Thank you for your interest in our company. Data protection is of particular importance to the management of GTS Ground Transfer Service GmbH. The website www.taxi-belvedere.at can generally be used without providing any personal data. If you wish to use particular services offered through our website – for example a request or a booking – the processing of personal data may become necessary. Where processing is necessary and there is no statutory basis for it, we obtain your consent.

The processing of personal data such as your name, address, e-mail address or telephone number is always carried out in accordance with the General Data Protection Regulation (GDPR) and the Austrian Data Protection Act (DSG). By means of this privacy policy we inform you about the nature, scope and purpose of the personal data we collect, use and process, and about the rights to which you are entitled.

As the controller, GTS Ground Transfer Service GmbH has implemented numerous technical and organisational measures to ensure the most complete protection possible of the personal data processed through this website. Nevertheless, internet-based data transmissions may in principle have security gaps, so absolute protection cannot be guaranteed. You are therefore free to transmit personal data to us by alternative means, for example by telephone.

1. Name and address of the controller

The controller within the meaning of the GDPR, the DSG and other data protection provisions is:

Company: GTS Ground Transfer Service GmbH, trading as Belvedere Chauffeur Service Vienna and “Taxi Belvedere”
Address: Patrizigasse 12/1-2, 1210 Vienna, Austria
Company registration number: FN 588382v
VAT ID: ATU65791618
Telephone: +43 676 770 41 59
E-mail for privacy enquiries: booking@taxi-belvedere.at
Website: www.taxi-belvedere.at

For all questions about data protection and to exercise your rights, please write to booking@taxi-belvedere.at.

2. Definitions

This privacy policy is based on the terms used in the GDPR. It is intended to be easy to read and understand for the public as well as for our customers and business partners. Among others, we use the following terms:

Personal data: Any information relating to an identified or identifiable natural person (“data subject”) – for example a name, an identification number, location data or an online identifier.
Data subject: Any identified or identifiable natural person whose personal data is processed by the controller.
Processing: Any operation performed on personal data, such as collection, recording, organisation, storage, alteration, retrieval, consultation, use, disclosure by transmission, alignment, restriction, erasure or destruction.
Restriction of processing: The marking of stored personal data with the aim of limiting its processing in the future.
Profiling: Any automated processing of personal data used to evaluate or predict personal aspects relating to a natural person.
Pseudonymisation: Processing in such a manner that the personal data can no longer be attributed to a specific data subject without the use of additional information that is kept separately.
Controller: The natural or legal person, public authority, agency or other body which, alone or jointly with others, determines the purposes and means of the processing.
Processor: A natural or legal person, public authority, agency or other body which processes personal data on behalf of the controller.
Recipient: A natural or legal person, public authority, agency or other body to which personal data is disclosed; public authorities receiving data in the framework of a particular inquiry are not regarded as recipients.
Third party: A natural or legal person, public authority, agency or body other than the data subject, the controller, the processor and the persons authorised to process personal data under their direct authority.
Consent: Any freely given, specific, informed and unambiguous indication of the data subject’s wishes by which he or she signifies agreement to the processing of personal data relating to him or her.

3. Hosting and server log files

This website is hosted by Intellihost in Austria. The hosting provider processes on our behalf the technical data that arises when the website is accessed; a data processing agreement under Art. 28 GDPR is in place. No data is transferred to third countries for hosting.

Each time the website is accessed, the server records a series of general data and information in log files: (1) the browser type and version, (2) the operating system of the accessing system, (3) the website from which the system reached our website (referrer), (4) the sub-pages accessed, (5) the date and time of access, (6) the IP address, (7) the internet service provider of the accessing system and (8) similar data that serves to avert danger in the event of attacks on our systems.

We draw no conclusions about you personally from this data. It is needed to deliver the content of the website correctly, to ensure the permanent functioning of our systems and to provide law enforcement authorities with the information necessary for prosecution in the event of an attack. The legal basis is our legitimate interest in secure and stable operation (Art. 6(1)(f) GDPR). Log files are stored separately from all other personal data and are deleted after 30 days.

Security logs: in addition, our website keeps its own logs of rejected form submissions, submission limits that have been reached and technical errors; these may contain the time, your IP address and the address requested. The logs are held in a directory that cannot be retrieved over the internet. They are kept in a separate file for each day and are deleted automatically after 30 days. The legal basis is Art. 6(1)(f) GDPR.

4. Cookies and consent

Our website uses cookies. Cookies are small text files that are placed on your device via your browser. Many cookies contain a so-called cookie ID, a unique identifier that allows websites and servers to recognise a specific browser.

