Data Protection Declaration

We, Hotel Löwen Schruns GmbH, are pleased that you are visiting our web pages (hereinafter also referred to collectively as “website”) and that you have thereby expressed your interest.

We attach great importance to the protection and security of your personal data. Therefore, we consider it vital to inform you in the following about which of your personal data we process for what purpose and what rights you have in respect of your personal data.

GENERAL INFORMATION

What is personal data and what does processing mean?

• “Personal data” (hereinafter also referred to as “data”) are all the details that make a statement about a natural person. Personal data are not just details that allow a direct conclusion to be drawn about a certain person (such as the name or e-mail address of a person), but also information with which with suitable additional knowledge a connection can be made with a certain person.
• “Processing” means any action taken with your personal data (such as collection, recording, organisation, structuring, storage, use or erasure of data).

Who is the controller for the processing of your data?

The controller for the processing of your data is:

Hotel Löwen Schruns GmbH
Silvrettastraße 8
6780 Schruns
Austria

Telephone: +43 5556 7141
E-Mail: info@loewen-hotel.com

What rights do you have as a data subject?

As a data subject, you have the right, within the legal scope, to:

• Information about your data;
• Rectification of inaccurate data and completion of incomplete data;
• Erasure of your data, particularly if (1) they are no longer necessary for the purposes stated in this Data Protection Declaration, (2) you have withdrawn your consent and there is no other legal ground for the processing, (3) your data have been unlawfully processed, or (4) you have objected to the processing and there are no overriding legitimate grounds for the processing;
• Restriction of the processing of your data, particularly if the accuracy of the data is contested by you or the processing of your data is unlawful and instead of deletion you demand restriction of use;
• Object to processing of your data based on legitimate interests, on grounds relating to your particular situation, or, without specific justification, to processing of your data carried out for direct marketing purposes; unless it is an objection to direct marketing, we ask that you explain the reasons why we should not process your data as we may do, when you lodge an objection. In the event of your reasoned objection, we will examine the merits of the case and cease processing unless we can demonstrate compelling legitimate grounds for the processing which override your interests, rights and freedoms or for the establishment, exercise or defence of legal claims;
• Receive your data in a structured, commonly used and machine-readable format and to have your data transmitted from us directly to another controller;
• Withdraw consent, if you have given us consent for processing. Please note that the lawfulness of processing based on consent before its withdrawal will not be affected by your withdrawal.

If you assert any of the above-stated rights, please understand that we may require you to provide evidence showing that you are the person you claim to be.

Furthermore, you have the right to lodge a complaint with a supervisory authority if you consider that the processing of your data infringes the GDPR.

Links to other websites

Our website may contain links to and from websites of other providers not affiliated with us (“third parties”). After clicking on the link, we no longer have any influence on the processing of any data transmitted to the third party when the link is clicked (such as the IP address or the URL on which the link is located), as the behaviour of third parties is naturally beyond our control. Therefore, we cannot assume any responsibility for the processing of such data by third parties.

DatA PROCESSING

Log files

Each time you access and use our website, the web browser used on your terminal equipment (computer, smartphone or similar) automatically sends information to our web servers, which we store in so-called log files.

What data do we process and for what purposes?

We process the following data:

• Your (external) IP address
• Date and time of access
• Domain name of your internet access provider
• The type and version of browser you are using and the operating system you are using
• URL (address on the internet) of the web page you were on at the time of the access
• The files you retrieve via the respective web page (type of access, name of the retrieved file, URL of the retrieved file, success of the retrieval)
• The amount of data transmitted to you when visiting the respective web page

These data are in principle processed by us solely for the purpose of ensuring stability as well as network and information security.

Processing for other purposes may only be considered if the necessary legal requirements pursuant to Article 6 para. 4 GDPR are met. In that case, we will of course comply with any information obligations pursuant to Article 13 para. 3 GDPR and Article 14 para. 4 GDPR.

On what legal basis do we process your data?

The processing of your data is carried out for purposes of legitimate interests pursuant to Article 6 para. 1 point f GDPR.

Our legitimate interests pursued are the improvement and maintenance of the stability or functionality and the security of our website.

You have the right to object, on grounds relating to your particular situation, at any time to processing based on Article 6 para. 1 point f GDPR.

