Anfragen Buchen Inquiry Book

Privacy Policy

Below we would like to inform you about how we process your data.

The controller within the meaning of the GDPR is:

Hofgut Touristik GmbH
Wagrainerstraße 24
5602 Wagrain
Austria
Phone: +43 6413 8824
Fax: +43 6413 8824-11
E-mail: info@hofgut.com
Website: www.hofgut.com

The data processed includes:

  • Your first and last name
  • Your e-mail address
  • Your telephone number
  • Your address
  • Number and age of accompanying children
  • Travel, booking and stay data
  • Information provided by you in connection with a booking, enquiry or message

Personal data is processed for the following purposes:

  • Processing booking enquiries
  • Carrying out and processing online bookings
  • Communicating with guests and interested parties
  • Fulfilling an accommodation contract or taking steps prior to entering into a contract
  • Fulfilling statutory documentation and retention obligations

We will delete the data as soon as storage is no longer required or restrict processing if statutory retention obligations apply.

Disclosure of data

Your personal data will only be disclosed to third parties if this is necessary to fulfil our contractual and statutory obligations or if you have given us your express consent. Recipients of your data may include service providers that we use to perform contracts with you, external service providers that support us in IT system maintenance and development, analysis and marketing services and with whom we have concluded a data processing agreement, as well as authorities and public institutions where we are legally obliged to do so.

Security measures and transfer to third countries

Hofgut Touristik GmbH has taken appropriate organisational and technical measures to protect your data against unauthorised access, loss or misuse. Our service providers are contractually obliged to process data only in accordance with our instructions and to take appropriate security measures.

If we transfer your data to third parties outside the European Union (EU) or the European Economic Area (EEA), we will ensure that an adequate level of protection exists, for example through an adequacy decision by the European Commission, the use of EU Standard Contractual Clauses or certification of the recipient under the EU-U.S. Data Privacy Framework.

Rights of data subjects

As a data subject, you have the right of access, rectification or erasure, restriction of processing and objection to the processing of your personal data. If you have given us your consent, you may withdraw it at any time with effect for the future. You also have the right to data portability. Please send your requests, objections or withdrawals informally to the e-mail address stated above.

Questions about data protection

If you have any questions or concerns regarding the processing of your personal data, please contact us using the contact details provided above. We will process your request as quickly as possible.

You also have the right to lodge a complaint with a data protection supervisory authority. The competent supervisory authority in Austria is:

Austrian Data Protection Authority
Barichgasse 40-42
1030 Vienna
Austria

Further information is available at:
https://www.dsb.gv.at

Online booking/enquiry via the website

1. Controller

Hofgut Touristik GmbH
Wagrainerstraße 24
5602 Wagrain
Austria
Phone: +43 6413 8824
E-mail: info@hofgut.com

2. Description and scope of data processing

On our website, you can enquire about or book stays, offers and services. If you use this option, the data entered in the input form will be transmitted to us and stored. This includes in particular:

  • Title, first name, last name
  • E-mail address, telephone number and postal address
  • Number of accompanying travellers, age of children and special requests
  • Booking details such as travel dates, length of stay, room or offer selection and price

For the technical processing of online bookings and enquiries, we use an external reservation or booking system. The processing of booking data by the technical service provider is carried out exclusively on our behalf and in accordance with our instructions on the basis of a data processing agreement pursuant to Art. 28 GDPR. All booking data entered by you is transmitted in encrypted form and protected by appropriate technical and organisational measures.

Disclosure to other third parties only takes place if this is necessary to process your enquiry, process your booking, fulfil the accommodation contract or comply with statutory obligations.

3. Legal basis and purpose of data processing

The processing of personal data serves to process your enquiry, process your booking, communicate with you and fulfil an accommodation contract.

  • Art. 6(1)(b) GDPR: performance of an accommodation contract or steps prior to entering into a contract
  • Art. 6(1)(c) GDPR: compliance with legal obligations, in particular tax and corporate retention obligations
  • Art. 6(1)(a) GDPR: where you give your express consent

4. Storage period

We store your data only for as long as this is necessary to fulfil the contract and statutory obligations. Statutory retention periods may be up to 10 years. After these periods have expired, your data will be deleted.

5. Right to object and removal option

You may object to the processing of your personal data at any time. Please note that, in the event of an objection, a booking or enquiry may no longer be carried out or continued.

