Privacy Policy

Last updated: September 2026

Data Protection at a Glance

General information

The following information provides a simple overview of what happens to your personal data when you visit our website. Personal data is any data by which you can be personally identified. For detailed information on the subject of data protection, please refer to our privacy policy set out below this text.

Responsible party

The party responsible for data processing on this website within the meaning of the General Data Protection Regulation (GDPR / DSGVO) is:

Biohotel Schweitzer
Pirktl Holiday GmbH & Co KG
Obermieming 141
6414 Mieming in Tyrol, Austria
Phone: +43 5264-5285
E-mail: info@biohotel.at
Website: www.biohotel.at

The responsible party is the natural or legal person who alone or jointly with others determines the purposes and means of processing personal data (e.g. names, e-mail addresses or the like).

How do we collect your data?

On the one hand, your data is collected when you provide it to us. This may, for example, be data that you enter into a contact or booking form.

Other data is collected automatically by our IT systems when you visit the website. This is primarily technical data (e.g. internet browser, operating system or the time of the page view). This data is collected automatically as soon as you enter our website.

What do we use your data for?

Some of the data is collected to ensure the error-free provision of the website. Other data may – provided you give your consent – be used to analyse your user behaviour.

What rights do you have regarding your data?

You have the right at any time to obtain information free of charge about the origin, recipients and purpose of your stored personal data. You also have the right to request the correction or deletion of this data. If you have given consent to data processing, you can revoke this consent at any time with effect for the future. In addition, you have the right, under certain circumstances, to request the restriction of the processing of your personal data. Furthermore, you have a right to lodge a complaint with the competent supervisory authority. You can find details on this in the section “Your Rights”.

SSL or TLS encryption

For security reasons and to protect the transmission of confidential content, such as bookings or inquiries that you send to us as the site operator, this site uses SSL or TLS encryption. You can recognise an encrypted connection by the fact that the address line of the browser changes from “http://” to “https://” and by the lock symbol in your browser line.

When SSL or TLS encryption is activated, the data you transmit to us cannot be read by third parties.

Hosting & Server Log Files

External hosting (Netlify)

This website is hosted by an external service provider. The provider is Netlify, Inc., 512 2nd Street, Suite 200, San Francisco, CA 94107, USA (“Netlify”). The personal data collected when you visit this website is processed on Netlify’s servers or its content delivery network. This may primarily concern IP addresses, contact requests, meta and communication data, access data and other data generated via a website.

Netlify is used in the interest of a secure, fast and reliable provision of our online offering by a professional provider (Art. 6 (1) (f) GDPR). We have concluded a data processing agreement (DPA) with Netlify that ensures the protection of your data. Insofar as personal data is transferred to the USA in this context, this transfer is based on the standard contractual clauses of the EU Commission pursuant to Art. 46 GDPR.

Protection against overload (Upstash)

So that automated access does not block our booking and inquiry forms or our AI chat, we limit how often requests can be made from one internet connection. For this we count the requests per IP address in a cache of Upstash, Inc., San Jose, California, USA (“Upstash”) with its server location in Frankfurt am Main, Germany. For the AI chat we use only a shortened hash value instead of the IP address. The counters delete themselves after two hours at the latest.

Upstash acts as our processor; the data processing agreement is part of Upstash’s terms of service. Insofar as Upstash processes data from the USA, we base this on the standard contractual clauses of the EU Commission pursuant to Art. 46 GDPR. The legal basis is our legitimate interest in a secure and available online service (Art. 6(1)(f) GDPR).

Server log files

The provider of the pages automatically collects and stores information in so-called server log files, which your browser automatically transmits to us. This information is:

• Browser type and browser version
• Operating system used
• Referrer URL
• Host name of the accessing computer
• Time of the server request
• IP address

This data is not merged with other data sources.

This data is collected on the basis of Art. 6 (1) (f) GDPR. The website operator has a legitimate interest in the technically error-free presentation and optimisation of its website – to this end, the server log files must be collected.

Data Collection on Our Website

Cookies and comparable technologies

Our web pages partly use so-called cookies as well as comparable technologies (e.g. the local browser storage). Cookies are small text files that are stored on your device and do not cause any harm. They serve to make our offering more user-friendly, effective and secure.

