1.1 We are pleased that you are visiting our website and thank you for your interest. In the following, we inform you about the handling of your personal data when using our website. Personal data refers to all data with which you can be personally identified.
1.2 The controller responsible for data processing on this website within the meaning of the General Data Protection Regulation (GDPR) is:
Hotel Tannenberg e.U.
Owner: Adelheid Wenger
Haidweg 278,
5754 Saalbach-Hinterglemm,
Austria
Phone: +43 (0) 6541 6657
E-Mail: hotel@tannenberg.at
The controller is the natural or legal person who alone or jointly with others determines the purposes and means of the processing of personal data.
2.1 When you use our website for informational purposes only, i.e., if you do not register or otherwise provide us with information, we only collect data that your browser transmits to our server (so-called “server log files”). When you access our website, we collect the following data, which is technically necessary for us to display the website to you:
Our visited website
Date and time at the time of access
Amount of data sent in bytes
Source/reference from which you came to the page
Browser used
Operating system used
IP address used (if applicable: in anonymized form)
The processing is carried out in accordance with Art. 6 (1) lit. f GDPR based on our legitimate interest in improving the stability and functionality of our website. The data is not passed on or used otherwise. However, we reserve the right to check the server log files subsequently if there are specific indications of unlawful use.
2.2 For security reasons and to protect the transmission of personal data and other confidential content (such as orders or inquiries), this website uses SSL or TLS encryption. You can recognize an encrypted connection by the string “https://” and the lock symbol in your browser address line.
We use a service provider for hosting and displaying the website content who processes data on our behalf exclusively on servers within the European Union.
All data collected on our website is processed on these servers.
We have concluded a data processing agreement (DPA) with the provider, which ensures the protection of our visitors’ data and prohibits unauthorized disclosure to third parties.
To make visiting our website attractive and to enable the use of certain functions, we use cookies – small text files that are stored on your device. Some cookies are deleted after you close your browser (so-called “session cookies”), while others remain on your device to enable the storage of site settings (so-called “persistent cookies”). You can find out how long cookies are stored in your browser’s cookie settings.
If personal data is also processed by individual cookies implemented by us, the processing is carried out in accordance with Art. 6 (1) lit. b GDPR either for the execution of the contract, in accordance with Art. 6 (1) lit. a GDPR if consent has been given, or in accordance with Art. 6 (1) lit. f GDPR to safeguard our legitimate interests in the best possible functionality of the website and a customer-friendly and effective design of the site visit.
You can configure your browser to inform you about the setting of cookies and individually decide whether to accept them or to exclude the acceptance of cookies for specific cases or in general.
Please note that if cookies are not accepted, the functionality of our website may be restricted.
You have the option to contact us via the WhatsApp messaging service, operated by WhatsApp Ireland Limited, 4 Grand Canal Square, Grand Canal Harbour, Dublin 2, Ireland. We use the so-called “Business Version” of WhatsApp.
If you contact us via WhatsApp regarding a specific transaction (e.g., a booking), we will store and use your mobile phone number used on WhatsApp and – if provided – your first and last name, based on Art. 6 (1) lit. b GDPR to process and respond to your inquiry. On the same legal basis, we may ask you via WhatsApp for additional data (e.g., booking number, customer number, address, or e-mail address) to assign your request to a specific transaction.
If you use our WhatsApp contact for general inquiries (e.g., about our services, availability, or website), we store and use your mobile number and – if provided – your first and last name based on Art. 6 (1) lit. f GDPR, based on our legitimate interest in the effective and prompt provision of requested information.
Your data will only be used to respond to your inquiry via WhatsApp. Data will not be disclosed to third parties.
Please note that WhatsApp Business gains access to the address book of the mobile device used by us for WhatsApp communication and automatically transmits phone numbers stored in the address book to servers operated by its parent company Meta Platforms Inc. in the USA. For the operation of our WhatsApp Business account, we use a mobile device whose address book only contains the WhatsApp contact details of users who have contacted us via WhatsApp.
