Privacy Statement

1.      Introduction

To us, DO & CO im Haas Haus Restaurantbetriebs GmbH, Stephansplatz 12, 1010 Vienna, Tel: +43 1 535-3969 or +43 1 24188, E-Mail:, ("DO & CO", "We") the privacy of your data is a special concern. We process your personal data thus solely on the basis of laws, including the European General Data Protection Regulation ("GDPR"), the applicable Austrian Data Protection Act 2018 ("DPA") and the Austrian Telecommunications Act ("TKG"). The following explains what data we collect, process and use when you visit and use our website ("website").

We may need to update this privacy policy in line with the development of the Internet from time to time. Therefore, we recommend you to check this page periodically to make sure you have read the latest version.


Personal information is information regarding data subjects whose identity is determined or at least determinable. This includes, for example, your name, email address, and your IP address.

3.      What personal information DO we collect from YOU and what for?

3.1.       Contacting

If you send an e-mail, telephone or contact us via mail, your voluntarily provided personal information (address, title, name, company name, email, phone number) and the content of your request (including bookings of events or tables in our restaurant) are stored for the processing of the same and for the case of follow-up questions with us (pre-contractual obligations or legitimate interests). To the extent necessary, this data is passed on to our group companies for processing your request. Of course, we do not submit your request to other third parties without your consent.

3.2.       Hotel bookings through the website

For the contract performance we process the information provided by you during the booking process (salutation, title, name, company name, e-mail, phone number, address) and in addition, the selected hotel room, notes and special preferences related to your booking and credit card data (credit card provider, credit card holder, the last four digits of the credit card number). The data provided by you is necessary for the performance of the contract with you or in order to take steps prior to entering into a contract with you. Without this data, we cannot conclude the contract with you. Your data will not be transferred to third parties, except for the transmission of the data provided by you during the booking process which is transferred to the accounting department of DO & CO Aktiengesellschaft as our corporate headquarter, as well as to our tax advisor to fulfill our tax obligations.

3.3.       Transfer to Third Parties

In addition to the above-mentioned data transfers, we transfer your personal data to the extent necessary to external agents or service providers: 

  • IT service providers and / or provider of data hosting or data processing or similar services;
  • to other service providers, suppliers of tools and software solutions that also support us in providing our services and act on our behalf;
  • to service providers and / or providers of touristic activities (such as sightseeing tours) or transfer companies, if you ask us to arrange and book such activities or transfers for you;
  • to our affiliates listed below in order to fulfill the contract and fulfill legal obligations:

DO & CO Aktiengesellschaft
Stephansplatz 12
A-1010 Vienna
Tel.: +43 (1) 74 000-1001

K.u.K. Hofzuckerbäcker Ch. Demel's Söhne GmbH
Kohlmarkt 14
A-1010 Vienna
Tel.: +43 (1) 535 17 17-0 

DO & CO Catering & Logistics Austria GmbH
Stephansplatz 12
A-1010 Vienna
Tel.: +43 (1) 74 000-1001

DO & CO Pastry GmbH
Dampfmühlgasse 5
A-1110 Vienna
Tel.: +43 (1) 74 000-1001

DO & CO Event Austria GmbH
Stephansplatz 12
A-1010 Vienna
Tel.: +43 (1) 74 000-1001 

  • to any parties towards you contribute to the fulfillment of our obligations (such as payment service provider, banks for payment processing, other service providers for the provision of decoration, equipment or marketing materials for events, messengers);
  • to other external third parties to the extent necessary (eg accountants, insurance companies in the insurance case, legal representative in the present case, etc);
  • to authorities and other public bodies in the mandatory extent (eg tax authorities, etc).

4.      Cookies

Our website uses cookies to the extent to which it is technically mandatory for the use of the website or if you have given your consent.Cookies are small text files that are stored using the browser on your device.

We use cookies to make the site as well as our service more user-friendly. Some cookies remain stored on your device until you delete them. They allow us to recognize your browser the next time you visit.

If you do not want that, you can configuret your browser in a way that it informs you about the use of cookies and allow it only in individual cases. When disabling cookies the functionality of our site may be limited.

4.1.       Google Analytics

Our website uses functions of the web analytics service Google Analytics by Google Inc. ( "Google"). This analysis tool uses cookies to collect standard log information and visitor behavior of our website in an aggregated form. The information about your use of this website covered by the Google Analytics cookies are sent to Google servers (usually in the US or in other countries outside the EU) and stored there.

Our user analysis also uses Universal Analytics. So that we can obtain information about the use of our services on different devices ("Cross Device"). We are using the cookie technology with a pseudonymous user ID that does not contain personal data and is therefore not sent to Google. The data collection and storage can be revoked at any time with effect for the future by clearing the cross-device user analysis in your account. ore information on Universal Analytics can be found here:

The following information is collected by Google Analytics: IP address anonymously, browser, device type, device model, country, service provider, screen resolution (on a mobile device), time on site, language, operating system, pages visited on the site. Google will use this information, in particular to evaluate the use of the site by users, compiling reports on website activity. Google may also transfer this information to third parties where required by law or where third parties process this data on behalf of Google. Because the privacy of our users is important to us, we do anonymize the IP addresses of our users.

If you do not want our site to record your activities on Google Analytics, you can go to and download an appropriate browser plug-in and install it.

User data is stored indefinitely or until you ask us to delete your data. Google will then as soon as possible and in any case within 180days delete your data.

