Privacy Policy

Privacy settings

We use cookies on our website. Some of them are essential, while others help us to improve this website and your experience.

You can change your settings at any time by reopening the consent dialogue.

Data protection at a glance

General information

The following notice gives a simple overview of what happens to your personal data when you visit our website. Personal data is any data that could be used to personally identify you. Detailed information on the subject of data protection can be found in our privacy policy set out below this text.

Data collection on our website

Who is responsible for data collection on this website?

Data processing on this website is carried out by the website operator:

Alpenresort Schwarz
Pirktl Holiday GmbH & Co KG
Obermieming 141
6414 Mieming
Phone: +43 5264 5212-0
Fax:
Email: hotel@schwarz.at
Internet: www.schwarz.at

How do we collect your data?

Your data is collected in part by you telling us. This may, for example, be data you enter into a contact form.

Other data is collected automatically by our IT systems when you visit the website. This is primarily technical data (e.g. internet browser, operating system, or the time the page was accessed). This data is collected automatically as soon as you enter our website.

What do we use your data for?

Some of the data is collected to ensure the website is provided free of errors. Other data may be used to analyse your user behaviour.

Analytics tools and third-party tools

When you visit our website, your browsing behaviour may be statistically evaluated. This is done primarily using cookies and so-called analytics programs. The analysis of your browsing behaviour is generally anonymous; your browsing behaviour cannot be traced back to you. You can object to this analysis or prevent it by not using certain tools. Detailed information can be found in the privacy policy below.

You can object to this analysis. We will inform you about your options to object in this privacy policy.

SSL/TLS encryption

For security reasons, and to protect the transmission of confidential content — such as orders or enquiries you send to us as the site operator — this site uses SSL or TLS encryption. You can recognise an encrypted connection by the fact that the address line of your browser changes from “http://” to “https://” and by the lock icon in your browser bar.

If SSL or TLS encryption is enabled, the data you transmit to us cannot be read by third parties.

Encrypted payment transactions on this website

If, after concluding a contract subject to a fee, you are obliged to transmit your payment details to us (e.g. your account number for a direct debit authorisation), this data is required to process the payment.

Payment transactions using common means of payment (Visa/Mastercard, direct debit) are processed exclusively via an encrypted SSL or TLS connection. You can recognise an encrypted connection by the fact that the address line of your browser changes from "http://" to "https://" and by the lock icon in your browser bar.

With encrypted communication, the payment details you transmit to us cannot be read by third parties.

Data collection on our website

Cookies

Some of our web pages use what are known as cookies. Cookies do not cause any damage to your computer and do not contain viruses. Cookies help make our website more user-friendly, effective and secure. Cookies are small text files that are stored on your computer and saved by your browser.

Most of the cookies we use are so-called “session cookies”. They are automatically deleted once your visit ends. Other cookies remain stored on your device until you delete them. These cookies enable us to recognise your browser on your next visit.

You can set your browser so that you are informed about the setting of cookies and allow cookies only in individual cases, exclude the acceptance of cookies for certain cases or in general, and activate the automatic deletion of cookies when you close your browser. If cookies are deactivated, the functionality of this website may be limited.

Necessary data storage includes cookies that are strictly required for the functions of a website. This includes, for example, storing log-in data, the shopping cart, or the language selection through so-called session cookies (which are deleted when the browser is closed).

Non-necessary cookies, on the other hand, are text files that do not solely serve the functionality of the website but also collect other data. These include the following cookies:

• Tracking cookies
• Targeting cookies
• Analytics cookies
• Cookies from social media websites

Necessary cookies may be set from the outset, i.e. even without the user's prior consent. Non-necessary cookies, on the other hand, require the website visitor's consent before they may store data.

External hosting (Netlify)

This website is hosted by an external service provider. The provider is Netlify, Inc., 512 2nd Street, Suite 200, San Francisco, CA 94107, USA (“Netlify”). The personal data collected when you visit this website is processed on Netlify’s servers or its content delivery network. This may primarily concern IP addresses, contact requests, meta and communication data, access data and other data generated via a website.

Netlify is used in the interest of a secure, fast and reliable provision of our online offering by a professional provider (Art. 6 (1) (f) GDPR). We have concluded a data processing agreement (DPA) with Netlify that ensures the protection of your data. Insofar as personal data is transferred to the USA in this context, this transfer is based on the standard contractual clauses of the EU Commission pursuant to Art. 46 GDPR.

Server log files

We automatically collect and store information in so-called server log files, which your browser automatically transmits to us. This information is:

• Browser type and browser version
• Operating system used
• Referrer URL
• Host name of the accessing computer
• Time of the server request
• IP address

This data is not merged with other data sources.

This data is collected on the basis of Art. 6(1)(b) and (f) GDPR. We have a legitimate interest in the technically error-free presentation and optimisation of our website — for this, the server log files must be collected. The processing also serves the performance of a contract or the implementation of pre-contractual measures.

Anonymous counting of search terms

If you enter a term in the search on our “SPA Treatments” page, we count this term as a plain total. This shows us what guests are looking for and cannot find with us. For each day, each language version and each search term we increase a counter by one and note how many treatments the search found.

