This Privacy Policy for Good Vienna Tours GmbH (‘we’, ‘us’, or ‘our’), describes how and why we might access, collect, store, use, and/or share (‘process’) your personal information when you use our services (‘Services’), including when you:
This notice covers BucketBill only. The website of our tour business at goodviennatours.eu is a separate service and is not covered by this notice; nothing said here about analytics or tracking describes that site.
Questions or concerns? Reading this Privacy Policy will help you understand your privacy rights and choices. We are responsible for making decisions about how your personal information is processed. If you do not agree with our policies and practices, please do not use our Services. If you still have any questions or concerns, please contact us at info@goodviennatours.eu.
This summary provides key points from our Privacy Policy, but you can find out more details about any of these topics in the sections below.
What personal information do we process? When you visit, use, or navigate our Services, we may process personal information depending on how you interact with us and the Services, the choices you make, and the products and features you use. Learn more about personal information you disclose to us.
Do we process any sensitive personal information? Some of the information may be considered ‘special’ or ‘sensitive’ in certain jurisdictions, for example your racial or ethnic origins, sexual orientation, and religious beliefs. We do not process sensitive personal information.
Do we collect any information from third parties? Only one thing: when you validate a VAT number, the EU’s VAT register (VIES) returns the registered name and address for it, which the application offers to fill in for you.
How do we process your information? We process your information to provide, improve, and administer our Services, communicate with you, for security and fraud prevention, and to comply with law. We may also process your information for other purposes with your consent. We process your information only when we have a valid legal reason to do so. Learn more about how we process your information.
How do we keep your information safe? We have adequate organisational and technical processes and procedures in place to protect your personal information. However, no electronic transmission over the internet or information storage technology can be guaranteed to be 100% secure, so we cannot promise or guarantee that hackers, cybercriminals, or other unauthorised third parties will not be able to defeat our security and improperly collect, access, steal, or modify your information. Learn more about how we keep your information safe.
What are your rights? Depending on where you are located geographically, the applicable privacy law may mean you have certain rights regarding your personal information. Learn more about your privacy rights.
How do you exercise your rights? The easiest way to exercise your rights is by visiting https://bucketbill.eu/data-request.html, or by contacting us. We will consider and act upon any request in accordance with applicable data protection laws.
In Short: We collect personal information that you provide to us.
We collect personal information that you voluntarily provide to us when you register on the Services, express an interest in obtaining information about us or our products and Services, when you participate in activities on the Services, or otherwise when you contact us.
Personal Information Provided by You. The personal information that we collect depends on the context of your interactions with us and the Services, the choices you make, and the products and features you use. The personal information we collect may include the following:
Sensitive Information. We do not process sensitive information.
Payment Data. If you subscribe, you enter your card details on the payment page of myPOS, our payment processor, which opens in your browser; we never receive the full card number or the security code. myPOS returns to us a token that lets us charge your card for renewals (kept in an encrypted vault, never readable from the application), the outcome and amount of each payment, and its transaction reference. The same happens when you start a 14-day introductory period, except that nothing is charged: myPOS returns the token and the transaction reference. For every checkout we also record, in your organisation’s billing history, the plan you chose, its price, for an introductory period the date of the first payment, and your request that the service starts at once (see ‘Right of withdrawal’ in the Terms and Conditions). You may find their privacy notice here: https://merchant.mypos.com/en/terms-conditions/doc:PP.
Device permissions. The applications ask for the following, each only when you use the feature:
In Short: We record which days your account used the Services, and which broad areas of the application you opened on those days. Nothing in this usage measurement is finer-grained than a day, and you can switch the second part off.
Usage days. When you use the Services while signed in, we record a single entry per user per calendar day, containing: your user identifier, the date, your organisation, which application you used (desktop, Android, iOS, or web) and its version number. We keep these entries for 400 days at most. They are deleted when your account is deleted.
We record this so we can tell whether customers are still able to use what they are paying for — if an account that used the Services daily stops, we want to notice and ask why. The legal basis is our legitimate interest (Art. 6(1)(f) GDPR) in understanding whether our product works for the people who bought it.
