Legal
Data Privacy Notice
Version: 04/2026 — Deutsch ist maßgeblich; English is provided for convenience.
1. Controller
The controller within the meaning of the General Data Protection Regulation (GDPR) is: Co-Victory GmbH, Nestroyplatz 1/3/32, 1020 Vienna, Austria. Email: office@co-victory.com. Company register number: FN 630724k. VAT ID: ATU80933402. No data protection officer has been appointed, as we currently do not consider ourselves legally required to appoint one. Privacy requests may be sent at any time to office@co-victory.com.
2. Scope
This Privacy Notice applies to the processing of personal data by Co-Victory GmbH in connection with websites, landing pages and online offers, including co-victory.com, jewishheritage.at, connoisseur.trvl, visitaustriaconnoisseur and future domains or subdomains registered or operated by Co-Victory. It also applies to brands and offer lines such as Jewish Heritage Austria / Jewish Heritage by Co-Victory and Connoisseur Travel / Connoisseur.trvl. It covers travel planning, bespoke luxury travel, Jewish Heritage tours, city tours, events, group travel, conferences, corporate travel, DMC services and other tourism or organizational services as well as communication via email, telephone, SMS, WhatsApp Business, online forms, Meta Lead Forms, Zoom, calendar bookings, CRM systems and other digital channels.
3. Categories of Personal Data
Depending on the inquiry, booking, contractual relationship or website use, we process in particular master data and contact data; travel, booking and operational data; identity, entry and security data; payment and billing data; communication, CRM and marketing data; website, cookie, tracking and device data; photo, video, audio and meeting data. This may include name, address, email, phone number, WhatsApp number, country, language, company, role, travel period, destinations, interests, budget, participant lists, hotel and activity preferences, flight details, passport details, emergency contacts, invoice data, payment status, communication history, IP address, consent status, analytics and conversion data, meeting notes, recordings and transcripts.
4. Special Categories of Personal Data
In certain cases, special categories of personal data may be processed, including health data, mobility requirements, allergies, dietary requirements, religiously influenced meal preferences, accessibility information or other sensitive preferences. This is done only where such information is voluntarily provided, necessary for the requested service, required to comply with legal obligations or based on explicit consent. In the case of Jewish Heritage tours or thematic travel, interest in certain programs may potentially indicate cultural, religious or historical interests. Co-Victory handles such information with particular care and generally only for the purpose of organizing the requested service.
5. Purposes of Processing
We process personal data in particular to handle inquiries, contact users, prepare bespoke offers, travel proposals, tours, programs and event concepts, conclude and perform contracts, manage bookings, provide client care, and organize hotels, transfers, guides, restaurants, activities, tickets, insurance, conferences, workshops and other services. Further purposes include communication before, during and after a trip or event, payment processing, invoicing, accounting, debt collection, website security, cookie management, analytics, conversion tracking, online marketing, CRM, lead management, automated follow-ups, newsletters, direct marketing, quality assurance, internal documentation, evidence keeping, Zoom/call recordings, photo/video publication, legal obligations and legal enforcement.
6. Legal Bases
Depending on the purpose, processing is based on Art. 6(1)(b) GDPR (contract performance and pre-contractual measures), Art. 6(1)(c) GDPR (legal obligations), Art. 6(1)(f) GDPR (legitimate interests, in particular efficient business organization, client care, CRM, direct marketing where permitted, IT security, documentation and legal enforcement) and Art. 6(1)(a) GDPR (consent, in particular for newsletters, non-essential cookies, tracking, photo/video publication or recordings where required). Special categories of personal data are processed, where required, in particular based on Art. 9(2)(a) GDPR (explicit consent) or Art. 9(2)(f) GDPR (legal claims).
7. Websites, Hosting and Server Logs
Our websites are operated through technical service providers, including Hostinger, cPanel, WordPress and Elementor. When visiting our websites, technically required data is processed, including IP address, date and time of access, pages accessed, browser type, operating system, referrer URL and server log data. This processing serves technical delivery, stability, security, error analysis and prevention of misuse. The legal basis is our legitimate interest under Art. 6(1)(f) GDPR and, where applicable, the provision of a service requested by the user.