ONLINE BOOKINGS

On our website, we offer you the option of making travel bookings online. For an optimal booking process, we use the booking system “Kognitiv” (formerly: “Seekda”) of Seekda GmbH, Neubaugasse 10/15, 1070 Vienna, Austria, which processes your data listed below on our behalf bound by instructions and purposes (data processing in accordance with Article 28 GDPR). Further, we use essential cookies in the course of operating the booking system, for which you can find more information below in the section “Use of cookies and other technologies”

What data do we process and for what purposes?

We process the following data:

• Salutation
• First name, last name
• If applicable, company name
• If applicable, birth date
• Telephone number
• E-mail address
• Postal address
• The data you may have entered in the notes field
• If applicable, data on the accompanying person (first name, last name and, if applicable, birth date)

These data are in principle processed by us solely for the purpose of handling, performing and processing your travel booking.

Processing for other purposes may only be considered if the necessary legal requirements pursuant to Article 6 para. 4 GDPR are met. In that case, we will of course comply with any information obligations pursuant to Article 13 para. 3 GDPR and Article 14 para. 4 GDPR.

Note: In this context, we would like to point out that we may also process your data, in particular your e-mail address, which we have received from you in the context of your completed travel booking, in compliance with the legal provisions for marketing purposes in the way of regular delivery of our newsletter (possibly with a personal address) by e-mail, provided that you have not already objected to this processing (“existing customer advertising”). The newsletter contains marketing information, such as information on our own products or service offerings or about corresponding promotions, events, competitions, posts/articles, etc.

On what legal basis do we process your data?

The processing of your data within the scope of the booking process is carried out for the performance of a contract or in order to take steps prior to entering into a contract pursuant to Article 6 para. 1 point b GDPR and for purposes of legitimate interests pursuant to Article 6 para. 1 point f GDPR.

Our legitimate interests pursued are customer care and retention as well as the provision and improvement of our services.

You have the right to object at any time to processing of your data for marketing purposes. The objection does not affect the lawfulness of the processing before the objection. You can exercise your right of objection at any time by unsubscribing from the newsletter by sending an e-mail to info@loewen-hotel.com or by clicking on the unsubscribe link at the end of each newsletter.

• Travel insurance

As part of the booking process, when booking your travel, we offer you the option of also taking out a cancellation and accident insurance for one hotel stay (“Hotel Cancellation Plus”) from Europäische Reiseversicherung AG, Kratochwjlestraße 4, 1220 Vienna, Austria (hereinafter “ERV”). If you make use of this option, we will transmit your data provided during the booking process to ERV. For further processing of your data, ERV is responsible. For details on the further processing of your data, please refer to the complete information (PDF) provided by ERV, in particular the “Information on Withdrawal, Complaints and Data Processing” included therein.

What data do we process and for what purposes?

We process the following data:

• Salutation
• First name, last name
• If applicable, company name
• If applicable, date of birth
• Telephone number
• E-mail address
• Postal address
• If applicable, first and last name of third parties as insured person(s)

These data are in principle processed by us solely for the purpose of providing the service (transmission of your data to ERV).

Processing for other purposes may only be considered if the necessary legal requirements pursuant to Article 6 para. 4 GDPR are met. In that case, we will of course comply with any information obligations pursuant to Article 13 para. 3 GDPR and Article 14 para. 4 GDPR.

On what legal basis do we process your data?

The processing of your data is carried out for the performance of a contract or in order to take steps prior to entering into a contract pursuant to Article 6 para. 1 point b GDPR.

Deposit system

On our website, we offer you the option of making down payments for booked travels or events by credit card (VISA, MasterCard or American Express) or online bank transfer (Jumio or Klarna) via the electronic deposit system at https://www.loewen-hotel.com/en/rooms-suites/down-payment/. For an optimal payment process, we use the deposit system of incert eTourismus GmbH & Co KG, Leonfeldnerstraße 328, 4040 Linz, Austria (hereinafter “incert”), which processes your data listed below on our behalf bound by instructions and purposes (data processing in accordance with Article 28 GDPR). Further, we use essential cookies in the course of operating the deposit system, for which you can find more information below in the section “Use of cookies and other technologies”.

What data do we process and for what purposes?

We process the following data:

• Reservation number
• Booking details
• Down payment amount
• E-mail address

These data are in principle processed by us solely for the purpose of handling, performing and processing your down payment.

