Data protection

We process your personal data exclusively in accordance with the provisions of the General Data Protection Regulation (GDPR) and the Data Protection Act 2018.

Note: For ease of reading, the term "data" is generally used, even though personal data is meant. Legal provisions without reference apply exclusively to those of the GDPR, unless otherwise stated.

Below, we inform you about the type, scope, purpose of data collection, and its use in accordance with the provisions of the GDPR:

I. Name and address of the controller

The person responsible for data processing is:
Johann Lassnig
Stuben 58
6762 Stuben am Alberg
Austria
T +43 5582 301 88
servus@stuben.rocks

II. Provision of the website and creation of log files

1. Description and scope of data processing
Each time our website is accessed, our system automatically collects data and information from the computer system of the accessing computer.

The following data is collected:
Information about the browser type and version used
The user's operating system
The user's Internet service provider
The user's IP address
Date and time of access
Websites from which the user's system accesses our website
Websites accessed by the user's system via our website

2. Legal basis for data processing
The legal basis for the temporary storage of data and log files is Art. 6 para. 1 f.

3. Purpose of data processing
The temporary storage of the IP address by the system is necessary to enable the website to be delivered to the user's computer. For this purpose, the user's IP address must remain stored for the duration of the session. Storage in log files is done to ensure the functionality of the website. In addition, the data helps us to optimize the website and to ensure the security of our information technology systems. The data is not evaluated for marketing purposes in this context. These purposes also constitute our legitimate interest in data processing in accordance with Art. 6 (1) f.

4. Duration of storage
The data will be deleted as soon as it is no longer necessary for the purpose for which it was collected. In the case of data collection for the provision of the website, this is the case when the respective session has ended.
In the case of storage of data in log files, this is the case after seven days at the latest. Storage beyond this period is possible. In this case, the IP addresses of the users are deleted or alienated so that an assignment of the calling client is no longer possible.

5. Right to object and right to erasure
The collection of data for the provision of the website and the storage of data in log files is essential for the operation of the website.

III. Use of cookies

We use the consent tool "Real Cookie Banner" to manage the cookies and similar technologies (tracking pixels, web beacons, etc.) we use and the related consents. Details on how "Real Cookie Banner" works can be found at https://devowl.io/de/rcb/datenverarbeitung/.

The legal basis for the processing of personal data in this context is Art. 6 (1) (c) GDPR and Art. 6 (1) (f) GDPR. Our legitimate interest is the management of the cookies and similar technologies used and the related consents.

The provision of personal data is neither contractually required nor necessary for the conclusion of a contract. You are not obliged to provide personal data. If you do not provide personal data, we cannot manage your consents.

1. Description and scope of data processing
Our website uses cookies. Cookies are text files that are stored in the Internet browser or by the Internet browser on the user's computer system. When a user accesses a website, a cookie may be stored on the user's operating system. This cookie contains a characteristic string of characters that enables the browser to be uniquely identified when the website is accessed again.

Technically necessary cookies:
We use cookies to make our website more user-friendly. Some elements of our website require that the calling browser can be identified even after a page change.

The following data is stored and transmitted in the cookies:

Hide cookie notice
Accessibility settings
Cookies that are not technically necessary:
We also use cookies on our website that enable us to analyze users' surfing behavior. The following data may be transmitted:

Search terms entered
Frequency of page views
Use of website functions
The user data collected in this way is pseudonymized by technical measures. This means that it is no longer possible to assign the data to the user who accessed the site. The data is not stored together with other personal data of the users. When visiting our website, users are informed about the use of cookies for analysis purposes via an information banner and referred to this privacy policy. In this context, there is also a note on how to prevent the storage of cookies in the browser settings.

2. Legal basis for data processing
The legal basis for processing your data using technically necessary cookies is Art. 6 (1) f. For cookies used for analysis purposes, the legal basis is Art. 6 (1) a, provided you have given your consent.

3. Purpose of data processing
The purpose of using technically necessary cookies is to simplify the use of websites for users. Some functions of our website cannot be offered without the use of cookies. For these, it is necessary that the browser is recognized even after a page change.

The user data collected by technically necessary cookies is not used to create user profiles. The use of (non-technically necessary) analysis cookies is for the purpose of improving the quality of our website and its content. Analysis cookies tell us how the website is used, enabling us to continuously optimize our offering.

