Privacy Policy
As of: November 2, 2026
1. Person responsible and contact
Responsible for this website, the central online booking system, memberships, newsletters and video surveillance at all four WORLD4KIDS locations is WORLD4KIDS GmbH und Co KG, Am Tabor 23/43, 1020 Vienna, Austria, commercial register number FN 624197m.
Michael Havel handles data protection inquiries. Contact: office@world4kids.at, telephone +43 699 12424049. There is no formally appointed data protection officer.
2. Website, hosting and technical data
Our WordPress website operates at IONOS. The central booking system is operated at Amazon Web Services (AWS) in Stockholm, Sweden (region eu-north-1). Technical connection and protocol data are processed for hosting, in particular IP address, time, address accessed, browser and device information as well as technical error data.
This is for the provision, stability, troubleshooting and security of our offering. The legal basis is Article 6 Paragraph 1 Letter f GDPR; our legitimate interests are a functional offer that is protected against misuse. Technical logs are retained for the period necessary to ensure operations, analyze errors and resolve specific security incidents. The decisive factors are the type of protocol, the scope of the incident and the length of time it will take to resolve it. IONOS specifies that visitor data for its web hosting products will be retained for eight weeks.
Order processing contracts exist with IONOS and AWS. Provider information: IONOS Web hosting and AWS and EU data protection.
3. Inquiries, rentals and bookings
If you contact us via a form, by email or by telephone, we will process your information to process the request and to answer any questions. Depending on the request, this includes name, email address, telephone number, location if applicable, as well as the wishes and messages transmitted.
For day tickets, party bookings and rental requests, the respective booking data is added, for example location, date, duration of visit or rental, number of people, selected services, pickup location and payment status. A rental request is initially non-binding; The reservation will only be confirmed personally by email. When renting, payment is made upon collection.
The legal basis for processing contract-related inquiries and bookings is Article 6 Paragraph 1 Letter b GDPR. We process other inquiries based on our legitimate interest in answering them in accordance with Article 6 (1) (f) GDPR. Without the required information, we may not be able to process the request or booking.
Michael Havel and other employees process ordinary customer inquiries and booking data. Relevant data is transmitted to accounting or tax consultancy for accounting and tax purposes. Completed inquiries without booking and the associated emails will be deleted after the inquiry has been completed, unless there are legal retention obligations or storage required for legal prosecution.
In principle, accounting documents and invoice receipts are legally retained for a period of seven years from the end of the relevant calendar year. Longer obligations may apply if proceedings are pending. The legal basis is Article 6 Paragraph 1 Letter c GDPR. We retain other contractual data for as long as it is necessary for the processing and the assertion, exercise or defense of claims. The contract term and applicable limitation periods are decisive; in the case of a specific dispute, the duration of the procedure. Backup copies are used to restore data after technical disruptions. Their retention depends on the backup cycle and recovery needs; During a restore, the same deletion rules apply to the restored data.
4. Payments
We use Stripe for online payments. Other payment methods used are PayPal, SumUp for card payments on site as well as bank transfer and cash payment. You can see which payment methods are available for an offer in the respective payment process.
For the selected payment method, the required payment and transaction data are transmitted to the respective payment service or the credit institution involved. WORLD4KIDS processes in particular the booking reference, payment amount and payment status. This serves to fulfill the contract in accordance with Article 6 Paragraph 1 Letter b GDPR; Legally required records are made in accordance with Article 6 Paragraph 1 Letter c GDPR.
Payment service providers sometimes also process data on their own responsibility, for example to fulfill legal obligations and to prevent fraud. Stripe may include different Stripe companies, in particular Stripe Payments Europe, Limited in Ireland. For PayPal in the EU context is PayPal (Europe) S.à r.l. et Cie, S.C.A., Luxembourg. For SumUp, the specific company depends on the service and contract used.
Further information: Stripe Data protection, PayPal Data protection and SumUp Data protection.
5. Memberships and Identity Control
For memberships, we process the contact details of the adult contact person, the selected tariff, start and end of validity, payment status and access authorizations. For registered children, name, date of birth and photo are requested. In addition, an ID file for the adult contact person will be requested.
The children’s photos are used exclusively for the assignment and control of membership, not for advertising or publication on social media. Within WORLD4KIDS, only Michael Havel has access to the uploaded children’s photos and ID files. The uploaded children’s photos and ID files will be deleted no later than 30 days after the end of the membership.
The processing serves to assign the booked membership, to check identity and to prevent unauthorized disclosure. The legal basis is Article 6 Paragraph 1 Letter b GDPR, insofar as the information is required to provide membership; We base the prevention of misuse on Art. 6 Para. 1 lit. f GDPR. Our interest is to limit access to authorized persons. Please do not provide any additional identification information that is not required for this check; such information may be blacked out before uploading. The remaining contract and invoice data may be retained for longer due to legal obligations.
6. Newsletter
When purchasing a day ticket or party, you can register for our newsletter with information about activities, offers and events using a voluntary box. Registration only takes place if you choose the voluntary newsletter option. The processing takes place on the basis of your consent in accordance with Art. 6 Para. 1 lit. a GDPR. An additional confirmation link via email (double opt-in) is currently not used.
