Privacy Policy

This policy explains what viennatourism.org collects, why, and what you can do about it. It describes the site as it is configured on 30 August 2026, and is revised when the configuration changes rather than kept deliberately vague.

Reading the site

You can read every guide here without giving us anything. There is no account, no login, no newsletter sign-up, and no paywall. Comments are closed site-wide, so there is no comment form and no comment data is collected.

The site is hosted by DreamHost, which keeps standard server logs — IP address, timestamp, page requested, browser user agent — as a normal part of running a web server and for security. We do not use those logs to build profiles of individual readers.

Analytics

We run Google Analytics 4, connected through the Site Kit by Google plugin, to see which guides are read and where readers arrive from. It sets cookies in your browser and sends Google a record of the pages you view, an approximate location derived from your IP address, and technical details about your device. IP addresses are anonymised by Google Analytics 4 before storage. We look at this in aggregate; we do not attempt to identify individual readers and have not enabled any Google Analytics advertising or remarketing features.

Google Search Console is also connected. It reports search queries that led to this site in aggregate, with no user-level data.

Advertising

Third-party advertising is not currently running on this site. If and when it is enabled, this section will be updated before any ad is served, and the following will apply: the ad network, its certified partners and Google will set cookies or read device identifiers to select and measure advertisements, and Google’s use of advertising cookies is described in its own policy on how it uses data from partner sites. Readers in the EEA, the UK and Switzerland will be asked for consent through a Google-certified consent management platform before any advertising or measurement cookie is set, and personalised advertising can be declined there without losing access to any guide.

Booking links and commission

Some links here go to accommodation and activity providers. Those links are handled by Stay22, a booking partner whose script rewrites them as the page loads so that a booking made afterwards can be credited to this site. We earn a commission when a booking is made through one of them. The price you pay is the same either way.

Stay22 does not set a cookie. It identifies your device from characteristics of your browser — screen, language, time zone and similar — and stores an identifier in your browser’s local storage, which means clearing cookies alone does not clear it. Its script is classed as a marketing service by the consent banner and does not load at all until you allow marketing. Declining costs you nothing: every guide reads the same and the links still work, unmodified.

Our affiliate disclosure sets out the arrangement in full.

The contact form

If you write to us, the form collects the name, email address, subject, page reference and message you type in. It is delivered to the publisher’s inbox by Contact Form 7 and used solely to answer you. Contact Form 7 does not retain submissions in the site’s database; the message lives in email, and correspondence is deleted once the matter is closed or, for corrections we have acted on, kept as a record of what was changed and when. We do not add you to a mailing list and we do not pass your address to anyone.

Cookies actually set

• Google Analytics 4 — measurement cookies (_ga and related), used to distinguish sessions. Expiry is set by Google, typically up to two years.
• WP Super Cache — the caching layer may set a short-lived cookie to determine whether to serve you a cached page. It carries no personal data.
• WordPress — sets cookies only for logged-in administrators. As a reader you will not receive one.

Every browser lets you block or delete cookies. Blocking analytics cookies does not affect anything you can read here.

One thing here stores something without using a cookie at all: the booking partner’s script keeps an identifier in your browser’s local storage, as described under Booking links and commission above. Clearing cookies does not remove it; clearing the site’s stored data does.

Your choices, and what runs before you make them

What runs before you choose depends on where you are reading from, because the law does. In the European Economic Area and the United Kingdom, and in Brazil, Chile, China, Israel, Nigeria, South Korea, Thailand, Türkiye and Vietnam, nothing beyond the strictly necessary runs until you answer the dialog on your first visit — not analytics, not Stay22 — and Reject all sits on that first screen next to Accept all, not behind a second click.

In the United States you are shown a bar rather than a dialog, and it is not only a notice. Analytics starts on arrival there, but advertising and booking-partner scripts stay switched off until you answer it. In Switzerland you get the dialog too, but analytics starts on arrival there and only advertising and booking-partner scripts wait for your answer. In Canada, and in the countries where notice is enough — among them Australia, New Zealand, Japan, Singapore, India and Mexico — everything described on this page starts when you arrive; the notice tells you so, and the same control switches it off. Everywhere else, and whenever we cannot tell where you are, the strictest setting applies: nothing beyond the necessary runs until you answer.

Your answer is kept on your own device, in a first-party cookie called cookie_consent_99a247 that only this site can read, so you are not asked again on every page. It lasts about a year. The Cookie settings link in the footer of every page reopens the choice, and withdrawing is the same two clicks as agreeing: the scripts stop and what they stored on your device is cleared, including visitor_id_id22, cache_id22 and the thumbmark_* keys.

Refusing costs you nothing. Every guide here is readable in full either way, nothing is paywalled, and no part of Vienna Tourism Guide is held back from readers who say no.

If you are reading this in the United States

Several US states give you the right to opt out of the “sale” or “sharing” of personal information, and those words are broader than they sound: letting an advertising or affiliate partner receive information about your visit can count as sharing even though no money changes hands for your data and we have never sold anything of the kind. Rather than argue the definition, Vienna Tourism Guide treats it as covered.

So the bar shown to US readers carries a Do not sell or share button, and for US readers the Cookie settings link at the foot of every page reads Do not sell or share my personal information. Using it stops the advertising category, which is what Stay22 and any ad partner sit in, and clears what they have already stored on your device.

This site also honours Global Privacy Control. If your browser or an extension sends a GPC signal, it is treated as a valid opt-out on arrival — you do not have to find the control and click it as well, and we do not ask again on later visits. Do Not Track is a different and long-abandoned signal, and to be straight about it: this site does not act on DNT, because nothing agreed what it ought to mean.

The record kept of your choice

Proving that a choice was offered and honoured means keeping a record of it. Each answer is logged with the date and time, the two-letter country the choice was made from, which of the rule sets above applied, a reference to the exact wording you were shown, and the choice itself, against a random identifier generated for your browser.

That record contains no name, no email address and no IP address. It holds a salted hash of your browser’s user-agent string, and the salt changes every day, so two visits on different days cannot be linked back together through it. Records are deleted after 26 months. If you want to see or delete the entries tied to your browser, ask through the contact form.

Content loaded from elsewhere

Guides sometimes embed a map or a video. Where they do, the provider — Google, YouTube, or similar — receives your IP address and can set its own cookies as soon as the embed loads, exactly as if you had visited that provider directly. Their privacy policies govern that, not this one. Images are served from this site’s own domain.

Legal basis and your rights

For readers in the EEA and the UK, the GDPR applies. Server logs and site security rest on our legitimate interest in operating the site. Answering your message rests on our legitimate interest in responding to correspondence you initiated. Analytics and, in future, advertising cookies rest on consent where consent is required, which you may withdraw at any time by clearing cookies or blocking them in your browser.

You have the right to ask what we hold about you, to have it corrected or erased, to object to processing, and to receive a copy. In practice we hold almost nothing: unless you have written to us, there is no record here tied to your name. Requests go through the contact page and are answered within one month. If you are unhappy with the outcome you may complain to your national data protection authority.

Transfers, children, and changes

Google processes analytics data on servers outside the EEA under its standard contractual clauses. This site is written for adults planning travel and is not directed at children under 16; we do not knowingly collect data from them. Material changes to this policy are reflected in the revision date above, and we will not quietly begin doing something this page says we do not do.