Feature areas. On the same once-a-day basis, we also record which broad areas of the application you opened or completed, so that we can tell whether a feature is being found and used at all. Each entry contains only: your user identifier, the date, your organisation, and one area name from this fixed list —
That list is exhaustive: an area not named above is not recorded, and adding one requires this notice to be updated first. These entries are kept for the same 400 days and are deleted when your account is deleted.
What a feature entry cannot tell us. One entry per area per day, and no more. Opening the invoice list once and opening it fifty times produce exactly the same entry, so we cannot count your activity, measure how long you spent anywhere, see the order in which you did things, or reconstruct a session. We never record the contents of what you were working on: opening an invoice records “invoice editor”, never which invoice, which customer, or which amount.
The legal basis is again our legitimate interest (Art. 6(1)(f) GDPR) in knowing which parts of the product are working for the people who bought it — a feature nobody opens is one we should fix or remove, and we have no other way to find out. You have the right to object to this under Art. 21 GDPR, and you can exercise it yourself at any time: open Settings → User → Privacy and switch off “Help us see which features are used”. It takes effect immediately on that device — anything already waiting to be sent is discarded rather than sent — and your objection is recorded with us against your account, not just that device: our systems then refuse new feature entries for your account no matter which device they come from, other devices you are signed in on apply the setting the next time they start or sign in, and it survives reinstalling the application. If the device you used was offline at that moment, it keeps the setting locally and passes your objection to us as soon as it next connects. Switching the setting off does not delete entries recorded before your objection; they simply age out on the 400-day schedule above (or earlier, with your account). It also does not affect the usage-day entry described above, which we rely on to tell whether a paying customer can still reach the product at all.
Problem reports. If you use “Report a problem” inside the application — including to tell us about an accessibility barrier — we store what you send us so that we can answer it. That is: the message you write, the kind of problem you chose (accessibility, something broken, or something else), the reply address you give (your account address is filled in by default, and you may change or clear it), your user identifier, your organisation, the application version and device type (desktop, Android, iOS, or web), and the page you were on, with any record identifiers removed (for example “/invoices/:id”, never which invoice). Those last three are sent whether or not you leave the technical snapshot below switched on.
Technical details, if you leave them switched on. The report form offers to include a technical snapshot, and explains in the form itself what that means. It contains: the moment the snapshot was taken, the size of your window, which element had the keyboard focus, whether the application window had the keyboard focus and whether its window was visible or in the background, which interface modes were switched on (recorded as the style names the page was using — for example that a guided tour was running), which dialogs and pop-up layers were open, any layer that was covering the page, how many form fields were checked, and which of them appeared to be blocked (the field’s name and what was covering it — never what you typed into it), and your display settings — dark mode, reduced motion, increased contrast, forced colours, text language and screen scaling. It also contains a short technical trace of the last few interface events, recorded as element names such as “the VAT number field”. It never contains the contents of any field you typed into, and never your invoices, customers or amounts. You can switch it off before sending, and the report is still delivered without it.
We use this to reproduce and fix the problem and to reply to you. The legal basis is the performance of our contract with you (Art. 6(1)(b) GDPR) where the report concerns the Services you pay for, and otherwise our legitimate interest (Art. 6(1)(f) GDPR) in being told when our product does not work — an accessibility complaint we never receive is one we cannot fix. Reports are readable only by you and by us; they are not visible to the administrator of your organisation, so that you can tell us about a barrier without telling your employer.
We keep a report for 12 months after we close it, and an open report until it is closed. Reports are deleted when your account is deleted, and when your organisation is deleted. If we have configured an email address for support, a copy of the message (but not the technical snapshot) is sent to that mailbox so that we notice it.
Your acceptance of the legal texts. When you accept the Terms and Conditions and this Privacy Policy, we record which version you accepted (its ‘Last updated’ date), when, and from which kind of application (desktop, Android, iOS, web, or the website’s sign-up form), so that we can show that we obtained your agreement. The record is kept with your account, is included in a copy of your data, and is deleted with your account.
