Source: https://www.stuben-arlberg.at/en/data-protection-statement/
Timestamp: 2019-04-24 18:21:54+00:00

Document:
Note: For ease of reading, we generally use the term "data", even when referring to personal data. Statutory provisions without reference exclusively refer to the provisions of the GDPR, unless stated otherwise.
In the following, we will inform you about the type, scope, and purpose of data collection and use, in accordance with the provisions of the GDPR.
The legal basis for the temporary storage of data and log files is Art. 6 para. lit. f.
Temporary storage of the IP address by the system is necessary to enable delivery of the website to the user's computer. To this end, the user's IP address must remain stored for the duration of the session.
The data are stored in log files to ensure the website's functionality. The data are also used to optimise the website and to ensure the security of our information technology systems. The data are not evaluated for marketing purposes in connection with this.
Our legitimate interest in data processing pursuant to Art. 6 para. 1 lit. f also lies in these purposes.
The data will be deleted as soon as they are no longer necessary to achieve the purpose for which they were collected. In the case of data collection for provision of the website, this will be undertaken once the respective session has ended.
Should any data be stored in log files, these will be deleted after seven days at the latest. Further storage is possible. In this case, the user's IP addresses will be deleted or distorted, so that assignment of the accessing client is no longer possible.
The collection of data for the provision of the website and the storage of data in log files is absolutely necessary for operation of the website. Consequently, there is no option to object on the part of the user.
The legal basis for the processing of your data using technically necessary cookies is Art. 6 para 1 lit. f. For cookies which are used for analysis purposes, the legal basis is, given that you have provided relevant consent, Art. 6 para 1 lit. a.
The user data collected by technically necessary cookies are not used to create user profiles. The analysis cookies (which are not technically necessary) have the purpose of improving the quality of our website and its content. With the analysis cookies, we learn how the website is used and can constantly optimise our service.
You can subscribe to a free newsletter on our website. The data from the entry fields are transmitted to us when you subscribe to the newsletter. Specifically, we need your email address and optionally your first and last name including your salutation (gender) and company name.
Your consent will be obtained for the processing of the data as part of the subscription process.
Furthermore, your data will in principle not be passed on to third parties (see below for the exception to data processing). Under no circumstances will your contact information be sold or lent out. The data will be used exclusively for sending the newsletter.
The legal basis for processing data after the user has subscribed to the newsletter, given that the user has provided their consent, is Art. 6 para. 1 lit. a.
Your email address is collected in order to deliver the newsletter.
The subscription to the newsletter can be cancelled by the user at any time. A relevant link can be found in every newsletter for this purpose.
When visiting our website, data on the access are collected and stored without personal reference; these data include the browser type, date, the website from which you visited us (referrer), and time of access. We use the Webalizer software for the analyses.
On our web server, the web analytics tool Webalizer uses IP address anonymisation. The IP addresses are not displayed within the analysis tool; a personal reference can no longer be made and you as a user remain anonymous to us. The anonymised data sets are stored on our web server and solely evaluated in-house for statistical purposes.
The controller has integrated the Google Analytics component (with anonymisation function) on this website. Google Analytics is a web analytics service. Web analysis is the surveying, collecting, and analysing of data on the behaviour of visitors to websites. A web analysis service collects, among other things, data on the website from which a data subject has accessed a website ("referrer"), which sub-pages of the website have been accessed, or how often and for how long a sub-page has been viewed. A web analysis tool is mainly used to optimise a website and for cost-benefit analysis of Internet advertising.
The data controller uses the suffix "_gat._anonymizeIp" for the web analysis via Google Analytics. Using this addition, Google shortens and anonymises the IP address of the data subject when accessing our Internet pages from a Member State of the European Union or from another signatory state to the Agreement on the European Economic Area.
The purpose of the Google Analytics component is to analyse the flow of visitors to our website. Among other things, Google uses the data and information obtained to evaluate the use of our website, to compile online reports showing us the activities on our websites, and to provide other services related to the use of our website.