Processing for other purposes may only be considered if the necessary legal requirements pursuant to Article 6 para. 4 GDPR are met. In that case, we will of course comply with any information obligations pursuant to Article 13 para. 3 GDPR and Article 14 para. 4 GDPR.

Note: The processing of payments by credit card or online bank transfer is carried out via incert, through their commissioned payment service provider, Unzer Austria GmbH, Grüngasse 16, 1050 Vienna, Austria. This means that the data you provide at the end of the respective payment process for the handling of electronic payment transactions is processed by the payment service provider. We ourselves do not receive any account or credit card-related information (including in particular card number, expiry date or verification number), but only information about when (date and time) you (name, e-mail address) made the respective down payment and in what amount. For payment processing, in so far the terms and conditions and the data protection declaration of the payment service provider are of relevance, to which we also refer for the purpose of further information and assertion of access and other data subject rights.

On what legal basis do we process your data?

The processing of your data is carried out for the performance of a contract or in order to take steps prior to entering into a contract pursuant to Article 6 para. 1 point b GDPR.

Voucher Shop

On our website, we offer you the option of purchasing various vouchers by credit card (MasterCard or VISA) or online bank transfer (Jumio or Klarna) via our voucher shop at https://www.loewen-hotel.com/en/voucher/ and having the respective voucher sent by us at your choice by post (voucher folder) or e-mail (PDF file) to yourself or another person. For an optimal ordering process, we use the voucher system of incert eTourismus GmbH & Co KG, Leonfeldnerstraße 328, 4040 Linz, Austria (hereinafter “incert”), which processes your data listed below on our behalf bound by instructions and purposes (data processing in accordance with Article 28 GDPR). Further, we use essential cookies in the course of operating the voucher system, for which you can find more information below in the section “Use of cookies and other technologies”.

What data do we process and for what purposes?

We process the following data:

• Promocode, if applicable
• Salutation
• Title, if applicable
• First name, last name
• Telephone number
• E-mail address
• Date of birth
• Postal address
• If applicable, company name and VAT no.
• The data you may have provided in your personal message on the voucher
• If applicable, data on the recipient to whom the respective voucher is to be sent (salutation, first name, last name, e-mail address, postal address)

These data are in principle processed by us solely for the purpose of handling, performing and processing your voucher order.

Processing for other purposes may only be considered if the necessary legal requirements pursuant to Article 6 para. 4 GDPR are met. In that case, we will of course comply with any information obligations pursuant to Article 13 para. 3 GDPR and Article 14 para. 4 GDPR.

Note: The processing of payments by credit card or online bank transfer is carried out via incert, through their commissioned payment service provider, Unzer Austria GmbH, Grüngasse 16, 1050 Vienna, Austria. This means that the data you provide at the end of the respective payment process for the handling of electronic payment transactions is processed by the payment service provider. We ourselves do not receive any account or credit card-related information (including in particular card number, expiry date or verification number), but only information about when (date and time) you (name, e-mail address) paid for which voucher (voucher number) and in what amount. For payment processing, in so far the terms and conditions and the data protection declaration of the payment service provider are of relevance, to which we also refer for the purpose of further information and assertion of access and other data subject rights.

On what legal basis do we process your data?

The processing of your data is carried out for the performance of a contract or in order to take steps prior to entering into a contract pursuant to Article 6 para. 1 point b GDPR.

E-Mail-Newsletter

On our website, we offer you the option of subscribing to our e-mail newsletter. If and insofar as you have given us your consent for this, we will process the data listed below as part of the sending of our e-mail newsletter.

We may process your data, in particular your e-mail address, to send you our e-mail newsletter in compliance with the legal requirements, even without your consent, if we have obtained your data from you in the context of the sale of a service or product and you have not already objected to this processing (“existing customer advertising”).

What data do we process and for what purposes?

We may process the following data:

• Salutation
• Name
• E-mail address
• Your (external) IP address
• Date and time of subscription and reconfirmation of subscription
• Opening and click rates (only with correspondingly given consent, i.e. not for existing customer advertising)

The data provided by you are in principle processed by us solely in order to regularly send you our newsletter (if applicable with a personal address) by e-mail and to provide you with marketing information on our products or service offerings or about corresponding promotions, events, competitions, articles, etc.

