Data Privacy Statement

Responsible for the data processing (controller)

ASFINAG Autobahnen- und Schnellstraßen-Finanzierungs-Aktiengesellschaft, 1030 Wien, Schnirchgasse 17, T +43 50 108-10000, F +43 50 108-10020,, FN 92191 a (hereinafter "ASFINAG") is responsible for the data processing described in the following.

The ASFINAG data protection officer is available at: ASFINAG Datenschutz, Autobahnen- und Schnellstraßen-Finanzierungs-Aktiengesellschaft, 1030 Wien, Schnirchgasse 17,, T +43 1 955 1266, F +43 1 955 1277.

ASFINAG Autobahnen- und Schnellstraßen-Finanzierungs-Aktiengesellschaft attaches great importance to the protection of your personal data. If the use of our webshop is not possible without the provision of personal data, the use of your personal data (such as name, address, e-mail address) is always voluntary and only with your consent. This also applies to the transfer of your personal data to third parties (subsidiaries or other third parties).

We have applied the necessary technical and organisational measures according to the legal requirements for electronic communication and data protection.

You have the right to access correct or delete your personal data at any time. For the purpose of the technical operation of the webshop, the IP address, date, time and viewed pages are collected when visiting the ASFINAG webshop. These are used exclusively from a technical point of view for traceability in the event of a fault and troubleshooting. This data will not be disclosed to third parties.

Log files and hosting

When you visit our website, information is automatically sent from your device to our website in an automated manner. The following information is temporarily stored in a so-called log file:

  • IP address of the device
  • Date and time of access
  • Name and URL of the retrieved file
  • The website from which access is made
  • The browser and, if necessary, the operating system used by your device

These data are stored for 4 months until their automatic deletion.

The processing serves the following purpose:

The temporary storage of the user’s IP address by the system is necessary in order to enable the delivery of the website to the user’s computer. The data mentioned make it possible to gain important points of reference for the optimisation of the website. Error situations can be better understood, and the user friendliness can be improved. These data also serve to ensure the security of our systems (e.g. detection of attacks). Evaluation for marketing purposes does not take place.

The legal basis for the data processing is Art. 6 Para. 1 Item f GDPR. Our legitimate interest is in the above-mentioned purpose.

In order to make your visit to our website as pleasant as possible, we make use of the content delivery network of our hosting provider. A content delivery network (CDN) is a distributed network of servers with which static web contents (images, JavaScript, CSS files) can be efficiently transmitted to users and made available based on their region as quickly as possible, in order to minimise the loading times. The legal basis for the data processing is Art. 6 Para. 1 Item f GDPR. Our legitimate interest is in the above-mentioned purpose.

Cookies & consent

We use cookies on our website. These are small text files that are automatically stored on your device when you call up our site. The use of cookies serves, on the one hand, to make your visit to our website as enjoyable as possible, and on the other to optimise the user-friendliness of our website.

When you call up the website, we use a cookie banner to request your consent to the placement of functional and statistical cookies. Functional cookies are necessary so as to be able to execute basic functions of the website. If you do not accept these, the functionality of the website may be restricted. You have the right to revoke your consent at any time. You may delete these cookies at any time via the settings in your browser.

For this purpose, the following cookies are set:

NameStorage durationObjective
truendo_cmp1 yearThis cookie is used to save your privacy settings.
This allows the privacy management software on this website
to correctly configure privacy-related functions.
__RequestVerificationTokenEnd of sessionPrevents unauthorised posting of website content
(so-called cross-site request forgery).
Contains no information about the user
_pk_id13 monthsCollects statistics about the user's visits to the website,
such as the number of visits, average time spent on the website
and which pages were read.
_pk_ses30 minutesUsed by Matomo Analytics Platform to track page views
of the visitor during the session.

Data analysis / Matomo

Our website uses the open source software "Matomo" ( as a web analysis tool. This enables us to create an analysis of the use of the website. The purpose of this analysis is to improve the website for you by, among other things, detecting navigation problems in the website and adapting functions and offers according to your preferences.

Matomo sets the cookies listed below. The data collected by the cookies is automatically anonymised immediately by shortening the IP address and thus making it impossible to trace it back to your end device or person.

In addition, the data is stored exclusively on our server and is not transmitted to other servers or third parties. The determination with immediate anonymisation of your data is absolutely necessary for the operation of the website.

Omnichannel – Chat

Our website uses the live chat from the Microsoft Dynamics 365 module, Omnichannel for Customer Service ( This is provided by Microsoft Cooperation, 1 Microsoft Way, 98052 Redmond, USA. You can use the live chat like a contact form to chat with our employees almost in real time. When starting the chat, the following personal data is collected:

  • Date and time of access
  • Duration of access
  • Browser type/version
  • Anonymised IP address (last octet deleted)
  • Operating system used
  • URL of the previously visited website
  • Contents of the transmitted chats
  • First name, last name (if specified)
  • E-mail address (if specified)

Depending on the course of the conversation with our employees, additional personal data may arise in the chat, which will be entered by you. We have configured our systems to process and store your data exclusively in the European Union.

