Privacy Policy

A) Data of the responsible party

Responsible within the meaning of the GDPR is:

HOTEL EDELWEISS & GURGL ® SCHEIBER GMBH
Schäfergasse 1
6456 Obergurgl
Austria

Phone: +43 5256 6223
E-mail: info@gletscherblick-gurgl.com
VAT ID number: ATU 61911417

Hereinafter referred to as "we". For further questions on the subject of data protection, please contact info@gletscherblick-gurgl.com.

B) Information on the collection & processing of your data

1. Scope of data processing

We only use personal data if it is necessary for the functioning of our website and the provision of our content and services. Whenever we process your personal data, we do so in compliance with the provisions of the GDPR, in particular in compliance with the lawfulness requirements for data processing pursuant to Art. 6 GDPR.

2. Legal basis

We process your personal data on the basis of your consent if this is necessary for the fulfillment of the contract or if we have a legitimate interest in data processing (Art. 6 para. 1 lit. a & f GDPR). If we base our data processing on your consent (Art. 6 para. 1 lit. a), you have the right to revoke any consent you may have given to the use of your personal data at any time. To do so, please use the contact address under A).

3. Storage & deletion of data

Personal data, if collected, will only be retained by us for as long as necessary to fulfill our contractual or legal obligations. If you have contacted us, we may retain your data for up to one year to evaluate the effectiveness of our sales and marketing. We delete the data collected as soon as this purpose of collection has been fulfilled, unless there is a need to retain it until the end of the statutory limitation period for evidentiary purposes or due to legal retention obligations.

C) Processing purposes

When we collect your personal data, we do so for one of the following reasons:

• Operation of the website 
• Newsletter subscription management 
• Tracking (analysis of visitor traffic)
• Social media presence (e.g. Facebook fan page)

If personal data is collected on our website for the purposes of providing a functional website, newsletter subscription management, tracking or social media presence, it may be processed for the following purposes:

• To improve the website (e.g. heatmaps, A/B tests)
• To personalize the website experience (display results from tracking data, third-party content)
• To analyze user behavior on the website
• To enable communication with you (e.g. to inform you of news by newsletter)

1. Scope of data processing when accessing our website

Each time you visit our website, we process the following data:

Data that is always processed:

• type of browser
• device category & operating system
• IP address of the page from which the file was requested (so-called "referrer URL")
• your internet service provider (ISP)
• approximate geographical location
• the name of the file 
• websites or sources from which you came to us
• the date and time of the request (so-called "time stamp") 
• the amount of data transferred and the access status (file transferred, file not found, etc.) 
• a description of the type of web browser used (e.g. Mozilla Firefox, Google Chrome, Microsoft Internet Explorer, Microsoft Edge, Apple Safari, Opera, etc.)

Data collected on the basis of the user's consent:

• websites that you visit from our website
• clicks
• mouse movements
• scroll depth
• events on the website (e.g. video views, inquiries, purchases, etc.)
• number of users 
• session statistics 
• approximate location determination 
• browser and device information

D) Contact

• If you fill out a contact form or send us an e-mail or other electronic message, your details will only be stored for the purpose of processing the inquiry, possible further questions in connection with it, and will only be used within the scope of the inquiry. 
• The legal basis for processing your request is Art. 6 para. 1 lit. a or b GDPR.
• We will delete your personal data after your request has been dealt with.

1. Newsletter

• When you register for our newsletter, we will immediately send an e-mail containing a hyperlink to the e-mail address you have provided. By clicking on this link, you confirm your newsletter registration (double opt-in procedure). If this registration confirmation is not received within 7 days, we will delete the e-mail address from our temporary list and no registration will take place.
• By confirming your newsletter registration, you consent to the storage of your e-mail address including the date of registration, IP address and the respective list name of the desired newsletter. We only use your e-mail address and the personal data collected at the same time (salutation, first name, last name, e-mail address, telephone number, home address) for the administration and sending of the newsletter you have requested at the periodicity specified during registration.
• Our newsletters do not contain any obvious or hidden counters, third-party advertising or links to external sites that are not directly related to the content of our newsletter.
• The legal basis for sending you a newsletter is Art. 6 para. 1 lit. a GDPR.
• Each newsletter contains a note on how you can unsubscribe from the newsletter.

2. Social Plugins

All integrated social plugins work using the 2-click method; this means that the recording of your surfing behavior by a plugin only starts when you activate the corresponding plugin by clicking on it. If you are logged into your social media platform account at the same time as visiting our website, for example, the page visit can be assigned to your user account after activating the plugin (first click).

