DATA PROTECTION
As of: February 9, 2024
1. General information
The protection of your personal data is very important to us. We process your personal data exclusively on the basis of the statutory provisions (GDPR, DSG, TKG 2003).
In order to provide our website and our services, we process information about you, known as personal data – or “data” for short. The term “processing” refers to any handling of data, such as the collection, storage, use, and deletion of personal data.
We are happy to inform you about the processing of your personal data and your rights under data protection regulations in our privacy policy.
The entity responsible for processing your personal data is:
GSL THERMENHOTEL LOIPERSDORF GMBH
Schaffelbadstraße 219, 8282 Bad Loipersdorf
Tel-Nr.: +43 3382 20 000 7009
E-Mail:
If you have any complaints, questions, or suggestions regarding data protection, please do not hesitate to contact us at any time using the contact details provided.
2. Data processing within the scope of our website
2.1. General information
Within the scope of our website, we process data that you provide to us (e.g. in the context of inquiries), logs (for security reasons, our servers log who makes inquiries) and cookies (these are small text files that are stored on your device and contain information to recognize you).
The web server for the operation of our website is technically operated by internex GmbH as a processor.
Internex acts as a processor for us and may only use the transmitted data to process specific orders and is contractually obliged to comply with the legal provisions on data protection.
To prevent third-party cookies from being set, you can block third-party cookies in your browser. Here you will find instructions for the most common browsers:
Firefox: here
Chrome: here
Internet Explorer: here
Safari: Third-party cookies are blocked by default in Apple's Safari browser.
2.2. Data processing for the operation and security of our website (server logs):
2.2.1. Server logs
Purpose of processing: When you visit our website, the web server collects usage data (so-called server logs). The collection of this data is necessary to enable the connection to our server and the use of the website from a technical point of view. In addition, this data is used to defend against and analyze attacks.
The following server logs are collected: The IP address of the requesting device, together with the date, time, request, which file is requested (name and URL), how much data is transferred to you, a message indicating whether the request was successful, identification data of the browser and operating system used, and the website from which access was made (if access was via a link).
Legal basis for processing: Your data is processed on the basis of our legitimate interest in ensuring the operation of the service and system security.
Recipients of the data: The web server for the operation of our website is technically operated by the IT service center internex GmbH as a processor. In the event of a hacker attack, the data from the server logs will be passed on to the law enforcement authorities. No further transfer to third parties will take place.
2.3. Data processing for marketing purposes:
2.3.1. Web analysis
We use the tool listed below to process data about your use of our website in order to tailor it to your interests as closely as possible.
GOOGLE ANALYTICS
A web analysis service provided by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland (“Google”)
Purpose of processing: Google Analytics stores cookies to recognize you and then create personalized user statistics about your website activities. In addition, we have activated Google's “anonymize IP” module. To do this, Google anonymizes the IP address assigned to you within the European Union. The cookies stored by Google Analytics on your device are based on the data protection settings of the Cookiebot cookie banner.
Legal basis for processing: Your data is processed on the basis of your consent. If you agree to the processing of your data on our cookie banner, you consent to us processing your data to the extent described here.
Recipients of the data: The information generated by the cookie about your use of the website is usually transferred to a Google server in the USA and stored there. The adequate level of protection for the transfer is provided by standard contractual clauses in accordance with Art. 46 GDPR. Further information on the standard contractual clauses and suitable or appropriate safeguards can be found at https://privacy.google.com/businesses/processorterms/. Google acts as a processor for us and may only use the transmitted data to process specific orders and is contractually obliged to comply with the legal provisions on data protection.
Further information: You can prevent the storage of cookies by adjusting your browser software settings accordingly; however, we would like to point out that in this case you may not be able to use all functions of the websites to their full extent. You can also prevent Google from collecting the data generated by the cookie and relating to your use of the websites (including your anonymized IP address) and from processing this data by downloading and installing the browser plugin available at the following link (http://tools.google.com/dlpage/gaoptout?hl=de).
2.3.2. Re-marketing
We also use the re-marketing function of Google Ads and Google DoubleClick, an online marketing service provided by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland (“Google”), on our website.
Purpose of processing: To display advertising tailored to you on our website and to evaluate your interaction with these advertisements. The use of this tool also enables us to present interest-based advertisements.
Legal basis for processing: Your data is processed on the basis of your consent.
Recipients of the data: The information generated by the cookie about your use of the website is usually transferred to a Google server in the USA and stored there. The adequate level of protection for the transfer is provided by standard contractual clauses in accordance with Art. 46 GDPR. For more information on standard contractual clauses and appropriate or adequate safeguards, please visit https://privacy.google.com/businesses/processorterms/. Google acts as a processor for us and may only use the transmitted data to process specific orders and is contractually obliged to comply with the legal provisions on data protection.
2.4. Data processing in the context of our social media activities:
We use so-called “social media plugins.” These enable us to display interactive elements or content (e.g., text posts, graphics, images, and videos) from social media services. These plugins can be used to transmit data, including personal data, to social media service providers, which may then use this data.
When you visit our website, the social media plugins first establish a direct connection between your browser and the server of the social media service provider once you have consented to the transfer of data.
We currently use social media plugins from the following services:
FACEBOOK
We use plugins from the Facebook service on our website. The plugins can display interactive elements or content (e.g., videos, graphics, or text posts) and can be recognized by one of the Facebook logos (white “f” on a blue tile, the terms “Like,” “I like it,” or a “thumbs up” sign). With the help of the plugins, you can “like” a post on our website or share it on Facebook. Data will only be transferred to Facebook once you have consented to its use.
The cookies stored by Facebook on your device are based on the data protection settings of the Cookiebot cookie banner.