Your export history. When an owner, administrator or read-only viewer exports to Excel, or an owner or administrator creates a SEPA payment file, the application records one entry for the organisation (running an export again from that list adds none): who ran it, when (date and time), from which kind of application (desktop, Android, iOS, or web), which export it was and with which filter (for example a year or a date range), the file name and the number of rows; a SEPA entry also carries the payment total. The file itself and where you saved it are never stored. This is a business record of the organisation — kept so that an export can be run again on another device, and so that a payment run is not made twice — and not usage measurement. We keep it for the organisation as part of the Services (Art. 6(1)(b) GDPR) and in the organisation’s legitimate interest in not making a payment run twice (Art. 6(1)(f) GDPR). It is visible to the organisation’s owner, administrators and read-only viewers; members do not see it, and exports made as a member are not recorded. It stays with the organisation until the organisation is deleted; when the account of the person who ran an export is deleted, the entry no longer refers to anyone.
Cookies and local storage. When you sign in to your account, the website sets two strictly necessary cookies: one that keeps you signed in (not readable by scripts) and one small flag that holds only the session’s expiry time, so the page knows whether you are signed in. Neither carries a tracking identifier, and neither is used for advertising or analytics. The applications keep your sign-in session and your settings in local storage on your device. There are no advertising or analytics cookies anywhere in the Services.
What we deliberately do not collect. We do not use any third-party analytics or tracking service. Outside a problem report you choose to send us, our usage measurement records no time of day, no durations, no individual clicks or keystrokes, no screen contents and no advertising or cross-site identifier (your business records naturally carry the time you saved them, like any bookkeeping). We do not store your IP address in our own records; the providers that deliver the Services to you — our hosting providers and the bot check on the sign-in page — see it in the course of delivering them, as described under ‘When and with whom do we share your personal information?’. There is no tracking pixel, tag manager, or session-replay tool in our Services. The daily entries described above — one for the day, and one per feature area on that day — are the entirety of our usage measurement.
All personal information that you provide to us must be true, complete, and accurate, and you must notify us of any changes to such personal information.
In Short: We process your information to provide, improve, and administer our Services, communicate with you, for security and fraud prevention, and to comply with law. We may also process your information for other purposes with your consent.
We process your personal information for a variety of reasons, depending on how you interact with our Services, including:
In Short: We only process your personal information when we believe it is necessary and we have a valid legal reason (i.e. legal basis) to do so under applicable law, like with your consent, to comply with laws, to provide you with services to enter into or fulfil our contractual obligations, to protect your rights, or to fulfil our legitimate business interests.
The General Data Protection Regulation (GDPR) and UK GDPR require us to explain the valid legal bases we rely on in order to process your personal information. As such, we may rely on the following legal bases to process your personal information:
In Short: We may share information in specific situations described in this section and/or with the following third parties.
Vendors, Consultants, and Other Third-Party Service Providers. We may share your data with third-party vendors, service providers, contractors, or agents (‘third parties’) who perform services for us or on our behalf and require access to such information to do that work.
The third parties we may share personal information with are as follows:
Subscription confirmation e-mails. After each successful subscription payment we e-mail the account owner a confirmation with the corresponding VAT invoice attached as a PDF. To deliver that e-mail, the following passes through our e-mail delivery provider (SMTP): the account owner’s e-mail address, and the invoice itself, which carries the company name, address and VAT number saved in the account’s settings alongside the plan and amount paid. Like any ordinary e-mail, this transfer is not end-to-end encrypted (the connection to the mail server is TLS-protected). The legal basis is performance of the contract and our legal obligation to issue invoices (§ 11 UStG); issued invoices are retained for the statutory period (§ 132 BAO) even after account deletion.
Push notifications and Google. If you turn on schedule reminders in the mobile app, the reminder is delivered through Firebase Cloud Messaging, operated by Google Ireland Limited. To deliver it, the following is sent to Google: your device’s push token, the appointment’s start time, its title, its location or meeting point where one is set, and its internal identifier. This is the text you see on your lock screen, and it is what makes the reminder useful. Please note that a push notification is not end-to-end encrypted: the delivery provider is technically able to read it, so an appointment title that names a client, a guide or a person will be visible to Google in the same way it is visible on your screen. If you would rather that did not happen, you can turn push notifications off in your device settings, which ends this transfer entirely; the reminders remain visible inside the application. The legal basis is performance of the contract (delivering the reminder you enabled). Google may process this data outside the EEA under the EU Standard Contractual Clauses and the EU-U.S. Data Privacy Framework. The device token is deleted when it stops being valid or when you sign out.