Cookiebot

We use the Cookiebot consent management service provided by Usercentrics A/S, Havnegade 39, 1058 Copenhagen, Denmark. This enables us to obtain, document and manage website users’ consent to data processing. Processing is necessary to fulfil a legal obligation (Art. 7(1) GDPR) to which we are subject (Art. 6(1)(c) GDPR).

For this purpose, the following data in particular is processed with the help of cookies:

  • Your IP address, with the last three digits set to “0”
  • Date and time of consent
  • Browser information
  • URL from which the consent was submitted
  • An anonymous, random and encrypted key
  • Your consent status as proof of consent

The key and consent status are stored in the browser for 12 months using the “CookieConsent” cookie. This preserves your cookie preferences for subsequent page requests.

If you activate the “bulk consent” function, a separate, random and unique ID may also be stored with your consent. This key is stored in encrypted form in the “CookieConsentBulkTicket” cookie if the necessary technical requirements are met.

The website cannot function properly without this processing. Usercentrics is the recipient of your personal data and acts as a processor on our behalf. Processing takes place in the European Union. Further information is available at: https://www.cookiebot.com/de/privacy-policy/

Your personal data will be deleted on an ongoing basis after 12 months or immediately after termination of the contract between us and Usercentrics.

Cloudflare

We use the Content Delivery Network (CDN) of Cloudflare Germany GmbH, Rosental 7, c/o Mindspace, 80331 Munich, Germany (Cloudflare), to increase the security and delivery speed of our website. This corresponds to our legitimate interest (Art. 6(1)(f) GDPR). A CDN is a network of globally distributed servers that is able to deliver content to website users in an optimised manner. For this purpose, personal data may be processed in Cloudflare server log files. Please also see the explanations under “Hosting”.

Cloudflare is the recipient of your personal data and acts as a processor on our behalf. This corresponds to our legitimate interest within the meaning of Art. 6(1)(f) GDPR in not operating our own content delivery network.

You have the right to object to the processing. Whether the objection is successful must be determined as part of a balancing of interests.

The processing of the data specified in this section is neither legally nor contractually required. The functionality of the website cannot be guaranteed without this processing.

Your personal data will be stored by Cloudflare for as long as is necessary for the purposes described.

Further information on objection and removal options with regard to Cloudflare can be found at: Cloudflare DPA

Cloudflare has implemented compliance measures for international data transfers. These measures are based in particular on the EU Standard Contractual Clauses (SCCs). Further information is available at: https://www.cloudflare.com/cloudflare_customer_SCCs-German.pdf

Hosting & Content Delivery Network

When you visit our website, we collect the following data in so-called log files, which your browser transmits:

IP address, date and time of the request, time zone difference to Greenwich Mean Time, content of the request, HTTP status code, amount of data transferred, website from which the request originates, and information about browser and operating system.

This is necessary to display our website, ensure stability and security, enable our host to bill us for the services provided and allow efficient delivery of the website. This corresponds to our legitimate interest within the meaning of Art. 6(1)(f) GDPR.

We use the following hosting provider to make our website available.

Kinsta Inc.
Attn: Privacy and Data Protection Team
8605 Santa Monica Blvd #92581
West Hollywood, CA 90069
USA
privacy@kinsta.com

Kinsta primarily uses the Google Cloud Platform service of Google LLC, 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA, for its infrastructure.

Kinsta has implemented compliance measures for international data transfers with Google. These measures are based in particular on the EU Standard Contractual Clauses (SCCs).

Kinsta is the recipient of your personal data and acts as a processor on our behalf. The server location is Germany.

Further information on objection and removal options with regard to Kinsta Inc. can be found at: https://kinsta.com/legal/privacy-policy/

You have the right to object to the processing. Whether the objection is successful must be determined as part of a balancing of interests.

The data will be deleted after 30 days.

The processing of the data specified in this section is neither legally nor contractually required. The functionality of the website cannot be guaranteed without this processing.

Google Analytics 4

This website uses Google Analytics 4, a web analytics service provided by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. Google Analytics 4 uses cookies and similar technologies that enable an analysis of your use of the website.

Google Analytics is activated only after you have given your consent via our consent management system. We use Google Consent Mode v2. IP anonymisation is activated.

The information generated by Google Analytics about your use of this website is usually transmitted to Google servers and stored there. IP anonymisation is used on this website, meaning that your IP address is truncated by Google within Member States of the European Union or in other contracting states to the Agreement on the European Economic Area before transmission.