The data collected in the course of newsletter subscription, including the so-called double opt-in procedure, are in principle processed by us solely for the protection of the offer and for the compliance with our legal obligations to provide proof. With the double opt-in procedure, you will receive an e-mail in the course of the newsletter subscription with a request to reconfirm your subscription to our newsletter. If you do not confirm your subscription by clicking on the confirmation link sent to you, you will not be subscribed for our e-mail newsletter and therefore will not receive it.

In addition, we track and analyse your interactions with our newsletter (measurement of opening and click rates) in order to measure the success of our newsletter and to be able to continuously improve it and design it as needs dictate. No recipient profiles are created in this process. Opening rates are measured with the help of a so-called pixel, a small, invisible image file that is automatically loaded by the web server when the newsletter is opened and thereby provides information that the newsletter was actually opened. The measurement of click rates, on the other hand, is carried out in such a way that after clicking on a web link contained in the newsletter, you are first directed to a web server where your click is registered; only then do you reach the actual target page.

In the case of e-mail newsletters that we send as part of existing customer advertising, no measurement of opening and click rates takes place.

Processing for other purposes may only be considered if the necessary legal requirements pursuant to Article 6 para. 4 GDPR are met. In that case, we will of course comply with any information obligations pursuant to Article 13 para. 3 GDPR and Article 14 para. 4 GDPR.

On what legal basis do we process your data?

The processing of your data is based on your consent pursuant to Article 6 para. 1 point a in conjunction with Article 7 GDPR resp. for the compliance with a legal obligation pursuant to Article 6 para. 1 point c, para. 3 point a GDPR in conjunction with Article 32 GDPR (security) resp. Article 7 para. 1 GDPR (obligation to provide evidence).

In the case of e-mail newsletters that we send as part of existing customer advertising, the processing is carried out for purposes of legitimate interests pursuant to Article 6 para. 1 point f GDPR. Our legitimate interests pursued in this regard are customer care and retention.

You have the right to withdraw given consent at any time with effect for the future and/or to object at any time to processing of your data for marketing purposes. The withdrawal/objection does not affect the lawfulness of the processing before the withdrawal/objection. An isolated withdrawal/objection regarding only the measurement of opening and click rates that may take place (with corresponding consent) is not possible, which means that you will have to unsubscribe from the newsletter as a whole for that. You can unsubscribe from the newsletter at any time by sending an e-mail to info@loewen-hotel.com or by clicking on the unsubscribe link at the end of each newsletter.

In order for you to manage the use of optional cookies on our website, we have implemented a consent management service. Via the consent management service, the first time you access our website, you will be presented with a previously defined query (“Cookies, other technologies and miscellaneous services”), which allows you to accept or decline the use of optional cookies by clicking the appropriate button. In addition, clicking on “settings” will take you to the settings of the consent management service, where you will find inter alia a simplified cookie list, classified by type. With the consent management service, you can inter alia find out about the purposes of the cookies that we use, the data processed in each case as well as any data recipients and, in the case of optional cookies, you can give or withdraw your consent at any time by selecting or deselecting the relevant box.

Please note that essential cookies are already stored upon accessing our website and that the relevant box is preselected. It is not possible to deselect essential cookies via the consent management service. The functionality of the consent management service itself requires the use of certain cookies.

Service provider information:
Usercentrics GmbH, Sendlinger Straße 7, 80331 Munich, Germany

Website:
https://usercentrics.com/

General Terms and Conditions:
https://usercentrics.com/terms-and-conditions/

Privacy Policy:
https://usercentrics.com/privacy-policy/

Booking system

In the course of operating the booking system (see above under “Booking system” in the “Online bookings” tab), we use various session cookies for the error-free display of the booking mask, to temporarily keep track of the shopping cart and to check the credit card.

Service provider information:
Seekda GmbH, Neubaugasse 10/15, 1070 Vienna, Austria

Website:
https://kognitiv.com/hoteltechnology/

Privacy Policy:
https://kognitiv.com/legal/privacy-policy/

Deposit system

In the course of operating the deposit system (see above under “Deposit system” in the “Online bookings” tab), we use a session cookie to temporarily keep track of your input when filling the down payment form over several pages.

