Privacy Policy

1. Privacy at a Glance

Protecting your personal data is important to us. This privacy policy explains which personal data we process when you visit our website or contact us, why we process it and what rights you have. Personal data means any information relating to an identified or identifiable individual.

Technical connection data is generated when you use our website. We also receive information when you send us a message, make a booking enquiry or choose to use additional services. Analytics, advertising and embedded third-party content may involve further processing. Where your consent is required, these services are activated only after you have agreed to their use.

2. Data Controller and Contact Details

Hotel Englhof · Andreas Hotter e.U.
Zellbergeben 28 · 6277 Zellberg · Austria
T +43 5282 3134 · info@englhof.at

You can contact us using these details if you have any questions about data protection or wish to exercise your rights.

3. Legal Basis for Processing Personal Data

Legal Grounds

We process personal data only where a valid legal basis applies. Depending on the circumstances, this may be your consent (Article 6(1)(a) GDPR), steps taken at your request before entering into a contract or the performance of a contract (Article 6(1)(b) GDPR), compliance with a legal obligation (Article 6(1)(c) GDPR), or our legitimate interests (Article 6(1)(f) GDPR). Further details of the applicable legal basis are provided in the relevant sections below.

Retention Periods

We retain your personal data only for as long as necessary for the purpose for which it was collected, or where statutory retention requirements or another lawful reason justify keeping it for longer. In particular, accounting and contractual records may be subject to statutory tax retention periods. Once the purpose no longer applies and there is no other lawful reason to retain the information, we delete or anonymise it.

Recipients and Service Providers

We may use technical service providers, hosting providers, communications providers and the other providers identified in this policy to operate our website and respond to enquiries. Personal data is disclosed only where necessary to provide the relevant service, comply with legal obligations or act on your consent. Where required by law, we enter into data processing agreements with processors in accordance with Article 28 GDPR.

Transfers of Data Outside the EEA

When certain external services are used, personal data may be processed outside the European Economic Area, particularly in the United States. Such transfers take place only in accordance with Articles 44 et seq. GDPR, for example on the basis of a European Commission adequacy decision covering the relevant recipient, appropriate safeguards such as the European Commission's standard contractual clauses, or another applicable legal exception. An adequacy decision applies to companies validly participating in the EU–US Data Privacy Framework. The applicable arrangements depend on the specific service and recipients involved.

Your Rights

Subject to the conditions laid down in the GDPR, you have the right to access your personal data (Article 15), request rectification (Article 16), erasure (Article 17), restriction of processing (Article 18) and, where applicable, data portability (Article 20). You may object to processing based on legitimate interests for reasons relating to your particular situation (Article 21(1) GDPR). You may object to the processing of your personal data for direct marketing purposes at any time and without giving reasons (Article 21(2) GDPR).

You can withdraw your consent at any time with effect for the future. Withdrawal does not affect the lawfulness of processing carried out before that point. Where necessary, we may verify your identity before responding to a request.

You also have the right to lodge a complaint with a data protection supervisory authority, in particular the Austrian Data Protection Authority (Österreichische Datenschutzbehörde), Barichgasse 40–42, 1030 Vienna, Austria, email: dsb@dsb.gv.at, www.dsb.gv.at.

Security of Data Transmission

Our website uses an encrypted HTTPS connection (TLS) to protect data transmitted between your browser and our web server. However, no form of electronic communication can be guaranteed to be completely free of security risks.

4. Website Operation and Enquiries

Hosting

Our website is operated and hosted by Ing. Ulrich Huber, Ginzling 252, 6295 Ginzling, Austria, T +43 676 5617779, info@huber-online.at. In providing these services, the provider may process connection details, IP addresses and technical access information. The legal basis is our legitimate interest in operating a secure and functional website (Article 6(1)(f) GDPR). Where necessary, the provider's data protection obligations are governed by contractual agreements.

Server Logs

When you visit our website, technical information may be recorded in server log files, including your IP address, the date and time of access, pages requested, data volume transferred, browser information, referring website and technical status messages. These records are used to deliver the website, investigate errors and identify potentially abusive access. The legal basis is Article 6(1)(f) GDPR. The specific retention period is determined by the hosting provider's operational security and deletion procedures.