On behalf of the operator of this website, Google will use this information to evaluate your use of the website, compile reports on website activity and provide the website operator with other services relating to website and internet usage.

Data processing is based on your consent pursuant to Art. 6(1)(a) GDPR, where you have given such consent. You may withdraw your consent at any time with effect for the future.

In addition, this website may use Google Analytics 4 for cross-device analysis of visitor flows, provided that the necessary requirements and consents are in place.

You can prevent the storage of cookies by selecting the appropriate settings in your browser software. You can also prevent Google from collecting and processing your data by changing your cookie settings.

Further information on terms of use and data protection is available at: https://www.google.com/analytics/terms/de.html and https://policies.google.com/privacy.

Google Tag Manager

We use Google Tag Manager provided by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland, on our website.

Google Tag Manager is used to manage and deploy website tags. Google Tag Manager itself does not create user profiles, does not perform independent analyses and does not store cookies on your device. However, as part of the technical provision of the service, the IP address may be transmitted to Google.

Google Tag Manager is used to integrate other services such as Google Analytics, Google Ads or other marketing and analytics services. Where consent is required, these services are activated only after you have given your consent via our consent management system.

Processing is based on our legitimate interest in technically reliable and efficient management of the services used on our website pursuant to Art. 6(1)(f) GDPR. Where personal data is processed by services integrated via Google Tag Manager, the legal basis depends on the respective service used.

Further information on data protection at Google is available at: https://policies.google.com/privacy

Adobe Fonts

Where Adobe Fonts are integrated on our website, we use a service provided by Adobe Systems Software Ireland Limited, 4-6 Riverwalk, Citywest Business Campus, Dublin 24, Ireland. Adobe Fonts enables us to display fonts consistently on our website.

When you visit our website, your browser may transmit information to Adobe, in particular the IP address, browser information, the website accessed, the fonts accessed and the time of access. Adobe uses this information to provide the fonts and to diagnose delivery or download problems.

Processing is based on our legitimate interest in a consistent and appealing presentation of our website pursuant to Art. 6(1)(f) GDPR, provided that the integration is technically required. Where consent is required, processing is based on Art. 6(1)(a) GDPR.

Further information can be found in Adobe’s privacy information at: https://www.adobe.com/de/privacy/policies/adobe-fonts.html

SSL and TLS encryption

Our website uses SSL (Secure Socket Layer) and TLS (Transport Layer Security) technology to encrypt data transmissions. These technologies ensure the integrity, confidentiality and authenticity of the transmitted data so that it cannot be read or modified by unauthorised persons.

When you visit our website, your browser automatically establishes a connection to our server that is encrypted using SSL/TLS. You can recognise this by the fact that the address line of your browser changes from “http” to “https” and the lock symbol appears in the address bar.

Google Ads and Google Conversion Tracking

Our website uses Google Ads, an online advertising programme provided by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. In connection with Google Ads, we also use conversion tracking to measure the effectiveness of our advertising campaigns.

If you reach our website via a Google ad, Google may set a cookie or use a comparable technology. This enables us and Google to recognise that you clicked on the ad and were redirected to our website. Conversion tracking is used to evaluate specific actions on our website, such as enquiries, bookings or other forms of contact.

Google Ads and Google Conversion Tracking are activated only after you have given your consent via our consent management system. The legal basis is Art. 6(1)(a) GDPR. You may withdraw your consent at any time with effect for the future.

Further information on Google Ads and data protection is available at: https://policies.google.com/privacy

Meta Pixel

To measure the effectiveness of our advertising campaigns, we use the Meta Pixel provided by Meta Platforms Ireland Limited, Merrion Road, Dublin 4, D04 X2K5, Ireland, on our website.

This pixel enables us to track the behaviour of visitors who reached our website via a Facebook or Instagram ad. This allows us to evaluate the effectiveness of advertisements and improve our advertising measures.

As a rule, the data collected cannot be directly evaluated by us on a personal basis. However, Meta may link the data to your user account and use it for its own advertising purposes. As the website operator, we cannot fully influence this processing.

The Meta Pixel is activated only after you have given your consent via our consent management system. The legal basis is Art. 6(1)(a) GDPR. You may withdraw your consent at any time with effect for the future.