Where your data is processed. Our database and file storage run on Supabase in the European Union (Frankfurt, Germany), and myPOS processes payments within the EU. Vercel and Cloudflare are companies of the United States and may process the data named above outside the EEA, as may Google for push notifications; each of these transfers relies on the EU Standard Contractual Clauses and, where the provider is certified, on the EU-U.S. Data Privacy Framework. Sentry (error monitoring) is named above but is not switched on at the time of writing; if we enable it, this notice will say so first.
We also may need to share your personal information in the following situations:
An account can belong to an organisation with several members, each holding a role (owner, administrator, member, or read-only viewer). Inside an organisation, the business records the organisation works with — invoices, clients, tours, the schedule, and job assignments — are visible to every member, including read-only viewers; what each role may change is restricted, but visibility of the organisation’s operational records is shared by design. Purchase records (supplier documents and photographed receipts) are visible to owners, administrators and read-only viewers; billing history is visible to the owner only. The organisation’s export history (see section 1) is visible to owners, administrators and read-only viewers only. Every member can see the email addresses and roles of the other members — that is what the team list is. Work you create inside an organisation (for example an invoice or a calendar entry, which records you as its author or assignee) is therefore visible to the organisation’s other members under these rules, for as long as the organisation keeps it. The schedule of your own business, and the entries assigned to you in another organisation you belong to, are not visible to an organisation you are a member of unless you choose to share your availability (see ‘Sharing your availability’ below); another organisation’s entries are then shown as busy times only. Invitations to join an organisation take effect only when you explicitly accept them in the application — creating an account never places you into someone else’s organisation by itself.
Two independent businesses using the Services can pair with each other (an agency and a contractor), by one side handing the other a short-lived pairing code out-of-band. Pairing is deliberate and mutual, and it shares the following between the two businesses — each of which is a separate controller of what it receives:
Where the application offers it, you can let an organisation’s owner and administrators see when you are busy, if you are a member of that organisation or a contractor paired with it, so that the organisation can offer you jobs on days you are free. What can be shown is the entries of your own business in BucketBill and the entries assigned to you in another organisation you belong to. At the time of writing, the application offers this only to paired contractors, only for the entries of their own business, and only as busy times. This concerns your schedule inside BucketBill only, never your device’s calendar. You decide, per organisation or pairing, how much is shown: nothing (the default); your busy times only, that is the start and end of each entry, or that it is an all-day entry, shown as blocks without any content; or your busy times together with the names of your entries. The entries of another organisation are always shown as busy times only, never with their names. Nothing else from an entry is shared: never its location, client, price or notes. Sharing is switched on only by you, can be switched off by you at any time, and ends when you leave the organisation or the pairing is revoked; the organisation can never switch it on. The legal basis is your consent (Art. 6(1)(a) GDPR), which you withdraw by switching it off. The organisation sees your busy times at the moment it looks; we keep no copy for it. Your choice is stored with the pairing or your membership and is deleted with your account or the organisation. If you choose to show the names of your entries, bear in mind that a name can identify a client or another person; you decide what you share, and the organisation that receives it is a separate controller (within the meaning of Art. 4(7) GDPR) of what it receives and may use it only to plan work with you.
In Short: We keep your information for as long as necessary to fulfil the purposes outlined in this Privacy Policy unless otherwise required by law.
We will only keep your personal information for as long as it is necessary for the purposes set out in this Privacy Policy, unless a longer retention period is required or permitted by law (such as tax, accounting, or other legal requirements). Each section of this notice states the retention period for the records it describes. Personal records tied to your account (see section 13) are removed when your account is deleted; records that belong to your organisation stay with the organisation for as long as it keeps them, and are removed when the organisation is deleted. The exception is what the law requires us to keep: the VAT invoices we issued to you for your subscription, and a ledger entry of your account’s settled payments (your company name and address, VAT number, the account e-mail address, and the amounts and dates charged). We retain those for the statutory period of seven years (§ 132 BAO) after your account is deleted, isolated from any other processing.
