Legal information

Privacy policy

goldene linien mit ausgefuelltem herz

1. General information

This Privacy Policy explains the nature, scope and purposes of the collection and processing of your personal data by our business.

The controller responsible for the processing of personal data is:

Johann Angermann

Rabisch 10

9822 Mallnitz

Tel. +43 676 4568736

E-Mail: hoteloswald@aon.at

2. Purposes of Data Processing

This Privacy Policy covers all processing activities relevant to you as a prospective guest, customer, website visitor, newsletter subscriber or other individual whose personal data we process.

The purposes for which we process your personal data can be summarized as follows:

  • Our business activities (hotel operations)
  • Reservations, online check-in and other enquiries
  • Operation and security of our website
  • Cookies and similar technologies
  • Integration of Google Maps

3. Business Activities (Hotel Operations)

We process your personal data in connection with your interest in or use of our services, including the following:

  • Your personal details (e.g. surname, first name, residential address, email address, telephone number, date of birth, gender, country of origin)
  • Information from travel documents provided by you, such as passports, identity cards or driving licences (e.g. document type, document number, date of issue, issuing authority, validity period, nationality and other passport details)
  • Information relating to payment methods and payments (e.g. payment method, payment amount, card number and cardholder)
  • Information relating to your booking or requested services (e.g. requested or booked arrival and departure dates, rooms, preferred language, vehicle registration number for verifying parking eligibility and number of guests)
  • Other information provided or requested in connection with your booking or requested services (e.g. details of accompanying guests, destinations, contact persons, booking conditions, special services, personal preferences, dining arrangements, rental vehicles, transfers, registration procedures, insurance and vouchers)

In certain circumstances, we may also receive personal data from sources other than the individuals concerned. This may occur, for example, when a person making a reservation, a travel agency or a booking platform provides us with such information.

In these cases, we assume that the person for whom the reservation was made has already received information about how personal data is processed by our business, for example through the person making the booking, or that providing this information separately would involve disproportionate effort.

We process the personal data mentioned above on the following legal grounds:

  • Processing necessary for the performance of a contract or to take steps prior to entering into a contract (Article 6(1)(b) GDPR).
  • Your consent, where you have provided it (Article 6(1)(a) GDPR).
  • Compliance with legal obligations to which we are subject, including accounting, taxation, customs, contractual and guest registration requirements (Article 6(1)(c) GDPR).
  • Our overriding legitimate interests within the meaning of Article 6(1)(f) GDPR, such as improving customer service or protecting our legal interests.

Where statutory retention requirements or other legal obligations apply, we retain your personal data in accordance with those obligations.

Accounting data, including books, records and supporting documents pursuant to Section 132 of the Austrian Federal Fiscal Code (Bundesabgabenordnung), as well as information required for the guest register under Section 10 of the Austrian Registration Act (Meldegesetz), is retained for a period of seven years.

Personal data relating to prospective guests or individuals making enquiries, for example by email or through our contact form, that do not result in a booking is retained for a maximum of three years after the last contact.


All other personal data will be deleted no later than three years after the relevant period begins.

If continued retention is necessary after these periods for the establishment, exercise or defence of legal claims, for example in legal proceedings, we will retain the relevant data until those proceedings have been legally concluded.

4. Hosting and Server-Logfiles

Our website is hosted by PEAK.AT / Regional Kabel-TV Mölltal GesmbH & Co KG, Hauptplatz 15, 9821 Obervellach, Austria.

When you access our website, technically necessary data is processed by the web server and may be stored in server log files.

This may include the following information:

  • IP address of the device accessing the website
  • Date and time of access
  • Pages or files accessed
  • Amount of data transferred
  • Browser and operating system used
  • Referrer-URL
  • HTTP status code

This information is processed to ensure the technical operation, stability, functionality and security of our website.


In particular, it helps us identify and investigate technical errors, misuse and unauthorised access.

The legal basis for this processing is our legitimate interest in operating a secure and functional website in accordance with Article 6(1)(f) GDPR.

Server log files are stored only for as long as necessary to ensure the security and functionality of the website and to identify or prevent technical problems or unauthorised access.

Longer retention takes place only where required by law or where the information is necessary for the establishment, exercise or defence of legal claims.

Where the hosting provider processes personal data on our behalf, this is carried out under a data processing agreement in accordance with Article 28 GDPR.

5. Reservations, Online Check-in and Other Enquiries (e.g. by Email)

Reservations, Online Check-in and Other Enquiries

For reservations and, where applicable, online check-in, we use the easybooking hotel software provided by zadego GmbH, Anton-Melzer-Straße 10, 6020 Innsbruck, Austria.

When you submit an enquiry, make a reservation or use online check-in through the easybooking functions integrated into our website, the personal data you enter is processed.

This may include your name, contact details, information about accompanying guests and details of your intended stay or reservation.

You may also contact us by email or telephone regarding rooms, reservations, our services or other general enquiries.

