the online platform
• We also use the data for the purposes of direct advertising and marketing.

Legal basis
Insofar as your personal data is not used for the purposes of direct advertising and marketing, the legal basis is the joint contractual relationship and its performance pursuant to Art. 6 (1) (b) GDPR. Otherwise, the data processing is based on our overriding legitimate interest pursuant to Art. 6 (1) (f) GDPR. If you separately consent to certain processing operations in this context, Art. 6 (1) (a) GDPR serves as the legal basis. For the possibility of withdrawal, please refer to § 4 (b) mutatis mutandis.

Storage period
The aforementioned data is deleted once the stated purposes have been achieved or you have objected to the data processing and no statutory retention obligations prevent deletion.

j) Falstaff Circle membership administration and transfer to Falstaff Circle partners required for performance of the contract

For the purpose of administering your membership in the Falstaff Circle, Falstaff Verlags-Gesellschaft m.b.H. (Austria) or Falstaff Deutschland GmbH or Falstaff Verlag Schweiz AG (depending on the country you come from) processes the personal data and contact details you have provided in the relevant form. This processing is carried out on the basis of Art. 6 (1) (b) GDPR, as it is necessary for the performance of the contractual relationship with you as a Falstaff Circle member.

In order for you to receive the services provided as part of the membership free of charge, Falstaff Verlags-Gesellschaft m.b.H. (Austria) or Falstaff Deutschland GmbH or Falstaff Verlag Schweiz AG (depending on the country you come from) transmits to the Falstaff Circle partners the information as to whether you have become a member of the Falstaff Circle. This transmission is a mandatory part of the performance of the contract, as the financing and provision of the free services takes place via the cooperation model with the Circle partners, who need to know of the existence of the membership in order to provide their services. The transmission is therefore also based on Art. 6 (1) (b) GDPR. The transmission is limited exclusively to the information about the existence of the membership.

§ 5 Disclosure of data

We only pass on your personal data to third parties if:

• you have given your express consent to this pursuant to Art. 6 (1) sentence 1 (a) GDPR
• this is legally permissible and necessary pursuant to Art. 6 (1) sentence 1 (b) GDPR for the performance of a contractual relationship with you
• there is a legal obligation to disclose pursuant to Art. 6 (1) sentence 1 (c) GDPR
• the disclosure is necessary pursuant to Art. 6 (1) sentence 1 (f) GDPR to safeguard legitimate business interests or to assert, exercise or defend legal claims, and there is no reason to assume that you have an overriding interest worthy of protection in your data not being disclosed.

Recipients and service providers used
For the purposes described in this privacy policy we use in particular the service providers listed below. In each case only the data required for the respective service is processed. Where a service provider processes personal data on our behalf, this takes place on the basis of an agreement pursuant to Art. 28 GDPR and in accordance with our instructions.

Piano Software Norway (formerly Cxense ASA), Drammensveien 165, 0277 Oslo, Norway (Piano): Provision of the central user database and administration of user accounts and access entitlements with Piano ID/Piano Subscriptions and Piano Composer. The data categories required for this pursuant to § 4 (b) are processed. Piano Audience (data management platform, DMP) only receives the usage and identifier data described in § 8 within the scope of the consent described there. The modules used are Piano ID (identity management), Piano Composer with subscription management (Linked Terms) and Piano Audience. Piano processes the data on our behalf on the basis of a data processing agreement dated 31 March 2025; the application is operated in the EU hosting region. As sub-processors, Piano uses group companies of the Piano group (including Piano Software Inc., Philadelphia, USA) as well as, in particular, Amazon Web Services, Cloudflare and Google; data centres of Hetzner Online GmbH (Germany) and Gcore are used for Piano Audience. The current list is available at piano.io/privacy-policy. For transfers to third countries, see below.

KONZEPT IT GmbH, Kirchenplatz 6/8/1, 1230 Vienna, Austria (FN 187860s) (Konzept IT): Hosting of our Websites and operation of the Keycloak instance for the shared login. The technical access, authentication and session data required for this as well as the data stored on the respective infrastructure pursuant to § 4 (a) and (b) is processed.