Further information about Facebook and the exact scope and purpose of data processing can be found in Facebook's privacy policy at https://www.facebook.com/privacy/explanation. Facebook Ireland Ltd., 4 Grand Canal Square, Grand Canal Harbour, Dublin 2 Ireland, is responsible for data processing.
2.5. Other third-party providers
We also use the following third-party providers to improve our website:
GOOGLE MAPS
By integrating Google Maps, we can display Google's map service directly on our website and enable you to use the map function. By integrating Google Maps, data may be sent to Google and used by Google if necessary. When you visit our website, data is not automatically transmitted to Google.
When integrating Google Maps into our website, we use the so-called “two-click solution.” When you visit our website, data is therefore not automatically transmitted to Google. Only when you click on the corresponding button on the Google Maps map will data be transmitted to Google.
The appropriate level of protection for the transmission is based on standard contractual clauses in accordance with Art. 46 GDPR. Further information on the standard contractual clauses and suitable or appropriate safeguards can be found at https://privacy.google.com/businesses/processorterms/. Google acts as a processor for us and may only use the transmitted data to process specific orders and is contractually obliged to comply with the legal provisions on data protection.
Matterport 360° Tour
With the integration of Matterport, Inc., our virtual tour can be viewed on our website and its features can be used.
For more information about Matterport, Inc. and the exact scope and purpose of data processing, please refer to Matterport, Inc.'s privacy policy at https://matterport.com/de/privacy-policy Matterport, Inc., 352 E. Java Dr. Sunnyvale, CA 94089, USA, Gordon House, Barrow Street, Dublin 4, Ireland, is responsible for data processing.
3. Data processing for direct marketing purposes:
Purpose and legal basis of processing: If we have received your contact details in connection with a service, we also process this data in order to send you (advertising) information by post and email (including newsletters) about our own similar products and services on the basis of our legitimate interest.
If you no longer wish to be contacted by us, no problem. Simply contact us at .
Recipients of the data: The following service providers receive your data in order to create and send the newsletter on our behalf:
MAILCHIMP
An email marketing platform provided by the US company The Rocket Science Group, LLC, 675 Ponce de Leon Ave NE Suite 5000, Atlanta, GA 30308, USA. This company acts as a processor for us and may only use your data to process specific orders. It is contractually obliged to comply with the legal provisions on data protection. The appropriate level of protection for the transfer of data to the USA is provided by standard contractual clauses in accordance with Art. 46 GDPR. Further information on standard contractual clauses and suitable or appropriate safeguards can be found at https://mailchimp.com/legal/data-processing-addendum/.
Further information: We process your data on the basis of your consent until you revoke your consent or unsubscribe from the newsletter.
4. Data processing in the context of business operations:
4.1. Data processing in the context of establishing contact:
Purpose of processing: When you contact us (e.g., by email, contact form, or telephone), we process the data you provide in the context of establishing contact only to the extent necessary to process your inquiry or request.
Legal basis for processing: Your data is processed for the purpose of implementing pre-contractual measures or fulfilling a contractual relationship, or is based on our legitimate interest in organizing the response to your inquiry.
Recipients of the data: This data will only be transferred if the transfer is necessary for responding to the inquiry.
Further information: We process your data for as long as is necessary to process the inquiry and, in addition, for a further seven years after the last contact with you in the event of a follow-up inquiry.
4.2. Data processing for the purpose of performing administrative tasks
Purpose of processing: We operate a customer relationship management system and process your data in order to document and improve our customer relations with you (documentation of the content of communications between our employees and you).
Legal basis for processing: Your data is processed on the basis of our legitimate interest in optimizing customer-specific communication with you.
Recipients of the data: Your data will not be transferred to third parties pursuing their own purposes.
Further information: We store your data until the end of the third year after our last contact with you.
5. Your rights
5.1. Right to information about stored data in accordance with Art. 15 GDPR
You have the right to request information about whether we process your personal data. If this is the case, you have the right to information about this personal data and other information related to the processing.
5.2. Right to rectification of inaccurate data pursuant to Art. 16 GDPR
In the event that personal data we process about you is no longer accurate or is incomplete, you may request that this data be rectified and, if necessary, completed.
5.3. Right to erasure of data in accordance with Art. 17 GDPR
If the legal requirements are met, you may request the erasure of your personal data.
5.4. Right to restriction of data pursuant to Art. 18 GDPR
If the legal requirements are met, you may request the restriction of the processing of data concerning you.
5.5. Right to data portability pursuant to Art. 20 GDPR
If the legal requirements are met, you may request the transfer of your data in a structured, commonly used, and machine-readable format.
5.6. Right to object to unreasonable data processing pursuant to Art. 21 GDPR
For reasons arising from your particular situation, you may object at any time to the processing of data concerning you that we process on the basis of a legitimate interest pursuant to Art. 6 (1) (f) GDPR.
5.7. Right to withdraw consent
If processing is based on a declaration of consent, you have the option of withdrawing this consent at any time without affecting the legality of the processing carried out on the basis of the consent until withdrawal.
5.8. Right to lodge a complaint with the data protection authority
If you believe that our processing of your personal data violates applicable data protection law or that your data protection rights have been violated in any other way, you have the option of lodging a complaint with the competent supervisory authority (Austrian Data Protection Authority). The address is:
Austrian Data Protection Authority
Barichgasse 40-42, 1030 Vienna
Telefon: +43 1 52 152-0
E-Mail:
6. Further information:
We require the data we ask you to provide in order to process and provide our services within the framework of the contractual relationship or to provide information you have requested from us or when sending our newsletters and other information.
If you do not provide the data, we will not be able to provide our services.
There is no automated decision-making, including profiling. If we process your personal data for a purpose other than that for which we collected it, we will notify you of this fact and inform you of this other purpose.