Google Analytics places a cookie on the information technology system of the data subject. Cookies have already been explained above. The placement of this cookie enables Google to analyse the use of our website. Each time one of the individual pages of this website is accessed which is operated by the data controller and on which a Google Analytics component has been integrated, the Internet browser on the information technology system of the data subject is automatically prompted by the respective Google Analytics component to transmit data to Google for the purpose of online analysis. As part of this technical process, Google obtains knowledge of personal data, such as the IP address of the data subject, which allows Google, among other things, to trace the origin of visitors and clicks and subsequently enable commission settlements.
Cookies are used to store personal information, such as the time of access, the location from which the website was accessed, and the frequency of visits to our website by the data subject. Whenever you visit our website, these personal data, including the IP address of the Internet connection used by the data subject, are transmitted to Google in the United States of America. These personal data are stored by Google in the United States of America. Google may disclose personal data collected through the technical process to third parties.
The data subject can prevent cookies being set by our website at any time, as already described above, by using an appropriate setting of the Internet browser used and therefore permanently objecting to cookies being set. Setting the Internet browser used in this way would also prevent Google from placing a cookie on the information technology system of the data subject. In addition, a cookie already set by Google Analytics can be deleted at any time via the Internet browser or other software programmes.
The data will be deleted as soon as they are no longer needed for our recording purposes. In our case, this takes place after 26 months.
The controller has integrated Google AdWords into this website. Google AdWords is an Internet advertising service that allows advertisers to run advertisements in both Google search engine results and the Google advertising network. Google AdWords allows an advertiser to pre-define certain keywords to display an ad in Google's search engine results only when the user uses the search engine to retrieve a keyword-relevant search result. In the Google advertising network, ads are distributed to thematically relevant websites using an automatic algorithm and using the previously defined keywords.
The operating company for the services of Google AdWords is Google Inc., 1600 Amphitheatre Pkwy, Mountain View, CA 94043-1351, USA.
If a data subject accesses our website via a Google advertisement, a so-called conversion cookie will be stored on their information technology system by Google. Cookies have already been explained above. A conversion cookie loses its validity after thirty days and is not used to identify the data subject. The conversion cookie is used to trace whether certain sub-pages, such as the shopping cart of an online shop system, were accessed on our website. The conversion cookie enables both us and Google to track whether a person who has accessed our website via an AdWords advertisement has generated revenue, i.e. has completed or cancelled a purchase of goods.
The data and information collected through the use of the conversion cookie are used by Google to generate visit statistics for our website. We use these visit statistics to determine the total number of users who have been referred to us via AdWords advertisements, i.e. to determine the success or failure of the respective AdWords advertisement and to optimise our AdWords advertisements for the future. Neither our company nor other Google AdWords advertisers receive information from Google that could identify the data subject.
The conversion cookie stores personally identifiable information, such as the web pages visited by the data subject. Whenever you visit our website, these personal data, including the IP address of the Internet connection used by the data subject, are transmitted to Google in the United States of America. These personal data are stored by Google in the United States of America. Google may disclose personal data collected through the technical process to third parties.
The data subject can prevent cookies being set by our website at any time, as already described above, by using an appropriate setting of the Internet browser used and therefore permanently object to the setting of cookies. Setting the Internet browser used in this way would also prevent Google from placing a conversion cookie on the information technology system of the data subject. In addition, a cookie already set by Google Analytics can be deleted at any time via the Internet browser or other software programmes.
Furthermore, the data subject has the option of objecting to interest-based advertising by Google. To do so, the data subject must access www.google.com/settings/ads from every single internet browser currently in use and configure the desired settings there.
We use DoubleClick components on our website, a product of Google Inc., 1600 Amphitheatre Pkwy, Mountain View, CA 94043-1351, USA. This is a special online marketing solution for advertising agencies and publishers.