We distinguish between technically necessary and non-necessary storage processes. Technically necessary cookies or storage entries are required for the operation of the website – this includes in particular the saving of the selection you made in the consent dialog. These are set on the basis of our legitimate interest in a functioning website (Art. 6 (1) (f) GDPR) or, where the law so provides, for the provision of the service you have expressly requested.

Non-necessary cookies or technologies serve purposes beyond this, in particular statistics, reach measurement and marketing. We use such technologies exclusively after your express consent (see below “Consent with our cookie tool” as well as the section “Analysis Tools and Advertising”). You can also set your browser so that you are informed about the setting of cookies, allow cookies only in individual cases or exclude them in general. When cookies are deactivated, the functionality of this website may be limited.

Consent with our cookie tool

Our website uses a self-operated consent tool to obtain your consent to the storage of certain cookies and comparable technologies and to document this in a data-protection-compliant manner. Your selection is stored in versioned form exclusively locally in your browser (in the so-called “localStorage”) and is not transmitted to us or to third parties. Technically, we use Google Consent Mode v2: analysis and marketing services are only enabled or loaded once you have consented to the respective category. Without your consent, the website remains free of statistics and marketing services.

You can revoke or change your consent at any time with effect for the future. To do so, open the cookie settings again via the button below or the “Privacy settings” link in the footer and adjust your selection. Alternatively, you can delete the stored selection yourself in your browser.

Open cookie settings

Consent to the setting of non-necessary cookies or to access to information on your device is given on the basis of Section 165 (3) of the Austrian Telecommunications Act 2021 (TKG 2021) as well as Art. 6 (1) (a) GDPR. In order to fulfil our obligations to provide proof, we document your consent or its revocation; mandatory statutory retention periods remain unaffected.

Anonymous counting of banner responses

In order to find out how many visitors decline our consent banner, we count the responses to the banner as a plain total. For each day, each language version, the window width (narrow or wide view) and the response given (banner shown, everything accepted, everything declined, own selection saved) we increase a counter by one.

NO record relating to you personally is created in the process: all that is stored is this number — no IP address, no identifier, no session, no point in time more precise than the calendar day, and nothing you type in. Conclusions about individual persons are therefore impossible; this constitutes anonymous statistics within the meaning of Recital 26 GDPR. The counting takes place on our own servers: no analytics service is loaded for it and nothing is stored on or read from your device. The principle stated above therefore remains untouched — without your consent the website remains free of statistics and marketing services.

Anonymous counting of search terms

If you enter a term in the treatment search while booking, we count this term as a plain total. This shows us what guests are looking for and cannot find with us. For each day, each language version and each search term we increase a counter by one and note how many treatments the search found.

We only count what looks like a search term: at most three words made of letters. Terms containing digits or an @, such as telephone numbers or e-mail addresses, are not counted. No record relating to you personally is created in the process: no IP address, no identifier, no session, no point in time more precise than the calendar day. This constitutes anonymous statistics within the meaning of Recital 26 GDPR. The counting takes place on our own servers, without any analytics service, and nothing is stored on or read from your device. Please do not enter names or other personal details in the search.

Inquiry by e-mail, telephone or contact form

If you contact us by e-mail, telephone or via a contact form, your inquiry including all the personal data resulting from it (name, e-mail address, telephone number if applicable, your concern) will be stored and processed by us for the purpose of handling your concern. We do not pass on this data without your consent.

This data is processed on the basis of Art. 6 (1) (b) GDPR, provided your inquiry is connected with the performance of a contract or is necessary for the implementation of pre-contractual measures. In all other cases, the processing is based on our legitimate interest in the effective handling of the inquiries addressed to us (Art. 6 (1) (f) GDPR) or on your consent (Art. 6 (1) (a) GDPR), provided this was requested.

The data you send us remains with us until the purpose for storing the data no longer applies (e.g. after your concern has been fully processed) or you ask us to delete it. Mandatory statutory provisions – in particular statutory retention periods – remain unaffected.

Online booking and booking inquiry

Via our website, you can check availability and make a booking or booking inquiry. To process this, we require your form of address, your first and last name, your e-mail address, your travel dates (arrival and departure) as well as the chosen product/arrangement. In individual cases, your telephone number is requested in order to be able to contact you quickly, in particular in the event of unforeseeable circumstances affecting your booking.

For the calculation of the applicable travel price, the details of the stay, the chosen product, the number of travelling persons as well as the information on whether they are adults or children (for children additionally the age) are required. Further information in the form is provided on a voluntary basis.