4. Duration of storage, objection and removal options
Cookies are stored on the user's computer and transmitted to our site by the user. Therefore, as a user, you have full control over the use of cookies. By changing the settings in your Internet browser, you can deactivate or restrict the transmission of cookies. Cookies that have already been stored can be deleted at any time. This can also be done automatically. There are several ways to manage cookies. The help button on the toolbars of most browsers shows you how to stop accepting cookies, how to be notified when a new cookie is set, and how to block cookies. If you block cookies, you may not be able to register, log in, or use the services to their full extent.

More information about disabling cookies

IV. Newsletter

1. Description and scope of data processing
On our website, you have the option of subscribing to a free newsletter. When you register for the newsletter, the data from the input mask is transmitted to us. Specifically, we need your email address and, optionally, your first and last name, including title (gender) and company name.

In addition, the following data is collected during registration:

Date and time of registration
Your consent will be obtained during the registration process for the processing of your data.

Furthermore, your data will not be passed on to third parties (see below for exceptions to data processing). Under no circumstances will your contact details be sold or loaned out. The data will be used exclusively for sending the newsletter.

In the course of this data processing, we forward the personal data collected to the following third parties (data processors): popup communications gmbh, Werdenbergerstraße 39a, 6700 Bludenz, datenschutz@popup.at

2. Legal basis for data processing
The legal basis for processing your data after you have subscribed to the newsletter is Art. 6 (1) a if the user has given their consent.

3. Purpose of data processing
Your email address is collected for the purpose of delivering the newsletter.

4. Duration of storage
The data will be deleted as soon as it is no longer required for the purpose for which it was collected. The user's email address will therefore be stored for as long as the newsletter subscription is active.

5. Right of withdrawal and removal option
The newsletter subscription can be canceled by the user concerned at any time. A link for this purpose can be found in every newsletter.

V. Web analytics services

1. Data protection provisions regarding the use of Webalizer
When you visit our website, data about your visit is collected and stored without personal reference, e.g., browser type, date, the website from which you accessed our site (referrer), and time of access. We use the Webalizer program for analysis.

Our web server uses the Webalizer web analysis tool, which anonymizes IP addresses. IP addresses are not displayed in the analysis tool, meaning that they can no longer be linked to individuals and you, as a user, remain anonymous to us. The anonymized data records are stored on our web server and evaluated internally for statistical purposes only.

2. Data protection provisions regarding the use of Google Analytics (with anonymization function)
The controller has integrated the Google Analytics component (with anonymization function) into this website. Google Analytics is a web analytics service. Web analytics is the collection, gathering, and analysis of data about the behavior of visitors to websites. A web analytics service collects, among other things, data about which website a data subject came to a website from (so-called referrer), which subpages of the website were accessed, or how often and for how long a subpage was viewed. Web analytics is mainly used to optimize a website and for cost-benefit analysis of internet advertising.

The operator of the Google Analytics component is Google Inc., 1600 Amphitheatre Pkwy, Mountain View, CA 94043-1351, USA.

The controller uses the addition "_gat._anonymizeIp" for web analysis via Google Analytics. This addition is used by Google to shorten and anonymize the IP address of the data subject's Internet connection when accessing our website from a Member State of the European Union or from another state party to the Agreement on the European Economic Area.

The purpose of the Google Analytics component is to analyze visitor traffic on our website. Google uses the data and information obtained to evaluate the use of our website, to compile online reports for us that show the activities on our website, and to provide other services related to the use of our website.

Google Analytics places a cookie on the information technology system of the data subject. What cookies are has already been explained above. By placing the cookie, Google is enabled to analyze the use of our website. Each time one of the individual pages of this website, which is operated by the controller and on which a Google Analytics component has been integrated, is accessed, the Internet browser on the information technology system of the data subject is automatically prompted by the respective Google Analytics component to transmit data to Google for the purpose of online analysis. As part of this technical process, Google obtains knowledge of personal data, such as the IP address of the data subject, which Google uses, among other things, to track the origin of visitors and clicks and subsequently enable commission settlements.

The cookie stores personal information, such as the time of access, the location from which access originated, and the frequency of visits to our website by the data subject. Each time you visit our website, this personal data, including the IP address of the Internet connection used by the data subject, is transmitted to Google in the United States of America. This personal data is stored by Google in the United States of America. Google may pass on this personal data collected using technical procedures to third parties.

As described above, the data subject can prevent the setting of cookies by our website at any time by means of a corresponding setting in the Internet browser used and thus permanently object to the setting of cookies. Such a setting in the Internet browser used would also prevent Google from setting a cookie on the information technology system of the data subject. In addition, a cookie already set by Google Analytics can be deleted at any time via the Internet browser or other software programs.