E) Data security

We use the widespread SSH encryption method in conjunction with the highest encryption level supported by your browser when you visit our website. You can tell whether an individual page of our website is transmitted in encrypted form by the closed display of the key or lock symbol in the address bar of your browser.

We also use other suitable technical and organizational security measures to protect your data against accidental or intentional manipulation, partial or complete loss, destruction or unauthorized access by third parties. Our security measures are continuously improved in line with technological developments.

F) Recipients of data and data transfer to third countries

1. Recipients of data

We do not sell, trade or transfer personal data to uninvolved third parties. Exceptions are trusted partners or service providers who assist us with the website, business operations or service delivery. Although these trusted third parties may have access to personal data, they are bound by contract to keep this information confidential.

We may also disclose your information as we believe necessary to comply with the law, enforce our site policies, or protect our or others' rights, property, or safety. In addition, information about visitors that is not directly identifiable may be shared with third parties for marketing, advertising or other purposes.

We only pass on the data collected by us to third parties if it is necessary for the fulfillment of a contract, to ensure the technical function of the website or if there is another legal reason for passing on the data.

In some situations, we use service providers to process personal data. These may include data centers that host the website and databases, IT providers that maintain the systems, and consulting firms. When data is passed on to these service providers, they only use the information to fulfill their specific tasks. They have been carefully selected and commissioned by us. They contractually follow our instructions and have taken appropriate measures to protect the rights of data subjects. A list of service providers:

Company	Address	Function	Website
Seekda Hospitality Solutions GmbH	Neubaugasse 10/15, 1070 Wien, Austria	Booking software (KUBE)	seekda.com
Intermaps AG	Untere Paulistrasse 6b, 8834 Schindellegi, Switzerland	Widget (Maps)	intermaps.com
TrustYou GmbH	Schmellerstraße 9, 80337 München, Germany	Widget (Ratings)	trustyou.com
Panomax GmbH	Landesstraße 23, 5302 Henndorf, Austria	Widget (Webcams)	panomax.com
Google Ireland Limited	Gordon House, Barrow Street, Dublin 4, Ireland	Analysis tool/Marketing tool (Analysis & Advertising)	policies.google.com
Meta Platforms Ireland Limited	Merrion Road, Dublin 4, D04 X2K5, Ireland	Analysis tool/Marketing tool (Analysis & Advertising)	facebook.com
Microsoft Ireland Operations Limited	One Microsoft Place, South County Business Park, Leopardstown, Dublin 18, D18 P521, Ireland	Analysis tool/Marketing tool (Analysis & Advertising)	privacy.microsoft.com
LinkedIn Ireland Unlimited Company	Wilton Place, Dublin 2, Ireland	Analysis tool/Marketing tool (Analysis & Advertising)	de.linkedin.com
Spotify AB	Regeringsgatan 19, 111 53 Stockholm, Sweden	Analysis tool/Marketing tool (Analysis & Advertising)	spotify.com
Pinterest Europe Ltd.	Palmerston House, 2nd Floor Fenian Street, Dublin 2, Ireland	Analysis tool/Marketing tool (Analysis & Advertising)	policy.pinterest.com
TikTok Technology Limited	10 Earlsfort Terrace, Dublin D02 T380, Ireland	Analysis tool/Marketing tool (Analysis & Advertising)	tiktok.com
Hotjar Ltd	Dragonara Business Centre 5. Stock, Dragonara Road, Paceville St Julian's STJ 3141, Malta	Analysis tool/Marketing tool (User behaviour)	hotjar.com
myNET gmbh	Bruggfeldstraße 5, 6500 Landeck, Austria	Website hoster	mynet.at

In addition, data may be disclosed in the context of official requests, judicial orders and legal proceedings if this is necessary to protect or enforce rights. If government agencies make a legitimate claim to us for customer data, we strive to minimize the scope of disclosure. Only the specific data specified by the relevant legal request will be released by us.

2. Data transfer to third countries

We use services from providers, some of which are based in countries outside the European Union or the European Economic Area or process data there. This means that data may be transferred to countries that do not have the same data protection standards as the European Union. For some of these countries, the European Commission has adopted an adequacy decision, see Data Privacy Framework in the USA. If such a decision does not exist, we use mechanisms such as the EU standard contractual clauses or binding corporate rules to ensure that adequate data protection is maintained when data is transferred. If data is transferred to such a third country and there is neither an adequate decision nor appropriate security measures in place, there is a risk that local authorities (such as intelligence agencies) may access and use this data. This could make it difficult to enforce your data protection rights.