Privacy Policy and Information Obligations

1 Controller

1.1 The controller within the meaning of Art. 4(7) GDPR is:

Venediger Lodge Management GmbH Marktstraße 64, 5741 Neukirchen am Großvenediger, Austria Telephone: +43 6565 6204 Email: info@venediger-lodge.at FN 521310h, Regional Court of Salzburg | VAT No.: ATU74861018

1.2 For all data protection enquiries and to exercise your rights, please contact us using the details above.

1.3 Schweinberger Gastronomie GmbH, Marktstraße 64, 5741 Neukirchen, is a separate legal entity. Where you use food and beverage services, Schweinberger Gastronomie GmbH is itself responsible for the related data processing.

2 Principles and Legal Bases

2.1 We process personal data exclusively on the basis of the GDPR, the Austrian Data Protection Act (DSG) and the Austrian Telecommunications Act 2021 (TKG 2021).

2.2 Depending on the purpose, we base processing on the following legal grounds:

• Consent pursuant to Art. 6(1)(a) GDPR
• Performance of a contract and pre-contractual measures pursuant to Art. 6(1)(b) GDPR
• Compliance with legal obligations pursuant to Art. 6(1)(c) GDPR
• Legitimate interests pursuant to Art. 6(1)(f) GDPR

2.3 You may withdraw any consent given at any time with effect for the future. This does not affect the lawfulness of processing carried out before the withdrawal.

2.4 We only process data that is necessary for the respective purpose. We only process special categories of personal data (e.g. health data) if you provide them to us voluntarily, for instance in connection with allergies or intolerances, and solely for the purpose for which you have provided them.

2.5 No automated decision-making, including profiling, within the meaning of Art. 22 GDPR takes place.

3 Bookings and Stays

3.1 Enquiries and bookings: When you make an enquiry or booking with us (via our website, by email, by telephone or through a booking platform), we process the data required for this purpose. This includes in particular your name, address, email address, telephone number, travel dates, room or apartment category, number and ages of fellow travellers, special requests and payment details. The legal basis is Art. 6(1)(b) GDPR.

3.2 Online booking via HotelPartner: For online bookings via our website, we use the web booking engine of HotelPartner, Hotelpartner YM GmbH, Eberhard-Fugger-Str. 5, 5020 Salzburg, Austria. The data entered in the booking form is transmitted to HotelPartner and processed there on our behalf. HotelPartner acts as a processor pursuant to Art. 28 GDPR and processes the data solely in accordance with our instructions and not for its own purposes. A data processing agreement is in place with HotelPartner. The legal basis is Art. 6(1)(b) GDPR.

3.3 Booking platforms: If you book via an external booking platform (e.g. Booking.com), we receive the data required for the booking from that platform. The platform’s own privacy policy applies to its processing of your data.

3.4 Guest registration data: As an accommodation provider, we are required under the Austrian Registration Act 1991 (Meldegesetz 1991) to record certain data about our guests (e.g. name, date of birth, nationality, home address, dates of arrival and departure and, for guests from abroad, the type, number and issuing authority of the travel document). We also use this data to calculate the local tourist tax in accordance with regional legislation. The legal basis is Art. 6(1)(c) GDPR. Registration data is retained in accordance with the statutory requirements and deleted thereafter.

3.5 Payment processing: To process deposits and payments, we pass on the necessary payment details to the relevant payment service providers and banks, in particular Hobex GmbH. Credit card details are transmitted in encrypted form and are not stored by us in plain text. The legal basis is Art. 6(1)(b) GDPR.

3.6 Communication relating to your stay: Before, during and after your stay, we contact you by email, telephone or messenger where this is necessary for your stay, for example to provide arrival information or details of the key handover. The legal basis is Art. 6(1)(b) GDPR.

3.7 Preferences: To make your stay as pleasant as possible, we store details of your wishes and preferences (e.g. a preferred apartment) with your consent or on the basis of our legitimate interest in looking after our guests well. The legal basis is Art. 6(1)(a) or (f) GDPR.

3.8 Accounting and tax: We process invoices and accounting records to comply with our tax and commercial law obligations and pass on the necessary data to our tax adviser and the tax authorities. The legal basis is Art. 6(1)(c) GDPR.

4 Use of Our Website

4.1 Hosting: Our website is hosted by Ing. Gerfried Ranner, Am Reitholz 4, D-83416 Surheim, Germany. The hosting provider processes the data generated when you visit the website on our behalf under a data processing agreement pursuant to Art. 28 GDPR. The legal basis is our legitimate interest in the secure and efficient operation of the website pursuant to Art. 6(1)(f) GDPR.

4.2 Server log files: Each time our website is accessed, technical data is recorded automatically, in particular the IP address, date and time of access, page accessed, amount of data transferred, browser type and version, operating system and the previously visited page (referrer). This data is used solely for technical operation, security and error analysis. It is not combined with other data sources. Log files are deleted after three months at the latest, unless they are required for longer to investigate a specific security incident. The legal basis is Art. 6(1)(f) GDPR.

4.3 Encryption: Our website uses SSL/TLS encryption. You can recognise an encrypted connection by “https://” in the address bar and the padlock symbol in your browser.

4.4 Cookies and consent: Our website uses cookies and similar technologies. We use technically necessary cookies on the basis of § 165(3) TKG 2021 and Art. 6(1)(f) GDPR. All other cookies, in particular for statistics and marketing, are only used with your consent pursuant to § 165(3) TKG 2021 and Art. 6(1)(a) GDPR. You can adjust or withdraw your consent at any time via the cookie banner.