We only count what looks like a search term: at most three words made of letters. Terms containing digits or an @, such as telephone numbers or email addresses, are not counted. No record relating to you personally is created in the process: no IP address, no identifier, no session, no point in time more precise than the calendar day. This constitutes anonymous statistics within the meaning of Recital 26 GDPR. The counting takes place on our own servers, without any analytics service, and nothing is stored on or read from your device. Please do not enter names or other personal details in the search.

Enquiries by email, contact form, telephone or fax

If you contact us by email, contact form, telephone or fax, we will store and process your enquiry, including all personal data arising from it (name, email address, enquiry), for the purpose of handling your request. We do not pass this data on without your consent.

This data is processed on the basis of Art. 6(1)(b) GDPR, provided your enquiry relates to the performance of a contract or is necessary for the implementation of pre-contractual measures, or on the basis of our legitimate interest (Art. 6(1)(f) GDPR), as we have a legitimate interest in the effective handling of enquiries addressed to us.

The data you send us via contact enquiries remains with us until the purpose for storing it no longer applies (e.g. once your request has been fully processed) or you ask us to delete it. Mandatory statutory provisions — in particular statutory retention periods — remain unaffected.

Email delivery (Resend)

To send transactional emails — in particular confirmations of receipt and appointment confirmations for enquiries you submit via forms on our website — we use the email delivery provider Resend. The provider is Plus Five Five, Inc., 2261 Market Street #5039, San Francisco, CA 94114, USA ("Resend"). This involves processing the data required for delivery, in particular your name, your email address and the content of the respective message (e.g. your enquiry details).

Resend processes and stores this data on our behalf on servers in the USA. We have concluded a data processing agreement (DPA) with Resend; the transfer to the USA is based on the European Commission's Standard Contractual Clauses pursuant to Art. 46 GDPR. The legal basis for the processing is Art. 6(1)(b) GDPR (performance of a contract or implementation of pre-contractual measures) as well as our legitimate interest in reliable and secure email delivery (Art. 6(1)(f) GDPR).

Birthday greetings

If you have stayed with us or at the Biohotel Schweitzer within the last three years and provided your date of birth with your reservation, we send you a greeting by email on your birthday – from the hotel you have visited most often. The legal basis is our legitimate interest in maintaining our relationship with our guests (Art. 6 (1) (f) GDPR) and, for existing guests, Section 174 (4) of the Austrian Telecommunications Act (TKG 2021). We use your date of birth solely to determine the day; it is not transmitted to Resend or to any third party. You can object to these greetings at any time – via the unsubscribe link in each of these emails or informally at hotel@schwarz.at; the objection then applies to all marketing emails of both hotels.

Newsletter: delivery and performance measurement

We send our newsletter via the delivery provider Resend (see above) from the sender domain news.schwarz.at. To learn whether our newsletters arrive and which content interests you, we record per recipient whether a message was delivered, whether it was opened (via a so-called tracking pixel, a small image loaded from the server when the message is opened) and which links in the message were clicked. For this purpose, the links in our newsletters lead via the subdomain links.news.schwarz.at, which registers the click and immediately forwards you to the target page. Only the time, the type of event and, in the case of a click, the target address of the link are stored; your IP address and details of your email client are not stored. No cookies are set for this purpose.

To evaluate the impact of our newsletters, we also check whether an enquiry or booking under the same email address was received by us within 14 days of a click on a link in the newsletter. The legal basis for this measurement is your consent to receive the newsletter (Art. 6 (1) (a) GDPR) or, for existing guests who receive the newsletter on the basis of § 174 (4) TKG 2021, our legitimate interest in evaluating our newsletters (Art. 6 (1) (f) GDPR). You can object to the measurement at any time by unsubscribing via the link at the end of every newsletter; the measurement ends with your unsubscription. The measurement data is retained for the evaluation of our newsletters and is not passed on to third parties.

Our messages to you: performance measurement

Via the delivery provider Resend (see above), we send you messages about your inquiry, your booking and your stay. These include the confirmation of your inquiry, booking or cancellation, up to three messages before your arrival (anticipation, arrival, Last Minute), personal messages from our team and the receipt for a refunded online tip. After your stay, we send our thanks with an invitation to our questionnaire, a reminder and, where applicable, our reply to your feedback.

To learn whether these messages arrive and which information is useful to you, we record per message whether it was delivered, whether it was opened (via a so-called tracking pixel, a small image loaded from our server when the message is opened) and which links in it were clicked. For this purpose, the links in the content of a message lead via our own address (updates.schwarz.at or www.schwarz.at), which registers the click and immediately forwards you to the target page. Links to our legal texts (legal notice, privacy policy, terms and conditions, terms of participation) and the other links in the footer, such as those to our social media channels, lead directly to their target; we do not record these clicks. On the browser version of the messages before your arrival, we also record the page view and the links clicked there. Every message also ends with a link that lets you unsubscribe from the messages before your arrival and after your stay; if you unsubscribe this way or by replying to a message, we note which message the request came from.