Contact, Enquiry and Booking Forms

When you contact us or submit an enquiry using a form, we process the information you provide, such as your name, email address, telephone number, travel dates, number of guests and message, to respond to you and, where applicable, prepare an offer or arrange a booking. The legal basis is Article 6(1)(b) GDPR where the processing relates to pre-contractual steps or performance of a contract; otherwise, it is Article 6(1)(f) GDPR. Information marked as mandatory is required to process the relevant enquiry. Other details may be provided voluntarily.

We share enquiry details with technical service providers only where necessary for transmission or processing. Enquiry data is deleted when it is no longer needed and no statutory obligation or other lawful basis justifies further retention. For information on forms and marketing services provided through ADDITIVE, please refer to Section 8.

Contact by Email or Telephone

If you contact us by email or telephone, we process your contact details and the information you provide to deal with your enquiry and respond to any follow-up questions. Depending on the nature of your enquiry, the legal basis is Article 6(1)(b) or Article 6(1)(f) GDPR. We retain this information only for as long as necessary to handle your enquiry or comply with legal or other legitimate requirements.

5. Cookies, External Services and Consent Management

Cookies and Similar Technologies

Our website uses essential cookies and, where applicable, comparable storage technologies to enable basic functions and manage your privacy preferences. Analytics services and external content are used only after you have expressly consented to them. Before you give consent, the associated scripts, web fonts, maps, videos and social media content are not loaded from those external providers.

Section 165(3) of the Austrian Telecommunications Act 2021 (TKG 2021) applies in particular to storing information on your device or accessing information already stored on it. Where optional services involve the processing of personal data, the legal basis is your consent under Article 6(1)(a) GDPR. Where applicable, the processing of essential connection and security data is based on Article 6(1)(f) GDPR or compliance with a legal obligation under Article 6(1)(c) GDPR.

Your Choices and Withdrawal of Consent

When you visit our website, you can use our consent management tool to choose which optional categories or services to enable. You can decline these services without losing access to the website's basic functions. External content that you have not authorised remains blocked and may be replaced with a notice or placeholder. If you do not consent to Adobe Fonts, the website uses alternative fonts.

You can change or withdraw your consent at any time with effect for the future using the cookie or privacy settings on our website. This does not affect the lawfulness of processing carried out before withdrawal. You can also delete previously stored cookies through your browser settings. Information about the cookies used, their providers and their lifetimes is available in the consent management tool where technically supported.

Scope of Consent Management

The descriptions below relate to services used on our hotel website. If you follow a link to another website, the privacy policy of that website's operator will apply. Please also refer to Section 8 for external ADDITIVE landing pages and services, which may have their own consent arrangements and processing procedures.

6. Analytics, Social Media and Advertising

Google Analytics

We use Google Analytics to analyse the use of our website. This service is provided by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. Analytics data may include page views, interactions, technical details of your device and the approximate geographical origin of visits. Depending on the configuration, cookies, online identifiers and other usage information may be processed.

Google Analytics is activated on this website only after you have expressly consented. We do not load its analytics functions before you give consent. The legal basis is Article 6(1)(a) GDPR and, where information is stored on or accessed from your device, Section 165(3) TKG 2021. You can withdraw your consent at any time using our cookie settings. Personal data may also be processed outside the European Economic Area; further details of international transfers are provided in Section 3.

Further information: Google Privacy Policy and Google Analytics data privacy and security.

Facebook, Instagram and Social Media Wall

We display content and posts from social networks, in particular Facebook and Instagram, sometimes in the form of a social media wall. These services are operated by Meta Platforms Ireland Limited, Ireland. An additional technical provider may be involved in compiling the posts displayed in a social media wall. If content is retrieved directly from Meta or another external provider, your IP address, browser and device details and information about the page visited may be transmitted. If you are signed in to the relevant platform, it may be possible to associate your visit with your user account.