The booking is processed via our own booking backend; the database and server infrastructure used for this (provider: Supabase, server location within the European Union) processes your data as a processor on our behalf. In order to carry out your booking, we also transmit the necessary data to our hotel management system. With the service providers used, we have concluded data processing agreements where necessary.

The processing of your data for the booking or booking inquiry is carried out on the basis of Art. 6 (1) (b) GDPR and serves the performance of a contract or the implementation of pre-contractual measures. The transmitted data remains with us until the purpose for storing the data no longer applies. Mandatory statutory provisions – in particular statutory retention periods – remain unaffected.

Email delivery (Resend)

For sending transactional emails – in particular booking, offer and cancellation confirmations as well as messages relating to your inquiry – we use the email delivery service Resend. The provider is Plus Five Five, Inc., 2261 Market Street #5039, San Francisco, CA 94114, USA (“Resend”). The data required for delivery is processed, in particular your name, your email address and the content of the respective message (e.g. your booking details).

Resend processes and stores this data on our behalf on servers in the USA. We have concluded a data processing agreement (DPA) with Resend; the transfer to the USA is based on the standard contractual clauses of the EU Commission pursuant to Art. 46 GDPR. The legal basis for the processing is Art. 6 (1) (b) GDPR (performance of a contract or implementation of pre-contractual measures) as well as our legitimate interest in reliable and secure email delivery (Art. 6 (1) (f) GDPR).

Birthday greetings

If you have stayed with us or at the Alpenresort Schwarz within the last three years and provided your date of birth with your reservation, we send you a greeting by email on your birthday – from the hotel you have visited most often. The legal basis is our legitimate interest in maintaining our relationship with our guests (Art. 6 (1) (f) GDPR) and, for existing guests, Section 174 (4) of the Austrian Telecommunications Act (TKG 2021). We use your date of birth solely to determine the day; it is not transmitted to Resend or to any third party. You can object to these greetings at any time – via the unsubscribe link in each of these emails or informally at info@biohotel.at; the objection then applies to all marketing emails of both hotels.

Newsletter: delivery and performance measurement

We send our newsletter via the delivery provider Resend (see above) from the sender domain news.biohotel.at. To learn whether our newsletters arrive and which content interests you, we record per recipient whether a message was delivered, whether it was opened (via a so-called tracking pixel, a small image loaded from the server when the message is opened) and which links in the message were clicked. For this purpose, the links in our newsletters lead via the subdomain links.news.biohotel.at, which registers the click and immediately forwards you to the target page. Only the time, the type of event and, in the case of a click, the target address of the link are stored; your IP address and details of your email client are not stored. No cookies are set for this purpose.

To evaluate the impact of our newsletters, we also check whether an enquiry or booking under the same email address was received by us within 30 days of a click on a link in the newsletter. The legal basis for this measurement is your consent to receive the newsletter (Art. 6 (1) (a) GDPR) or, for existing guests who receive the newsletter on the basis of § 174 (4) TKG 2021, our legitimate interest in evaluating our newsletters (Art. 6 (1) (f) GDPR). You can object to the measurement at any time by unsubscribing via the link at the end of every newsletter; the measurement ends with your unsubscription. The measurement data is retained for the evaluation of our newsletters and is not passed on to third parties.

Guest chat and personal chat page

For personal correspondence around your stay we keep a guest chat: an ongoing message history between you and our hotel. For this purpose we store the time, the direction (from us to you or from you to us), the subject and the text of each message, as well as – as a note on its origin – the booking or inquiry the message arose from. What reaches us by telephone or in person may be recorded there in substance and is marked as added by us. The history is kept under your email address.

Our messages reach you by email. That email contains a personal link to your chat page, where you can read the previous history and reply directly. You need neither a user account nor a password for this: the link contains a cryptographically secured access key that is valid for 14 days. After that the page no longer shows any content; there you can have a new link sent to the same email address with a single click, or call us. Please treat the link like a password and do not pass it on – whoever holds it can see your history.

Shared email address: the history is tied to the email address, not to an individual person. If two people – a couple, for instance – use the same address, both see the same history, and a deletion on request covers the messages of both. If you would rather avoid this, please give us separate email addresses.

We use Resend as a processor for sending the corresponding notification emails (see above). Please note: if we delete your message history on our side, emails that have already been sent are unaffected – both in your own mailbox and in Resend’s delivery records, which are subject to Resend’s own retention there.