Only a number that allows the message to be assigned (such as your booking or inquiry number), the type of message, the time, the type of event and, in the case of a click, the target address and label of the link are stored; your IP address and details of your email client or browser are not stored. No cookies are set for this purpose. To evaluate the impact of our messages, we also check whether a booking under the same email address was received by us within 14 days of a click and confirmed by us. The legal basis is our legitimate interest in making our messages clear and helpful (Art. 6 (1) (f) GDPR). You can object to the measurement at any time with a short message to hotel@schwarz.at; you can also prevent the tracking pixel yourself by switching off the loading of external images in your email client. The measurement data is retained for the evaluation of our messages and is not passed on to third parties.

Online booking and booking inquiry

Via our website, you can check availability and make a booking or booking inquiry. To process this, we require your form of address, your first and last name, your e-mail address, your telephone number, your postal address, your travel dates (arrival and departure) as well as the chosen product/arrangement. We need your telephone number in order to be able to contact you quickly, in particular in the event of unforeseeable circumstances affecting your booking.

For the calculation of the applicable travel price, the details of the stay, the chosen product, the number of travelling persons as well as the information on whether they are adults or children (for children additionally the age) are required. Further information in the form is provided on a voluntary basis.

If you book for several people, you also provide the details of the other travellers when booking: their first and last names and, for adults, their e-mail address and telephone number, unless you use your own for everyone. We process this data on the same legal basis to prepare and carry out their stay and transmit it to our hotel management system for this purpose.

The booking is processed via our own booking backend; the database and server infrastructure used for this (provider: Supabase, server location within the European Union) processes your data as a processor on our behalf. In order to carry out your booking, we also transmit the necessary data to our hotel management system. With the service providers used, we have concluded data processing agreements where necessary.

The processing of your data for the booking or booking inquiry is carried out on the basis of Art. 6 (1) (b) GDPR and serves the performance of a contract or the implementation of pre-contractual measures. The transmitted data remains with us until the purpose for storing the data no longer applies. Mandatory statutory provisions, in particular statutory retention periods, remain unaffected.

AI chat of Alpenresort Schwarz

On our website you can write to an AI assistant. It answers questions about our hotel, the surrounding area and the businesses of the Schwarz Company, checks prices and availability in our booking system on request, and prepares an online booking, an inquiry to our reservations team or a question to our team for you. The assistant itself books and sends nothing: a booking only exists once you complete the online booking, and an inquiry or a question is only sent once you submit the respective form. The chat does not send offers. In the chat window the assistant is labelled as AI. Its answers are generated automatically and may contain errors; prices and conditions are only binding in your booking or in an offer from our reservations team.

What data we process: We store your messages, the assistant’s answers, the language of the conversation and the travel details it takes from them (arrival and departure, number of guests, children’s ages, room and board preference), as well as the results of its checks (rooms, prices, availability). For each answer we also record the response time and the costs incurred. For the conversation we create a random identifier that your browser stores only for the open tab (sessionStorage); there is no user account. The assistant does not ask for your name, address or phone number: you enter these yourself in the forms, and they are not transmitted to the AI service. If you switch from the chat to the online booking, we carry over your selection and, if you wrote it in the chat, your email address to the booking page; for this the email address is kept only briefly in your browser’s sessionStorage and is deleted there when the booking page opens. We handle an inquiry from the chat like an inquiry via our inquiry form (see “Online booking and booking inquiry”). Please do not write any information about your health or other particularly sensitive data in the chat. For such questions, please use the option to forward your question to our team or call us.

AI service Anthropic: The answers are generated by a language model of Anthropic Ireland, Limited, 6th Floor, South Bank House, Barrow Street, Dublin 4, D04 TR29, Ireland (“Anthropic”), which acts as our processor. For this purpose our server transmits the conversation (your messages, the previous answers and the results of the checks) together with our instructions to Anthropic. We do not transmit your IP address or the information from the forms. Anthropic stores the data in the USA and may also compute the answers in data centres in other countries. We base this transfer on the EU Commission’s standard contractual clauses pursuant to Art. 46 GDPR; they are part of the data processing agreement that forms part of Anthropic’s terms of business. Anthropic does not use the data to train its models and deletes it no later than 30 days after it was received or generated. Anthropic only keeps it longer where the law requires it or where Anthropic’s automated abuse detection classifies a request as a possible breach of its usage policy, in which case for up to two years.

Fallback in case of a disruption (OpenAI): If Anthropic fails, we can manually switch the chat to a language model of OpenAI Ireland Limited, 1st Floor, The Liffey Trust Centre, 117-126 Sheriff Street Upper, Dublin 1, D01 YC43, Ireland (“OpenAI”); the chat never switches by itself. As long as this switch applies, the same data goes to OpenAI, which then likewise acts as our processor and also processes the data in the USA. We base this transfer on the EU Commission’s standard contractual clauses pursuant to Art. 46 GDPR in our data processing agreement with OpenAI. OpenAI does not use the data to train its models. We have switched off the storage of requests at OpenAI; however, OpenAI may keep them for up to 30 days to detect abuse. Further information: https://openai.com/policies/eu-privacy-policy/.