Our social media wall and embedded Facebook and Instagram content are loaded only after you have expressly consented. Without consent, these embedded services do not establish connections to the relevant external content; a placeholder with an option to enable the content may be displayed instead. The legal basis for consent-dependent processing is Article 6(1)(a) GDPR, where applicable in conjunction with Section 165(3) TKG 2021. You can withdraw your consent at any time using our cookie settings.

Ordinary links to our social media profiles are different: you are taken to the relevant platform only if you choose to follow a link. For further details, see Meta's Privacy Policy. Where joint controllership applies to a specific processing activity, the relevant Meta agreements also apply.

Remarketing and Interest-Based Advertising

If we use technologies on our hotel website to measure advertising performance or display personalised advertising, these are activated only after you have given separate, express consent. Such technologies may process information about visits and interactions and share it with the advertising platforms involved. The legal basis is Article 6(1)(a) GDPR, together with Section 165(3) TKG 2021 for access to or storage of information on your device requiring consent. You can withdraw your consent at any time with effect for the future. Additional information about separate ADDITIVE landing pages is provided in Section 8.

7. Embedded Content and External Services

YouTube

Our website may feature embedded videos from YouTube, a service provided by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. When the embedded player is loaded or a video is played, your IP address, browser and device information and details of your use of the video may be transferred to Google. Cookies or similar technologies may also be used.

YouTube videos are loaded only after you have expressly consented. Until then, a notice or activation option is displayed instead of the video, without loading the embedded YouTube player. The legal basis is Article 6(1)(a) GDPR and, where applicable, Section 165(3) TKG 2021. You can withdraw consent for the future using our cookie settings. Further information: Google Privacy Policy.

Google Maps

We may use Google Maps to show our location and provide travel information. This mapping service is provided by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. Once a map is loaded, your IP address, technical browser details and information about your use of the map may be transmitted to Google.

Google Maps is displayed and loaded on our website only after you have expressly consented. Without consent, the external map remains blocked and may be replaced by a placeholder. The legal basis is Article 6(1)(a) GDPR and, where the service involves access to information on your device, Section 165(3) TKG 2021. You can withdraw your consent at any time through our cookie settings. Further information: Google Privacy Policy.

Adobe Fonts

We use externally hosted Adobe Fonts to control the typography of our website. When these web fonts are requested, your browser connects to Adobe's servers or content delivery network. In order to provide the fonts, your IP address and information about the fonts or website requested are transmitted. According to Adobe, its web font delivery service does not set cookies; Adobe receives the IP address for delivery purposes but states that it does not store it.

Adobe Fonts are loaded from Adobe's external servers only after you have expressly consented. If you have not consented or have withdrawn consent, our website uses alternative system or standard fonts without requesting Adobe Fonts. The legal basis for the processing of personal data associated with this optional connection is Article 6(1)(a) GDPR. You can withdraw your consent at any time using our cookie settings.

Further information: Adobe Fonts Privacy Policy and Adobe Privacy Policy.

External Links

Our website may contain links to websites operated by third parties. When you follow such a link, you leave our website and the data protection information of the relevant website operator applies to any subsequent processing.

8. Additive Online Marketing

ADDITIVE+ LANDINGPAGE - Online Marketing and Landing Pages

Beside our website we do also operate optimized landing pages for means of hotel online marketing. To process your request, reservation, order, activation, registration or the transmission of other contact forms on our website as well as to save and store your data we use cloud services, CRM systems and software provided by ADDITIVE Srl, 39011 Lana (BZ), Italy (“ADDITIVE”), our partner in the field of hotel digital marketing. The adequate level of data protection is based on data processing agreements with the respective company.

Our landing pages use Google Analytics, a web analytics service provided by Google Inc. (“Google”). Google Analytics enables website operators to analyse the user behavior of the visitors. The information about the user behavior is transmitted to and stored by Google on its servers.

Your IP address is collected but immediately anonymised (for example by deleting the last 8 bits). As a result the geolocation data is less accurate.

You can prevent the data collection connected to your use of our online services through cookies and the processing of this data by Google, by installing the browser-plugin available at the following link:
https://chrome.google.com/webstore/detail/google-analytics-opt-out/fllaojicojecljbmefodhfapmkghcbnh

ADDITIVE has an insight into data gathered through Google Analytics. This data will be used only to analyse the use of our websites and to evaluate our marketing and distribution strategies.