The legal basis for the processing is Art. 6 (1) (b) GDPR insofar as the exchange relates to your booking or booking inquiry, and otherwise our legitimate interest in traceable guest correspondence (Art. 6 (1) (f) GDPR). We retain the message history for the duration of the business relationship; it is not deleted automatically after a fixed period, because it is part of our ongoing correspondence with you. We will delete it in full at your request. Mandatory statutory provisions – in particular statutory retention periods – remain unaffected.

AI chat “Questions & advice”

On our website you can write to an AI assistant. It answers questions about our hotel, the surrounding area and the businesses of the Schwarz Company, checks prices and availability in our booking system on request, and prepares a booking, an offer by email, an inquiry to our reservations team or the forwarding of a question to our team for you. The assistant does not book or send anything itself: a booking only exists once you complete the online booking, and an offer, inquiry or question is only sent once you submit the respective form. In the chat window the assistant is labelled as AI. Its answers are generated automatically and may contain errors; prices and conditions are only binding in your booking or in our offer.

What data we process: We store your messages, the assistant’s answers, the conversation language, the travel details it takes from them (arrival and departure, number of guests, children’s ages, room and board preferences) and the results of its checks (rooms, prices, availability). For each answer we also record the response time and the costs incurred. For the conversation we create a random identifier that your browser stores only for the open tab (sessionStorage); there is no user account. The assistant does not ask for your name, address or telephone number: you enter these yourself in the forms, and they are not transmitted to the AI service. If you switch from the chat to the online booking, we transfer your selection and, if you wrote it in the chat, your email address to the booking page; for this the email address is kept only briefly in your browser’s sessionStorage and is deleted there when the booking page opens. Please do not write any information about your health or other particularly sensitive data in the chat. For such questions, please use the forwarding to our team or call us.

AI service OpenAI: The answers are generated by a language model of OpenAI Ireland Limited, 1st Floor, The Liffey Trust Centre, 117-126 Sheriff Street Upper, Dublin 1, D01 YC43, Ireland (“OpenAI”), which acts as our processor. For this our server transmits the conversation (your messages, the previous answers and the results of the checks) together with our instructions to OpenAI. We do not transmit your IP address or the details from the forms. OpenAI also processes the data in the USA; we base this transfer on the standard contractual clauses of the EU Commission pursuant to Art. 46 GDPR, which are part of our data processing agreement with OpenAI. OpenAI does not use the data to train its models. We have switched off the storage of requests at OpenAI; however, OpenAI may retain them for up to 30 days to detect abuse.

Content and pages of our guest app: For questions about your stay, the assistant also uses the guest directory and the programme of our guest app. Our server retrieves this content from Hotel MSSNGR GmbH, Tölzer Straße 17, 83677 Reichersbeuern, Germany; we do not transmit any data about you in the process. Below an answer there may be a button to the matching page of the app. Only when you click it does your browser load this page directly from Hotel MSSNGR GmbH and show it next to the chat. Hotel MSSNGR GmbH then receives your IP address, technical details of your browser and the address of our website (without the page you are on). The app page loads its own programs, including error monitoring (Sentry) and a tool for improving usability (Maze), and stores a random identifier in your browser’s storage that is not linked to your person; it does not set cookies. The legal basis is our legitimate interest in showing you the content of our guest app directly in the chat at your request (Art. 6 (1) (f) GDPR). If you do not click the button, none of this is loaded.

Storage period: We store the chat history in our database (provider: Supabase, server location within the European Union) and delete it automatically 30 days after the last message. Only anonymous daily figures without identifier or content remain, such as the number of conversations, response times and costs. If you submit an inquiry, a question to our team or an offer request from the chat, or book after the chat, we store an excerpt of the last six chat messages of at most 400 characters each with it, so that our team understands your request. This excerpt is kept as long as the inquiry, the offer or the booking itself (see above). On a booking from the chat we also note an identifier that it came from the chat, in order to measure the benefit of the chat. Within our company, the complete conversations are seen only by a narrowly limited group of people responsible for the chat, for quality assurance. We do not pass the conversation identifier on to analytics services.