Content and pages of our guest app: For questions about your stay, the assistant also uses the guest directory, the additional services and the programme of our guest app. Our server retrieves this content from Hotel MSSNGR GmbH, Tölzer Straße 17, 83677 Reichersbeuern, Germany; we do not transmit any data about you in the process. Below an answer there may be a button to the matching page of the app. Only when you click it does your browser load this page directly from Hotel MSSNGR GmbH and show it next to the chat. Hotel MSSNGR GmbH then receives your IP address, technical information about your browser and the address of our website (without the subpage you are on). The app page loads its own programs, including error monitoring (Sentry) and a tool for improving usability (Maze), and stores a random identifier not linked to your person in your browser’s storage; it sets no cookies. The legal basis is our legitimate interest in showing you the content of our guest app directly in the chat at your request (Art. 6(1)(f) GDPR). If you do not click the button, none of this loads.

Storage period: We store the chat history in our database (provider: Supabase, servers within the European Union) and delete it automatically 30 days after the last message. Only anonymous daily figures without identifier and without content remain, such as the number of conversations, response times and costs. If you submit an inquiry or a question to our team from the chat, or book after the chat, we store an excerpt of the last six chat messages of no more than 400 characters each so that our team understands your request. This excerpt is kept as long as the inquiry, the question or the booking itself. We answer a question to our team by email; we keep it and our answer as part of our correspondence with you and delete them at your request. For a booking from the chat we also note an identifier that it came from the chat, in order to measure the chat’s benefit. At our hotel, only a narrowly limited group of people responsible for the chat sees the complete conversations, for quality assurance. We do not pass the conversation identifier on to analytics services.

Protection against abuse: So that automated requests neither block the chat nor cause costs, we limit messages and new conversations per conversation and per internet connection. We keep the counters for this under the random identifier of the conversation or under a hash of your IP address with the service of Upstash, Inc., San Jose, California, USA; they expire by themselves after a short time. If a conversation stands out due to abuse, we can block it. In case of conspicuous use, a confirmation that a human is writing may additionally appear (see “Cloudflare Turnstile”).

Legal basis: Insofar as the chat prepares your booking or an inquiry, the legal basis is Art. 6(1)(b) GDPR (taking pre-contractual steps at your request). Otherwise we process the data on the basis of our legitimate interest in answering your questions quickly, ensuring the quality of the chat and protecting it against abuse (Art. 6(1)(f) GDPR); you may object to this processing under Art. 21 GDPR. Using the chat is voluntary: booking, inquiry and contact remain open to you without it, via the online booking, the inquiry form, by email or by phone. The chat does not make any decision based solely on automated processing within the meaning of Art. 22 GDPR: prices and availability come from our booking system according to the same rules as in the online booking, whether you book is your decision, and our team decides on an inquiry. Further information on storage at Anthropic: https://privacy.claude.com/en/articles/7996866-how-long-do-you-store-my-organization-s-data.

Cloudflare Turnstile (protection of the AI chat)

We protect our AI chat against automated abuse. If usage is conspicuous, for example because a very large number of messages or new conversations come from one connection within a short time, we ask you in the chat window for a short confirmation that a human is writing. For this we use the Turnstile service of Cloudflare, Inc., 101 Townsend St., San Francisco, CA 94107, USA.

Turnstile only appears in case of conspicuous use. Only then does your browser load Cloudflare’s check program; it is not loaded when you visit our website or in the normal chat. Instead of the confirmation, you can always wait for the displayed waiting time and then continue writing without confirmation.

During the check, Cloudflare states that it processes your IP address, a technical fingerprint of the encrypted connection (TLS), your browser identifier (user agent) as well as the identifier of our widget and the address of our website, in order to distinguish humans from automated programs. Cloudflare acts as our processor; insofar as Cloudflare uses these signals to improve its bot detection, Cloudflare is itself responsible. Cloudflare only tells us whether the check was passed. To verify this result, our server transmits your browser’s check result and your IP address to Cloudflare. How often a conversation has already been confirmed is counted under the random identifier of the conversation; how often a connection has already been confirmed, under a hash of your IP address. Both counters expire by themselves after 24 hours.

The legal basis is our legitimate interest in protecting our chat against abuse and against the costs of automated requests (Art. 6(1)(f) GDPR). We do not obtain consent for this, because the check only appears in case of conspicuous use and waiting always remains possible. The transfer to the USA is based on Cloudflare’s certification under the EU-US Data Privacy Framework. Further information: https://www.cloudflare.com/turnstile-privacy-policy/ and Cloudflare’s privacy policy at https://www.cloudflare.com/privacypolicy/.

AI assistance for our team (Anthropic)

We also use a language model from Anthropic in our work behind the scenes, for three tasks. The same applies to provider, transfer to the USA, training and retention as for the AI chat (see above). The model never sends messages to you itself: whatever reaches you is read, edited and sent by a person from our team.