We use strictly necessary cookies only where they are indispensable for a function – for example a session cookie on the pages with a form (booking, request, contact, “My booking”), which keeps your entries during the session and protects the forms against misuse. These cookies do not require consent (Art. 6(1)(f) GDPR, § 165(3) of the Austrian Telecommunications Act 2021).

Analytics and marketing cookies (Google Analytics, Google Ads) are set only with your consent via our cookie banner (“Accept all”). Without consent no such scripts are loaded; we use Google Consent Mode, which blocks these services until you have made your choice. Your choice is stored in your browser and you can change or withdraw it at any time via cookie settings (Art. 7(3) GDPR).

You can also prevent cookies from being set through your browser settings and delete cookies that have already been set at any time. If you disable cookies completely, some functions of the website may not be fully available. Details of all cookies used are provided in our cookie policy.

5. Request and contact forms, e-mail, telephone

In accordance with statutory requirements, our website contains information that enables quick electronic contact with our company, including an e-mail address. If you contact us by e-mail, telephone, WhatsApp or through a form, the personal data you transmit is stored in order to handle your enquiry and to communicate with you.

Request form (price request/booking): we process your name, e-mail address, telephone number, pickup and destination address, date and time, number of passengers, flight or train number, preferred vehicle class, extras and your message. The details are sent by e-mail to our booking mailbox (booking@taxi-belvedere.at); you receive a copy at the address you provide. Our server additionally files a copy of the request in a directory that cannot be retrieved over the internet, so that your request remains traceable if an e-mail fails to arrive. We keep no further customer database on the website. The legal basis is the performance of pre-contractual measures or of the contract (Art. 6(1)(b) GDPR).

Contact form: we process your name, e-mail address, telephone number (if provided) and your message. The details are sent by e-mail to booking@taxi-belvedere.at; you receive an acknowledgement of receipt. The legal basis is Art. 6(1)(b) GDPR (enquiries about a booking) or our legitimate interest in answering enquiries (Art. 6(1)(f) GDPR).

Protection against misuse: when a form is submitted we additionally process your IP address and the time of submission to ward off automated mass requests (rate limit, session token). This data is deleted after a short period. The legal basis is Art. 6(1)(f) GDPR.

Disclosure: we pass your data only to the chauffeur who performs your journey (name, telephone number, pickup and destination address, flight number) and to the processors we use for e-mail delivery and hosting. For the address suggestions and, where applicable, the distance calculation, Google receives the addresses entered (section 8). There is no disclosure to other third parties unless we are legally obliged to do so.

Retention: enquiries and contact messages that do not lead to a booking are deleted no later than 6 months after the correspondence ends; the copy on the server is filed separately for each month for this purpose and deleted automatically once the period has expired. Data on journeys performed and invoices is retained for 7 years on the basis of the retention obligations under tax and company law (§ 132 BAO, § 212 UGB) and deleted thereafter. The logs in which your IP address may appear when a form is submitted are deleted after 30 days.

6. Google Analytics (with your consent only)

If you have given your consent in the cookie banner, we use Google Analytics 4 (property G-7T0QGK7JWY) on this website. Google Analytics is a web analytics service that records data about visitor behaviour: the website from which you reached us (referrer), which sub-pages you visited, how often and for how long. We use these evaluations to improve our website and our services.

The operating company is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. Google Analytics 4 does not store IP addresses permanently and truncates them before use; we have not activated Google Signals or the advertising features for demographic and interest reports. Data may nevertheless be transferred to servers of Google LLC in the United States. Google is certified under the EU-US Data Privacy Framework; the EU Commission’s standard contractual clauses apply in addition.

Google Analytics sets cookies on your device (including “_ga” and “_ga_…”) by which your browser is recognised on repeat visits. The retention period for user data stored by Google is set to the shortest available period. The legal basis for the processing is your consent (Art. 6(1)(a) GDPR, § 165(3) TKG 2021).

You can withdraw your consent at any time with effect for the future via cookie settings. In addition, you can prevent collection by Google Analytics with the browser opt-out add-on. Further information is available in Google’s privacy policy.

7. Google Ads conversion tracking and remarketing (with your consent only)

If you have given your consent in the cookie banner, we use Google Ads (account AW-11205732284). Google Ads is an online advertising service with which we place advertisements in Google search results and in the Google advertising network. The operating company is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland.

Conversion tracking: if you reach our website via a Google advertisement, a conversion cookie is placed on your device. It expires after a short period and does not serve to identify you. Through the cookie, we and Google can determine whether a request or booking originated from an advertisement. We use these statistics to measure the effectiveness of our advertisements. Neither we nor other advertisers receive information that could identify you.