Service provider information:
Incert eTourismus GmbH & Co KG, Leonfeldnerstraße 328, 4040 Linz, Austria

Website:
https://www.incert.at/en/

Privacy Policy:
https://www.incert.at/en/data-protection/

Voucher system

In the course of operating the voucher system (see above in the “Voucher shop” tab), we use various session cookies and a persistent cookie with a lifetime or functional life of one day for error-free display and proper functionality.

Service provider information:
Incert eTourismus GmbH & Co KG, Leonfeldnerstraße 328, 4040 Linz, Austria

Website:
https://www.incert.at/en/

Privacy Policy:
https://www.incert.at/en/data-protection/

2. On which legal basis are essential cookies used?

In order to be able to demonstrate that – or whether – you have consented to the use of optional cookies requiring your consent, we store the information about your consent, whether given or not, in order to fulfil our legal obligation to provide evidence in accordance with Article 6 para. 1 point c and Article 6 para. 3 point a GDPR in conjunction with Article 7 para. 1 GDPR.

Furthermore, we use essential cookies for the purposes of legitimate interests in accordance with Article 6 para. 1 point f GDPR.

Our legitimate interests pursued are:

• Ensuring the security and stability of our website and information technology systems, for example by protecting against attacks in the form of targeted server overloads (Denial of Service attacks) or by using optimal load distribution on servers
• Establishment, exercise or defence of legal claims
• Providing and guaranteeing the proper functionalities of our website

3. How can I object to the use of essential cookies?

You can exercise your right to object by means of the blocking options described below under “Deletion/Blocking of Cookies” (cf. Article 21 para. 5 GDPR), i.e. by blocking essential cookies via your web browser settings.

Please note that if you delete without blocking, essential cookies will be used once again when you access our website at a later date. Please also note that deactivating or deleting or blocking essential cookies may affect the performance and functionality of our website and may cause certain features and functions to be unavailable.

II. Optional cookies

Using the following information, we would like to enable you to make a well-founded decision for or against the use of optional cookies and the associated data processing.

1. Which optional cookies are used for what purpose and for how long?

Service Google Analytics
Purpose Web analysis
Service provider Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland
Functional life Up to 2 years

Service Google Ads Conversion Tracking
Purpose Marketing
Service provider Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland
Functional life Up to 2 years

Service Google Ads Remarketing
Purpose Marketing
Service provider Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland
Functional life Up to 2 years

Service Google Ad Manager
Purpose Marketing
Service provider Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland
Functional life Up to 2 years

Web analysis

Subject to your consent, we use web analysis cookies in order to analyse the use of our website and thereby be able to improve it continuously. The anonymised user statistics obtained (e.g. number and origin of website visitors) enable us to optimise our website and improve its design - such as by placing frequently accessed information or topics on our website at the right location to meet demand.

For web analysis we use “Google Analytics”, a web analysis service of Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland; parent company: Google LLC, 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA (hereinafter collectively “Google”), with the “IP anonymization” extension (also called “IP masking method”). To this end, we have concluded a data processing agreement with Google in accordance with Article 28 GDPR. Google will accordingly process the data collected (data about your terminal equipment or web browser, IP addresses and your website or application activities) on our behalf for the purposes of evaluating your use of our website, compiling reports on website activity and providing other services relating to website and internet usage.

The data collected using Google Analytics may be stored and processed in the USA or any other country in which Google or subprocessors of Google maintain facilities. The IP masking method that we use ensures that before the IP address is transferred to a Google server in the USA and stored there, it is shortened within EU member states or in other EEA member states so that no IP address is transferred in its entirety, thereby preventing or considerably complicating identification of a person. Only in exceptional cases will the complete, i.e. entire, IP address be transferred to a Google server in the USA and only shortened there.

For a data transfer to a third country, i.e. a country outside the EU or EEA, appropriate safeguards for the protection of your personal data are generally required. After the Commission Implementing Decision (EU) 2016/1250 of 12 July 2016 on the adequacy of the protection provided by the EU-US Privacy Shield was declared invalid by the European Court of Justice, the EU-US Privacy Shield can no longer be used to guarantee an adequate level of protection in the USA in line with EU standards. Consequently, in the USA there does not currently exist a level of data protection that is equivalent to that prevailing in the EU pursuant to Article 45 GDPR and we cannot provide appropriate safeguards under Article 46 GDPR to offset this shortcoming. As a result, data transfer to the USA is only permitted here with your explicit consent in accordance with Article 49 para. 1 point a GDPR. Possible risks of this data transfer are that access by state authorities, such as security agencies and/or intelligence services, cannot be excluded and your data could be processed by them – possibly without you being informed separately and without you having enforceable rights and effective legal remedies available to you – for reasons of national security, law enforcement or for other purposes in the public interest of the USA.