Reply to your questionnaire: If you have filled in our questionnaire after your stay, our quality management can have a draft of a personal reply created at the push of a button. For this we transmit to Anthropic your salutation and your name, the period and nights of your stay, the number of adults and children, room category and package, whether you are a regular guest, your answers in the questionnaire including everything you wrote yourself, and, where applicable, an internal note from our team on your questionnaire. We do not transmit your email address or your postal address.

Barometer report: Every week and every month we summarise the completed questionnaires of the period in a report for the management of our hotel and of our departments. For this we transmit each questionnaire to Anthropic without name, email address and room number, only under a code: your answers including everything you wrote yourself, month and nights of the stay, the number of adults and children, room category and package, your country of origin, the language of the questionnaire, whether you are a regular guest, and, where applicable, the internal note from our team. Only afterwards do we add the name and room number in our own system next to the passages where the report refers to your questionnaire. The report goes only to our team; it does not decide anything about individual guests.

Sorting your replies to our emails: If you reply to our newsletter or to one of our messages about your stay (for example before arrival or afterwards), the model sorts your reply: if you would like to unsubscribe from the newsletter, we unsubscribe you; if you show interest in a stay, we forward your email to our reservations team; everything else is collected for our team to read. For this we transmit to Anthropic your email address and the name you write under, the subject and text of your email (the first 6,000 characters), the number of attachments (not the attachments themselves), the time of receipt, which of our messages you are replying to, where applicable with the related number (such as your booking number), and the status of your address in our newsletter mailing list. Out-of-office replies that we detect beforehand without AI are not sent to Anthropic.

The legal basis is our legitimate interest in replying to your feedback personally, in learning from our guests’ feedback what we can do better, and in handling your messages correctly and quickly (Art. 6(1)(f) GDPR). You can object to this processing at any time with a short message to hotel@schwarz.at.

Cookie consent

Our website uses a self-operated consent tool to obtain your consent to the storage of certain cookies and comparable technologies and to document this in a data-protection-compliant manner. Your selection is stored in versioned form exclusively locally in your browser (in the so-called “localStorage”) and is not transmitted to us or to third parties. Technically, we use Google Consent Mode v2: analysis and marketing services are only enabled or loaded once you have consented to the respective category. Without your consent, the website does not load any statistics or marketing services in your browser. Independently of this, our server reports confirmed bookings and received enquiries to PostHog anonymously (see “PostHog”).

Withdrawing your consent

The consent you gave in the cookie consent dialogue for the storage of certain cookies, or the revocation of that consent, can be withdrawn at any time with effect for the future. If you would like to change your selection in the cookie consent dialogue, please click here. Once you have clicked the link, the cookie consent dialogue will reappear and you can change your selection. Alternatively, you can delete the stored selection yourself in your browser.

Consent to the setting of non-necessary cookies or to access to information on your device is given on the basis of Section 165 (3) of the Austrian Telecommunications Act 2021 (TKG 2021) as well as Art. 6 (1) (a) GDPR. In order to fulfil our obligations to provide proof, we document your consent or its revocation; mandatory statutory retention periods remain unaffected.

Payment processing via payment service provider (hobex)

For the online payment of your booking, we use the payment service provider hobex AG, Josef-Brandstätter-Straße 2b, 5020 Salzburg, Austria. Payment is made via an encrypted payment field embedded directly in our booking process; to confirm the payment (e.g. 3-D Secure), you may be briefly redirected to your bank or card provider.

The data required for the payment (e.g. name, payment or credit card data, invoice amount) is processed by hobex within its own area of responsibility in accordance with hobex’s data protection provisions, which you can view at hobex.at/datenschutz. At the same time, hobex processes this data to fulfil its own legal and regulatory obligations as well as for fraud prevention.

The legal basis for the data processing is Art. 6 (1) (b) GDPR (performance of a contract). Payment transactions are carried out exclusively via an encrypted SSL or TLS connection. Your data is only passed on to hobex insofar as this is necessary for the payment processing.

Online tip (“A thank-you for the team”)

On the page “A thank-you for the team” (dankeschoen.schwarz.at/en/thank-you, also reachable via the QR codes in the hotel) you can give a tip to our whole team. For this we process your first and last name, your email address, the amount and, if you write one, your message to the team. Payment is made via hobex (see above). We send you the confirmation by email via Resend. Your details are stored in our own booking backend (Supabase, servers in the European Union).

We then match the tip to your guest profile with us using your email address. If you gave it during your stay or up to 14 days after departure, we also match it to that stay. This way we know which stay your thank-you belongs to and can handle questions and refunds correctly. We do not pass anything on to our hotel management system in the process.

The legal basis for the payment and the confirmation is Art. 6(1)(b) GDPR. For matching the tip to your guest profile and stay, it is our legitimate interest in maintaining our relationship with our guests and in accounting for tips transparently (Art. 6(1)(f) GDPR). You can object to this matching at any time, informally, at hotel@schwarz.at. We keep the data for as long as it is needed for these purposes. Statutory retention periods remain unaffected.