We may also receive enquiries through third parties, such as booking platforms.

In these cases, we process the personal data you provide, particularly your contact and communication details and the content of your enquiry.

The processing is carried out to respond to your enquiry, take steps prior to entering into a contract and perform the accommodation contract.

The legal basis for this processing is Article 6(1)(b) GDPR.

For general enquiries that are not directly related to entering into or performing a contract, processing is based on our legitimate interest in appropriate communication and handling enquiries in accordance with Article 6(1)(f) GDPR.

Where legal obligations apply, personal data may also be processed to comply with guest registration, retention or accounting requirements in accordance with Article 6(1)(c) GDPR.

zadego GmbH processes personal data on our behalf in connection with the provision of easybooking under a data processing agreement in accordance with Article 28 GDPR.

Personal data is disclosed to other recipients only where necessary for processing reservations, where required by law or where another appropriate legal basis exists.

Personal data is retained only for as long as necessary to process the relevant enquiry, manage the reservation or perform the accommodation contract.

Any additional retention takes place only where statutory retention obligations apply or where the data is required for the establishment, exercise or defence of legal claims.

6. Google-Maps

We use Google Maps, a mapping service provided by Google, on our website to display our location and help you find your way to our hotel.

The provider for users in the European Economic Area is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland.

When Google Maps is loaded, personal data, particularly your IP address and technical information about your device and browser, may be transmitted to and processed by Google.

The transfer of data to Google servers outside the European Economic Area, particularly in the United States, cannot be ruled out.

Google Maps is loaded on our website only after you have given your consent through our consent management system.

The legal basis for this processing is your consent in accordance with Article 6(1)(a) GDPR.

Where information is stored on or accessed from your device, this also takes place only with your consent in accordance with applicable telecommunications laws.

Your consent is voluntary and may be withdrawn or changed at any time with future effect using the “Manage Consent” function.

If you do not give your consent, Google Maps will not be loaded.

Further information about Google’s processing of personal data can be found in Google’s Privacy Policy.

7. Google-Reviews/Trustindex

We display Google reviews on our website using the Trustindex service.

The provider is Trustindex Ltd., Hungary.

Trustindex enables us to display publicly available reviews of our business on our website.

When the review widget is loaded, data may be transmitted to and processed by Trustindex.

This may include technical information such as your IP address and details about your browser and device.

The review widget is loaded on our website only after you have given your consent.

The legal basis for this processing is your consent in accordance with Article 6(1)(a) GDPR.

Your consent is voluntary and may be withdrawn or changed at any time with future effect using the “Manage Consent” function.

If you do not give your consent, Google reviews will not be loaded.

Further information about data processing by Trustindex can be found in the Trustindex Privacy Policy.

8. Cookies and similar technologies

Our website uses cookies and similar technologies.

Cookies are small text files that may be stored on your device.

We use technically necessary or functional cookies where they are required for the proper operation and essential functions of our website.

These include, in particular, cookies that store your choices regarding cookie settings.

Our consent management system stores your selected cookie preferences so that they can be taken into account during subsequent visits to our website.

The cookies used for this purpose are stored for up to 365 days.

Where services are used that are not technically necessary and require consent, they will be loaded only after you have given your prior consent.

This applies in particular to the integration of Google Maps and the display of Google reviews through Trustindex.

We use a consent management system to manage your consent preferences.

This allows you to choose which services you wish to accept.

You can change or withdraw your consent at any time with future effect using the “Manage Consent” function.

Where personal data is processed, the legal basis for technically necessary processing is Article 6(1)(f) GDPR.

Processing that requires consent is based on your consent in accordance with Article 6(1)(a) GDPR and the applicable provisions of telecommunications law.

9. Data subject rights / right to object / contact

As a data subject under the GDPR, you generally have the right to access, rectification, erasure, restriction of processing and data portability, subject to the applicable legal requirements.

If you have given us consent to process your personal data, you have the right to withdraw that consent at any time.

The withdrawal of consent does not affect the lawfulness of processing carried out before the withdrawal.

Following withdrawal, we will no longer process your personal data for the purposes covered by that consent.

Where the processing of your personal data is based on our legitimate interests, you have the right to object to such processing.

If you object on grounds relating to your particular situation, we will no longer process your personal data unless we can demonstrate compelling legitimate grounds for the processing that override your interests, rights and freedoms, or where processing is necessary for the establishment, exercise or defence of legal claims.

If your personal data is processed for direct marketing purposes, it will no longer be processed for those purposes once you have objected.

To exercise your rights, please contact:

Email: hoteloswald@aon.at

Hotel Pension Oswald
Rabisch 10
9822 Mallnitz
Austria

You also have the right to lodge a complaint with a data protection supervisory authority regarding the processing of your personal data.

In Austria, the competent authority is:

Austrian Data Protection Authority (Österreichische Datenschutzbehörde)
Barichgasse 40–42
1030 Vienna
Austria

Further information is available at: www.dsb.gv.at