Mailjet SAS, 4 rue Jules Lefebvre, 75009 Paris, France (Mailjet / Sinch Email): Technical handling of the newsletter dispatch; in particular the e-mail address, the salutation and personalisation details you have provided, message content and the required consent, sign-up, unsubscribe and dispatch information pursuant to § 4 (e) is processed.

Microsoft Ireland Operations Limited, One Microsoft Place, South County Business Park, Leopardstown, Dublin 18, Ireland (Dynamics 365 Customer Insights): Handling of commercial e-mails; the contact and personalisation data required for the respective communication, message content as well as consent, unsubscribe and dispatch information pursuant to § 4 (e) is processed. Evaluations requiring consent only take place to the extent described there.

Shopify International Limited, The Sidings, 4th Floor, Grand Canal Quay, Dublin D02 E7K8, Ireland (Shopify): Provision of the shop platform shop.falstaff.com and technical processing of orders. The required contact, billing, delivery, order and payment information pursuant to § 4 (d) as well as the technical access data required for operating the shop is processed.

Google Ireland Limited (Google) and Apple Distribution International Limited (Apple): If you voluntarily select the respective social login, the data exchange required for the login takes place pursuant to § 4 (b). The providers also process data within their own login services under their own data protection responsibility.

Algolia SAS, 55 Rue d’Amsterdam, 75008 Paris, France (Algolia, search function): The search function of our Websites is provided by Algolia. Search queries are forwarded to Algolia exclusively from our servers; your browser does not establish a direct connection to Algolia, and neither your IP address nor a user identifier is transmitted. The search terms you enter are transmitted; in individual cases these may be personal data, for example if you search for the name of a person. Algolia processes the search terms on our behalf on the basis of an agreement pursuant to Art. 28 GDPR exclusively for providing the search function and for error analysis; the legal basis is our legitimate interest in a functioning search pursuant to Art. 6 (1) (f) GDPR. Processing takes place in the EEA; search logs are deleted by Algolia no later than 90 days after termination of the contractual relationship.

Processing outside the EEA
With internationally operating service providers, processing may take place outside the European Economic Area (EEA), for example in the context of hosting or support services. Insofar as personal data is transferred to third countries, this only takes place under the conditions of Art. 44 et seq. GDPR, in particular on the basis of an applicable adequacy decision pursuant to Art. 45 GDPR or appropriate safeguards pursuant to Art. 46 GDPR, such as the Standard Contractual Clauses of the European Commission and, where necessary, supplementary protective measures. Information on the safeguards used in a specific case and a copy of the relevant provisions can be obtained from datenschutz@falstaff.com. For Piano: our contractual partner is Piano Software Norway, based in Oslo (EEA); the application is operated in the EU hosting region. Under the data processing agreement, Piano may involve group companies and sub-processors in the United Kingdom, the USA, Sri Lanka and the Philippines, in particular for support and maintenance services. These transfers take place on the basis of the Standard Contractual Clauses of the European Commission (Implementing Decision (EU) 2021/914), an adequacy decision (United Kingdom) or the Binding Corporate Rules of the Piano group approved by the European Data Protection Board, supplemented by additional protective measures such as encryption of the data with keys managed exclusively within the EEA. Mailjet processes the data for the newsletter dispatch on servers in the EEA. Microsoft Ireland Operations Limited and Shopify International Limited are established in the EEA; insofar as group companies in the USA (Microsoft Corporation, Shopify Inc.) or in Canada (Shopify Inc.) are involved, this takes place on the basis of the adequacy decisions for the EU-U.S. Data Privacy Framework and for Canada respectively, supplemented by the Standard Contractual Clauses. Algolia processes search queries in the EEA; the Standard Contractual Clauses apply to any transfers within the Algolia group.