Local fonts

For the uniform display of fonts, this website uses exclusively font files (web fonts) stored locally on our server. When a page is called up, these fonts are loaded from our own server. No connection to third-party servers (such as Google Fonts) takes place in the process; no personal data is transmitted to third parties.

OpenStreetMap – mapping service

We use the mapping service provided by OpenStreetMap ("OSM") to show you the route to our property and to make it easier for you to plan your journey.

We embed the map material from OSM hosted on the servers of the OpenStreetMap Foundation ("OSMF"), St John’s Innovation Centre, Cowley Road, Cambridge, CB4 0WS, United Kingdom. The United Kingdom is regarded as a safe third country under data protection law. This means that the United Kingdom has a level of data protection equivalent to the level of data protection in the European Union.

When you use the OSM maps, a connection is established to the OSMF’s servers. In the process, your IP address and other information about your behaviour on this website may, among other things, be forwarded to the OSMF. OSM may store cookies in your browser for this purpose or use comparable recognition technologies. Further information on how OSM handles your personal data can be found here:

https://wiki.osmfoundation.org/wiki/Privacy_Policy

The use of OSM is based exclusively on Art. 6(1)(a) GDPR. Consent can be withdrawn at any time.

Analytics tools and advertising

Use of external tracking services

This website uses the following external tracking services:

• Google Analytics 4 Signals, Google Ireland Ltd., Gordon House, Barrow Street, Dublin 4, IE
• Meta Pixel, Meta Platforms Ireland Ltd, Merrion Road, Dublin 4, D04 X2K5, IE
• PostHog, PostHog, Inc., 2261 Market Street #4008, San Francisco, CA 94114, US

Google Analytics 4 (with Google Signals)

This website uses functions of the web analytics service Google Analytics. The provider is Google Ireland Limited ("Google"), Gordon House, Barrow Street, Dublin 4, Ireland.

Google Analytics enables the website operator to analyse the behaviour of website visitors. In doing so, the website operator receives various usage data, such as page views, time spent on the page, operating systems used and the origin of the user. This data is assigned to the respective end device of the user. It is not linked to a device ID.

Furthermore, Google Analytics allows us to record, among other things, your mouse and scroll movements and clicks. Google Analytics also uses various modelling approaches to supplement the data collected and applies machine-learning technologies in its data analysis.

Google Analytics uses technologies that enable the user to be recognised for the purpose of analysing user behaviour (e.g. cookies or device fingerprinting). The information collected by Google about the use of this website is generally transferred to a Google server in the USA and stored there.

This service is used on the basis of your consent pursuant to Art. 6(1)(a) GDPR. Consent can be withdrawn at any time.

Browser plug-in

You can prevent the collection and processing of your data by Google by downloading and installing the browser plug-in available at the following link: https://tools.google.com/dlpage/gaoptout?hl=en.

For more information on how Google Analytics handles user data, please see Google’s privacy policy: https://support.google.com/analytics/answer/6004245?hl=en.

Google Signals

We use Google Signals. When you visit our website, Google Analytics collects, among other things, your location, search history and YouTube history as well as demographic data (visitor data). With the help of Google Signals, this data may be used for personalised advertising. If you have a Google account, your visitor data from Google Signals is linked to your Google account and used for personalised advertising messages. The data is also used to compile anonymised statistics on the behaviour of our users.

Google Analytics e-commerce measurement

This website uses the "e-commerce measurement" feature of Google Analytics. With the help of e-commerce measurement, the website operator can analyse the purchasing behaviour of website visitors in order to improve its online marketing campaigns. This involves collecting information such as the orders placed, average order values, shipping costs and the time between viewing and purchasing a product. This data may be consolidated by Google under a transaction ID that is assigned to the respective user or their device.

Data processing agreement

We have concluded a data processing agreement with Google and fully implement the strict requirements of the German data protection authorities when using Google Analytics.

The transfer of data to the USA is based on the European Commission's Standard Contractual Clauses. Details can be found here: https://privacy.google.com/businesses/controllerterms/mccs/.

PostHog

After your consent to the category “Statistics & analytics”, we use the product analytics service PostHog. The provider is PostHog, Inc., 2261 Market Street #4008, San Francisco, CA 94114, USA. We operate PostHog via the provider’s US cloud infrastructure; the processing takes place on servers in the USA.

With PostHog, we evaluate the use of our website in pseudonymised form (e.g. pages viewed, buttons clicked and the usage history within the booking process) in order to improve our offering. Entries in form fields are not captured in the process. Heatmaps show us, in aggregated form, where people click on a page, where the mouse moves and how far down they scroll.

On selected pages, for example during online booking, in the enquiry form and on the pages of our offers, we also record the course of a visit (session recording): mouse movements, clicks and scrolling. This shows us where using the website causes difficulties. In these recordings, too, entries in form fields remain masked, as does personal information such as your name or email address. The recordings are deleted after 30 days.

The legal basis is your consent pursuant to Art. 6 (1) (a) GDPR and Section 165 (3) TKG 2021; the consent can be revoked at any time. The transfer of personal data to the USA associated with this use is based on the standard contractual clauses of the EU Commission pursuant to Art. 46 GDPR. You can find more information at https://posthog.com/privacy.