Protection against abuse: So that automated requests neither block the chat nor cause costs, we limit messages and new conversations per conversation and per internet connection (see “Protection against overload (Upstash)”). If a conversation stands out due to abuse, we may block it. In case of unusual usage, a confirmation that a person is writing may additionally appear (see “Cloudflare Turnstile”).

Legal basis: Insofar as the chat prepares your booking, an offer or an inquiry, the legal basis is Art. 6(1)(b) GDPR (steps prior to entering into a contract at your request). Otherwise we process the data on the basis of our legitimate interest in answering your questions quickly, ensuring the quality of the chat and protecting it against abuse (Art. 6(1)(f) GDPR); you may object to this processing under Art. 21 GDPR. Using the chat is voluntary: booking, inquiries and contact are also open to you without it, via the online booking, the inquiry form, by email or by telephone. The chat does not make any decision based solely on automated processing within the meaning of Art. 22 GDPR: prices and availability come from our booking system under the same rules as the online booking, whether you book is your own decision, and our team decides on an inquiry. Further information on data processing by OpenAI can be found at https://openai.com/policies/eu-privacy-policy/.

Cloudflare Turnstile (protection of the AI chat and the inquiry form)

We protect our AI chat “Questions & advice” against automated abuse. If usage looks unusual, for example because a great many messages or new conversations come from one connection within a short time, we ask you in the chat window to briefly confirm that a person is writing. For this we use the Turnstile service of Cloudflare, Inc., 101 Townsend St., San Francisco, CA 94107, USA.

We protect our inquiry form in the same way, because every inquiry triggers emails to us and to the address provided. If several inquiries come from one connection within a short time, or unusually many overall, we ask you for the same confirmation before sending.

Turnstile only appears in case of unusual usage. Only then does your browser load Cloudflare’s verification program; it is not loaded when you visit our website, during an ordinary chat or when you send an inquiry in the ordinary way. Instead of confirming, you can always wait for the displayed waiting time and then continue writing or send your inquiry without confirmation.

According to Cloudflare, the check processes your IP address, a technical fingerprint of the encrypted connection (TLS), your browser identifier (user agent) as well as the identifier of our widget and the address of our website, in order to distinguish people from automated programs. Cloudflare acts as our processor in doing so; to the extent that Cloudflare uses these signals to improve its bot detection, Cloudflare is itself the controller. Cloudflare only tells us whether the check was passed. To verify this result, our server transmits the check result from your browser and your IP address to Cloudflare. We count how often a conversation has already been confirmed under the conversation’s random identifier; the counter expires by itself after 24 hours. We count how many inquiries come from one connection under a hash value of your IP address; this counter expires by itself two hours after the last inquiry. We count how often a connection has already confirmed under the same hash value; this counter expires after 24 hours.

The legal basis is our legitimate interest in protecting our chat against abuse and against the costs of automated requests, and our inquiry form against being misused to send unwanted emails (Art. 6 (1) (f) GDPR). We do not ask for consent for this, because the check only appears in case of unusual usage and waiting always remains possible. The transfer to the USA is based on Cloudflare’s certification under the EU-US Data Privacy Framework. You can find further information at https://www.cloudflare.com/turnstile-privacy-policy/ and in Cloudflare’s privacy policy at https://www.cloudflare.com/privacypolicy/.

Payment processing via payment service provider (hobex)

For the online payment of your booking, we use the payment service provider hobex AG, Josef-Brandstätter-Straße 2b, 5020 Salzburg, Austria. Payment is made via an encrypted payment field embedded directly in our booking process; to confirm the payment (e.g. 3-D Secure), you may be briefly redirected to your bank or card provider.

The data required for the payment (e.g. name, payment or credit card data, invoice amount) is processed by hobex within its own area of responsibility in accordance with hobex’s data protection provisions, which you can view at hobex.at/datenschutz. At the same time, hobex processes this data to fulfil its own legal and regulatory obligations as well as for fraud prevention.

The legal basis for the data processing is Art. 6 (1) (b) GDPR (performance of a contract). Payment transactions are carried out exclusively via an encrypted SSL or TLS connection. Your data is only passed on to hobex insofar as this is necessary for the payment processing.

Online tip (“A thank-you for the team”)

On the page “A thank-you for the team” (biohotel.at/en/thank-you, also reachable via the QR codes in the hotel) you can give a tip to our whole team. For this we process your first and last name, your email address, the amount and, if you write one, your message to the team. Payment is made via hobex (see above). We send you the confirmation by email via Resend. Your details are stored in our own booking backend (Supabase, servers in the European Union).