§ 6 User profiles / use of cookies

Type and scope of data processing
Personal user accounts are maintained to the extent set out in § 4 (b). In addition, with your consent, usage data, online identifiers and interests derived from them may be processed for the analyses described in § 8. This may also affect visitors who are not logged in. Data that can be assigned to a cookie or user identifier is not anonymous merely because we do not know the visitor’s name.

We use so-called “cookies”. Cookies are small text files that are sent from our web server to your browser when you use our APPs and/or our Websites and are stored on your computer for later retrieval. We use both session cookies, which are stored for the duration of a session, and persistent cookies with a longer storage period. Details on the purpose, provider and lifetime of the cookies used can be found in the Cookie Settings.

The following cookies are used:

Our website uses transient cookies, which are automatically deleted when you close your browser. This type of cookie allows your session ID to be recorded. This makes it possible to assign different requests from your browser to a common session and to recognise your device on subsequent visits to the website.

Required cookies
These cookies are needed for technical reasons so that you can visit our website and use the functions we offer. They also contribute to secure and proper use of the website. This includes functions of Keycloak, Piano ID and Piano Composer only insofar as they are strictly necessary for the login, session management or entitlement check you have expressly requested. Analysis, personalisation or marketing functions of these services going beyond this are not covered by this exception. The required cookies include in particular the session cookies of Keycloak (including AUTH_SESSION_ID, KEYCLOAK_SESSION, KEYCLOAK_IDENTITY; lifetime for the duration of the login session), the Piano ID login token (__utp; up to 2 years if “stay logged in” is selected), the encrypted access entitlements (__tac, 90 days; __tae, 13 months), the identifiers required for access control by Piano Composer (__tbc and xbc, 2 years each; _pcid, _pctx and _pprv, 13 months each) as well as auxiliary cookies for language settings and ad-blocker detection (__pil, 30 days; __pnahc, 90 days; __adblocker, session). Without your consent, these identifiers are not used for the analysis described in § 8.

Performance cookies
With your consent and with the help of these cookies, we are able to analyse website usage and improve the performance and functionality of our website. For example, information is collected about how visitors use our website, which pages are accessed most frequently, or whether error messages appear on certain pages.

Type 1: Transient cookies. Our website uses transient cookies, which are automatically deleted when you close your browser. This type of cookie allows your session ID to be recorded. This makes it possible to assign different requests from your browser to a common session and to recognise your device on subsequent visits to the website.

Type 2: Persistent cookies
Our website also uses persistent cookies. Persistent cookies are stored in your browser for a longer period of time and transmit information to us. The storage period varies depending on the cookie. You can delete persistent cookies yourself via your browser settings.

Legal basis
Pursuant to § 165 (3) TKG 2021, storing information on your device or accessing such information requires your prior consent, unless this serves exclusively to transmit a communication or is strictly necessary for a service you have expressly requested. The subsequent processing of personal data for analyses and personalisation requiring consent is based on Art. 6 (1) (a) GDPR. Art. 6 (1) (b) GDPR applies to the required account functions; insofar as the technical provision and security of our Websites is based on legitimate interests, Art. 6 (1) (f) GDPR applies. A legitimate interest does not replace consent required under § 165 (3) TKG 2021.

Storage period
As soon as the data transmitted to us via cookies is no longer required to achieve the purposes described above, this information is deleted. Further storage may take place in individual cases if required by law.

Configuring your browser settings
Most browsers are preset to accept cookies automatically. However, you can configure your browser so that it only accepts certain cookies or no cookies at all. Please note, however, that you may no longer be able to use all functions of our website if cookies are deactivated on our website by your browser settings. You can also delete cookies already stored in your browser via your browser settings. Furthermore, it is possible to set your browser to notify you before cookies are stored. Since the various browsers differ in their respective functions, we ask you to consult the help menu of your browser for the configuration options.