Our server also reports confirmed bookings and received enquiries to PostHog anonymously, even without your consent: with details such as the offer, arrival date, room, number of guests and amount, but without name, email address, phone number, IP address or any identifier that points to you or your device.

Meta Pixel

This website uses Meta’s visitor action pixel for conversion measurement. The provider of this service is Meta Platforms Ireland Ltd, Merrion Road, Dublin 4, D04 X2K5, Ireland. According to Meta, the collected data is also transferred to the USA and to other third countries.

This makes it possible to track the behaviour of site visitors after they have been redirected to the provider’s website by clicking on a Meta advertisement. This allows the effectiveness of Meta ads to be evaluated for statistical and market research purposes and future advertising measures to be optimised.

For us, as the operator of this website, the collected data is anonymous — we cannot draw any conclusions about the identity of users. However, the data is stored and processed by Meta, so that a connection to the respective user profile on Facebook or Instagram is possible, and Meta may use the data for its own advertising purposes in accordance with the Meta Data Usage Policy. This enables Meta to display advertisements on Facebook, Instagram and other advertising channels. This use of the data is beyond our control as the operator of this website.

This service is used on the basis of your consent, Art. 6(1)(a) GDPR; consent can be withdrawn at any time.

Insofar as personal data is collected on our website with the help of the tool described here and forwarded to Meta, we and Meta Platforms Ireland Ltd, Merrion Road, Dublin 4, D04 X2K5, Ireland are jointly responsible for this data processing (Art. 26 GDPR). This joint responsibility is limited exclusively to the collection of the data and its transfer to Meta. The processing carried out by Meta after the transfer is not part of the joint responsibility. The obligations incumbent on us jointly have been set out in a joint controller agreement. The wording of the agreement can be found at: https://www.facebook.com/legal/controller_addendum. Under this agreement, we are responsible for providing the privacy information when using the Meta tool and for the data-protection-compliant implementation of the tool on our website. Meta is responsible for the data security of Meta products. You can assert data subject rights (e.g. requests for information) regarding data processed by Facebook or Instagram directly with Meta. If you assert your data subject rights with us, we are obliged to forward them to Meta.

The transfer of data to the USA is based on the European Commission's Standard Contractual Clauses. Details can be found here: https://www.facebook.com/legal/EU_data_transfer_addendum and https://de-de.facebook.com/help/566994660333381.

You can find further information on the protection of your privacy in Meta’s privacy notices at: https://www.facebook.com/about/privacy/.

You can also deactivate the "Custom Audiences" remarketing feature in the advertising settings section at https://www.facebook.com/ads/preferences/?entry_product=ad_settings_screen. To do this, you must be logged in to Facebook.

If you do not have a Facebook or Instagram account, you can deactivate usage-based advertising from Meta on the website of the European Interactive Digital Advertising Alliance: http://www.youronlinechoices.com/de/praferenzmanagement/.

The company is certified under the "EU-US Data Privacy Framework" (DPF). The DPF is an agreement between the European Union and the USA intended to ensure compliance with European data protection standards for data processing in the USA. Every company certified under the DPF undertakes to comply with these data protection standards. Further information is available from the provider at the following link: https://www.dataprivacyframework.gov/participant/4452.

YouTube with extended privacy mode

This website embeds videos from the YouTube website. YouTube is operated by Google Ireland Limited ("Google"), Gordon House, Barrow Street, Dublin 4, Ireland.

We use YouTube in extended privacy mode. According to YouTube, this mode means that YouTube does not store any information about visitors to this website before they watch a video. However, extended privacy mode does not necessarily rule out the sharing of data with YouTube partners. For instance, YouTube establishes a connection to the Google DoubleClick network regardless of whether you watch a video.

As soon as you start a YouTube video on this website, a connection is established to YouTube’s servers. This tells the YouTube server which of our pages you have visited. If you are logged in to your YouTube account, you enable YouTube to associate your browsing behaviour directly with your personal profile. You can prevent this by logging out of your YouTube account.

Furthermore, after starting a video, YouTube may store various cookies on your device or use comparable recognition technologies (e.g. device fingerprinting). In this way, YouTube can obtain information about visitors to this website. Among other things, this information is used to compile video statistics, improve user-friendliness and prevent fraud attempts.

Further data processing operations, over which we have no influence, may be triggered after a YouTube video has started.

We use YouTube in the interest of presenting our online offerings in an appealing way. This constitutes a legitimate interest within the meaning of Art. 6(1)(f) GDPR. Where corresponding consent has been requested, processing is carried out exclusively on the basis of Art. 6(1)(a) GDPR; consent can be withdrawn at any time.

Further information on data protection at YouTube can be found in their privacy policy at: https://policies.google.com/privacy?hl=en.

Your rights

Information, deletion and correction

Within the scope of the applicable statutory provisions, you have the right at any time to free information about your stored personal data, its origin and recipients and the purpose of the data processing, and, where applicable, a right to rectification or erasure of this data. For this purpose, as well as for any further questions on the subject of personal data, you may contact us at any time at the address given in our legal notice.

