Privacy.

1. Controller

2. Hosting & server logs

Our website is hosted by Hetzner Online GmbH, Industriestr. 25, 91710 Gunzenhausen, Germany.

When you access the website, the server processes technically necessary connection data. This may include your IP address, date and time, the requested page or file, transferred data volume, referrer URL, browser type and version, and operating system. This data is needed to provide the website securely and reliably, diagnose errors and prevent attacks.

Legal basis: Art. 6(1)(f) GDPR. Our legitimate interest is the secure and technically reliable operation of the website.

Log data is stored only for as long as required for operation and security and is then deleted, unless a longer period is necessary to investigate a specific security incident.

Hetzner Privacy Policy (opens in a new tab)

3. Contact & enquiry form

When you contact us through the form, by email or by phone, we process the information you provide to answer your enquiry, check availability, prepare an offer and, where applicable, arrange a booking.

The enquiry form may process:

• first and last name, date of birth, postal address, email address and optional phone number,
• requested dates and apartment,
• first and last name and date of birth of any fellow travellers (adults and children),
• the content of your message.

We already collect the date of birth at enquiry stage so that, should a booking result, it does not need to be provided again — for example for the statutory guest registration and age-dependent local taxes (see "Offer, booking & check-in" below).

Legal basis: Art. 6(1)(b) GDPR for pre-contractual steps and a possible booking. For general questions, the legal basis is Art. 6(1)(f) GDPR; our legitimate interest is responding to your message.

Form data is transmitted to our server over an encrypted connection and then sent to us by email. We use services provided by Zoho Corporation B.V., Beneluxlaan 4B, 3527 HT Utrecht, Netherlands, for email delivery and our mailbox. Within the Zoho group, data may also be processed in third countries based on appropriate safeguards.

Zoho Privacy Policy (opens in a new tab)

If no offer is needed any longer (declined or expired without a reply), we automatically and permanently delete the enquiry, including all data it contains, after 30 days. If the enquiry results in a booking, the longer retention periods described under "Retention periods" below apply. Further storage takes place only where necessary to establish, exercise or defend legal claims.

4. Offer, proposed dates, booking & check-in

After an enquiry, you will receive an offer by email, or — for date-flexible enquiries — a proposed date and price, together with a personal link. Using this link, without needing to log in, you can view and accept or decline the proposed dates and price. These pages run on our internal booking system, which is also hosted by Hetzner (see "Hosting" above).

When you accept an offer, the data on the main booker and fellow travellers already provided at enquiry stage (name, date of birth) is carried over — needed for the statutory guest registration and for local taxes/charges that depend on guests' ages. If anything is still missing (e.g. because the travel party has changed), we additionally ask for a complete postal address and phone number.

If details for individual fellow travellers are still missing at a later point, you can add them via a further personal link (pre-check-in). You will receive your invoice as a PDF attached to an email.

Legal basis: Art. 6(1)(b) GDPR (performance of a contract) and Art. 6(1)(c) GDPR (statutory record-keeping and registration duties, among others under the Austrian Federal Fiscal Code and the Salzburg Tourism Act).

These links are long, randomly generated and unguessable. Once an offer has expired, or after an enquiry has been processed, a no-longer-valid link no longer displays any personal data and instead redirects to the website.

All emails in the booking process (offer, proposed dates, booking confirmation, pre-check-in, invoice, cancellation confirmation) are sent via the same email provider named under "Contact & enquiries" above. For invoicing, we also share the necessary data with our tax advisor to fulfil our tax obligations.

5. Bookings via booking platforms

If you book one of our apartments not directly with us but through a booking platform, your booking is processed via the regional reservation system of Saalfelden Leogang Touristik GmbH, Mittergasse 21a, 5760 Saalfelden, Austria (Feratel/Deskline). The booking confirmation — including name, address, contact details, dates, number of guests and price — reaches us automatically by email and is imported into our internal booking system, so the booking can be correctly recorded, invoiced and prepared for the statutory guest registration on our end as well. To technically receive these emails we use the email service provider Mailgun (Sinch Email), which forwards the message to our system.