4.2.       Google Maps

Our site uses Google Maps API to display geographic information on the site Contact/ Directions visually. Google Maps is operated by Google Inc. 1600 Amphitheater Parkway, Mountain View, CA 94043.

When using Google Maps Information about the use of our website, including your IP address gets transmitted to a Google server in the US and stored there. By using this site, you agree in this respect to the collection, processing and use of your data automatically collected by Google. We receive at no time any of your personal data.

The terms of use for Google Maps can be found under Terms and Conditions for Google Maps

If you do not want that Google Maps handles your personal information, disable this JavaScript in your browser. However, we point out that you can not use in this case, the map display.

4.3.       Facebook site Custom Audiences

This website uses "site Custom Audiences" pixel of the social network Facebook, 1601 South California Avenue, Palo Alto, CA 94304, USA.

When you visit our site, a direct connection between your browser and the Facebook server is established through these web beacons. Facebook receives the information that you have visited this website with your IP address. This allows Facebook to assign your visit to our site to your user account. The information thus obtained can be used for the display of Facebook Ads. We point out that we as providers of the site obtain no knowledge of the content of the transmitted data and the use of it through Facebook.

For more information, please see the privacy policy of Facebook at If you do not want data collected via custom audience, you can disable Custom Audiences.

4.4.            Social Plugins

Our website uses the following social plugins ( "plugins") of various social networks. In interaction with the social plugins exclusively social networks process personal data as follows. We get in no way aware of any personal data (eg IP address): 

4.4.1.  Use of Facebook plugins

On our website plugins of the social network Facebook, 1601 South California Avenue, Palo Alto, CA 94304, USA are integrated. The Facebook plugins are identifiable by a Facebook Logo (white"f"on a blue tile) or the terms"Like","Likeme"or"thumbs-up"sign on our website. An overview of the Facebook plugin can be found here:

When you visit our web site, the plugin establishes a direct connection between your browser and the Facebook server. Facebook receives the information that you have visited our website with your IP address. If you click on the Facebook button while you are logged into your Facebook account, you can link content of our sites on your Facebook profile, share the content or "Like" it. This allows Facebook to assign your visit to our sites to your account. We point out that we receive no knowledge of the content of the transmitted data and use through Facebook. For more information, please see the privacy policy of Facebook at

4.4.2.  WebInstagram

On our website we use Plugins of the social network Instagram that is operated by the Instagram LLC., 1601 Willow Road, Menlo Park, CA 94025, USA. The plugins are identified by a Instagram logo, for example in the form of an "Instagram camera". You can find an overview of the Instagram plugins and their appearance here:

When you visit our site, your browser makes a direct connection to the servers of Instagram. The content of the plugin is from Instagram directly to your browser and integrated into the site. This integration enables Instagram to receive the information that your browser has accessed the corresponding page of our website, even if you do not have an Instagram profile or just not logged in. This information (including your IP address) is transmitted from your browser directly to a server of Instagram in the USA and stored there.

If you are logged in at Instagram, Instagram can assign your visit to our website to your Instagram account immediately. If you interact with the plugin, eg the "Instagram" pressbutton, this information is also transmitted directly to a server of Instagram and stored there. The information will also be published on your Instagram account and appear with your contacts.

The purpose and scope of data collection and further processing and use of data by Instagram as well as your rights and ways to protect your privacy is described in the privacy policies of Instagram:

5.      Storage period

We store your personal data in principle only as long as they are necessary to fulfill our obligations to you. For the sake of resident and tax and corporate legal retention requirements, however, we may store the data made available in connection with bookings and orders for seven years after the contract. We store your personal data submitted through other requests for a period of six months after answering the request in order to respond to any follow-up questions. This storage is based on our legitimate interests. DO & CO has a strong interest to create its customer support as user-friendly as possible and to strengthen the company's reputation. In this case, no prevailing interests exist on your part.

6.      Data security

We take appropriate technical and organizational security measures to protect your personal data against accidental or unauthorized destruction, alteration or against loss, theft and unauthorized access, disclosure, reproduction, use, modification or access.

Thus, our secure server software encrypts all your personal information such as credit card number, bank code, bank account number, name and address. This information can not be read by unauthorized persons during transmission on the Internet. When encrypting the characters you enter are converted into a code that can be securely transmitted over the Internet. This means that our customers are optimally protected from unauthorized access.

In addition, we and our employees are obliged to maintain confidentiality and secrecy. Likewise, our agents and agents who need to have access to your personal data to fulfill your job responsibilities are, access and subject to the same obligations to maintain confidentiality and secrecy.

7.      Your data subjects' rights

You may always ask for information about your stored personal data. In addition, you may, in certain circumstances, request the correction or deletion of your data. You can still have a right to limit the processing of your data and a right to publish the information you provide in a structured, consistent and machine-readable format.

You also have a right to object to the data processing when the processing is provided for purposes of direct marketing. As far as we will process your data for legitimate purposes, you also have the right to object at any time, if there are reasons for it under your particular situation.

You have the opportunity to address a complaint to the Data Protection Inspectorate. The authority responsible for our data protection supervisory authority is the Austrian Data Protection Authority, Wickenburggasse 8, 1080 Wien.

For questions, you can of course also contact us:

DO & CO im Haas Haus Restaurantbetriebs GmbH
Stephansplatz 12, 1010 Vienna
Tel: +43 (0) 535-3969 or + 43 (1) 241-88
Email: or

In order to process your request in accordance with our rights mentioned above and to ensure that your personal data will not be released to unauthorized third parties, please address the request in clear identification of your person as well as a short description of the scope of the exercise of your subjects' rights listed above.