DoubleClick by Google transmits data to the DoubleClick server with every impression as well as click or other activity. Each instance of data transmission triggers a cookie request to the data subject's browser. If the browser accepts this request, DoubleClick sets a cookie on the information technology system of the data subject. Cookies have already been explained above. The purpose of the cookie lies in the optimisation and display of advertisements. The cookie is used, among other things, to activate and display advertisements which are relevant to the user, as well as to generate reports on advertising campaigns or to improve them. Furthermore, the cookie is used to avoid multiple displays of the same advertisement.
DoubleClick uses a cookie ID; this is required to perform the technical process. For example, the cookie ID is necessary to display an advertisement in a browser. DoubleClick can also use the cookie ID to register which advertisements have already been displayed within a browser to avoid duplicate advertisement activations. DoubleClick can also track conversions with the cookie ID. Conversions are logged, for example, if users were previously shown a DoubleClick advertisement and then make a purchase on the advertiser's website using the same Internet browser.
A DoubleClick cookie does not contain any personal data; however, a DoubleClick cookie may contain additional campaign identifiers. A campaign identifier serves the purpose of identifying campaigns with which users have already come into contact.
Each time one of the individual pages of this website is accessed on which a DoubleClick component has been integrated, the Internet browser on your computer is automatically prompted by the respective DoubleClick component to transmit data to Google for the purposes of online advertisement and commission settlement. As part of this technical process, Google obtains knowledge of data to subsequently enable commission settlement. Google can, among other things, trace that you have clicked certain links on our website.
You can prevent cookies being set by our website at any time, as already described above, by using an appropriate setting of the Internet browser used and therefore permanently object to the setting of cookies. Such a browser setting would also prevent Google from setting a cookie on the information technology system of the data subject; furthermore, cookies that have already been set by Google can be deleted at any time through the settings of an Internet browser or other software programmes.
The controller has integrated components from the Facebook company on this website. Facebook is a social network.
A social network is an Internet-based social meeting place, an online community that usually enables users to communicate with one other and interact in a virtual space. A social network can serve as a platform for the exchange of opinions and experiences or enable the Internet community to provide personal or company-related information. Facebook allows users of the social network to create private profiles, upload photos, and network via friendship requests, among other things.
The operating company of Facebook is Facebook, Inc., 1 Hacker Way, Menlo Park, CA 94025, USA. The entity responsible for the processing of personal data, if the entity in question resides outside the US or Canada, is Facebook Ireland Ltd., 4 Grand Canal Square, Grand Canal Harbour, Dublin 2, Ireland.
On each visit to one of the individual pages of this website, which is operated by the data controller and which has integrated a Facebook component (Facebook plug-in), the relevant Facebook component causes the Internet browser on the information technology system of the data subject to automatically download from Facebook a representation of the corresponding Facebook component. An overview of all Facebook plug-ins can be found at https://developers.facebook.com/docs/plugins/. As part of this technical process, Facebook receives information about the specific sub-page of our website visited by the data subject.
If the data subject is simultaneously logged in to Facebook, Facebook recognises which specific sub-page of our website they have visited for each access of to our website and for the entire duration of the respective visit to our website. This information is collected through the Facebook component and assigned by Facebook to the appropriate Facebook account of the data subject. If the data subject clicks on one of the Facebook buttons integrated on our website, for example the "Like" button, or they leave a comment, Facebook assigns this information to the personal Facebook user account of the data subject and stores these personal data.
Facebook receives information via the Facebook component that the data subject has visited our website whenever they are logged in to Facebook at the same time as accessing our website; this happens regardless of whether the data subject clicks on the Facebook component or not. If data subjects do not want this information to be transmitted to Facebook, they can prevent it from being transmitted by logging out of their Facebook account before accessing our website.