When we have no ongoing legitimate business need to process your personal information, we will either delete or anonymise such information, or, if this is not possible (for example, because your personal information has been stored in backup archives), then we will securely store your personal information and isolate it from any further processing until deletion is possible.
In Short: We aim to protect your personal information through a system of organisational and technical security measures.
We have implemented appropriate and reasonable technical and organisational security measures designed to protect the security of any personal information we process. However, despite our safeguards and efforts to secure your information, no electronic transmission over the Internet or information storage technology can be guaranteed to be 100% secure, so we cannot promise or guarantee that hackers, cybercriminals, or other unauthorised third parties will not be able to defeat our security and improperly collect, access, steal, or modify your information. Although we will do our best to protect your personal information, transmission of personal information to and from our Services is at your own risk. You should only access the Services within a secure environment.
In Short: We do not knowingly collect data from or market to children under 18 years of age.
We do not knowingly collect, solicit data from, or market to children under 18 years of age, nor do we knowingly sell such personal information. The Services are for business use by adults; by using them you confirm that you are at least 18. If we learn that personal information from users less than 18 years of age has been collected, we will deactivate the account and take reasonable measures to promptly delete such data from our records. If you become aware of any data we may have collected from children under age 18, please contact us at info@goodviennatours.eu.
In Short: In some regions, such as the European Economic Area (EEA), United Kingdom (UK), and Switzerland, you have rights that allow you greater access to and control over your personal information. You may review, change, or terminate your account at any time, depending on your country, province, or state of residence.
In some regions (like the EEA, UK, and Switzerland), you have certain rights under applicable data protection laws. These may include the right (i) to request access and obtain a copy of your personal information, (ii) to request rectification or erasure; (iii) to restrict the processing of your personal information; (iv) if applicable, to data portability; and (v) not to be subject to automated decision-making. In certain circumstances, you may also have the right to object to the processing of your personal information. You can make such a request by contacting us by using the contact details provided in the section ‘How can you contact us about this notice?’ below.
We will consider and act upon any request in accordance with applicable data protection laws.
If you are located in the EEA or UK and you believe we are unlawfully processing your personal information, you also have the right to complain to your Member State data protection authority or UK data protection authority.
If you are located in Switzerland, you may contact the Federal Data Protection and Information Commissioner.
Withdrawing your consent: If we are relying on your consent to process your personal information, you have the right to withdraw your consent at any time. You can withdraw your consent at any time by contacting us by using the contact details provided in the section ‘How can you contact us about this notice?’ below or updating your preferences.
However, please note that this will not affect the lawfulness of the processing before its withdrawal nor, will it affect the processing of your personal information conducted in reliance on lawful processing grounds other than consent.
To review or change the information in your account, sign in and edit your account and company settings. To delete your account, open the app, go to Settings, then the User tab, and choose ‘Delete account’; you confirm it with your password. You can also ask us to do it through the data-request page named in section 13. The deletion is completed automatically 30 days after your request. Until then you can sign in and cancel it in the same place; your data stays readable and exportable, but the organisations you own can no longer be changed, and their subscription is not renewed. An organisation of another owner that you are a member of is not affected; you leave it when the deletion is completed. If you own an organisation that has other members, you must first transfer its ownership or remove the members, so that no one else loses the organisation’s records.
When we delete your account, we remove your personal records as described in section 5; only the records the law requires us to keep remain, isolated, for the statutory period.
If you have questions or comments about your privacy rights, you may email us at info@goodviennatours.eu.
Most web browsers and some mobile operating systems and mobile applications include a Do-Not-Track (‘DNT’) feature or setting you can activate to signal your privacy preference not to have data about your online browsing activities monitored and collected. At this stage, no uniform technology standard for recognising and implementing DNT signals has been finalised. As such, we do not currently respond to DNT browser signals or any other mechanism that automatically communicates your choice not to be tracked online. If a standard for online tracking is adopted that we must follow in the future, we will inform you about that practice in a revised version of this Privacy Policy.