For shipping we use CleverReach GmbH & Co. KG, Schafjückenweg 2, 26180 Rastede, Germany. An order processing contract exists. Openings and clicked links are not evaluated.
Registered customers remain in the shipping list until they unsubscribe or are revoked. Every newsletter contains a working unsubscribe link. You can also revoke your consent in the future via office@world4kids.at. The lawfulness of processing until revocation remains unaffected. To send and manage the registration, we process the email address as well as the registration time and registration source, if necessary with the associated booking or location identifier. Evidence of registration and revocation as well as necessary blocking notices will only be retained for as long as they are necessary to prove consent, to comply with the revocation or for legal defense. The duration of the need for proof and the applicable statute of limitations are decisive. The legal basis for this proof and blocking processing is Article 6 (1) (f) GDPR; Our interest lies in demonstrably respecting your decision and defending against unfounded claims.
Further information: CleverReach Data protection.
7. Cookies and embedded content
Google visitor and advertising measurement is deactivated. We no longer integrate Google Analytics, Google Ads and Google Tag Manager for visitor or advertising measurement.
When you open an embedded booking form, a connection to app.world4kids.at is established. Technical connection data is processed to provide and use the form. Technically necessary cookies or local storage can be used for registration, form and booking functions. They are used for session management, the assignment of entries and the secure use of the offer. The storage period depends on the respective session or the validity of the registration or booking status. You can delete stored data or restrict storage via your browser settings; this can impair functions. The associated data processing is carried out to fulfill the contract in accordance with Art. 6 Para. 1 lit. b GDPR or to secure the offer in accordance with Art. 6 Para. 1 lit. f GDPR.
Google Maps is accessed on our location pages via an external link for route planning. Only when you open the link do you access the Google Maps page. The virtual tours for 1020, 1150 and 1230 Vienna are provided by WORLD4KIDS subdomains and are only loaded when the tour area is opened. Technical connection data is transmitted to the server providing the service.
8. Video surveillance
WORLD4KIDS GmbH und Co KG is responsible for the cameras at all four locations. Entrance and play areas are recorded. Only images and no sound are recorded. Notices are visible at all locations before entering the monitored areas.
The monitoring serves to detect unauthorized access and to investigate theft, damage to property, accidents and specific security incidents. Within WORLD4KIDS only Michael Havel can view live images and saved recordings. Remote access to the recordings takes place via a VPN connection directly to the on-site recorder.
Recordings are stored exclusively on a recorder or memory card on site, not in a cloud. Regular recordings are automatically deleted after 72 hours at the latest. In the case of specific incidents, relevant excerpts may be stored separately on the recorder to preserve evidence and deleted after the investigation and any proceedings have been completed.
The legal basis is Article 6 Paragraph 1 Letter f GDPR. Our legitimate interests are the protection of people and property as well as ensuring authorized access. An evaluation is carried out for a specific purpose and for a specific reason. To the extent that this is necessary and legally permissible in individual cases, secured recordings can be transmitted to the responsible authorities, courts or bodies responsible for legal prosecution. Recordings will not be published.
9. Automatic access with SOREX
For visits, party bookings and memberships, we manage time-valid access codes and authorizations via SOREX. In particular, code and authorization identifiers, Schloss and location identifiers as well as validity periods are processed. The provision of the booked access serves to fulfill the contract in accordance with Art. 6 Para. 1 lit. b GDPR.
The provider is SOREX Wireless Solutions GmbH, Viktor-Kaplan-Straße 2B, 2700 Wiener Neustadt, Austria. An order processing or data protection agreement exists.
SOREX also describes device, event and access protocols for networked access systems; The provider specifies up to six months for cloud recordings. The duration depends on the system used and the purpose of authorization management or clarification of access events. Once the authorization expires, the code will no longer be used for regular access; Evidence required by law or to clarify specific incidents can be retained for longer.
Further information: SOREX Data protection and SOREX Information about the access system.
10. Recipients and international processing
Depending on the process, the recipients are our employees entrusted with the processing, hosting and IT service providers, payment services and participating credit institutions, CleverReach, SOREX as well as accounting or tax advice. Data will be passed on to authorities or other bodies if there is a legal obligation or another relevant legal basis.
A provider’s location in the EEA does not preclude international processing by its group of companies or subcontractors. Stripe provides, among other things, for transfers to the USA and describes the EU-US Data Privacy Framework and standard contractual clauses in its data transfer supplement. For information and the opportunity to request a copy of relevant warranties, please contact our Privacy Contact. If data is processed outside the EEA, the requirements of Article 44 ff. GDPR are relevant, in particular an applicable adequacy decision or suitable guarantees such as the EU Commission’s standard contractual clauses. You can obtain information about the recipients and guarantees relevant to a specific transaction via our data protection contact.
WORLD4KIDS does not post recognizable photos of guests or children on the website or social media. Membership photos are used exclusively to assign and control membership.
11. Your rights
Under the legal requirements, you have rights to information, correction, deletion, restriction of processing and data portability. If processing is based on legitimate interests, you can object based on your particular situation. You can object to processing for direct advertising at any time. Consent can be revoked at any time with future effect.
Please contact us office@world4kids.at. You can also complain to a data protection supervisory authority, in particular the Austrian Data Protection Authority, Barichgasse 40–42, 1030 Vienna.