The data policy published by Facebook available at https://de-de.facebook.com/about/privacy/ provides information on the collection, processing, and use of personal data by Facebook. It also explains what setting options Facebook offers to protect the privacy of the data subject. In addition, various applications are available that make it possible to suppress data transmission to Facebook. Such applications can be used by the data subject to suppress the transfer of data to Facebook.
For more information, please visit Facebook's data protection statement at https://www.facebook.com/about/privacy/. If you wish to object to data collection via Custom Audience, you can deactivate "Custom Audience" here.
The data will be deleted as soon as they are no longer needed for our recording purposes. In our case, this will be after 180 days.
The controller has integrated YouTube components on this website. YouTube is an Internet video portal that enables video publishers to post video clips and other users to view, rate, and comment on them free of charge. YouTube allows the publication of all types of videos. Complete film and television programmes, music videos, trailers, and videos produced by users themselves can therefore be called up via the Internet portal.
Each time one of the individual pages of this website, which is operated by the data controller and on which a YouTube component (YouTube video) has been integrated, is accessed, the Internet browser on the information technology system of the data subject is automatically prompted by the respective YouTube component to download a display element of the corresponding component from YouTube. For more information about YouTube, please visit https://www.youtube.com/yt/about/. As part of this technical process, YouTube and Google receive information about which specific sub-page of our website was visited by the data subject.
If the data subject is logged in to YouTube at the same time, YouTube recognises which specific sub-page of our website the data subject visits when they call up a sub-page that contains a YouTube video. This information is collected by YouTube and Google and assigned to the respective YouTube account of the data subject.
YouTube and Google receive information via the YouTube component that the data subject has visited our website whenever the data subject is logged in to YouTube at the same time as accessing our website; this happens regardless of whether the data subject clicks on a YouTube video or not. If data subjects do not want this information to be transmitted to YouTube and Google, they can prevent it from being transmitted by logging out of their YouTube account before accessing our website.
The data protection provisions published by YouTube, which can be accessed at https://www.google.com/policies/privacy/, provide information about the collection, processing, and use of personal data by YouTube and Google.
Alternatively, you can contact us via the email address provided. In this case, the user's personal data which are transmitted along with the email will be stored.
The data will not be disclosed to third parties during the course of this. The data are used exclusively for processing the conversation.
The legal basis for processing the data, given that the user's consent to this has been obtained, is Art. 6 para.1 lit. a GDPR.
The legal basis for processing the data transferred in the course of sending an email is Art. 6 para.1 lit. f GDPR. If you send us an email with the intention to enter into a contract with us, this creates an additional legal basis for its processing under Art. 6 para.1 lit. b GDPR.
The processing of personal data from the input screen is only used by us for processing the contact. In the event of contact by email, this also constitutes the necessary legitimate interest in processing the data.
The processing of other personal data during the sending process is carried out for the purpose of preventing the misuse of the contact form and ensuring the security of our information technology systems.
All data are deleted as soon as they are no longer required to achieve the purpose for which they were collected. For the personal data from the contact form input screen and the data that were sent by email, this is the case when the respective exchange with the user has been completed. The exchange will be deemed as completed when the circumstances indicate that the matter in question has been fully resolved.
Personal data which were additionally collected during the sending procedure will be deleted at the latest after a period of seven days.
The user has the option of revoking his or her consent to the processing of personal data at any time. A user who has contacted us by email can object can at any time object to the storage of his or her personal data. It will not be possible to continue the conversation in this case.
Please inform us of any revocation by using our e-mail address specified above. In this case, all personal data stored when establishing contact with us shall be deleted.
If you make a request or booking through our website, we collect the data necessary to reply to you or make a reservation for you. In particular, this includes your name, your telephone number, your email address ("contact details"), as well as the date of your arrival and departure, your hotel, and the type of room booked ("booking details").
Alternatively, you can contact us via the email address provided. In this case, the user's personal data that is transmitted along with the email will be stored.