Furthermore, the data subject has the option of objecting to and preventing the collection of data generated by Google Analytics relating to the use of this website and the processing of this data by Google. To do this, the data subject must download and install a browser add-on from the link https://tools.google.com/dlpage/gaoptout. This browser add-on informs Google Analytics via JavaScript that no data and information relating to visits to websites may be transmitted to Google Analytics. The installation of the browser add-on is considered by Google as an objection. If the data subject's information technology system is deleted, formatted, or reinstalled at a later date, the data subject must reinstall the browser add-on to deactivate Google Analytics. If the browser add-on is uninstalled or deactivated by the data subject or another person within their sphere of control, it is possible to reinstall or reactivate the browser add-on.

Further information and Google's applicable data protection provisions can be found at https://www.google.de/intl/de/policies/privacy/ and at http://www.google.com/analytics/terms/de.html. Google Analytics is explained in more detail at this link: https://www.google.com/intl/de_de/analytics/.

The data will be deleted as soon as it is no longer needed for our record-keeping purposes. In our case, this is after 26 months.

3. Data protection provisions regarding the use of INSTAGRAM
The controller has integrated components of the Instagram service into this website. Instagram is a service that qualifies as an audiovisual platform and enables users to share photos and videos and also to redistribute such data on other social networks.

The operator of Instagram's services is Instagram LLC, 1 Hacker Way, Building 14 First Floor, Menlo Park, CA, USA.

Each time one of the individual pages of this website, which is operated by the controller and on which an Instagram component (Insta button) has been integrated, is accessed, the Internet browser on the information technology system of the data subject is automatically prompted by the respective Instagram component to download a representation of the corresponding component from Instagram. As part of this technical process, Instagram receives information about which specific subpage of our website is visited by the data subject.

If the data subject is logged into Instagram at the same time, Instagram recognizes which specific subpage the data subject visits each time the data subject accesses our website and for the entire duration of their stay on our website. This information is collected by the Instagram component and assigned by Instagram to the respective Instagram account of the data subject. If the data subject clicks on one of the Instagram buttons integrated on our website, the data and information transmitted will be assigned to the data subject's personal Instagram user account and stored and processed by Instagram.

Instagram receives information via the Instagram component that the data subject has visited our website whenever the data subject is logged into Instagram at the same time as visiting our website; this occurs regardless of whether the data subject clicks on the Instagram component or not. If the data subject does not want this information to be transmitted to Instagram, they can prevent the transmission by logging out of their Instagram account before visiting our website.

Further information and Instagram's applicable data protection provisions can be found at https://help.instagram.com/155833707900388 and https://www.instagram.com/about/legal/privacy/.

4. Data protection provisions regarding the use of FACEBOOK
The controller has integrated components of the Facebook company into this website. Facebook is a social network.

A social network is an online social meeting place, an online community that generally allows users to communicate with each other and interact in a virtual space. A social network can serve as a platform for exchanging opinions and experiences or enable the Internet community to provide personal or company-related information. Facebook allows users of the social network to create private profiles, upload photos, and connect with others via friend requests, among other things.

The operating company of Facebook is Facebook, Inc., 1 Hacker Way, Menlo Park, CA 94025, USA. If a data subject lives outside the USA or Canada, the controller responsible for processing personal data is Facebook Ireland Ltd., 4 Grand Canal Square, Grand Canal Harbour, Dublin 2, Ireland.

Each time one of the individual pages of this website, which is operated by the controller and on which a Facebook component (Facebook plug-in) has been integrated, is accessed, the Internet browser on the information technology system of the data subject is automatically prompted by the respective Facebook component to download a representation of the corresponding Facebook component from Facebook. A complete overview of all Facebook plug-ins can be found at https://developers.facebook.com/docs/plugins/?locale=de_DE. As part of this technical process, Facebook receives information about which specific subpage of our website is visited by the data subject.

If the data subject is logged into Facebook at the same time, Facebook recognizes which specific subpage of our website the data subject visits each time the data subject accesses our website and for the entire duration of their stay on our website. This information is collected by the Facebook component and assigned by Facebook to the respective Facebook account of the data subject. If the data subject clicks on one of the Facebook buttons integrated into our website, for example the "Like" button, or if the data subject posts a comment, Facebook assigns this information to the data subject's personal Facebook user account and stores this personal data.

Facebook receives information via the Facebook component that the data subject has visited our website whenever the data subject is logged into Facebook at the same time as visiting our website; this occurs regardless of whether the data subject clicks on the Facebook component or not. If the data subject does not want this information to be transmitted to Facebook, they can prevent the transmission by logging out of their Facebook account before visiting our website.