Remarketing: Google Remarketing makes it possible to show visitors to our website interest-based advertisements on other websites in the Google advertising network. For this purpose Google sets a cookie by which your browser is recognised; in the course of this procedure Google learns your IP address and browsing behaviour. Data may be transferred to Google in the United States (EU-US Data Privacy Framework, standard contractual clauses).

The legal basis is your consent (Art. 6(1)(a) GDPR). Without consent the Google Ads scripts are not loaded. You can withdraw your consent at any time via cookie settings and object to interest-based advertising by Google under Ads Settings. Further information: Google’s privacy policy.

8. Google Maps Platform (address suggestions)

To help you enter addresses, hotels and airports quickly and unambiguously, the pickup and destination fields suggest matching places – in the booking, in the request form and in the short forms, for example on the home page. For this we use the Google Maps Platform (Maps JavaScript API and Places API). The provider is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland; the data may also be processed by Google LLC, 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA.

When data goes to Google: for the address suggestions nothing is loaded from Google when a page opens. Only when an address field receives input focus (by tapping, clicking or using the Tab key) does your browser load the required program library from Google servers. After that, your browser sends the text you type into the address field to Google and receives matching suggestions. If you choose a suggestion, it retrieves the address for it (street, postcode, town).

Which data: your IP address, the text you type, the language of the page and technical information from your browser (for example browser type, language setting and the address of the page you are on). Several entries of one search are grouped by a randomly generated identifier. Your name, e-mail address and telephone number are not sent to Google.

Cookies: we do not set any cookies ourselves for the address suggestions. What Google may store in your browser in the process is described in our cookie policy.

Legal basis: the address suggestions serve to prepare and perform your booking or request (Art. 6(1)(b) GDPR) and our legitimate interest in complete, unambiguous pickup and destination addresses and in forms that are easy to use (Art. 6(1)(f) GDPR). The address you finally send with the form becomes part of your request or booking; section 5 applies to it.

Transfer to the USA: data may be transferred to servers of Google LLC in the United States. Google is certified under the EU-US Data Privacy Framework. How long Google stores the data is determined by Google; details are available in Google’s privacy policy.

Without address suggestions: if the suggestions are not available, the address fields work as normal text fields. If you prefer not to use the suggestions, you can also tell us about your journey by telephone or e-mail.

Distance for the per-kilometre price: if a route is neither within our zones nor among our fixed destinations, our server may send the pickup and destination address to the Google Distance Matrix API to determine the driving distance. Only these two addresses go to Google, not your IP address and no contact details. The legal basis is Art. 6(1)(b) GDPR.

9. Legal basis of processing

Art. 6(1)(a) GDPR serves as the legal basis for processing operations for which we obtain consent for a specific purpose (analytics and marketing cookies). If processing is necessary for the performance of a contract to which you are party, or for pre-contractual measures – for example requests and bookings of journeys – it is based on Art. 6(1)(b) GDPR. If we are subject to a legal obligation that requires processing, for example to fulfil tax obligations, processing is based on Art. 6(1)(c) GDPR.

In rare cases processing may be necessary to protect the vital interests of the data subject or of another natural person (Art. 6(1)(d) GDPR), for example in the event of an accident during a journey. Finally, processing operations may be based on Art. 6(1)(f) GDPR where they are necessary for the purposes of the legitimate interests pursued by our company or by a third party and your interests, fundamental rights and freedoms do not override them – in particular the secure operation of the website and the prevention of misuse.

10. Legitimate interests

Where processing is based on Art. 6(1)(f) GDPR, our legitimate interest is the conduct of our business, the secure and stable operation of our website, the answering of enquiries, complete and unambiguous pickup and destination addresses (address suggestions, section 8) and protection against misuse and attacks.

11. Retention period and routine erasure

We process and store personal data only for the period necessary to achieve the purpose of storage, or where this is provided for by laws or regulations to which we are subject. If the purpose of storage no longer applies or a statutory retention period expires, the data is routinely erased or blocked in accordance with statutory provisions.

The specific periods are stated with the individual processing operations: server and security logs 30 days, enquiries and contact messages without a booking 6 months, booking and invoice data 7 years (retention obligation under tax law, § 132 BAO).

On the server, erasure runs by itself: the logs are filed separately for each day and the copies of requests separately for each month; once the relevant period has expired, the system removes the files concerned the next time it writes. Data we are required to keep under a statutory retention obligation is not used further until that period ends.

