Privacy Policy
Dorfstub'n – Restaurant & Apartments
Dienten am Hochkönig, Austria
1. Data Controller
The controller responsible for processing personal data in connection with this website is:
Dorfstub'n – Maria Pabinger
Dorf 60
5652 Dienten am Hochkönig
Austria
Phone: +43 6461 262
Email: info@dorfstuben.at
If you have any questions about data protection or wish to exercise your rights under data protection law, you may contact us at any time using the contact details above.
2. General Information on Data Protection
Protecting your personal data and respecting your privacy are important to us. We process personal data exclusively in accordance with applicable data protection regulations, in particular:
-
Regulation (EU) 2016/679 (General Data Protection Regulation – GDPR)
-
The Austrian Data Protection Act (DSG)
-
The Austrian Telecommunications Act 2021 (TKG 2021)
-
Other relevant legal provisions
This Privacy Policy explains which personal data is processed when you visit our website, use our online services, or submit inquiries and bookings.
In particular, we explain the purposes of data processing, the relevant legal bases, possible recipients of personal data, retention periods, and your rights as a data subject.
Personal data includes any information relating to an identified or identifiable natural person. Examples include names, addresses, email addresses, telephone numbers, IP addresses, and booking and stay details.
3. Legal Bases for Data Processing
Depending on the purpose, personal data is processed on the following legal bases:
Article 6(1)(a) GDPR – Consent
Where you have expressly consented to specific data processing, such as the use of non-essential analytics cookies or the activation of certain external content.
Article 6(1)(b) GDPR – Performance of a Contract and Pre-contractual Measures
Where processing is necessary to handle a booking inquiry, prepare an offer, make a reservation, or fulfill an accommodation contract.
Article 6(1)(c) GDPR – Legal Obligation
Where we are required by law to process or retain personal data, for example in connection with invoicing, tax-related retention obligations, or statutory reporting requirements.
Article 6(1)(f) GDPR – Legitimate Interests
Where processing is necessary to protect our legitimate interests, provided these are not overridden by the interests or fundamental rights of the individuals concerned.
These interests may include ensuring the security and functionality of our website, responding to general inquiries, and preventing misuse.
4. Website Hosting and Technical Operation by Wix
Our website is created and operated using the Wix Studio website platform.
Provider:
Wix.com Ltd.
40 Namal Tel Aviv St.
Tel Aviv 6350671
Israel
As part of the technical operation and provision of our website, Wix and its service providers may process personal data, including:
-
IP address of the accessing device
-
Date and time of website access
-
Browser type and version
-
Operating system and device information
-
Pages and files accessed
-
Technical connection information
-
Referring website, where transmitted
-
Information about technical errors and security-related events
This data is processed where necessary to ensure the technical availability, stability, troubleshooting, and security of the website.
Processing is primarily based on our legitimate interests pursuant to Article 6(1)(f) GDPR.
Where Wix or integrated services use technologies requiring consent, the provisions regarding cookies and consent apply.
When using Wix, personal data may also be processed by affiliated companies or service providers outside the European Economic Area.
Further information can be found in the Wix Privacy Policy:
https://www.wix.com/about/privacy
5. Technical Access Data and Server Logs
When you visit our website, technical information about your access may be processed automatically and stored in server logs.
This information is used primarily to ensure the proper functioning of the website, identify technical problems, prevent attacks, and maintain system security.
Where necessary, processing is based on Article 6(1)(f) GDPR.
Server logs are generally stored only for as long as necessary to achieve the relevant purposes.
Longer retention may be necessary due to legal obligations or to investigate specific security incidents.
The actual retention periods depend on the technical and contractual settings of the hosting provider.
6. Cookies and Similar Technologies
Our website may use cookies and similar technologies.
Cookies are small data files that may be stored on or accessed from your device when visiting a website.
Similar technologies may include local browser storage, technical identifiers, or other methods used to recognize devices.
Depending on their purpose, we distinguish between the following categories:
Strictly Necessary Technologies
These technologies provide essential website functions, such as navigation, security, session management, and the storage of your privacy preferences.
Where these technologies are strictly necessary to provide a service expressly requested by the user, separate consent for storage or access is generally not required under Section 165(3) TKG 2021.