Service provider information:
Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland; parent company: Google LLC, 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA

Google Ads Data Processing Terms:
https://privacy.google.com/businesses/processorterms/

Terms of Service:
https://marketingplatform.google.com/about/analytics/terms/us/

Overview of data usage in Google Analytics:
https://support.google.com/analytics/answer/6004245?hl=en

Privacy Policy:
https://policies.google.com/privacy

Technical explanation of “IP Anonymization (or IP masking) in Google Analytics”
https://support.google.com/analytics/answer/2763052?hl=en

Additional note:

If you wish to deactivate Google Analytics across all websites, you can download and install the “Google Analytics Opt-out Browser Add-on” at https://tools.google.com/dlpage/gaoptout?hl=en. This option only disables web analysis as long as you are using a web browser for which you have installed the add-on.

Marketing

Subject to your consent, we use marketing cookies. Marketing cookies can detect whether you have accessed an advertised website and what content has been – and is being – used by you to display advertising content that is relevant to you and tailored to your interests, to limit the frequency with which advertisements appear and to measure the success or effectiveness of advertising campaigns.

For marketing purposes we use the following advertising products of Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland; parent company: Google LLC, 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA (hereinafter collectively “Google”).

We use the advertising product “Google Ads” (formerly: “AdWords”), which enables us to display advertisements inter alia in Google search results, in the Google partner network or on other Google platforms. When you interact with an advertisement placed through Google Ads, such as by clicking on an advertisement, “Google Ads Conversion Tracking” uses a cookie to track whether you have subsequently completed an action (“conversion”) defined by us, such as subscribing to a newsletter. The information collected with the help of the cookie involved is provided to us by Google in the form of so-called conversion statistics, from which we can read, for example, the total number of anonymous users who have clicked on our advertisement. We do not ourselves receive any information that would enable personal identification. In addition to Google Ads Conversion Tracking, we use “Google Ads Remarketing”, which enables advertisements to be displayed in the Google partner network during your subsequent internet usage, after you have visited our website. To this end, Google records your usage behaviour when you visit various websites in the Google partner network, whereby, according to Google, pseudonymisation is used. One further advertising product that we use is “Google Ad Manager” (formerly: “DoubleClick”) to present targeted advertisements to you based on your perceived interests. A pseudonymous identification number is assigned to the web browser that you are using in order to check which advertisements have already been displayed in your web browser and which of them you have accessed.

Data collected in the context of Google’s advertising products may be stored and processed by Google inter alia in the USA. We have no influence over further data processing by Google. For a data transfer to a third country, i.e. a country outside the EU or EEA, appropriate safeguards for the protection of your personal data are generally required. After the Commission Implementing Decision (EU) 2016/1250 of 12 July 2016 on the adequacy of the protection provided by the EU-US Privacy Shield was declared invalid by the European Court of Justice, the EU-US Privacy Shield can no longer be used to guarantee an adequate level of protection in the USA in line with EU standards. Consequently, in the USA there does not currently exist a level of data protection that is equivalent to that prevailing in the EU pursuant to Article 45 GDPR and we cannot provide appropriate safeguards under Article 46 GDPR to offset this shortcoming. As a result, data transfer to the USA is only permitted here with your explicit consent in accordance with Article 49 para. 1 point a GDPR. Possible risks of this data transfer are that access by state authorities, such as security agencies and/or intelligence services, cannot be excluded and your data could be processed by them – possibly without you being informed separately and without you having enforceable rights and effective legal remedies available to you – for reasons of national security, law enforcement or for other purposes in the public interest of the USA.

Service provider information:
Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland; parent company: Google LLC, 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA

Website:
https://marketingplatform.google.com

Privacy Policy:
https://policies.google.com/privacy

2. On which legal basis are optional cookies used?

We use optional cookies on the basis of the consent pursuant to Article 6 para. 1 point a in conjunction with Article 7 GDPR.