This ensures that all users whose WhatsApp contact details are stored in our address book have already consented to the transmission of their WhatsApp phone number from the address books of their chat contacts pursuant to Art. 6 (1) lit. a GDPR by accepting WhatsApp’s terms of use when first using the app on their device. Data transmission for users who do not use WhatsApp and/or have not contacted us via WhatsApp is excluded.
For details on the purpose and scope of data collection, further processing, and use by WhatsApp, and your rights and privacy protection settings, please refer to WhatsApp’s privacy policy:
https://www.whatsapp.com/legal/?eea=1#privacy-policy
We have concluded a data processing agreement (DPA) with WhatsApp ensuring the protection of our visitors’ data and prohibiting unauthorized disclosure.
In the course of the above-mentioned processing, data may be transmitted to servers of Meta Platforms Inc. in the USA.
The provider is certified under the EU-US Data Privacy Framework, which ensures compliance with European data protection levels based on an adequacy decision by the European Commission.
When you contact us (e.g., via contact form or e-mail), personal data is collected. Which data is collected via a contact form is shown in the respective form. These data are stored and used exclusively for the purpose of responding to your request or for contacting you and the associated technical administration.
The legal basis for processing the data is our legitimate interest in responding to your request in accordance with Art. 6 (1) lit. f GDPR. If your contact aims at concluding a contract, an additional legal basis for processing is Art. 6 (1) lit. b GDPR.
Your data will be deleted once your inquiry has been conclusively answered, provided that there are no statutory retention obligations.
When you sign up for our email newsletter, we will regularly send you information about our offers. The only mandatory information required for sending the newsletter is your email address. Providing additional data is voluntary and is used to address you personally. We use the so-called double opt-in procedure for sending newsletters. This means we will only send you an email newsletter once you have explicitly confirmed that you consent to receiving the newsletter. We will then send you a confirmation email asking you to confirm, by clicking a corresponding link, that you wish to receive the newsletter in the future.
By activating the confirmation link, you give us your consent to use your personal data in accordance with Art. 6(1)(a) GDPR. When registering for the newsletter, we store your IP address as entered by your Internet Service Provider (ISP) as well as the date and time of registration in order to trace any potential misuse of your email address at a later point. The data collected during the newsletter registration is used exclusively for promotional communication via the newsletter. You can unsubscribe from the newsletter at any time via the link provided in the newsletter or by sending a corresponding message to the controller mentioned at the beginning. After you unsubscribe, your email address will immediately be removed from our newsletter distribution list, unless you have expressly consented to further use of your data or we reserve the right to use your data in a manner permitted by law and of which we inform you in this statement.
If you have provided us with your email address when purchasing goods or services, we reserve the right to regularly send you offers for similar goods or services from our range by email. In accordance with § 7(3) UWG, we do not need to obtain separate consent for this. The data processing is based solely on our legitimate interest in personalized direct advertising according to Art. 6(1)(f) GDPR. If you initially objected to the use of your email address for this purpose, no mailings will be made.
You have the right to object to the use of your email address for advertising purposes at any time with future effect by notifying the controller mentioned at the beginning. For this, you will only incur transmission costs according to the basic rates. After receiving your objection, the use of your email address for advertising purposes will be immediately stopped.
Google Analytics 4
This website uses Google Analytics 4, a web analytics service provided by Google Ireland Limited, Gordon House, 4 Barrow St, Dublin, D04 E5W5, Ireland (“Google”), which enables an analysis of your use of our website.
By default, cookies are set by Google Analytics 4 when you visit the website, which are small text fragments stored on your device that collect certain information. This includes your IP address, which, however, is truncated by Google to exclude a direct personal reference.
The information is transmitted to Google servers and further processed there. Transfers to Google LLC in the USA may also occur.
Google uses the information on our behalf to evaluate your use of the website, to compile reports on website activity, and to provide other services related to website and internet usage. The IP address transmitted by your browser in the context of Google Analytics 4 is not merged with other Google data. The data collected via Google Analytics 4 is stored for two months and then deleted.