Functional Technologies
These technologies may provide additional features or save website visitors' preferences.
Where they are not strictly necessary, they are used only with appropriate consent.
Analytics and Statistics Technologies
These technologies may be used to collect information about how visitors use our website and to improve our online services.
Where consent is required, these technologies are activated only after your express agreement.
Marketing Technologies
These technologies may be used to evaluate advertising measures or tailor content to users' interests.
Where such technologies are used, the applicable consent requirements are observed.
The actual use of cookies and similar technologies depends on the functions activated on our website.
7. Cookie Banner and Consent Management
Where our website uses cookies or similar technologies requiring consent, we obtain your consent before activating them.
You can make your selection through our consent management system.
Consent is voluntary and may be withdrawn at any time with effect for the future.
Withdrawal of consent does not affect the lawfulness of processing carried out before the withdrawal.
Where a cookie settings area is provided, you can subsequently change your preferences there.
Rejecting non-essential technologies must generally not prevent you from accessing essential website content that functions without those technologies.
To document consent, we may process information necessary for this purpose, such as the selected categories, the time of the decision, and a technical consent identifier.
This processing serves to manage and demonstrate compliance with data protection consent requirements.
8. Google Analytics and Statistical Analysis
This section applies only if Google Analytics is actually activated on our website.
For statistical analysis of website usage, we may use Google Analytics 4, an analytics service provided by Google.
For users in the European Economic Area, the provider is generally:
Google Ireland Limited
Gordon House, Barrow Street
Dublin 4
Ireland
Google Analytics may process information about how visitors use our website, including:
-
Pages visited
-
Duration and timing of visits
-
Interactions with website elements
-
Technical device and browser information
-
Approximate geographical location
-
Information about the source of website visits
-
Pseudonymous online identifiers
Processing is carried out for statistical analysis and to improve our online services.
Where Google Analytics uses technologies requiring consent or processes personal data on the basis of consent, it is activated only after you have given your consent.
In this case, the legal basis is Article 6(1)(a) GDPR in conjunction with Section 165(3) TKG 2021.
Personal data may be transferred to Google companies or service providers outside the European Economic Area.
The storage and deletion of analytics data depend on the settings actually selected and the applicable retention rules.
You may withdraw your consent at any time with effect for the future.
Further information:
https://policies.google.com/privacy
9. Matterport – Virtual 3D Tours
Our website offers virtual 3D tours of our apartments.
These allow prospective guests to explore the accommodation and get an impression of the rooms before making a booking.
We use the Matterport service to provide these virtual tours.
Provider:
Matterport, LLC
USA
When using a Matterport 3D tour, technical information may be transmitted to and processed by Matterport, including:
-
IP address
-
Browser and device information
-
Operating system
-
Time of access
-
Information about the use of the tour
-
Technical identifiers
-
Interactions within the virtual environment
Processing may be carried out to display the tour, provide technical functionality, troubleshoot problems, and, where applicable, perform statistical analyses.
Where embedding or activating a Matterport tour requires consent, the corresponding data transfer takes place only after valid consent has been obtained.
In this case, the legal basis is Article 6(1)(a) GDPR.
If you are redirected to an external Matterport website, further data processing falls under the responsibility of the respective provider.
Personal data may be processed outside the European Economic Area.
Further information:
https://matterport.com/privacy-policy
10. Online Bookings and Booking Inquiries via EasyBooking
We use EasyBooking booking software to process booking inquiries, manage reservations, and, where applicable, enable online bookings.
Provider:
zadego GmbH – easybooking
Innsbruck, Austria
When using the booking or inquiry functions, the following personal data may be processed:
-
First and last name
-
Address
-
Email address
-
Telephone number
-
Requested arrival and departure dates
-
Number of guests
-
Ages of children, where applicable
-
Requested apartment
-
Additional information and special requests
-
Booking and reservation information
-
Payment and billing information, where applicable
Processing takes place where necessary to handle an inquiry, prepare an offer, complete a booking, or fulfill an accommodation contract.
The legal basis is Article 6(1)(b) GDPR.
Where personal data must be processed to comply with legal obligations, processing is based on Article 6(1)(c) GDPR.