3. How can I withdraw the consent that I have given to the use of optional cookies?

When you (first) access our website, we request inter alia your consent for the use of optional cookies by means of a predefined query (“Cookies, other technologies and miscellaneous services”). You can withdraw the consent that you have given at any time with effect for the future and thereby prevent further collection of your data by deselecting optional cookies (web analysis, marketing) in the settings of the consent management service.

If and insofar as you do not consent or withdraw consent already given (further) data collection by means of optional cookies requiring consent and the associated data processing will cease. This presents no drawbacks when using the website, unless you also deactivate the cookie functions for essential cookies.

The withdrawal of consent does not affect the lawfulness of processing based on consent before its withdrawal.

As an alternative to withdrawing your consent, you can also make use of the options described below under “Deletion/Blocking of Cookies” to delete or block cookies using the information provided there.

C. Deletion/Blocking of Cookies

Cookies are stored on your terminal equipment, so you have the control over them. If you do not want us to recognise your terminal equipment, you can deactivate or delete cookies already stored on your terminal equipment – manually or automatically – at any time and/or block storage of cookies with future effect by making the appropriate setting in your web browser software, e.g. “do not accept cookies” or similar. Most web browsers can also be configured in such a way that cookie storage is only accepted if you agree to this separately on a case-by-case basis. If you do not wish to accept cookies from our service providers and partners, you should have your web browser set to “block third-party cookies” or similar. Usually, the “Help” function in the menu bar of your web browser shows you how to deactivate or delete cookies already stored there and how to decline new cookies. For details of the options described, please refer to the instructions provided by your web browser manufacturer.

Please note that if you delete without blocking, any essential cookies will be used the next time and we may ask you once again for your consent to optional cookies when you access our website at a later date. Please also note that deactivating or deleting or blocking essential cookies may affect the performance and functionality of our website and may cause certain features and functions to be unavailable.

You can manage the settings for the use of optional cookies and the associated data processing at any time in the settings of the consent management service.

Integration of third-party services

In providing our website, we integrate various content and functional elements (hereinafter also referred to collectively as “services”) that are obtained from the web servers of their respective providers (hereinafter referred to as “third-party providers”). For the proper presentation and provision of the services, it is always necessary that your IP address is transmitted to the respective third-party provider. Although we endeavour to only integrate services where the respective third-party provider only uses the IP address to deliver the services, we have no influence on the further processing by third-party providers.

For data transmissions/transfers requiring consent, we ask you for your consent for the data transmission/transfer to third-party providers/third countries associated with the use of miscellaneous services, among other things, when you access our website for the first time with a previously defined query (“Cookies, other technologies and miscellaneous services”). If you do not already give your consent with this previously defined query, third-party services requiring your consent will be blocked on our website and no data will be transmitted/transferred to third-party providers/third countries. Instead, you can give your consent separately for individual third-party services in each case by clicking on “Accept” in the respective blocker. If in future you no longer wish to give your consent to each third-party service individually and wish to be able to load them without the respective blocker, you have the option of additionally selecting “always accept” and thus also consenting to the associated data transmissions/transfers for all other third-party services which you open on our website in the future.

You can withdraw given consents at any time with effect for the future and thus prevent the further transmission/transfer of your data by deselecting the corresponding services under “Miscellaneous services (optional)” in the settings of the consent management service.

Integrated third-party services:

YouTube videos

We integrate videos from “YouTube” on our website, a service of Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland; parent company: Google LLC, 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA (hereinafter collectively “Google”). For the integrated YouTube videos, the “privacy-enhanced mode” is turned on, so that no cookies for analysing user behaviour are used.