All processing activities described above, particularly the setting of cookies, are carried out only if you have given your express consent under Art. 6(1)(a) GDPR. Without your consent, Google Analytics 4 will not be used during your visit. You can revoke your consent at any time with future effect by disabling this service via the “cookie consent tool” provided on the website.
We have entered into a data processing agreement with Google to ensure the protection of our website visitors’ data and prevent unauthorized disclosure to third parties.
Further legal information on Google Analytics 4 can be found at:
8.1 Facebook Plugins
Plugins from the social network Facebook are used on our website (Facebook Ireland Ltd., 4 Grand Canal Square, Grand Canal Harbour, Dublin 2, Ireland (“Facebook”)).
You can recognize the Facebook plugins by the Facebook logo or the “Like” button on our page. An overview of Facebook plugins can be found here: https://developers.facebook.com/docs/plugins/
When you visit our pages, a direct connection between your browser and the Facebook server is established via the plugin. Facebook thereby receives the information that you have visited our site with your IP address. If you click the Facebook “Like” button while you are logged into your Facebook account, you can link the content of our pages to your Facebook profile. This allows Facebook to associate the visit to our pages with your user account. We would like to point out that, as the provider of the pages, we do not receive knowledge of the content of the transmitted data or their use by Facebook.
The use of Facebook plugins is based on your consent according to Art. 6(1)(a) GDPR. You can revoke your consent at any time with effect for the future.
If you do not want Facebook to assign the visit to our pages to your Facebook user account, please log out of your Facebook user account before visiting our website.
8.2 YouTube
This website integrates videos from the YouTube site operated by Google. The operator of the pages is Google Ireland Limited, Gordon House, 4 Barrow Street, Dublin 4, Ireland (“YouTube”).
When you visit one of our websites with a YouTube plugin, a connection to the YouTube servers is established. In the process, the YouTube server is informed about which of our pages you visited.
If you are logged into your YouTube account, YouTube can directly associate your browsing behavior with your personal profile. You can prevent this by logging out of your YouTube account.
YouTube is used in the interest of an appealing presentation of our online offerings. This constitutes a legitimate interest within the meaning of Art. 6(1)(f) GDPR.
Further information on the handling of user data can be found in YouTube’s privacy policy at: https://policies.google.com/privacy?hl=en
8.3 Google reCAPTCHA
On this website, we also use the reCAPTCHA function of Google Ireland Limited, Gordon House, 4 Barrow Street, Dublin 4, Ireland (“Google”). This function is primarily used to distinguish whether an input is made by a natural person or abusively by automated processing (e.g., by bots).
The service includes sending the IP address and any other data required by Google for the reCAPTCHA service to Google and is carried out according to Art. 6(1)(f) GDPR based on our legitimate interest in determining individual responsibility on the internet and preventing abuse and spam.
Further information about Google reCAPTCHA and Google’s privacy policy can be found at:
https://policies.google.com/privacy?hl=en
8.4 Cookie Consent Tool
This website uses a so-called “cookie consent tool” to obtain effective user consent for cookies requiring consent and cookie-based applications.
When you access the site, a cookie is stored in your browser that contains the consent you gave or the revocation of that consent. This data is not passed on to the provider of the cookie consent tool.
The collected data is stored until you request its deletion, delete the consent cookie yourself, or the purpose for data storage no longer applies. Mandatory statutory retention periods remain unaffected.
The applicable data protection law grants you comprehensive data subject rights (rights of access and intervention) vis-à-vis the controller with regard to the processing of your personal data, which we inform you about below:
Right of access according to Art. 15 GDPR
Right to rectification according to Art. 16 GDPR
Right to erasure according to Art. 17 GDPR
Right to restriction of processing according to Art. 18 GDPR
Right to notification according to Art. 19 GDPR
Right to data portability according to Art. 20 GDPR
Right to withdraw consent according to Art. 7(3) GDPR
Right to lodge a complaint according to Art. 77 GDPR
The duration of storage of personal data is based on the respective legal retention period (e.g., commercial and tax retention periods). After the expiration of the period, the respective data is routinely deleted, provided it is no longer necessary for contract fulfillment or contract initiation and/or there is no longer a legitimate interest in further storage on our part.