8. Cookies, Consent Management and Tracking
Our websites use cookies and similar technologies. Technically necessary cookies are used to provide the website, enable security functions, store language settings or consent status, or provide functions requested by the user. Non-essential cookies and similar technologies, particularly for analytics, marketing, retargeting, conversion tracking or embedded third-party content, are generally set only after consent. Consent is obtained through a WordPress cookie consent plugin and can be changed or withdrawn at any time with future effect via the cookie settings on the respective website. We use in particular Google Analytics 4, Google Tag Manager, Google Ads Conversion Tracking, Meta Pixel/Facebook Pixel, TikTok Pixel, YouTube integrations and other technically necessary or marketing-related website technologies.
9. Google, Meta, TikTok, YouTube and Online Marketing
We may use services of Google, Meta, TikTok and YouTube, in particular Google Analytics 4, Google Tag Manager, Google Ads Conversion Tracking, Meta Pixel, Facebook/Instagram, Meta Lead Forms, TikTok Pixel and YouTube embeds. These services serve to analyze website usage, measure campaigns, record conversions, build audiences and optimize our content and advertising. Through Meta Lead Forms, prospects may submit contact and travel data to Co-Victory. Tracking and marketing technologies are generally used only after consent, unless another legal basis is permissible.
10. Contact Forms, Travel Inquiries, Applications and Payment Links
When users use contact forms, travel inquiry forms, B2B inquiries, application forms, event registrations, insurance forms, consent forms or payment links, we process the submitted data to handle the inquiry, check availability, prepare offers, manage bookings, process payments and communicate with clients. Depending on the form, this may include name, email address, phone number, country, language, travel period, interests, budget, number of travelers, special requests, health or mobility information, payment data and other voluntary information.
11. CRM, Lead Management and Automated Follow-ups
We use CRM and automation systems, including Close.io / Close CRM, Zapier, Twilio, n8n, Base44 and other connected systems, to manage inquiries, leads, offers, follow-ups and client communication efficiently. After Meta Leads, website inquiries or other contacts, automated follow-ups may be sent by email, SMS, telephone or WhatsApp. For North America, particularly the USA and Canada, we seek where possible to distinguish between transactional communication relating to a specific inquiry, booking or travel planning and promotional communication. Users may object to promotional communication or withdraw consent at any time.
12. Email, Newsletters, Mailchimp and Direct Marketing
We may send newsletters and marketing communication through Mailchimp, Close.io or comparable systems. We process in particular email address, name, language, interests, campaign allocation, open and click data and unsubscribe information. Where required, newsletter distribution is based on consent. In certain cases, direct marketing to existing clients or business contacts may be based on legitimate interests, provided this is legally permissible and no overriding interests of the data subject exist.
13. SMS, WhatsApp Business, Telephone and Voice-over-IP
We communicate with clients and prospects via email, telephone, SMS, WhatsApp Business and other digital communication channels. For SMS and telephony, Zapier, Twilio, Close.io and Compass Tech may be used as Voice-over-IP or telecommunications service providers. WhatsApp chats are generally processed within the WhatsApp structure and are not separately stored outside that structure unless required in an individual case for documentation, contract performance or legal enforcement. Calls with clients or prospects from the USA and Canada may be recorded for documentation, quality and evidence purposes.
14. Zoom, Online Meetings, Recordings and Transcripts
We use Zoom and comparable video conferencing services for consultations, travel planning, B2B meetings, events and internal or external coordination. Zoom calls may be recorded and transcribed, in particular for documentation, quality assurance, traceability of client requests, offer preparation and contract performance. Participants are informed before or at the beginning of the meeting where required. Anyone who does not wish to be recorded or transcribed may notify us before the meeting or at the latest at the beginning.