Data may be transferred to EasyBooking and other service providers involved in booking management to the extent necessary.
Where EasyBooking processes personal data on our behalf, this is carried out in accordance with the legal requirements for processing on behalf of a controller under Article 28 GDPR.
Booking data is retained for as long as necessary for contract fulfillment and in accordance with statutory retention periods.
Further information:
https://www.easybooking.eu/auftragsverarbeitung
11. Contact and Inquiry Forms
If you contact us through a contact form, inquiry form, email, or telephone, we process the personal data you voluntarily provide.
This may include:
-
Name
-
Email address
-
Telephone number
-
Requested travel dates
-
Number of guests
-
Requested accommodation
-
Content of your message
-
Other information voluntarily provided
We use this data to process your inquiry, contact you, and, where applicable, prepare an offer.
Where your inquiry relates to a potential booking, the legal basis is Article 6(1)(b) GDPR.
For other general inquiries, processing may be based on our legitimate interest in handling and responding to inquiries pursuant to Article 6(1)(f) GDPR.
Data is shared with third parties only where necessary to process your inquiry, required by law, or otherwise legally permitted.
Data is deleted once it is no longer required for the respective purpose and no statutory retention obligations or other lawful grounds for continued storage apply.
12. Communication by Email and Telephone
If you contact us by email or telephone, we process the information you provide to handle your request.
This includes contact details, communication content, and, where applicable, information about existing or planned bookings.
When communicating by email, personal data may also be processed by the email and IT service providers involved for technical reasons.
Depending on the nature of your request, processing is based on Article 6(1)(b) or Article 6(1)(f) GDPR.
Where statutory documentation or retention obligations apply, processing may be based on Article 6(1)(c) GDPR.
Please note that ordinary email communication does not necessarily provide continuous end-to-end encryption, despite technical security measures.
13. Facebook and Instagram – External Links
Our website contains links to our profiles on the social networks Facebook and Instagram.
These services are provided by companies belonging to the Meta Group.
For users in the European Economic Area, the responsible provider is generally:
Meta Platforms Ireland Limited
Merrion Road
Dublin 4
Ireland
The Facebook and Instagram icons on our website serve as external links.
Simply visiting our website does not generally establish a connection to Facebook or Instagram through these ordinary links.
Only when you click the corresponding link do you leave our website and get redirected to the respective platform.
When accessing the external platform, Meta may process personal data, including:
-
IP address
-
Browser and device information
-
Time of access
-
Content accessed
-
Information about your user account, where applicable
-
Additional usage and interaction data
If you are logged into Facebook or Instagram, Meta may associate your activity with your user account.
We have only limited influence over the type and extent of data processing carried out by Meta after you access the external platform.
Further processing is subject to the privacy policies of the respective provider.
Further information:
https://www.facebook.com/privacy/policy/
https://privacycenter.instagram.com/policy/
The above information applies to ordinary external links. It does not cover the direct integration of social media feeds, tracking pixels, or other social media features.
14. Recipients and Disclosure of Personal Data
Personal data is disclosed to third parties only where a legal basis exists.
Depending on the type of data processing, the following categories of recipients may be involved:
-
Website hosting and technical service providers
-
IT and maintenance service providers
-
Booking and reservation software providers
-
Payment service providers, where used for payment processing
-
Tax advisors and accounting service providers, where necessary
-
Authorities and public bodies where legally required
-
Other service providers, where necessary to provide our services and legally permitted
Where service providers process personal data on our behalf, the legal requirements for processing under Article 28 GDPR are observed.
Personal data is not transferred to third parties for their independent advertising purposes without an appropriate legal basis.
15. Data Transfers Outside the European Economic Area
When using international service providers, particularly in connection with website hosting, analytics services, and external media content, personal data may be processed outside the European Economic Area.
Such transfers take place in accordance with the requirements of Articles 44 et seq. GDPR.
Where the European Commission has issued an adequacy decision for the respective recipient country, the transfer may be based on that decision.
Otherwise, appropriate safeguards, particularly Standard Contractual Clauses under Article 46 GDPR and, where necessary, additional protective measures, may be required.
The applicable legal basis depends on the service provider, recipient country, and specific circumstances of the data processing.