We then match the tip to your guest profile with us using your email address. If you gave it during your stay or up to 14 days after departure, we also match it to that stay. This way we know which stay your thank-you belongs to and can handle questions and refunds correctly. We do not pass anything on to our hotel management system in the process.

The legal basis for the payment and the confirmation is Art. 6(1)(b) GDPR. For matching the tip to your guest profile and stay, it is our legitimate interest in maintaining our relationship with our guests and in accounting for tips transparently (Art. 6(1)(f) GDPR). You can object to this matching at any time, informally, at info@biohotel.at. We keep the data for as long as it is needed for these purposes. Statutory retention periods remain unaffected.

Local fonts

For the uniform display of fonts, this website uses exclusively font files (web fonts) stored locally on our server. When a page is called up, these fonts are loaded from our own server. No connection to third-party servers (such as Google Fonts) takes place in the process; no personal data is transmitted to third parties.

Analysis Tools and Advertising

We use the analysis, reach measurement and marketing services described below exclusively on the basis of your consent pursuant to Art. 6 (1) (a) GDPR. Before you give your consent in the cookie dialog, these services are neither loaded nor executed. Your consent can be revoked at any time with effect for the future (see “Consent with our cookie tool”). The integration is technically carried out via Google Consent Mode v2. Insofar as personal data is transferred to the USA, we point out the respective transfer basis stated in each case.

Google Analytics 4

This website uses – after your consent to the category “Statistics & Analysis” – functions of the web analytics service Google Analytics 4. The provider is Google Ireland Limited (“Google”), Gordon House, Barrow Street, Dublin 4, Ireland.

Google Analytics enables us to analyse the behaviour of website visitors. In doing so, we receive various usage data, such as page views, dwell time, operating systems used and the origin of the user. Google Analytics uses technologies that enable the recognition of the user for the purpose of analysing user behaviour (e.g. cookies or device fingerprinting). The information collected by Google about the use of this website is generally transmitted to a Google server in the USA and stored there.

The use is based on your consent pursuant to Art. 6 (1) (a) GDPR and Section 165 (3) TKG 2021. The consent can be revoked at any time. We have concluded a data processing agreement with Google. The data transfer to the USA is based on the EU-US Data Privacy Framework; the parent company Google LLC is certified thereunder (adequacy decision of the EU Commission pursuant to Art. 45 GDPR).

Google Signals

If you have additionally consented to the category “Marketing”, we use Google Signals. This allows Google Analytics to collect, among other things, location, search history and YouTube history as well as demographic data (visitor data). If you have a Google account and have consented there to personalised advertising, this visitor data can be linked to your Google account across devices and sessions and used for personalised advertising. The legal basis is your consent pursuant to Art. 6 (1) (a) GDPR.

You can find more information on the handling of user data at Google Analytics in Google’s privacy policy: https://support.google.com/analytics/answer/6004245?hl=de.

Google Ads with conversion tracking

After your consent to the category “Marketing”, we use Google Ads. The provider is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. Google Ads enables us to display advertisements in the Google search engine or on third-party websites and, by means of conversion tracking, to measure whether users who reached our website via a Google ad have carried out a certain action (e.g. a booking).

If you reach our website via a Google ad, a conversion cookie is set, which loses its validity after a certain time and does not serve to personally identify you. Neither we nor other Google advertising customers receive information by means of which you could be identified. In the process, personal data, including your IP address, may be transferred to Google in the USA.

The legal basis is your consent pursuant to Art. 6 (1) (a) GDPR and Section 165 (3) TKG 2021; the consent can be revoked at any time. The data transfer to the USA is based on the EU-US Data Privacy Framework (Google LLC is certified thereunder). You can find more information at https://business.safety.google/privacy/.

Microsoft Clarity

After your consent to the category “Statistics & Analysis”, we use Microsoft Clarity, an analysis and session recording service. The provider for users in the European Economic Area is Microsoft Ireland Operations Limited, One Microsoft Place, South County Business Park, Leopardstown, Dublin 18, Ireland.

With Microsoft Clarity, we can better understand the use of our website by evaluating interactions such as mouse and scroll movements, clicks as well as page views in the form of aggregated statistics and pseudonymised session replays. Entries in form fields are masked by default in the process. Data processing may also take place on servers in the USA.