15. Payment Processing
For payments, we use in particular Stripe, SumUp, bank transfer, SEPA direct debit, PayPal, payment links, Bokun Checkout and, in exceptional cases, check payments by prior agreement. Cash payments are generally not offered. Payment amount, payment status, reference numbers, invoice details, payment time and, depending on the payment method, further payment information are processed. Co-Victory processes payment data for contract performance, billing, accounting, fraud prevention and enforcement of claims.
16. DocuSign, Contracts and Digital Signatures
DocuSign or comparable electronic signature services may be used for contracts, authorizations, consents or other documents. This may involve processing name, email address, signature data, IP address, timestamps, document content and audit trail data.
17. Accounting, Invoicing and Tax Obligations
For invoicing, accounting and tax documentation, we use in particular sevDesk, ProSaldo, Microsoft 365, Google Drive, OneDrive and other accounting or storage systems. Invoice and accounting data is generally retained for the statutory retention period.
18. Travel Organization, Suppliers and International Recipients
To perform travel, tours, events and other services, personal data may be transferred to suppliers and partners, in particular hotels, resorts, accommodation providers, guides, tour leaders, tour managers, local experts, transport, transfer, rental car, rail, bus and flight providers, restaurants, caterers, event locations, museums, memorial sites, cultural institutions, ticket providers, insurers, assistance providers, DMCs, travel agents, tour operators, local partners, authorities, payment service providers, IT service providers, CRM and communication providers. Depending on the trip, destination or client request, recipients may be located within the EU/EEA, Switzerland, the United Kingdom, the USA, Canada or other third countries.
19. Insurance and Additional Services
Where clients inquire about or book insurance or insurance-related additional services, relevant data may be transferred to insurers, intermediaries or assistance providers. This may include name, travel details, date of birth, contact details, insurance scope, payment data and, in the event of a claim, further necessary information. Co-Victory does not make coverage decisions and does not provide legal advice regarding insurance matters.
20. B2B, Travel Agents, Corporate Clients, Events and Conferences
In the B2B area, we process data of contacts, companies, participants, speakers, guests, employees and other involved persons. This concerns in particular travel agents, travel advisors, tour operators, DMCs, destination management companies, corporate clients, event and conference organizers, educational institutions, Jewish organizations, communities, family offices, hotels and partners.
21. Minors
Our contracting parties must generally be of legal age. However, in the case of group travel, school trips, family trips or events, data of minors may be processed, such as names, dates of birth, participant lists, dietary information, emergency contacts, travel data or insurance information. Data of minors is processed only where necessary for organization, safety, contract performance or legal obligations, or where appropriate consent or authorization has been provided.
22. Photos, Videos, Events and Social Media
Photos and videos may be created during tours, events, workshops, conferences or trips. These may be used for internal documentation, memories, client communication, reporting, websites, social media, presentations or marketing. Where publication cannot be based on legitimate interests or special circumstances apply, we obtain consent. Anyone who does not wish to be photographed or filmed may notify us on site or by email at any time.
23. Artificial Intelligence, ChatGPT, Base44, n8n and Automations
Co-Victory may use AI-supported and automated tools such as ChatGPT, Base44, n8n, Zapier or comparable systems to support internal workflows, draft texts, travel planning, offer structuring, summaries, translations, CRM processes, automations and customer service. We aim to use personal data only to the extent necessary for the respective purpose. Decisions with legal or similarly significant effects are not made solely by automated means unless legally permitted or based on explicit consent.
24. Recipients and Processors
We use various service providers for service delivery and business organization, including: hosting & website (Hostinger, cPanel, WordPress, Elementor); CRM & sales (Close.io); communication (Microsoft 365, Outlook, WhatsApp Business, Twilio, Compass Tech, Zoom); automation (Zapier, n8n, Base44); AI & text assistance (ChatGPT / OpenAI); payments (Stripe, SumUp, PayPal, banks, SEPA providers, Bokun Checkout); signatures (DocuSign); newsletters (Mailchimp, Close.io); advertising & analytics (Google Analytics, Google Tag Manager, Google Ads, Meta, TikTok, YouTube); documents & storage (Microsoft OneDrive, Google Drive, SharePoint, Canva); accounting (sevDesk, ProSaldo); travel & booking systems (Bokun, RateHawk API, hotels, DMCs, guides, suppliers).