Subject to your consent, we transmit/transfer your data, including your IP address, to Google when you load a YouTube video. The data transmitted/transferred within the scope of YouTube videos may be stored and processed by Google in the USA, among other places. We have no influence on further data processing by Google. For a data transfer to a third country, i.e. a country outside the EU or EEA, appropriate safeguards for the protection of your personal data are generally required. After the Commission Implementing Decision (EU) 2016/1250 of 12 July 2016 on the adequacy of the protection provided by the EU-US Privacy Shield was declared invalid by the European Court of Justice, the EU-US Privacy Shield can no longer be used to guarantee an adequate level of protection in the USA in line with EU standards. Consequently, in the USA there does not currently exist a level of data protection that is equivalent to that prevailing in the EU pursuant to Article 45 GDPR and we cannot provide appropriate safeguards under Article 46 GDPR to offset this shortcoming. As a result, data transfer to the USA is only permitted here with your explicit consent in accordance with Article 49 para. 1 point a GDPR. Possible risks of this data transfer are that access by state authorities, such as security agencies and/or intelligence services, cannot be excluded and your data could be processed by them – possibly without you being informed separately and without you having enforceable rights and effective legal remedies available to you – for reasons of national security, law enforcement or for other purposes in the public interest of the USA.

Third-party provider information:
Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland; parent company: Google LLC, 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA

Website:
https://www.youtube.com

Privacy Policy:
https://policies.google.com/privacy

Webcams

We integrate high-resolution webcam panorama images from “Panomax” on our website, a service of Panomax GmbH, Landesstraße 23, 5302 Henndorf, Austria. For the proper presentation and provision of the webcam panorama images, it is always necessary that technical data (IP address, browser type and version, operating system used, website URL visited, date and time of access) are transmitted to the third-party provider through a direct connection to the third-party provider’s web servers. We have no influence on the further processing by the third-party provider.

The processing of your data is carried out for purposes of legitimate interests pursuant to Article 6 para. 1 point f GDPR.

Our legitimate interests pursued are economic interests (tourism promotion, i.e. the panoramic views are intended to present the surrounding landscape and thus promote tourism).

You have the right to object, on grounds relating to your particular situation, at any time to processing based on Article 6 para. 1 point f GDPR.

Third-party provider information:

Panomax GmbH, Landesstraße 23, 5302 Henndorf, Austria

Website:
https://www.panomax.com/en.html

Terms of Service:
https://www.panomax.com/en/service/terms-of-use.html

Privacy Policy:
https://www.panomax.com/en/datenschutz.html

Google Tag Manager

We use the “Google Tag Manager” on our website, a service of Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland; parent company: Google LLC, 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA (hereinafter collectively “Google”).

The Google Tag Manager is a service with which we can use other services, such as Google Analytics, on our website or manage their use without having to change the source code of the website. The Google Tag Manager itself does not collect or access any personal data, but merely controls and executes the services managed by it, which in turn may process data with your consent, if necessary.

Third-party provider information:
Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland; parent company: Google LLC, 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA

Terms of Service:
https://marketingplatform.google.com/about/analytics/tag-manager/use-policy/

Privacy Policy:
https://policies.google.com/privacy

Data recipients

We may transmit your data to:

• The providers of the functions and any other services you actively use;
• Our service providers that we use in order to achieve the above-stated purposes;
• Courts of law, courts of arbitration, authorities or legal advisers, if this is necessary to comply with current law or for the establishment, exercise or defence of legal claims.

Data transfers to third countries

The transfer of data to bodies in countries outside the European Union or the European Economic Area (so-called third countries) or to international organisations is only permissible (1) if you have given us your consent or (2) if the European Commission has decided that an adequate level of protection exists in a third country (Article 45 GDPR). If the Commission has not made such a decision, we may only transfer your data to recipients located in a third country if appropriate safeguards are in place (e.g., standard data protection clauses adopted by the Commission or the supervisory authority following a specific procedure) and the enforcement of your data subject rights is ensured or the transfer is permissible in individual cases on the grounds of other legal bases (Article 49 GDPR).

Where we transfer your data to third countries, we will inform you of the respective details of the transfer at the relevant points in this data protection declaration.

Data erasure and storage period

We will process your data as long as this is necessary for the respective purpose, unless you have effectively objected to the processing of your data or effectively withdrawn any consent you may have given.

Insofar as statutory retention obligations exist, we will be bound to store the data in question for the duration of the retention obligation. Upon expiry of the retention obligation, we will check whether there is any further necessity for the processing. If there is no longer such a necessity, your data will be deleted.

Data security

We use technical and organisational security measures to ensure that your data is protected against loss, inaccurate alteration or unauthorised access by third parties. Moreover, for our part in every case, only authorised persons have access to your data, and this only insofar as it is necessary within the scope of the above-stated purposes. The transmission of all data is encrypted.

As of: March 2022