La Viesta Newsletter

Newsletter – privacy information

This is an English version of the section ‘La Viesta Newsletter’ of our privacy policy. The full privacy policy is available in German at laviesta.at/datenschutz. For the newsletter list – sign-up, import, sending, unsubscribing and deletion – the more specific information below applies and, to that extent, takes precedence over the general information in the sections ‘Zweck der Verarbeitung’ (purpose of processing), ‘Übermittlungen in Drittländer’ (transfers to third countries) and ‘Löschung von Daten’ (erasure of data) and in the two general sections ‘Newsletter’ of the German privacy policy. The newsletter pages themselves are treated in the same way as all other pages of this website (see ‘Newsletter pages on our website’).

Who is responsible

The La Viesta newsletter is the responsibility of Alexander Bergbauer (La Viesta), Kaasgrabengasse 121A, 1190 Vienna, Austria, office@laviesta.at.

What we use your data for

• We email you the La Viesta newsletter: new events and presale dates, specials and – if you give us your birthday – perhaps a birthday special. There’s no fixed schedule.
• We see which links in the newsletter you click and count how many ticket purchases come from an issue – so we can focus the newsletter on what interests you.
• We use your name to address you personally.
• We use your birthday (day and month) solely to see who has a birthday coming up and perhaps send you a ticket or a discount. There’s no entitlement to this.
• We use your year of birth (optional) only to tailor the newsletter roughly to age groups, e.g. with events that suit your age group. We keep it as long as your other newsletter data (see ‘How long we keep your data’).
• We use your address (optional) only to send you post from La Viesta, e.g. a birthday surprise or invitations.
• If you bought tickets from us and gave a postal address or a phone number in your order (see ‘Where imported data comes from’), we add them to the newsletter list. We use the postal address only to send you post from La Viesta, e.g. invitations, and the phone number only to reach you personally with questions about your ticket orders, events you have tickets for or post from La Viesta. We don’t use them for marketing calls, marketing text messages or marketing via messengers such as WhatsApp. If you unsubscribe, we delete both.
• We keep a record that and how you signed up or unsubscribed (double opt-in) and protect the form against misuse.
• We handle your unsubscription and your deletion request.
• We make sure an address isn’t added (again) to the list if you deleted your data or if, according to an earlier source, you didn’t want marketing (see ‘Check value’).
• If you put yourself on the waiting list for an event on its event page (‘Notify me’), we email you about this event at most three times: when tickets are available (presale start or tickets available again), when tickets are running low, and after the event with the link to the photos and a request for a Google review. Our newsletter tool sends some newsletters automatically as soon as it sees the occasion in the ticket data or on our website, e.g. the presale start of a new event – always with the same unsubscribe link.
• If you bought tickets for an event and receive our newsletter, we’ll email you once after the event with a link to the photos and a request for a Google review.

What data we process

• Required for the newsletter: email address, first name, surname. Without them we can’t send you the newsletter.
• Optional: address (street and house number, postcode, town or city, country) and birthday (day, month and – optionally – year).
• Automatically: the language of your sign-up (German or English), the times of sign-up, confirmation and any unsubscription, the version of the notice next to the sign-up button, the origin of the entry (website or import) and a history (e.g. ‘confirmation email sent’, ‘confirmed’, ‘unsubscribed’). We don’t store your IP address for this.
• Sending: which issue we sent to your address and when, whether delivery failed or the email bounced as undeliverable and – for imported contacts – when we informed you under Art. 14 GDPR.
• Clicks in the newsletter: which link you clicked in which issue, when for the first and the last time and how often. Calls that were probably triggered by a security program of your email provider are marked as ‘probably automatic’. We don’t store your IP address or details about your device for this.
• Protection against misuse: from your IP address we create a check value that changes daily and is used only to count how often the form is submitted. It is kept for no more than 24 hours.
• For an import: email address, first name and surname; from Tickethead also order number, order date, order status and event, your phone number and postal address (street and house number, postcode, town or city, country) if you gave them in your order, and your marketing preference. We add the phone number and postal address only to imported contacts before our first email to them and only where none is stored yet; we don’t take your birthday from this source.
• If, according to the source, you declined marketing, unsubscribed or complained, or your address was undeliverable, we don’t create an entry for you but only store the check value; if your address is already on our list, we record the unsubscription or block there. We don’t import ticket orders without your agreement to marketing.
• Waiting list: which event, when you signed up for it and confirmed, the version of the notice next to the button and – in the sending history – which of the emails about this event we sent you.

Sign-up with confirmation (double opt-in)

After you submit the form, we send you an email with a confirmation link. You only receive the newsletter once you open it and confirm. This makes sure nobody can sign up someone else’s address without confirmation; we don’t use details from an unconfirmed sign-up for the newsletter. We keep the steps (times, version of the notice, language) as a record.