Our website and landing pages also use functions provided by ADDITIVE for the multi-channel monitoring of the use of our websites as well as marketing and distribution strategies like landing pages, newsletter and social media presence. Information about your visits and submitted forms on our websites are also transmitted to ADDITIVE in order to evaluate and optimize our marketing and sales measures.

The data processing takes place in accordance with the requirements of art. 6 para. 1 lit f (legitimate interests) of the GDPR.

Our objective in accordance with the GDPR (legitimate interests) is the improvement of our products and services and our web presence through the analysis of the use of our website as well as marketing and distribution strategies.

Our website and our landing pages also use remarketing functions provided by Google Inc. (“Google”) and by Meta Platforms Inc. (“Meta”). Therefore, Meta and Google will know that you have visited our website. This way visitors of our website and of our landing pages will find ads adapted to their interests on Google’s advertising platforms and on the social media platforms Facebook and Instagram.

The data processing takes place in accordance with the requirements of art. 6 para. 1 lit a (consent) of the GDPR.

When you visit our landing pages a banner will inform you about the use of cookies for remarketing functions. Only by clicking on the corresponding button you consent to the use of these cookies. You can deny your consent anytime, by visiting the page containing the cookie information and denying the use in the banner that will be displayed.

ADDITIVE+ MARKETING AUTOMATION - Direktmarketing

In order to increase customer loyalty and to sell our services and additional services we use hotel online marketing software provided by ADDITIVE Srl, 39011 Lana (BZ), Italy (“ADDITIVE”) within the field of hotel marketing automation.
Therefore your data, which we gather and process in connection with your request, reservation, order, activation, registration or the transmission of other contact forms on our website, will be analysed and used to provide you with automatically generated offers for our services and additional services. Through the use of these services and systems your data will be processed and stored, at least in part, also outside of the EU or the EEC. The adequate level of data protection is based on data processing agreements.

You can deny the use of your data for this purpose anytime by clicking on the “unsubscribe” link in the respective message.

The data processing takes place in accordance with the requirements of art. 6 para. 1 lit f (legitimate interests) of the GDPR.

Our objective in accordance with the GDPR (legitimate interests) is the prevention of competitive disadvantages, the increase in brand awareness and the maximisation of our economic success through an optimal use of the acquired contacts.

ADDITIVE+ VOUCHERS

On our website you have the possibility to buy vouchers by using the integrated voucher software. To process your purchase and to save and store your data we use software provided by ADDITIVE Srl, 39011 Lana (BZ), Italy (“ADDITIVE”) in the context of voucher marketing. Through the use of these services and systems your data will be processed and stored in the EU.

The data you provide is required to fulfil the contract or to carry out pre-contractual measures. Without this data we cannot conclude a contract with you. The data will not be transferred to an outside third party, except for your credit card data which will be transferred to the payment provider and to our tax accountant to fulfil our tax obligations.

The data processing takes place in accordance with the requirements of art. 6 para. 1 lit b (processing necessary for the performance of a contract) of the GDPR.

ADDITIVE+ NEWSLETTER

On our website you have the possibility to subscribe to our newsletter. For the subscription we need your email address and your consent to receive our newsletter through ADDITIVE, our provider for hotel e mail marketing. To provide you with relevant information we also gather and process voluntary information concerning interests, name, date of birth and country/region of origin in our hotel newsletter tool.

After signing up for our newsletter you will receive an email containing a link to confirm the subscription.

Your subscription can be cancelled any time by clicking on the cancellation link in the respective newsletter.

To process your subscription, to send our newsletter and to determine openings and clicks we use software provided by ADDITIVE Srl, 39011 Lana (BZ), Italy (“ADDITIVE”). ADDITIVE uses the mailing service provider “Sinch Mailjet”, Paris, France to handle the secure delivery of the newsletter. Through the use of these services and systems your data will be processed and stored, at least in part, also outside of the EU or the EEC. The adequate level of data protection is based on data processing agreements.