Right to restriction of processing

You have the right to request the restriction of the processing of your personal data. To do so, you may contact us at any time at the address given in our legal notice. The right to restriction of processing exists in the following cases:

If you dispute the accuracy of the personal data we have stored about you, we generally need time to verify this. For the duration of this verification, you have the right to request the restriction of the processing of your personal data.

If the processing of your personal data was/is unlawful, you may request the restriction of the data processing instead of its erasure.

If we no longer need your personal data, but you need it to exercise, defend or assert legal claims, you have the right to request the restriction of the processing of your personal data instead of its erasure.

If you have objected pursuant to Art. 21(1) GDPR, a balance must be struck between your interests and ours. As long as it has not yet been determined whose interests prevail, you have the right to request the restriction of the processing of your personal data.

If you have restricted the processing of your personal data, this data may — apart from being stored — only be processed with your consent or for the assertion, exercise or defence of legal claims, or for the protection of the rights of another natural or legal person, or for reasons of important public interest of the European Union or a Member State.

Withdrawal of your consent to data processing

Many data processing operations are only possible with your express consent. You may withdraw any consent you have already given at any time. The lawfulness of the data processing carried out up to the point of withdrawal remains unaffected by the withdrawal.

Right to object to the collection of data in special cases and to direct marketing (Art. 21 GDPR)

IF THE PROCESSING OF YOUR PERSONAL DATA IS BASED ON ART. 6(1)(E) OR (F) GDPR, YOU HAVE THE RIGHT TO OBJECT AT ANY TIME, FOR REASONS ARISING FROM YOUR PARTICULAR SITUATION, TO THE PROCESSING OF YOUR PERSONAL DATA; THIS ALSO APPLIES TO PROFILING BASED ON THESE PROVISIONS. THE RESPECTIVE LEGAL BASIS ON WHICH A PROCESSING IS BASED CAN BE FOUND IN THIS PRIVACY POLICY. IF YOU OBJECT, WE WILL NO LONGER PROCESS YOUR AFFECTED PERSONAL DATA UNLESS WE CAN DEMONSTRATE COMPELLING LEGITIMATE GROUNDS FOR THE PROCESSING THAT OVERRIDE YOUR INTERESTS, RIGHTS AND FREEDOMS, OR THE PROCESSING SERVES THE ASSERTION, EXERCISE OR DEFENCE OF LEGAL CLAIMS (OBJECTION PURSUANT TO ART. 21(1) GDPR).

IF YOUR PERSONAL DATA IS PROCESSED FOR THE PURPOSE OF DIRECT MARKETING, YOU HAVE THE RIGHT TO OBJECT AT ANY TIME TO THE PROCESSING OF PERSONAL DATA CONCERNING YOU FOR THE PURPOSE OF SUCH MARKETING; THIS ALSO APPLIES TO PROFILING TO THE EXTENT THAT IT IS RELATED TO SUCH DIRECT MARKETING. IF YOU OBJECT, YOUR PERSONAL DATA WILL SUBSEQUENTLY NO LONGER BE USED FOR THE PURPOSE OF DIRECT MARKETING (OBJECTION PURSUANT TO ART. 21(2) GDPR).

Right to lodge a complaint with the competent supervisory authority

In the event of breaches of the GDPR, data subjects have the right to lodge a complaint with a supervisory authority, in particular in the Member State of their habitual residence, their place of work, or the place of the alleged breach. This right to lodge a complaint exists without prejudice to any other administrative or judicial remedy.

Right to data portability

You have the right to have data that we process automatically on the basis of your consent or in performance of a contract handed over to you or to a third party in a commonly used, machine-readable format. If you request the direct transfer of the data to another controller, this will only be done to the extent that it is technically feasible.

DialogShift chat application and other communication services on our website

Our website uses the communication services of DialogShift GmbH, Torstr. 201, 10115 Berlin. These include a chat application, email communication and telephone communication. These applications process and store data for the purpose of web analytics, operating the communication services, and responding to enquiries.

To operate the chat function, the chat texts are stored and a cookie with a unique ID is set — this is used to recognise you as a customer. For email and telephone communication, the content of the communication is likewise stored temporarily to ensure the efficient handling of your enquiries.

A cookie is a small text file that is stored locally in the cache on your device. With the help of this cookie, our application recognises the device again and can retrieve past chat logs. This cookie is stored for 90 days from its last use. You can disable the storage of cookies in your browser settings. However, the chat function cannot be carried out without the use of cookies.

Any disclosure of, for example, name, email address or a telephone number is voluntary and given with your consent to use and store this data temporarily for the purpose of contact until the end of the interaction. This personal data is deleted after 90 days. When using the Journey Messaging Service, your contact details may also be used to transmit travel-related information (such as check-in information), provided you have consented to this.

The legal basis for the data processing is Art. 6(1)(a) GDPR, § 25(1) TTDSG (German Telecommunications-Telemedia Data Protection Act), based on your consent.

DialogShift provides further information on the collection and use of data as well as your rights and options for protecting your privacy at https://www.dialogshift.com/privacy.