The legal basis for processing the data transferred in the course of sending an email is Art. 6 para.1 lit. f GDPR. If you send us an email with the intention of entering into a contract with us, this creates an additional legal basis for its processing under Art. 6 para.1 lit. b GDPR.
When you make a request or booking with us, your request or booking details will be forwarded to the selected accommodation provider to make your reservation possible in the first place. Furthermore, your data will generally not be passed on to third parties (see below for the exception to data processing). Under no circumstances will your contact information be sold or lent out. Legal regulations and corresponding judicial or official instructions obligate us , in exceptional cases, to disclose data to the mandating authorities or courts. This will only take place within the scope of our legal obligations.
The processing of other personal data during the sending process is carried out for the purpose of preventing misuse of the contact form and ensuring the security of our information technology systems.
All data are deleted as soon as they are no longer required to achieve the purpose for which they were collected. For the personal data from the contact form input screen and the data that was sent by email, this is the case when the respective exchange with the user has been completed. The exchange will have ended when it is evident from the circumstances that the matter at hand has been conclusively resolved.
The user has the option of revoking his or her consent to the processing of personal data at any time. A user who has contacted us by email can object at any time to the storage of his or her personal data. It will not be possible to continue the conversation in this case.
Please inform us of any revocation by using our email address specified above. In this case, all personal data stored when establishing contact with us shall be deleted.
You can request information on whether we are processing personal data that concerns you.
The purposes and categories of personal information that are being processed, including the recipients or categories of recipients to whom data have been or will be disclosed, as well as the planned duration of the storage of your data. If we use profiling technologies, we are obligated to provide you with meaningful information about the logic used, the scope, as well as the intended implications such processing might have for you. Furthermore, we are obligated to inform you about your right to complain to a data protection authority. You additionally have the right to request information on whether the data which concern you will be transmitted to a third-party country or an international organisation.
(4) if you have filed an objection to the processing of your data and it is not yet clear whether our justifiable grounds outweigh yours.
If the processing of your data has been restricted, such data – apart from being stored – may be processed only with your consent or for the purpose of asserting, exercising, or defending claims or for the protection of the rights of another natural or legal person.
If the processing has been restricted in accordance with the above conditions, you will be informed by us before the restriction is lifted.
(2) you revoke your consent and there exists no other legal basis for data processing.
(3) You file an objection against the processing pursuant to Art. 21 para. 1 and there exist no overriding legitimate reasons for the processing on our part, or if you file an objection against the processing pursuant to Art. 21 para. 2.
(4) Your data have been processed unlawfully.
(2) for the assertion, exercise, or defence of legal claims.
You have the right to object at any time to the processing of your personal data on the basis of Art. 6 para. 1 lit. e or f GDPR for reasons arising from your particular situation. This includes profiling based on these provisions.
We will then no longer process your data, unless we have compelling legitimate grounds for processing that outweigh your interests, rights, and freedoms, or if the processing is intended to assert, exercise, or defend legal claims.
If your data are processed for direct marketing purposes, you have the right to object at any time to the processing of the personal data that concern you for the purpose of such marketing; this also applies to profiling, insofar as it is associated with such direct marketing.
If you object to processing your data for direct marketing purposes, the data which concern you will no longer be processed for these purposes.
You have the right at any time to revoke your data protection declaration of consent. The revocation does not affect the lawfulness of processing based on consent before its withdrawal.
Without prejudice to any other administrative or judicial remedy, you have the right of appeal to a supervisory authority, in accordance with § 24 et seq. Federal Data Protection Act of 2018 (BDSG 2018), if you believe that the processing of your data is in contravention of the GDPR.
The data supervisory authority shall inform the appellant of the status and results of the appeal, including the possibility of a judicial remedy.

References: Art. 6
 Art. 6
 Art. 6
 Art. 6
 Art. 6
 Art. 6
 Art. 6
 Art. 6
 Art. 6
 Art. 6
 Art. 21
 Art. 21
 Art. 6
 § 24