Legal bases

• Sign-up on the website: your consent (Art. 6(1)(a) GDPR; for marketing emails s. 174(3) of the Austrian Telecommunications Act 2021, TKG 2021). You give it by clicking ‘Subscribe to the newsletter’ after reading the notice next to the button and by confirming by email. It also covers the birthday special if you give your birthday, and tailoring by age group if you give your year of birth.
• Record of your sign-up and protection of the form: our legitimate interest (Art. 6(1)(f) GDPR) in being able to demonstrate consent (Art. 7(1) GDPR) and in protecting our form against automated entries.
• Unconfirmed sign-ups: our legitimate interest (Art. 6(1)(f) GDPR) in being able to show when a sign-up was triggered for an address and in detecting misuse of our form.
• After you unsubscribe: our legitimate interest (Art. 6(1)(f) GDPR) in being able to demonstrate your unsubscription and your earlier consent (Art. 7(1) GDPR) and in not contacting you again; where necessary also to defend legal claims (Art. 17(3)(e) GDPR).
• Import of ticket buyers (Tickethead): the consent to marketing you expressly gave when ordering (Art. 6(1)(a) GDPR; s. 174(3) TKG 2021). We don’t import ticket buyers without this consent.
• Phone number and postal address from ticket orders: our legitimate interest (Art. 6(1)(f) GDPR) in informing customers by post about our own events (Recital 47 GDPR) and in reaching them with questions about their ticket orders, their events or this post. If you expressly agreed to marketing when ordering, we also rely on that consent (Art. 6(1)(a) GDPR). You can object at any time (see ‘Unsubscribing, objecting and withdrawing consent’).
• Check value after a deletion, and check value instead of an entry if, according to the source, you declined marketing, unsubscribed, complained or were undeliverable: our legitimate interest in respecting your wish or the earlier unsubscription permanently (Art. 6(1)(f) GDPR).
• Sending history and undeliverable addresses: our legitimate interest (Art. 6(1)(f) GDPR) in being able to show what we sent and when, and in not continuing to write to addresses that don’t accept emails.
• Clicks in the newsletter: your consent (Art. 6(1)(a) GDPR). You can withdraw it at any time by unsubscribing (see ‘Unsubscribing, objecting and withdrawing consent’); the withdrawal applies to the future.
• Handling unsubscriptions and deletion requests (link email, deletion, deletion confirmation): our legal obligation (Art. 6(1)(c) GDPR in conjunction with Art. 12, 17 and 21 GDPR).
• Waiting list and the emails about this event: your consent (Art. 6(1)(a) GDPR; s. 174(3) TKG 2021), which you give with the notice next to the button and – unless you’re already subscribed – by confirming by email. If you’re already subscribed and only join the waiting list, we email you about this event when tickets are available and when they’re running low; your newsletter consent covers this (new events, presale starts, specials). You’ll only get the email after the event with the request for a Google review if you confirmed your waiting list entry by email. It goes to everybody with a confirmed entry in the same way; there’s nothing in return. The link leads to Google, where Google’s privacy policy applies.

Where imported data comes from

If you didn’t sign up yourself, your data comes from Tickethead (Tickethead GmbH, our ticketing partner): data from your ticket order for a La Viesta event in which you agreed to marketing (the person who placed the order, not other ticket holders). In our first email to imported contacts we explain where the data comes from and how to unsubscribe or delete it.

Who receives your data

We don’t use a newsletter service provider for the newsletter list. The list is stored in our website’s database. The following service providers are involved on our behalf:

• GoDaddy (GoDaddy.com, LLC, 100 S. Mill Ave, Suite 1600, Tempe, AZ 85281, USA): hosting of our website including the database, and sending our emails via GoDaddy’s mail server. According to our hosting plan, the website and database are located in GoDaddy’s ‘Europe’ region; GoDaddy’s mail server may also be located in the USA.
• Cloudflare (Cloudflare, Inc., 101 Townsend St., San Francisco, CA 94107, USA): all requests to laviesta.at pass through Cloudflare’s network (protection and fast delivery), including form entries. Cloudflare is engaged for this by our host GoDaddy; we have no contract of our own with Cloudflare.
• Microsoft 365 (Microsoft Ireland Operations Limited, Dublin, Ireland; obtained via GoDaddy Europe Limited): our mailboxes events@laviesta.at and office@laviesta.at, which receive replies and undeliverable emails.

These providers belong to companies based in the USA; processing outside the EU is possible. For transfers to the USA we rely on the European Commission’s adequacy decision for the EU-U.S. Data Privacy Framework (Art. 45 GDPR). GoDaddy.com, LLC, Cloudflare, Inc. and Microsoft Corporation are certified under it (www.dataprivacyframework.gov). Should the decision or a certification cease to apply, our contract with GoDaddy – including for its sub-processors such as Cloudflare – provides for the European Commission’s standard contractual clauses (Art. 46(2)(c) GDPR). We don’t sell the newsletter list.