Under Cookie Settings you will find all cookies and similar technologies currently used, together with explanations. In this view you can also set your data protection preferences (under Manage options -> Vendor settings). Here you can withdraw or change any consent given at any time with effect for the future. Rejecting Piano Audience tracking does not prevent the use of the required login and account functions.

If you would like a comprehensive overview of all third-party access to your internet browser, we recommend installing plug-ins specially developed for this purpose.

§ 7 Integration of social plug-ins

Our Websites and the APPs contain social plug-ins of the social networks “Facebook/Instagram” (Meta Platforms Inc., 1601 S. California Ave, Palo Alto, California 94304, USA) and “X” (X Corp., 1355 Market St, Suite 900, San Francisco, California 94103, USA). These services are offered by the respective companies (“providers”). Within our online presence, the social plug-ins are identified by the respective buttons belonging to the service. These social plug-ins are designed as pure hyperlinks to Falstaff’s online presence with the respective service.

The scope and purpose of data collection by the respective service as well as the further processing and use of your data there can be found in the privacy notices directly on the website of the service. There you will also find further information on your corresponding data protection rights and setting options for protecting your privacy.

a) Meta Platforms Inc. (Facebook/Instagram), 1601 S California Ave, Palo Alto, California 94304, USA

• www.facebook.com/privacy/policy/
• privacycenter.instagram.com/policy

b) X Corp., 1355 Market St, Suite 900, San Francisco, California 94103, USA

• x.com/privacy

The services themselves do not collect any personal data via the social plug-ins and their use. Clicking on a social plug-in only leads to a redirection to the respective social media presence.

The scope, purpose and storage periods of the respective data collection when accessing the pages of these providers are not known to us. It is also possible that the respective service providers use cookies.

The scope and purpose of data collection by the respective service as well as the further processing and use of your data there can be found in the privacy notices directly on the website of the respective service. There you will also find further information on your corresponding data protection rights and setting options for protecting your privacy.

§ 8 Tracking and analysis tools

Google Analytics

This website uses Google Analytics, a web analytics service provided by Google Inc., 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA (“Google”). Google Analytics uses so-called “cookies”, text files that are stored on your computer and enable an analysis of your use of the website.

The information generated by these cookies, for example about the time, place and frequency of your use of this website, is generally transmitted to a Google server in the USA and stored there. When using Google Analytics, it cannot be ruled out that the cookies set by Google Analytics may collect further personal data in addition to the IP address. We would like to point out that Google may transfer this information to third parties where required by law or where third parties process this data on behalf of Google.

Google will use the information generated by the cookies on behalf of the operator of this website to evaluate your use of the website, to compile reports on website activity and to provide other services related to website and internet use to the website operator. According to Google, the IP address transmitted by your browser as part of Google Analytics is not merged with other Google data.

You can generally prevent the storage of cookies by adjusting your browser software settings accordingly. However, we would like to point out that in this case you may not be able to use all functions of this website to their full extent.

It cannot be ruled out that the cookies set by Google Analytics may collect further personal data in addition to the IP address. To prevent information about your use of the website from being collected by Google Analytics and transmitted to Google Analytics, you can download and install a browser plug-in from the following link: tools.google.com/dlpage/gaoptout?hl=en.

This plug-in prevents information about your visit to the website from being transmitted to Google Analytics. It does not prevent any other form of analysis.

Please note that you cannot use the browser plug-in described above when visiting our website via the browser of a mobile device (smartphone or tablet). When using a mobile device, you can prevent the collection of your usage data by Google Analytics by clicking on the following link:

Deactivate Google Analytics

By clicking on this link you can install an extension for your browser. It prevents information about your visit to the website from being transmitted to Google Analytics.

Piano Audience (DMP)

Type and scope of data processing
With your prior consent, we use Piano Audience as a data management platform (DMP). The processing serves to analyse the use of our offerings within the scope of the consent you have chosen. It may also take place for visitors who do not have a user account or are not logged in.

