Car Park Management
Car Park Management – GDPR Information: Version 23.05.2023
These notes describe how we [Hochkar & Ötscher Tourismus GmbH – Address: Göstling 46, 3345 Göstling/Ybbs] process your personal data in connection with our car park management (pursuant to Article 13(1) of the GDPR).
1. Purposes of Data Processing
We process your personal data for the following purposes:
a) Car park management, including the automation and acceleration of the service for vehicles for which a parking ticket has been booked;
c) Monitoring compliance with the car park regulations (e.g. parking across multiple spaces);
d) Monitoring the lawful use of parking tickets (e.g. exceeding the permitted parking duration);
e) Protection of facilities (e.g. prevention of vandalism);
f) Documentation, investigation, and prosecution (enforcement of legal claims) in cases of misuse of parking spaces (e.g. parking without payment);
g) Repositioning of motor vehicles.
We collect this data through:
- The data provided by you for the creation of the contract (personalised day ticket in connection with the parking ticket);
- The vehicle registration number you enter when purchasing the day ticket or provide at the ticket office;
- Evaluation of licence plate data.
Information regarding image recording and the collection of licence plate data is provided in accordance with legal requirements.
2. Legal Basis for Processing
- For the billing of parking fees in connection with the parking ticket, the legal basis is the performance of a contract (Article 6(1)(b) GDPR).
- For the collection of licence plate data in connection with our car park management, the legal basis is the legitimate interest of the controller (Article 6(1)(f) GDPR), which consists in achieving the purposes stated above under section 1 (a–g). You have the right to object to this data processing pursuant to Article 21(1) GDPR if there are reasons arising from your particular situation.
- For the identification of specific licence plates to automate and expedite the service for vehicles on the whitelist, the legal basis is the legitimate interest of the controller (Article 6(1)(f) GDPR), which lies in implementing our car park management efficiently.
3. Storage Period
a) Customer Data:
Your personal data are retained only for as long as necessary to perform the contract and achieve the purposes specified in section 1:
• See Privacy Policy – Online Shop
b) Image Processing (“Video Surveillance”):
Recorded data (vehicle registration numbers) are deleted no later than 48 hours after recording, unless they are required for the specific purpose of protection or securing evidence.
As a general principle, we aim to store as little data as possible. Normally, data are stored only for the period during which a licence plate is present, i.e. recording upon entry → recording upon exit → deletion thereafter.
In the case of inspection events, data are retained for an additional 24 hours to enable verification of movements, i.e. entry recording → exit recording + 24 hours → deletion thereafter.
If a vehicle does not exit, a defined maximum parking duration applies. This is set to 48 hours, meaning that if a vehicle has not exited or the exit was not recognised, the licence plate will remain in the system for no longer than 48 hours.
The only exceptions are “registered” licence plates (season ticket holders, employees) and plates with valid tickets (see Privacy Policy – Online Shop). Data for season ticket holders are stored indefinitely until revocation, and for ticket holders for as long as the ticket remains valid, including the rules set out above.
Personal data, including vehicle registration numbers, collected and stored by the controller in the context of the user’s request for the repositioning of their vehicle or in cases of parking without a valid ticket, are deleted immediately once the purpose of processing (the controller’s legitimate interest in documentation, investigation, and enforcement of legal claims, particularly civil actions and defence against liability claims) has been fulfilled and provided that no statutory retention obligations prevent earlier deletion.