The data policy published by Facebook, which is available at https://de-de.facebook.com/about/privacy/, provides information about the collection, processing, and use of personal data by Facebook. It also explains the settings options Facebook offers to protect the privacy of the data subject. In addition, various applications are available that enable data transmission to Facebook to be suppressed. Such applications can be used by the data subject to suppress data transmission to Facebook.

5. Data protection provisions regarding the use of YouTube
The controller has integrated components from YouTube into this website. YouTube is an Internet video portal that allows video publishers to upload video clips free of charge and other users to view, rate, and comment on them, also free of charge. YouTube permits the publication of all types of videos, which is why complete films and television programs, as well as music videos, trailers, or videos created by users themselves, are available via the Internet portal.

YouTube is operated by YouTube, LLC, 901 Cherry Ave., San Bruno, CA 94066, USA. YouTube, LLC is a subsidiary of Google Inc., 1600 Amphitheatre Pkwy, Mountain View, CA 94043-1351, USA.

Each time one of the individual pages of this website, which is operated by the controller and on which a YouTube component (YouTube video) has been integrated, is accessed, the Internet browser on the information technology system of the data subject is automatically prompted by the respective YouTube component to download a representation of the corresponding YouTube component from YouTube. Further information about YouTube can be found at https://www.youtube.com/yt/about/de/. As part of this technical process, YouTube and Google become aware of which specific subpage of our website is visited by the data subject.

If the data subject is logged in to YouTube at the same time, YouTube recognizes which specific subpage of our website the data subject is visiting when they call up a subpage that contains a YouTube video. This information is collected by YouTube and Google and assigned to the respective YouTube account of the data subject.

YouTube and Google receive information via the YouTube component that the data subject has visited our website whenever the data subject is logged in to YouTube at the same time as visiting our website; this occurs regardless of whether the data subject clicks on a YouTube video or not. If the data subject does not want this information to be transmitted to YouTube and Google, they can prevent the transmission by logging out of their YouTube account before visiting our website.

The privacy policy published by YouTube, which can be accessed at https://www.google.de/intl/de/policies/privacy/, provides information about the collection, processing, and use of personal data by YouTube and Google.

VI. Inquiries and bookings

1. Description and scope of data processing
When you make an inquiry or booking on our website, we collect the data necessary to respond to your inquiry or make your reservation. This includes, in particular, your name, telephone number, email address ("contact details"), as well as your arrival and departure dates, your hotel, and the type of room you have booked ("booking details").

When the message is sent, the following data is also stored:
a. The user's IP address
b. Date and time of the request

Alternatively, you can contact us via the email address provided. In this case, the user's personal data transmitted with the email will be stored.

2. Legal basis for data processing
The legal basis for data processing is Art. 6 para. 1 lit. a GDPR if the user has given their consent.

The legal basis for processing the data transmitted in the course of sending an email is Art. 6 (1) lit. f GDPR. If the email contact is aimed at concluding a contract, the additional legal basis for processing is Art. 6 (1) lit. b GDPR.

3. Purpose of data processing
Your inquiry or booking data is collected in order to make your reservation possible. Beyond that, your data will not be passed on to third parties. (See below for exceptions to data processing.) Under no circumstances will your contact details be sold or loaned out. Due to legal regulations and corresponding court or official orders, we are obliged in exceptional cases to disclose data to the ordering authorities or courts. This will only take place within the scope of our legal obligations.

The other personal data processed during the sending process serves to prevent misuse of the contact form and to ensure the security of our information technology systems.

In the course of this data processing, we forward the personal data collected to the following third parties (data processors):

Kognitiv (Seekda GmbH), Neubaugasse 10/15, 1070 Vienna, Tel.: +43 1 2365084-0, Email: office@seekda.com, Privacy Policy Kognitiv / Seekda
Innconcepts IT GmbH, Europastraße 8, 6322 Kirchbichl, Tyrol, Tel.: +43 5332 20820, support@innconcepts.at, https://www.innconcepts.at

4. Duration of storage
The data will be deleted as soon as it is no longer required for the purpose for which it was collected. For personal data from the input mask of the contact form and those sent by email, this is the case when the respective conversation with the user has ended. The conversation is ended when it can be inferred from the circumstances that the matter in question has been conclusively clarified.

The additional personal data collected during the sending process will be deleted after a period of seven days at the latest.

5. Right to object and right to erasure
Users may revoke their consent to the processing of their personal data at any time. If users contact us by email, they may object to the storage of their personal data at any time. In such cases, the conversation cannot be continued.

Please notify us of any revocation via our email address above. In this case, all personal data stored in the course of contacting us will be deleted.

