Privacy Policy & Data Protection

Effective Date: January 1, 2026 | Last Reviewed: Current 2026 Edition | Entity: Vaultchoicegrd Media Ltd.

1. Introduction & Statutory Scope

Vaultchoicegrd Media Ltd. ("Vaultchoicegrd", "we", "us", or "our"), operating the domain vaultchoicegrd.lat, is firmly committed to safeguarding the privacy and personal data of our global readers, subscribers, and travel inquiry clients. This Privacy Policy sets forth our operational principles regarding the collection, processing, storage, and transfer of personal data in accordance with the General Data Protection Regulation (EU Regulation 2016/679 - "GDPR"), the Austrian Data Protection Act (Datenschutzgesetz - "DSG"), the ePrivacy Directive (Directive 2002/58/EC), and relevant international privacy frameworks.

2. Data Controller & Data Protection Officer (DPO)

The Data Controller responsible for personal data collected through this website is:

Vaultchoicegrd Media Ltd.
Corporate Registration Number: ATU-98421045
Registered Office: Kärntner Ring 14, 1010 Wien, Austria
Data Protection Officer Contact: [email protected]
General Inquiries: [email protected]

3. Categories of Personal Data We Collect

We collect data through direct user interaction and automated telemetric protocols when you interact with our editorial travel portal:

Directly Provided Information: When you complete our Concierge Contact Form, subscribe to our Festive Despatches newsletter, or request customized winter rail itineraries, we collect your name, email address, country of residence, travel dates, and any dietary or accessibility notes submitted.
Automated Telemetry & Technical Identifiers: Upon accessing our servers, automated log files capture your IP address (anonymized after geolocation resolution), browser type and version, operating system, HTTP referrer URL, date and timestamp of page requests, and session duration.
Cookie & Storage Data: Client-side browser states stored via localStorage and session tokens to remember your cookie consent preferences and interactive map filters.

4. Legal Basis for Processing (GDPR Article 6)

We process personal data strictly under established statutory grounds:

Consent (Art. 6(1)(a) GDPR): For sending seasonal editorial newsletters and deploying non-essential analytical cookies. Consent may be revoked at any time.
Performance of a Contract / Pre-Contractual Steps (Art. 6(1)(b) GDPR): When processing concierge consultation requests or itinerary planning services requested by you.
Legitimate Interests (Art. 6(1)(f) GDPR): To maintain network security, prevent fraudulent bot traffic, and optimize web infrastructure performance.
Legal Obligation (Art. 6(1)(c) GDPR): To comply with Austrian corporate, tax, and regulatory record-keeping duties.

5. Third-Party Data Processors & Cross-Border Transfers

We do not sell, rent, or trade your personal data to third parties. We share data only with verified technical processors under strict Data Processing Agreements (DPAs) that guarantee GDPR-compliant security safeguards (Standard Contractual Clauses - SCCs):

Cloud Hosting & CDN Infrastructure: Enterprise-grade hosting partners located within the European Economic Area (EEA).
Newsletter Delivery Networks: Encrypted email service providers processing opt-in festive dispatches.

6. Data Retention Period

Personal data is stored only for the duration necessary to fulfill the specific processing purposes:

Concierge & contact inquiries: Retained for 12 months following resolution.
Newsletter subscriber emails: Retained until explicit unsubscribe or consent withdrawal.
Server security logs: Automatically purged on a 30-day rolling cycle.

7. Your Statutory Rights Under GDPR

As a data subject residing in the European Union or United Kingdom, you possess clear, enforceable rights regarding your personal information:

Right of Access (Art. 15 GDPR): The right to obtain confirmation and copies of your personal data held by us.
Right to Rectification (Art. 16 GDPR): The right to rectify inaccurate or incomplete records.
Right to Erasure / "Right to be Forgotten" (Art. 17 GDPR): The right to request total deletion of your personal data where retention is no longer legally mandated.
Right to Restriction of Processing (Art. 18 GDPR): The right to limit data processing during dispute verification.
Right to Data Portability (Art. 20 GDPR): The right to receive your data in a structured, machine-readable format.
Right to Object (Art. 21 GDPR): The right to object to processing based on legitimate interests.

To exercise any of these rights, submit a written request to our Data Protection Officer at [email protected]. You also reserve the right to lodge a formal complaint with the Austrian Data Protection Authority (Österreichische Datenschutzbehörde, Barichgasse 40-42, 1030 Wien, [email protected]).