The legal basis is your consent pursuant to Art. 6 (1) (a) GDPR and Section 165 (3) TKG 2021; the consent can be revoked at any time. Any data transfer to the USA is safeguarded by Microsoft’s certification under the EU-US Data Privacy Framework. You can find more information in Microsoft’s privacy policy: https://privacy.microsoft.com/de-de/privacystatement.

PostHog

After your consent to the category “Statistics & Analysis”, we use the product analytics service PostHog. The provider is PostHog, Inc., 2261 Market Street #4008, San Francisco, CA 94114, USA. We operate PostHog via the provider’s US cloud infrastructure; the processing takes place on servers in the USA.

With PostHog, we evaluate the use of our website in pseudonymised form (e.g. pages viewed, buttons clicked and the usage history within the booking flow) in order to improve our offering. Entries in form fields are not captured in the process. The legal basis is your consent pursuant to Art. 6 (1) (a) GDPR and Section 165 (3) TKG 2021; the consent can be revoked at any time. The transfer of personal data to the USA associated with this use is based on the standard contractual clauses of the EU Commission pursuant to Art. 46 GDPR. You can find more information at https://posthog.com/privacy.

Your Rights

Information, deletion and correction

Within the framework of the applicable statutory provisions, you have the right at any time to free information about your stored personal data, its origin and recipients and the purpose of the data processing and, if applicable, a right to correction or deletion of this data. For this and for further questions on the subject of personal data, you can contact us at any time at the address given in the imprint.

Right to restriction of processing

You have the right to request the restriction of the processing of your personal data. To do so, you can contact us at any time at the address given in the imprint. The right to restriction of processing exists in the following cases:

If you dispute the accuracy of the personal data stored by us, we generally need time to check this. For the duration of the check, you have the right to request the restriction of the processing of your personal data. If the processing of your personal data took/takes place unlawfully, you can request the restriction of the data processing instead of deletion.

If we no longer need your personal data but you need it to exercise, defend or assert legal claims, you have the right to request the restriction of the processing of your personal data instead of deletion. If you have lodged an objection pursuant to Art. 21 (1) GDPR, a balancing of your and our interests must be carried out. As long as it has not yet been determined whose interests prevail, you have the right to request the restriction of the processing of your personal data.

If you have restricted the processing of your personal data, this data – apart from its storage – may only be processed with your consent or for the assertion, exercise or defence of legal claims or for the protection of the rights of another natural or legal person or for reasons of an important public interest of the European Union or a Member State.

Revocation of your consent to data processing

Many data processing operations are only possible with your express consent. You can revoke consent you have already given at any time. The lawfulness of the data processing carried out up to the revocation remains unaffected by the revocation.

Right to object to data collection in special cases and to direct advertising (Art. 21 GDPR)

If the data processing is based on Art. 6 (1) (e) or (f) GDPR, you have the right at any time, for reasons arising from your particular situation, to object to the processing of your personal data; this also applies to profiling based on these provisions. You can find the respective legal basis on which processing is based in this privacy policy. If you object, we will no longer process your affected personal data unless we can demonstrate compelling legitimate grounds for the processing which override your interests, rights and freedoms, or the processing serves the assertion, exercise or defence of legal claims (objection pursuant to Art. 21 (1) GDPR).

If your personal data is processed for the purpose of direct advertising, you have the right to object at any time to the processing of personal data concerning you for the purpose of such advertising; this also applies to profiling insofar as it is connected with such direct advertising. If you object, your personal data will subsequently no longer be used for the purpose of direct advertising (objection pursuant to Art. 21 (2) GDPR).

Right to lodge a complaint with the competent supervisory authority

In the event of violations of the GDPR, data subjects have the right to lodge a complaint with a supervisory authority, in particular in the Member State of their habitual residence, their place of work or the place of the alleged violation. The right to lodge a complaint exists without prejudice to other administrative or judicial remedies. The competent supervisory authority in Austria is:

Österreichische Datenschutzbehörde (Austrian Data Protection Authority)
Barichgasse 40–42
1030 Wien
E-mail: dsb@dsb.gv.at
Website: www.dsb.gv.at

Right to data portability

You have the right to have data that we process automatically on the basis of your consent or in performance of a contract handed over to you or to a third party in a common, machine-readable format. If you request the direct transfer of the data to another controller, this will only take place insofar as it is technically feasible.