VII. Contact form and email contact

1. Description and scope of data processing
Our website features a contact form that can be used to contact us electronically. If a user takes advantage of this option, the data entered in the input mask will be transmitted to us and stored. This data includes:

Title
First name
Last name
Phone
Country
Email
Message
When the message is sent, the following data is also stored:

The user's IP address
Date and time of registration
Alternatively, you can contact us via the email address provided. In this case, the user's personal data transmitted with the email will be stored.

In this context, no data will be passed on to third parties. The data will be used exclusively for processing the conversation.

2. Legal basis for data processing
The legal basis for data processing is Art. 6 para. 1 lit. a GDPR if the user has given their consent.

3. Purpose of data processing
We process the personal data entered in the input mask solely for the purpose of processing your contact request. If you contact us by email, this also constitutes the necessary legitimate interest in processing the data.

The other personal data processed during the sending process serves to prevent misuse of the contact form and to ensure the security of our information technology systems.

The additional personal data collected during the sending process will be deleted after a period of seven days at the latest.

Please notify us of any revocation via our email address above. In this case, all personal data stored in the course of contacting us will be deleted.

VIII. User rights (rights of data subjects)

If your personal data is processed, you are a data subject within the meaning of the GDPR and you have the following rights vis-à-vis us as the controller:

1. Right to information
You may request confirmation from us as to whether we are processing personal data relating to you.

If such processing takes place, you can request the following information from us:

The purposes and categories of personal data being processed, including the recipients or categories of recipients to whom your data has been or will be disclosed, as well as the planned duration of storage of data concerning you. If we use profiling technologies, we will provide you with meaningful information about the logic involved, as well as the scope and intended effects of such processing for you. We will also inform you of your right to lodge a complaint with the data protection authority. You also have the right to request information about whether the data concerning you is transferred to a third country or to an international organization.

2. Right to rectification
You have the right to rectification and/or completion if your processed data is incorrect or incomplete. If applicable, we will make the rectification immediately.

3. Right to restriction of processing
You may request the restriction of the processing of your data under the following conditions:

(1) if you dispute the accuracy of the data concerning you for a period of time that allows us to verify the accuracy of your data;
(2) the processing is unlawful and you refuse to have your data deleted and instead request the restriction of the use of your data;
(3) we no longer need your data for the purposes of processing, but you need it to assert, exercise, or defend legal claims, or
(4) if you have objected to the processing and it is not yet clear whether our legitimate reasons outweigh your reasons.

If the processing of your data has been restricted, this data—apart from its storage—may only be processed with your consent or for the assertion, exercise, or defense of legal claims or for the protection of the rights of another natural or legal person.

If processing has been restricted in accordance with the above conditions, we will inform you before the restriction is lifted.

4. Right to erasure
We are obliged to erase your data immediately if one of the following reasons applies:

(1) Your data is no longer necessary for the purposes for which it was collected by us;
(2) You revoke your consent and there is no other legal basis for processing.
(3) You object to the processing pursuant to Art. 21 (1) and there are no overriding legitimate grounds on our part for the processing, or you object to the processing pursuant to Art. 21 (2).
(4) Your data has been processed unlawfully.

The right to erasure does not apply if processing is necessary

(1) to fulfill a legal obligation that requires processing (e.g., vis-à-vis authorities and agencies), or to perform a task in the public interest that has been assigned to us;
(2) to assert, exercise, or defend legal claims.

5. Right to object
You have the right to object at any time, on grounds relating to your particular situation, to the processing of your data on the basis of Article 6(1)(e) or (f); this also applies to profiling based on these provisions.

In this case, we will no longer process your data unless we have compelling legitimate grounds for the processing that override your interests, rights, and freedoms, or the processing serves to assert, exercise, or defend legal claims.

If your data is processed for direct marketing purposes, you have the right to object at any time to the processing of data concerning you for such marketing purposes; this also applies to profiling insofar as it is related to such direct marketing.

If you object to processing for direct marketing purposes, the data concerning you will no longer be processed for these purposes.

6. Right to revoke the data protection consent form
You have the right to revoke your data protection consent form at any time. Revoking your consent does not affect the legality of the processing carried out on the basis of your consent prior to revocation.

7. Right to lodge a complaint with the data protection authority
Without prejudice to any other administrative or judicial remedy, you have the right to lodge a complaint with the data protection authority pursuant to Section 24 et seq. of the DSG 2018 if you believe that the processing of your data violates the GDPR.

The data protection authority shall inform the complainant of the status and outcome of the complaint, including the possibility of judicial remedy.