The legal basis for data processing and data forwarding is your consent in accordance with Art. 6 para. 1 lit. a GDPR. This information is collected before the cookies are set and the listed data is transmitted. The purpose of the processing is to provide our customers with even better service and support. The chat function enables you to have a conversation with an ASFINAG employee in real time and thus contributes towards customer satisfaction. You have the right to revoke your consent at any time. You can delete these cookies at any time via the settings in your browser. The legality of the processing up to the time of your revocation shall not be affected by this. The chat logs are deemed corporate communications and are archived for three years.


A so-called Chatbot has been integrated to make it easier to find information on the website. This can quickly answer the website visitor's questions or refer the website visitor to a customer management employee.

Insofar as the use of the Chatbot is not possible without providing personal data, the use of personal data (such as name, vehicle registration number) is always voluntary.

Legal basis for processing

The legal basis for the processing of personal data in the website's Chatbot is a free service contract with the website visitor pursuant to Art 6 para 1 lit b DSGVO.


The Chatbot can be used on the website of ASFINAG.

The Chatbot is a dialog system that can answer your questions using routines and rules. If the Chatbot is not able to find a suitable answer, it will forward you to a member of the customer management team. The legal basis is a free service contract. The chat history is stored, i.e. the data you provide and an anonymous ID to identify the chats. These data will be deleted after 90 days.

To guarantee a correspondingly high quality, security and availability of use, ASFINAG uses the following order processors:

Company: IBM
Address: Obere Donaustraße 95, 1020 Wien, AUSTRIA
Category of order processing: Software as a Service

Information on the rights of the data subjects

According to the General Data Protection Regulation, data subjects have the following rights:

Right to receive information

Each data subject has the right – after verifying its identity – to request information from ASFINAG as to whether its personal data is being processed. If this is the case, the data subject shall have the right to obtain further information on the purposes and legal basis of the processing, the categories of data concerning it, the data sources, the recipients of its data, the (non-)existence of an automated decision-making process including profiling, instructions regarding its rights and obligations, and a copy of the personal data.

Right to rectification and erasure

If the personal data is inaccurate or incomplete, the data subject may request the rectification, completion or erasure of data relating to it as part of the processing purposes, if necessary by means of a supplementary declaration. In particular, ASFINAG is obliged to erase personal data if the erasure is prescribed by law or if any existing consent for processing has been revoked, if there is no further legal basis for processing, or if personal data is no longer necessary for the purposes for which it had originally been collected.

However, the right to erasure does not exist if the processing is necessary to fulfil a legal obligation of ASFINAG or to perform a task that is in the public interest or that is performed in the exercise of official authority or is required to assert, exercise or defend legal claims.

Right to restriction of processing

Every data subject has the right to have the processing of its personal data restricted. One of the following conditions must be fulfilled for this:

  • The accuracy of the personal data is contested by the data subject for a period of time long enough to allow ASFINAG to verify the accuracy of the personal data;
  • The processing is unlawful and the data subject rejects the deletion of the personal data and instead requests the restriction of the use of the personal data;
  • ASFINAG no longer needs the personal data for processing purposes and, at the same time, the data subject needs it for the assertion, exercise or defence of legal claims;
  • If the data subject has objected to the processing, until it has been established whether the legitimate reasons of ASFINAG outweigh those of the data subject.

However, limited data may still be used to protect the rights of another person, for important public interest or to assert, exercise or defend ASFINAG's legal claims.

Right to data transferability

The data subject shall have the right to receive the personal data concerning it that it has provided to ASFINAG in a structured, conventional and machine-readable format or – if technically possible – to have such data transferred to another responsible party. However, this right only exists if the processing is based on the legal basis of a contract or the consent of the data subject.

Right to object

The data subject shall have the right to object at any time to the processing of personal data concerning it on grounds relating to its particular situation. This right shall apply only if the processing

  • is necessary for the performance of a task that is in the public interest, or
  • takes place in the exercise of official authority vested in ASFINAG, or
  • is necessary to safeguard the legitimate interests of ASFINAG or a third party.

ASFINAG will then no longer process the personal data unless it can prove compelling reasons worthy of protection for the processing, which outweigh the interests, rights and freedoms of the data subject, or the processing serves to assert, exercise or defend legal claims.

Right to object to direct marketing

Where personal data is processed for direct marketing purposes, the data subject has the right to object at any time to the processing of personal data concerning said data subject for the purposes of such marketing. If the data subject objects to processing for direct marketing purposes, the personal data will no longer be processed for these purposes.

Right of appeal to the supervisory authority

Every data subject has the right to file a complaint with the data protection authority, Barichgasse 40–42, 1030 Vienna,