Information about applicable safeguards may be requested at:
16. Retention and Deletion of Personal Data
We generally retain personal data only for as long as necessary to fulfill the respective processing purposes.
Longer retention may take place where statutory retention obligations apply or continued processing is necessary for other legally permissible reasons.
The following principles apply in particular:
Contact and Inquiry Data
This data is retained for as long as necessary to process the respective request.
Longer retention may be necessary, for example, due to existing business relationships or to establish, exercise, or defend legal claims.
Booking and Contract Data
This data is processed to fulfill and document the contractual relationship and is subsequently retained in accordance with applicable statutory retention obligations.
Invoice and Accounting Data
Where tax-related retention obligations apply, the statutory retention period in Austria is generally seven years.
Longer periods may apply in individual cases.
Technical Access Data
This data is retained in accordance with the actual technical settings and necessary security purposes.
Consent and Analytics Data
Retention periods depend on the respective settings, services used, and legal requirements for documenting consent.
After the applicable retention period has expired, personal data is deleted or anonymized unless another legal basis permits continued processing.
17. Technical and Organizational Data Security
When processing personal data, we observe the requirements for security of processing under Article 32 GDPR.
Appropriate technical and organizational measures are implemented according to the respective risks.
These measures are intended in particular to protect personal data against unauthorized access, unlawful processing, accidental loss, alteration, or disclosure.
Our website uses an encrypted HTTPS connection where this is technically provided for the respective connection.
Data security also depends on the security measures implemented by the service providers and technical systems used.
Despite appropriate security precautions, absolute protection of personal data during electronic processing and transmission cannot be guaranteed.
18. Provision of Personal Data
Providing personal data when visiting our website solely for informational purposes is generally not contractually required.
However, certain technical data is necessary to access and display our website.
For booking inquiries, reservations, and the conclusion of contracts, certain information is required to offer and provide the requested services.
If required information is not provided, we may be unable to fully process an inquiry or complete a booking.
Providing data for voluntary analytics or marketing purposes is generally not necessary to use our essential services.
19. Rights of Data Subjects
Subject to the applicable legal requirements, you have the following rights in particular:
Right of Access – Article 15 GDPR
You may request information about whether and which personal data we process about you.
Right to Rectification – Article 16 GDPR
You have the right to request the correction of inaccurate personal data or the completion of incomplete personal data.
Right to Erasure – Article 17 GDPR
Under the applicable legal conditions, you may request the deletion of your personal data.
Right to Restriction of Processing – Article 18 GDPR
Under certain circumstances, you may request that the processing of your personal data be restricted.
Right to Data Portability – Article 20 GDPR
Under the applicable legal conditions, you have the right to receive the personal data you have provided in a structured, commonly used, and machine-readable format.
Right to Object – Article 21 GDPR
For reasons relating to your particular situation, you may object to certain processing activities based on Article 6(1)(e) or Article 6(1)(f) GDPR.
You may object to the processing of your personal data for direct marketing purposes at any time.
Right to Withdraw Consent – Article 7(3) GDPR
You may withdraw your consent at any time with effect for the future.
Rights Regarding Automated Decision-Making – Article 22 GDPR
Under the applicable legal conditions, you have the right not to be subject to a decision based solely on automated processing that produces legal effects concerning you or similarly significantly affects you.
To exercise your rights, please contact:
We process such requests within the statutory deadlines.
20. Right to Lodge a Complaint with a Data Protection Authority
If you believe that the processing of your personal data violates applicable data protection law, you have the right to lodge a complaint with a competent data protection supervisory authority.
In Austria, this is in particular:
Austrian Data Protection Authority
(Österreichische Datenschutzbehörde)
Barichgasse 40–42
1030 Vienna
Austria
Email: dsb@dsb.gv.at
Website: https://www.dsb.gv.at
Regardless of this, you may contact us directly at any time with questions or complaints.
21. Changes to This Privacy Policy
We reserve the right to amend this Privacy Policy if legal requirements, technical circumstances, or the services used on our website change.
This may be necessary in particular when introducing new website functions, using additional external service providers, or following changes to data protection regulations.
The version published on our website at the relevant time shall apply.
Last updated: October 2026