Further information can be found in Meta’s privacy information at: https://www.facebook.com/privacy/policy/

AI-supported chatbot by chatlyn

We use an AI-supported chatbot provided by chatlyn GmbH, Vienna, to answer general guest enquiries and support pre-contractual communication. In this context, your entries, technical connection data and voluntarily provided contact and travel data are processed.

chatlyn processes this data on our behalf. The legal basis is Art. 6(1)(b) GDPR where your enquiry serves to prepare a stay, and otherwise Art. 6(1)(f) GDPR based on our legitimate interest in efficient guest communication. Where consent is required for individual functions, processing is based on Art. 6(1)(a) GDPR.

Further information about the service provider can be found in chatlyn’s privacy information: chatlyn.

Digital guest directory by Guestnet

We use the digital guest directory provided by Guestnet, a service of Guestnet GmbH, Dantestraße 24, 39042 Brixen, Italy. When using the service, technical connection data as well as stay, contact and service data may be processed, for example for guest information, registrations for activities or the booking of additional services.

Processing is carried out for the purpose of performing your stay pursuant to Art. 6(1)(b) GDPR and on the basis of our legitimate interest in efficient guest communication pursuant to Art. 6(1)(f) GDPR. The data is stored only for as long as is necessary for the stated purposes or to fulfil statutory obligations.

Further information can be found in Guestnet’s privacy information: Guestnet.

Google reCAPTCHA

Our website uses Google reCAPTCHA, a service provided by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland, to protect forms against misuse and automated entries.

For this purpose, reCAPTCHA analyses various technical characteristics, such as IP address, browser and device information, time spent on the website and interactions with the website. The analysis may take place in the background.

Processing is based on our legitimate interest in protecting our website against misuse, spam and automated attacks (Art. 6(1)(f) GDPR). Where reCAPTCHA is loaded only after your consent or consent is required for individual functions, processing is based on Art. 6(1)(a) GDPR.

Further information on Google reCAPTCHA and data protection is available at: https://policies.google.com/privacy and https://policies.google.com/terms

Use of Google Signals

Where you have given your consent, we use Google Signals as part of Google Analytics. Google Signals enables enhanced analysis of user behaviour across different devices.

If you have a Google account and have consented to Google’s “personalised advertising” service, Google may link your usage patterns across different devices. We only receive aggregated and anonymised evaluations.

Processing is carried out exclusively on the basis of your consent pursuant to Art. 6(1)(a) GDPR. You may withdraw your consent at any time with effect for the future. You can also disable the “personalised advertising” setting in your Google account: https://adssettings.google.com/

Further information can be found in Google’s privacy policy: https://policies.google.com/privacy

Transfer of data to the USA and application of the EU-U.S. Data Privacy Framework

We use services on our website where personal data may be transferred to the United States. For certified companies, data transfers may take place on the basis of the EU-U.S. Data Privacy Framework. The European Commission adopted an adequacy decision for this on 10 July 2023.

An adequate level of data protection exists only for companies that are certified under the EU-U.S. Data Privacy Framework. The list of certified companies can be found at: https://www.dataprivacyframework.gov/s/participant-search

Where a service provider is not certified accordingly, we base data transfers to third countries in particular on the European Commission’s Standard Contractual Clauses or other appropriate safeguards pursuant to Art. 44 et seq. GDPR.

Withdrawal of consent and objection to data processing

You have the option to withdraw your consent to the use of marketing cookies and comparable technologies at any time. You will find the link to the cookie settings in the footer of our website. In addition, you can manage usage-based advertising via self-regulatory programmes, e.g. https://www.aboutads.info/choices/ or https://www.youronlinechoices.com/.

Data protection information on the use of Intermaps

On our website, we use the “Intermaps” service to display an interactive map of the ski slopes in our region. Intermaps may use cookies and other technologies to process data about the use of its services. This data may be used to provide the map, optimise the service and, where applicable, for analytics or advertising purposes.

Where Intermaps is not technically necessary, it is integrated only after you have given your consent via our consent management system. In this case, the legal basis is Art. 6(1)(a) GDPR. Where the integration is necessary to provide requested content, processing is carried out on the basis of our legitimate interest pursuant to Art. 6(1)(f) GDPR.

Further information on Intermaps data protection can be found at: https://www.intermaps.com/datenschutz.html

Copyright: Gipfelgold GmbH
Last updated: 10 August 2026