The Services allow you to enter and store personal information about your own clients and customers (for example, their names, email addresses, postal addresses, and tax identification numbers) in order to create invoices and manage bookings. With respect to that information, you are the data controller and we act as a data processor on your behalf. We process it only to provide the Services to you and in accordance with your instructions, and we do not use it for our own purposes. You are responsible for ensuring that you have a lawful basis to collect and process the personal information you enter into the Services, and for providing any notices or obtaining any consents required from those individuals. If a client or customer of yours contacts us directly to exercise their data protection rights, we will refer them to you as the controller of that information.
The same applies to your suppliers. When you file an invoice you have received — from the GetBill screen, or by importing a file from your computer — the Services record a bookkeeping entry for it. That entry can contain personal information about the person or business that billed you: their name, VAT identification number, invoice number and date, the amounts, and the bank account (IBAN and BIC) named on the invoice. Many of your suppliers are sole traders, so this is personal data about them, and you are its controller in exactly the same way as for your customers — we act as your processor.
Where these end up. When you file an invoice from the GetBill screen or by importing a file from your computer, the document file itself — the PDF or Word file — is not uploaded to us. It stays on the device you filed it from, in the folder you chose; the bookkeeping entry stores only a fingerprint of the file, which lets the app recognise the same document if it reaches you twice. The entry itself — the fields listed above — is stored in your organisation’s area of our cloud database, so it is available on the devices you sign in on. It is covered by the same retention, export and deletion rights described elsewhere in this notice, and is included when you request a copy of your data.
Your mailbox stays on your device. When you connect a mailbox to GetBill, its address and password (or the Microsoft sign-in token) are stored only on that device, protected by the operating system’s credential store, and the mailbox is read from that device directly. We never receive your mailbox credentials. The review queue itself is stored with us so that all your devices can show it: for each e-mail the app flagged as an invoice, the sender’s name and address, the subject, when it arrived, the attachment’s name and the values the app read from it — never the message body and never the file. The queue is deleted with your account.
Photographed receipts are different, and they are uploaded. When you photograph a receipt or invoice in the app to submit it for bookkeeping, the photograph itself is sent to us and stored. It is kept in your organisation’s own area of a private storage bucket — never publicly readable, and never reachable by a plain link. It can be opened by the owners, administrators and viewers of your organisation, and by whoever uploaded it, and only through short-lived links that expire a few minutes after they are issued. The image is deleted when the submission is rejected, and when the organisation itself is deleted. Because a photograph of a receipt can show more than the receipt — whatever else was on the table, and information your camera records with the picture, such as the time and place it was taken and the device used — please photograph only what you need to file.
In Short: Yes, we will update this notice as necessary to stay compliant with relevant laws.
We may update this Privacy Policy from time to time. The updated version will be indicated by an updated ‘Last updated’ date at the top of this Privacy Policy, and the applications will ask you to accept the new version. If we make material changes to this Privacy Policy, we may notify you either by prominently posting a notice of such changes or by directly sending you a notification. We encourage you to review this Privacy Policy frequently to be informed of how we are protecting your information.
If you have questions or comments about this notice, you may email us at info@goodviennatours.eu or contact us by post at:
Good Vienna Tours GmbH
Himmelpfortgasse 11/1/25A
1010 Vienna
Austria
Based on the applicable laws of your country, you may have the right to request access to the personal information we collect from you, details about how we have processed it, correct inaccuracies, or delete your personal information. You may also have the right to withdraw your consent to our processing of your personal information. These rights may be limited in some circumstances by applicable law. You can delete your account yourself in the app (Settings, User tab, ‘Delete account’; see section 8). To request to review, update, or delete your personal information, please visit: https://bucketbill.eu/data-request.html.
In a multi-member organisation, these rights are answered to you as a person: a copy of your data contains the organisation’s business records you have access to plus your own personal records (your preferences, your acceptance of the legal texts, your usage entries, your device registrations, your mailbox review queue, requests addressed to you, your pairings as a contractor and what you share with each, and any problem reports you have sent us together with our notes on them) — never a colleague’s personal records. Deleting an organisation removes its business records for every member; personal records are removed with the account they belong to. Records that another, independent business legitimately holds about its dealings with you — for example an agency’s own record of a job request it sent you through the contractor network — belong to that business’s books, and a request concerning them can also be directed to that business as their controller.