Piano Audience processes the following data: a randomly generated visitor identifier stored in cookies or in the local storage of your browser (the Piano browser ID _pcid and the DMP identifiers cX_P and cX_G); the pages and content accessed, including their categories, topics and authors; referrer sources and search terms entered on our pages; time, frequency and duration of visits; interactions such as clicks, displayed elements, newsletter sign-ups and purchases; technical details about browser, browser language, operating system, device type and screen resolution; the approximate location derived from the IP address (country, region, city) – the IP address itself is transmitted to Piano but not stored there; and, if you have a user account, your membership or subscription status. Such information may be personal data even without knowledge of your name. We operate Piano Audience as a shared instance for falstaff.com (including the country portals), wein.de and buehne-magazin.com; your usage data from these offerings is therefore combined in a cross-brand profile via a shared identifier (cX_G). If you are logged in, the DMP identifier is assigned to your Piano ID, so that your usage profile can be maintained across devices and linked to your account data pursuant to § 4 (b). No automated decision-making that produces legal effects concerning you or similarly significantly affects you (Art. 22 GDPR) takes place. The recipient is Piano as processor; § 5 applies in addition.

Legal basis and withdrawal
The processing is based on your consent pursuant to Art. 6 (1) (a) GDPR; § 165 (3) TKG 2021 additionally applies to the storage or reading of information on your device. Piano Audience is only activated for these purposes after you have made the corresponding selection in the Cookie Settings. You can withdraw your consent there at any time with effect for the future. Without such consent, the DMP tracking described here does not take place. The functions of Piano ID, Keycloak and Piano Composer required for providing your user account and for access control remain separate from this; cf. § 4 (b) and § 6.

Storage period
The identifiers set by Piano Audience (cX_P, cX_G) and the Piano browser ID (_pcid) have a lifetime of 13 months from the last visit; details on all cookies and similar identifiers used can be found in the Cookie Settings. This must be distinguished from server-side storage at Piano: usage events are stored there with reference to your identifier for a maximum of 12 months; thereafter the identifiers are removed and the data is retained for up to three years exclusively in a form that no longer allows any reference to you, in order to enable statistical evaluations. After withdrawal of your consent, further processing dependent on consent ceases; the personal data concerned is deleted or anonymised unless a statutory retention obligation applies. Necessary records of consent and its withdrawal remain unaffected.

§ 9 Facebook visitor action pixel

Type and scope of data processing
We offer the use of the Facebook visitor action pixel on our website. Through its use, the behaviour of users can be tracked after they have been redirected to the provider’s website by clicking on a Facebook ad. This procedure serves to evaluate the effectiveness of Facebook ads for statistical and market research purposes and can help to optimise future advertising measures.

The data collected is anonymous to us, i.e. it does not allow us to draw any conclusions about the identity of users. However, the data is stored and processed by Facebook, so that a connection to the respective user profile is possible and Facebook can use the data for its own advertising purposes in accordance with the Facebook data use policy (www.facebook.com/privacy/policy/). You can allow Facebook and its partners to place ads on and outside Facebook. A cookie may also be stored on your computer for these purposes.

Consent to the use of the visitor action pixel may only be given by users who are older than 14 years. If you are younger, please ask your legal guardians for permission.

Legal basis
The data processing described for the purpose of the visitor action pixel is carried out in accordance with the declaration of consent voluntarily given pursuant to Art. 6 (1) (a) GDPR.

Storage period
The processed data is deleted as soon as the declaration of consent is withdrawn.

§ 10 Security measures for protecting the data stored by us

We undertake to protect your privacy and to treat your personal data confidentially. In order to prevent loss or misuse of the data stored by us, we take extensive technical and organisational security precautions, which are regularly reviewed and adapted to technological progress. However, we would like to point out that, due to the structure of the internet, it is possible that the rules of data protection and the security measures mentioned above may not be observed by other persons or institutions outside our area of responsibility. In particular, data disclosed in unencrypted form – even by e-mail – may be read by third parties. We have no technical influence on this. It is the user’s responsibility to protect the data they provide against misuse by encryption or in some other way.