Mailgun Privacy Policy (opens in a new tab)

Conversely, we only transmit to the reservation system of Saalfelden Leogang Touristik GmbH and connected platforms which periods our apartments are already booked (without names or any other personal data), to prevent double bookings.

Legal basis: Art. 6(1)(b) GDPR (performance of the booking made via the platform) and Art. 6(1)(f) GDPR (legitimate interest in preventing double bookings). For the part handled directly by a booking platform itself (e.g. payment processing by the platform), the booking platform is an independent controller in its own right; its own privacy policy applies.

6. Cloudflare Turnstile

We use Cloudflare Turnstile, provided by Cloudflare, Inc., 101 Townsend St, San Francisco, CA 94107, USA, to protect the enquiry form from automated submissions and misuse.

Turnstile uses technical signals to assess whether a request is likely to come from a human or an automated program. It may process the IP address, browser and device information, operating system, referrer, interactions with the widget and technical characteristics of the browser environment. The result generated in the browser is then validated by Cloudflare on the server.

Legal basis: Art. 6(1)(f) GDPR. Our legitimate interest is protecting the form and our systems against spam, bots and abusive requests. Any storage or access on your device is limited to what is technically necessary to provide the form you have actively chosen to use.

Cloudflare processes data worldwide and states that it uses appropriate safeguards for transfers to third countries. It processes some signals as our processor and others under its own responsibility to improve bot detection.

We also limit repeated submissions. To do so, our server derives a pseudonymous identifier from the IP address and temporarily stores it with the time of the last successful submission. This is used solely to prevent automated repeat requests and is also based on Art. 6(1)(f) GDPR.

Cloudflare Turnstile Privacy Policy (opens in a new tab)

7. Google Maps

A Google Maps map is prepared on the enquiry page but is not loaded automatically. A connection to Google is established only after you select “Load map”.

For users in the European Economic Area, the provider is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. Loading the map may transfer your IP address, browser and device information, access time and the visited page to Google. Processing in the USA and other third countries cannot be ruled out.

Legal basis: your consent under Art. 6(1)(a) GDPR, given by actively loading the map. The placeholder remains visible without consent. As we do not store this choice, you can deactivate the map again by reloading the page.

The separate “Open in Google Maps” link is an ordinary external link. Data is transferred to Google only when you open it.

Google Privacy Policy (opens in a new tab)

8. Cookies, local fonts & analytics

We do not use analytics or marketing services and do not conduct personal tracking. In particular, this website does not use Google Analytics or social-media plugins.

Fonts are served locally from our own server, so displaying them does not connect to Google Fonts or another font provider.

Cloudflare Turnstile may use technically necessary storage technologies to detect and prevent automated access. Google Maps may use its own cookies or similar technologies after your active consent. As no optional service is loaded before consent, no cookie banner is required for analytics or marketing purposes.

9. Encrypted transmission

This website uses TLS encryption to protect data transmitted to us. An encrypted connection is generally indicated by the padlock symbol and “https://” in your browser's address bar.

10. Retention periods

We retain personal data only for as long as the respective purpose requires:

• Enquiry without an offer: for as long as it is actively being processed.
• Offer declined or expired without a reply, without a booking: deleted entirely after 30 days.
• If an enquiry results in a booking: booking and invoice data is retained for 7 years from the end of the year of stay due to statutory retention duties (among others under the Austrian Federal Fiscal Code) and is then anonymised (name, address and other direct contact details are removed; core data such as apartment, dates and price is kept without personal reference for statistical purposes).
• Contact data of a completed booking that is no longer needed (e.g. phone number, internal notes) is removed as early as 24 months after departure, provided there is no open payment matter.
• Address data stored for returning guests is deleted 3 years after its last use.

We deviate from these periods where necessary to clarify a specific legal dispute or in the course of an official audit.

11. Your data protection rights

Subject to the statutory requirements, you have the right to:

• access your personal data,
• rectify inaccurate or incomplete data,
• erase data or restrict its processing,
• data portability where applicable,
• object to processing based on legitimate interests,
• withdraw consent with effect for the future.

To exercise your rights, contact us at any time using the details above.

You also have the right to lodge a complaint with a data protection authority. In Austria, this is:

12. Changes to this policy

We update this Privacy Policy if our website, the services used or legal requirements change. The version published on this page applies.