25. International Data Transfers
Some service providers or suppliers we use may be located outside the EU/EEA or may process data there, in particular in the USA, Canada, the United Kingdom, Switzerland or the respective travel destination. Transfers to third countries take place, where required, based on an adequacy decision by the European Commission, appropriate safeguards (in particular EU Standard Contractual Clauses), the EU-U.S. Data Privacy Framework where applicable, necessity for contract performance, consent or other legally permissible transfer mechanisms.
26. Retention Periods
We retain personal data only as long as necessary for the respective purposes or as required by statutory retention obligations. Contract, booking, invoice and payment data are retained in accordance with statutory retention obligations, generally at least 7 years. Travel and operational data are retained as long as required for travel handling, follow-up, documentation, claims or legal obligations. Inquiries without booking are retained as long as required for handling, follow-up or legitimate business interests.
27. Data Security
We take appropriate technical and organizational measures to protect personal data against loss, misuse, unauthorized access, alteration or disclosure. These include access restrictions, password-protected systems, secure communication and storage services, internal permission concepts and careful selection of service providers. Despite appropriate security measures, absolute protection cannot be guaranteed for internet-based communication.
28. Rights of Data Subjects
Data subjects have the following rights under the GDPR: the right of access, rectification, erasure, restriction of processing, data portability, objection to processing based on legitimate interests, withdrawal of consent with future effect and lodging a complaint with a supervisory authority. Requests may be sent to office@co-victory.com. To process a request, identity verification may be required.
29. Withdrawal and Objection to Marketing
Consents may be withdrawn at any time with future effect. Promotional communication by email, SMS, telephone or WhatsApp may be unsubscribed from or objected to at any time. A withdrawal or objection does not affect necessary transactional communication required to handle an inquiry, perform a contract, process payments or comply with legal obligations.
30. Complaint to the Data Protection Authority
If a data subject believes that the processing of their personal data violates data protection law, they may lodge a complaint with the competent supervisory authority. In Austria, this is the Austrian Data Protection Authority, Barichgasse 40-42, 1030 Vienna, Austria, website: www.dsb.gv.at.
31. Changes to this Privacy Notice
We may update this Privacy Notice from time to time, in particular if our websites, tools, services, legal requirements or internal processes change. The version published on the website applies.
For any questions about these policies, please contact us.
SMS Messaging & Data Privacy
When you provide your mobile telephone number and consent to receive SMS communications from Connoisseur Travel / Co-Victory GmbH, we use this information to provide the SMS services for which you have opted in, including travel-related communications, booking updates, reminders, follow-ups, customer-service communications, and, where separately consented to, promotional travel communications.
Mobile information, SMS opt-in data, and SMS consent will not be sold, shared, rented, or transferred to third parties or affiliates for their own marketing or promotional purposes. SMS consent is specific to Connoisseur Travel / Co-Victory GmbH and will not be sold, shared, or transferred.
Personal information may only be disclosed where reasonably necessary in the following circumstances:
- To service providers acting on our behalf where disclosure is necessary to provide or fulfill a service requested by the customer.
- In connection with a merger, acquisition, restructuring, sale, or transfer of all or part of the business.
- Where disclosure is required by law, legal process, court order, or a competent law-enforcement or governmental authority.
- Where the user has expressly consented to the disclosure.
For the avoidance of doubt, SMS opt-in information and consent are not shared with third parties or affiliates for marketing or promotional purposes.
Any service provider processing information on our behalf may use such information only to provide the relevant services to us and/or the customer and not for its own independent marketing purposes.