12. Your rights as a data subject

You have the following rights with regard to the personal data concerning you. An informal message to booking@taxi-belvedere.at is sufficient to exercise them; we respond free of charge and generally within one month.

a) Right of confirmation and access (Art. 15 GDPR)

You have the right to obtain confirmation from us as to whether personal data concerning you is being processed and, if so, to obtain free access to that data and a copy of it. The information covers the purposes of the processing, the categories of data, the recipients or categories of recipients, the envisaged retention period or the criteria used to determine it, the existence of the right to rectification, erasure, restriction or objection, the right to lodge a complaint with a supervisory authority, all available information on the origin of the data where it was not collected from you, and the existence of automated decision-making including profiling. You also have the right to be informed whether data has been transferred to a third country or an international organisation and which safeguards apply.

b) Right to rectification (Art. 16 GDPR)

You have the right to obtain without undue delay the rectification of inaccurate personal data concerning you and – taking into account the purposes of the processing – to have incomplete personal data completed, including by means of a supplementary statement.

c) Right to erasure (Art. 17 GDPR)

You have the right to obtain from us the erasure of personal data concerning you without undue delay where one of the following grounds applies and the processing is not necessary:

The data is no longer necessary for the purposes for which it was collected or otherwise processed.
You withdraw the consent on which the processing was based under Art. 6(1)(a) or Art. 9(2)(a) GDPR and there is no other legal ground for the processing.
You object to the processing under Art. 21(1) GDPR and there are no overriding legitimate grounds, or you object under Art. 21(2) GDPR.
The data has been unlawfully processed.
The data has to be erased for compliance with a legal obligation in Union or Member State law to which we are subject.
The data has been collected in relation to the offer of information society services referred to in Art. 8(1) GDPR.

Where we have made the data public and are obliged to erase it, we take reasonable steps, taking account of available technology and the cost of implementation, to inform other controllers processing the data of your request for erasure.

d) Right to restriction of processing (Art. 18 GDPR)

You have the right to obtain restriction of processing where one of the following applies:

You contest the accuracy of the data, for a period enabling us to verify its accuracy.
The processing is unlawful and you oppose erasure and request the restriction of use instead.
We no longer need the data for the purposes of processing, but you require it for the establishment, exercise or defence of legal claims.
You have objected to processing under Art. 21(1) GDPR pending verification of whether our legitimate grounds override yours.

e) Right to data portability (Art. 20 GDPR)

You have the right to receive the personal data concerning you that you have provided to us in a structured, commonly used and machine-readable format and to transmit that data to another controller without hindrance from us, where the processing is based on consent or on a contract and is carried out by automated means. Where technically feasible, you may request that the data be transmitted directly from us to another controller, provided that this does not adversely affect the rights and freedoms of others.

f) Right to object (Art. 21 GDPR)

You have the right to object at any time, on grounds relating to your particular situation, to the processing of personal data concerning you which is based on Art. 6(1)(e) or (f) GDPR. In the event of an objection we no longer process the data unless we can demonstrate compelling legitimate grounds for the processing which override your interests, rights and freedoms, or the processing serves the establishment, exercise or defence of legal claims.

Where we process data for direct marketing purposes, you have the right to object at any time to processing for such marketing; we then no longer process the data for these purposes.

g) Automated individual decision-making (Art. 22 GDPR)

You have the right not to be subject to a decision based solely on automated processing, including profiling, which produces legal effects concerning you or similarly significantly affects you. We do not use automated decision-making or profiling.

h) Right to withdraw consent (Art. 7(3) GDPR)

You have the right to withdraw any consent you have given at any time with effect for the future – for cookies via cookie settings, otherwise by message to booking@taxi-belvedere.at. The lawfulness of processing carried out before the withdrawal is not affected.

i) Right to lodge a complaint (Art. 77 GDPR)

If you believe that the processing of your data infringes data protection law, you may lodge a complaint with the competent supervisory authority. In Austria this is the Austrian Data Protection Authority (Datenschutzbehörde), Barichgasse 40–42, 1030 Vienna, www.dsb.gv.at.

13. Obligation to provide data

The provision of personal data is partly required by law (e.g. tax regulations) or results from contractual provisions (e.g. information on the contracting party). To conclude a booking, you must provide us with the data necessary to perform the journey – in particular your name, telephone number, e-mail address, pickup and destination address and flight details. Without this information we cannot perform the journey. Before providing data you may contact us at any time; we will explain in the individual case whether the provision is required by law or contract or necessary for the conclusion of the contract, and what the consequences of not providing it would be.

14. Changes to this privacy policy

We reserve the right to amend this privacy policy if the legal situation, our website or the services we use change. The version published on this page applies; the date of the last update is shown at the bottom of the page.

Last updated: 27 September 2026

Privacy Policy