4.5 Contacting us: If you contact us via the contact form, by email, telephone, messenger or social media, we process your details to handle your enquiry and any follow-up questions. Mandatory fields are marked as such. The legal basis is Art. 6(1)(b) GDPR where the enquiry is aimed at concluding a contract, and otherwise Art. 6(1)(f) GDPR. Enquiries that do not result in a booking are deleted after two years at the latest.

4.6 Elfsight: We use widgets from Elfsight LLC to embed Instagram content and a route planner. When the widgets load, your IP address is transmitted to Elfsight. The widgets are only loaded with your consent. The legal basis is Art. 6(1)(a) GDPR. Further information can be found in Elfsight’s privacy policy.

5 Marketing and Analytics

5.1 ADDITIVE: Our website, landing pages, voucher system and marketing automation are operated using software from ADDITIVE GmbH, 39011 Lana (BZ), Italy, our marketing agency. ADDITIVE processes the data as a processor under a data processing agreement pursuant to Art. 28 GDPR. The data is processed within the EU/EEA.

5.2 Landing pages: In addition to our website, we operate landing pages for offers and promotions. We process the data you submit there via a form to handle your enquiry or booking. The legal basis is Art. 6(1)(b) GDPR.

5.3 Offers by email: If you have booked with us or made an enquiry, we send you information and offers about our own similar services via ADDITIVE’s marketing automation. The legal basis is § 174(4) TKG 2021 in conjunction with Art. 6(1)(f) GDPR. Our legitimate interest lies in maintaining existing guest relationships. You may object to this at any time free of charge, in particular via the unsubscribe link included in every message. For all other recipients, we only send newsletters with express consent pursuant to Art. 6(1)(a) GDPR.

5.4 Vouchers: You can purchase vouchers on our website through ADDITIVE’s voucher system. We process the data required to fulfil the contract and pass on payment details to the payment service provider handling the transaction. The legal basis is Art. 6(1)(b) GDPR.

5.5 Google Analytics: With your consent, we use Google Analytics 4 from Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. Google Analytics produces pseudonymised analyses of how our website is used. IP addresses are truncated within the EU. ADDITIVE also has access to this data in order to evaluate our marketing activities. The legal basis is Art. 6(1)(a) GDPR.

5.6 Remarketing by Google and Meta: With your consent, we use remarketing features from Google Ireland Limited and Meta Platforms Ireland Limited, Merrion Road, Dublin 4, Ireland. This involves informing Google or Meta that you have visited our website, so that we can show you relevant adverts in the Google advertising network and on Facebook and Instagram. The legal basis is Art. 6(1)(a) GDPR.

5.7 Social media: We maintain company profiles on Instagram and Facebook. If you communicate with us there, we process your messages and posts in order to respond. We are jointly responsible with Meta Platforms Ireland Limited for page insights (Art. 26 GDPR). In all other respects, the privacy policy of the respective network applies. The legal basis is Art. 6(1)(f) GDPR.

6 Recipients and Transfers to Third Countries

6.1 We only pass on your data where this is necessary for the purposes stated or where there is a legal obligation to do so. Recipients include in particular our processors (hosting, HotelPartner, ADDITIVE, IT service providers), payment service providers and banks, our tax adviser, public authorities in connection with statutory registration requirements, and any booking platforms through which you have booked.

6.2 Agreements pursuant to Art. 28 GDPR are in place with all processors. They may only process the data in accordance with our instructions.

6.3 We generally process your data within the EU/EEA. For certain services (in particular Google, Meta and Elfsight), a transfer to the USA cannot be ruled out. Such transfers only take place where the requirements of Art. 44 et seq. GDPR are met, for example on the basis of the European Commission’s adequacy decision on the EU-US Data Privacy Framework for certified companies, or on the basis of EU Standard Contractual Clauses.

7 Retention Period

7.1 We only store personal data for as long as is necessary for the respective purpose or as required by statutory retention obligations.

7.2 We retain booking, invoicing and accounting data for seven years from the end of the respective calendar year in accordance with § 132 of the Austrian Federal Fiscal Code (BAO) and § 212 of the Austrian Commercial Code (UGB), and beyond that for as long as it is relevant to pending tax or court proceedings.

7.3 We retain guest registration data for the statutory retention period under the Austrian Registration Act 1991.

7.4 Data processed on the basis of your consent is deleted once you withdraw your consent, unless another legal basis applies.

8 Your Rights

8.1 Under the GDPR, you have the following rights:

• Right of access (Art. 15 GDPR)
• Right to rectification (Art. 16 GDPR)
• Right to erasure (Art. 17 GDPR)
• Right to restriction of processing (Art. 18 GDPR)
• Right to data portability (Art. 20 GDPR)
• Right to object (Art. 21 GDPR)
• Right to withdraw consent (Art. 7(3) GDPR)

8.2 Right to object: Where we process your data on the basis of legitimate interests, you may object at any time on grounds relating to your particular situation. You may object to the processing of your data for direct marketing purposes at any time without giving reasons.

8.3 To exercise your rights, please contact us at info@venediger-lodge.at or at our postal address. We may ask you to verify your identity.

8.4 Right to lodge a complaint: If you believe that the processing of your data infringes data protection law, you may lodge a complaint with the competent supervisory authority. In Austria, this is the Data Protection Authority (Datenschutzbehörde), Barichgasse 40-42, 1030 Vienna, www.dsb.gv.at.

9 Data Security and Changes

9.1 We implement technical and organisational measures pursuant to Art. 32 GDPR to protect your data against loss, manipulation and unauthorised access, and continually adapt these to the state of the art. Data transmission over the internet, for example by email, may be subject to security vulnerabilities.

9.2 We will update this privacy policy if our data processing or the legal requirements change. The version published on our website at the time applies.

Last updated: October 2026