Sending: We send the newsletter with our own tool directly from our website, without a newsletter service provider, via the mail server of our web host GoDaddy (see above). GoDaddy processes your email address and the content of the email; the mail server may be located in the USA (legal basis as above). The newsletter comes from events@laviesta.at; replies and undeliverable emails arrive in our Microsoft 365 mailbox. The newsletter contains no tracking pixels – we don’t measure whether you open it. The links in the newsletter go via laviesta.at: if you click one, we store which link you clicked in which issue and when (see ‘What data we process’). Links to laviesta.at also carry an identifier of the issue that is the same for all recipients; with it, Google Analytics shows us how many visits and ticket purchases come from an issue – without names or email addresses. Each email also carries technical identifiers so that unsubscribing, deletion and matching undeliverable emails work. Images load from laviesta.at; this creates the usual server logs, as with any page view, but nothing linked to you. If you follow a link to our website, the same applies there as for any visit (see the sections on cookies, Google Analytics and Facebook of our privacy policy, in German). If we use a sending service in future, we’ll update this section first.

In addition, the newsletter pages use the same tracking as all other pages of this website; the sections on cookies, Google Analytics and Facebook of the German privacy policy apply to it (see ‘Newsletter pages on our website’).

How long we keep your data

• For as long as you’re subscribed.
• If you unsubscribe, you won’t get the newsletter any more. Your details are kept as ‘unsubscribed’ so that we don’t contact you again and can prove the unsubscription – until you ask us to delete them.
• Sign-ups that were started but not confirmed are kept as a record until deletion is requested.
• Imported contacts are kept until you ask us to delete your data. If you unsubscribe, your details are kept as ‘unsubscribed’, as described above, so that we don’t contact you again and can prove the unsubscription.
• We keep the sending history like your other newsletter data, until you ask us to delete it.
• We keep your clicks in the newsletter for as long as you’re subscribed. If you unsubscribe or ask us to delete your data, we delete them; only totals per issue remain, without any link to you.
• If you ask us to delete your data, we immediately and automatically delete all newsletter data for your address – except the check value.
• The check value used to protect the form (derived from the IP address) is kept for no more than 24 hours.
• We delete your waiting list entry 30 days after the event, when you unsubscribe or when you ask us to delete your data; unconfirmed entries after 7 days at the latest.
• Backup copies of our website still contain the data for up to 30 days; after that they are overwritten.

Check value

After a deletion we keep only a check value of your email address: an irreversible checksum created with a secret key (HMAC-SHA-256), without your name and without a date. Your address can’t be worked out from it. We store the same check value – instead of an entry – when importing if, according to the source, you declined marketing, unsubscribed, complained or your address was undeliverable. Its only purpose is to stop your address being added to the list (again) through a later import (e.g. from ticket orders); if you blocked an address (‘Didn’t sign up?’), we also won’t send any more confirmation emails to it. Nobody at La Viesta can see these check values. If you later sign up again yourself and confirm, the check value is removed. If you blocked the address via ‘Didn’t sign up?’, please write to office@laviesta.at before signing up again, and we’ll lift the block.

Unsubscribing, objecting and withdrawing consent

You can unsubscribe from the newsletter, withdraw your consent and object to the use of your data for direct marketing at any time (Art. 7(3) and Art. 21(2) GDPR): using the link in every newsletter or your email program’s unsubscribe button, at laviesta.at/en/newsletter/delete or by emailing office@laviesta.at. It costs you nothing beyond your usual internet costs. Withdrawal applies to the future; anything done before then remains lawful. You also have the right to object at any time, on grounds relating to your particular situation, to processing based on our legitimate interests (Art. 21(1) GDPR).

Deleting your data

Every newsletter has ‘Delete my data’, and the page you see after unsubscribing has ‘Delete my newsletter data’. Without a link to hand, you can request one at laviesta.at/en/newsletter/delete or write to office@laviesta.at; we’ll then send the link to your address. Once you click ‘Yes, delete everything’, we immediately and automatically delete all newsletter data for your address – including the origin from imports, the history and the sending history with your clicks and your waiting list entries – and confirm this by email. We respond to every request within one month (Art. 12(3) GDPR). Emails you send us and notices about undeliverable emails are kept in our mailbox. We delete them once they’ve been dealt with, at the latest after 30 days. Data about your ticket purchases with Tickethead and records we’re required by law to keep are not affected; for those, contact us at office@laviesta.at.

Your other rights

You have the right of access, rectification, erasure, restriction of processing, data portability and objection (Art. 15 to 18, 20 and 21 GDPR). If you believe we’re not processing your data lawfully, you can complain to the Austrian Data Protection Authority (Österreichische Datenschutzbehörde, Barichgasse 40–42, 1030 Vienna, www.dsb.gv.at).

No automated decisions

We don’t make automated decisions within the meaning of Art. 22 GDPR.

Newsletter pages on our website

The newsletter sign-up pages use the same tracking as all other pages on this website; the sections on cookies, Google Analytics and Facebook of the German privacy policy apply to it. In addition, when you confirm, block, unsubscribe or delete, we set a strictly necessary cookie for no more than 30 minutes. It contains only a random code so that this step can be completed securely, and is deleted afterwards.