§ 11 Hyperlinks to external websites

Our Websites and our APPs contain so-called hyperlinks to websites of other providers, such as payment service providers or form solution providers. When you activate these hyperlinks, you are redirected from our Websites and our APPs directly to the website of the other provider. You can recognise this, among other things, by the change in the URL. We cannot assume any responsibility for the confidential handling of your data on these third-party websites, as we have no influence on whether these companies comply with data protection provisions. Please inform yourself directly on these websites about how these companies handle your personal data.

§ 12 Rights of data subjects

Under the GDPR, you have the following rights as a data subject of the processing of personal data:

• Pursuant to Art. 15 GDPR, you may request information about your personal data processed by us. In particular, you may request information about the purposes of processing, the categories of personal data, the categories of recipients to whom your data has been or will be disclosed, the planned storage period, the existence of a right to rectification, erasure, restriction of processing or objection, the existence of a right to lodge a complaint, the origin of your data if it was not collected by us, about transfers to third countries or international organisations, and about the existence of automated decision-making including profiling and, where applicable, meaningful information about its details.
• Pursuant to Art. 16 GDPR, you may request without undue delay the rectification of inaccurate personal data or the completion of your personal data stored by us.
• Pursuant to Art. 17 GDPR, you may request the erasure of your personal data stored by us, unless the processing is necessary for exercising the right of freedom of expression and information, for compliance with a legal obligation, for reasons of public interest or for the establishment, exercise or defence of legal claims.
• Pursuant to Art. 18 GDPR, you may request the restriction of processing of your personal data insofar as you contest the accuracy of the data, the processing is unlawful, we no longer need the data and you oppose its erasure because you require it for the establishment, exercise or defence of legal claims. You also have the right under Art. 18 GDPR if you have objected to the processing pursuant to Art. 21 GDPR.
• Pursuant to Art. 20 GDPR, you may request to receive the personal data you have provided to us in a structured, commonly used and machine-readable format, or you may request that it be transmitted to another controller.
• Pursuant to Art. 7 (3) GDPR, you may withdraw your consent given to us at any time. As a consequence, we may no longer continue the data processing based on this consent in the future.
• Pursuant to Art. 77 GDPR, you have the right to lodge a complaint with a supervisory authority. As a rule, you can contact the supervisory authority of your habitual residence, your place of work or our company’s registered office. In Austria, the supervisory authority is the Data Protection Authority (Datenschutzbehörde), Barichgasse 40-42, 1030 Vienna, telephone: +43 1 521 52-25 69, e-mail: dsb@dsb.gv.at, website: dsb.gv.at.

§ 13 Objection

If your personal data is processed on the basis of legitimate interests pursuant to Art. 6 (1) sentence 1 (f) GDPR, you have the right to object to the processing of your personal data pursuant to Art. 21 GDPR, insofar as there are grounds relating to your particular situation or the objection is directed against direct marketing. In the case of direct marketing, you have a general right to object, which we implement without you having to state a particular situation.

§ 14 Information on your personal data stored by us / storage period / deletion

We only store your personal data for as long as permitted by law. Stored personal data is deleted when the user withdraws consent to its storage or when knowledge of this data is no longer necessary to fulfil the purpose pursued by storing it, in particular when the user account is deleted, or when its storage is inadmissible for other legal reasons.

On request, we will be happy to inform you which data we have stored about you. Should incorrect data be stored by us despite our efforts to keep data accurate and up to date, we will correct it without undue delay.

You may at any time review, change or delete the personal data you have provided to us by sending an e-mail to datenschutz@falstaff.com or by contacting us in writing at the following postal address: Falstaff Verlags-Gesellschaft m.b.H., Schottenring 2-6, 1010 Vienna. If you request the deletion of the stored data, this deletion is also carried out without undue delay at your request. If deletion is not possible for legal reasons, the data concerned is blocked instead. Please note, however, that if your data is deleted we can no longer offer you the services described here.