Chalet Franz+43 699 13285567Call Chalet Franz

Privacy Policy

This privacy policy explains which personal data we process on this website, for what purpose and on what legal basis. We process data in line with the General Data Protection Regulation (GDPR) and limit ourselves to what is necessary.

1. Controller

Chalet Franz
Dr. Antonia Thomas
Philippine-Welser-Straße 41
6020 Innsbruck
Austria
Email:
Phone: +43 699 13285567

2. Which data we process — and why

Contact form

When you use our contact form, we process the data you provide (name, email address, subject and message) as well as your IP address in order to handle and answer your enquiry. The legal basis is your consent and the performance of pre-contractual measures (Art. 6(1)(a) and (b) GDPR). We keep this data for as long as it is needed to handle your enquiry and delete it afterwards, unless statutory retention obligations apply.

Spam protection (Cloudflare Turnstile)

To protect our contact form against abuse by automated programs we use, where enabled, the Turnstile service provided by Cloudflare, Inc., 101 Townsend St., San Francisco, CA 94107, USA. Turnstile uses technical signals (including IP address, browser and device information, and interaction patterns) to determine whether input comes from a human. The following data is transferred to Cloudflare servers, including in the USA: your IP address, technical browser and device information (including user agent, browser properties, screen and language settings), interaction patterns within the Turnstile widget (such as mouse movements and timing), and the verification result in the form of a token. The contents of your form entries (name, e-mail address, message) are not transferred to Cloudflare. Cloudflare is certified under the EU-US Data Privacy Framework, and standard contractual clauses pursuant to Art. 46 GDPR are in place as an additional safeguard. In the standard configuration we use (without so-called pre-clearance), Turnstile does not set any cookies and does not build user profiles. The legal basis is our legitimate interest in protecting the website against abusive automated use (Art. 6(1)(f) GDPR). Cloudflare processes this data on our behalf under a data processing agreement pursuant to Art. 28 GDPR. For more information, see the Cloudflare Turnstile privacy policy:cloudflare.com/en-gb/turnstile-privacy-policy.

Availability calendar (easybooking)

The Availability page shows the availability calendar of our booking system easybooking. The provider is zadego GmbH (easybooking department), Sparkassenplatz 2, 6020 Innsbruck, Austria. When you open that page, your IP address and technical browser information are transferred to easybooking servers, which deliver the calendar and the current occupancy. The calendar does not set any cookies and stores nothing in your browser. The legal basis is our legitimate interest in showing you current availability directly from our booking system (Art. 6(1)(f) GDPR). Bookings and enquiries made through easybooking are additionally subject to easybooking's privacy policy: easybooking.eu/datenschutz.

Server log data

Every time the website is accessed, the server writes an access log containing the IP address, date and time, the page requested, the referrer (the previously visited page), browser type and the other technical details your browser sends with the request, as well as the status code and the amount of data transferred. This processing is necessary to operate the website and runs regardless of your cookie choices. The legal basis is our legitimate interest in the operation and security of the website (Art. 6(1)(f) GDPR). The access log is kept for 30 days and then deleted.

Seitenblicke: how our pages are used

When you read a page of this website, a small program in the page (a script from the server of our web host Kaino GmbH) measures how the page is used. Kaino GmbH does this on our behalf (see section 3). We call this Seitenblicke (“page views”). Seitenblicke works without cookies. It runs until you refuse “Statistics” in the cookie dialog. It records:

  • how far you scroll, in steps of 5 percent, and which section you see while doing so;
  • which links and buttons you click, meaning the target, not the text; the buttons of a form and links you use to call, write an e-mail or book an appointment are left out;
  • whether you start filling in a form, never what you type;
  • how long the page is visible and how long you actively read, each in whole seconds;
  • the address of the page you open;
  • the size of your browser window, rounded to coarse steps;
  • the kind of page you came from, for example a search engine;
  • whether you came through a Google ad.

From the browser identifier, the details about browser and operating system that your browser sends with every request, we derive the type of device and the operating system and browser without version number. We do not store the identifier Google adds to a click on an ad.

We count the submission of a form with valid entries only as a total per page and day. Likewise we count clicks on a phone number, an e-mail address or a link to book an appointment only as a total per page, day and kind. These totals carry no visit identifier and are kept apart from the course of a visit. So nothing in Seitenblicke says that a particular visit submitted a form, called, wrote an e-mail or opened the appointment booking, not even with your consent to “Statistics”.

We do not measure the pages shown after a message is sent or after a payment, nor the error page.

So that we can see the pages of a visit in their order, the web host’s server forms a visit identifier. It calculates it from your IP address, your browser identifier and the name of the website. For this it uses a secret random value (key) that is kept only in the server’s working memory. The key is deleted and created anew every day at midnight Coordinated Universal Time (UTC), which is 1 a.m. in Austria, 2 a.m. in summer time. We do not store the IP address or the browser identifier with Seitenblicke. Nothing is stored on your device for the visit identifier. Until this deletion the visit identifier is a pseudonym: it does not name you, but the server can calculate it again from your IP address and browser identifier. After the deletion it can no longer do so. We do not combine Seitenblicke with the server log or with form enquiries.

We want to judge which pages and sections are read, where visitors leave a page and by which routes they arrive, for example through an ad. The legal basis is our legitimate interest in this evaluation (Art. 6(1)(f) GDPR). Seitenblicke data is kept only on the web host’s server in Germany (see section 3). As personal data we keep it for at most one day, until the daily deletion of the key.

With your consent we record in more detail. If you have allowed “Statistics” in the cookie dialog, we also record:

  • the scroll position in pixels;
  • where you click;
  • the exact window and screen size;
  • every event with its time.

This lets a visit be retraced step by step. For this the website stores a random identifier in your browser’s session storage (“seitenblicke-sitzung”). Session storage is storage in your browser like a cookie, but it is emptied when you close the tab. Even then we do not record what you type into forms. The legal basis is your consent (Art. 6(1)(a) GDPR). You can withdraw it at any time in the cookie settings. We delete this data after 30 days.

Your right to object: You can object to Seitenblicke at any time (Art. 21 GDPR). To do so, open the cookie settings with the button below and refuse “Statistics”. Seitenblicke then stops measuring in your browser. This does not affect the server log (see “Server log data”). The setting applies until you decide again in the cookie dialog or delete the website data in your browser. It still applies when the website shows the cookie button again after 6 months. We also do not measure when your browser sends the “Global Privacy Control” or “Do Not Track” signal. With these signals some browsers ask websites not to measure. We cannot match an objection sent by e-mail to a browser. It therefore takes effect only through the button or one of the two browser signals. After the daily deletion of the key the server can no longer calculate the visit identifier from the IP address and browser identifier. We therefore cannot look up or delete your Seitenblicke on the basis of these details (Art. 11 GDPR).

Cookies and consent

By default this website sets only one technically necessary entry that stores your cookie choice. Analytics or marketing cookies are only set after your explicit consent. Seitenblicke works without cookies (see “Seitenblicke”). With your consent to “Statistics” the website also stores the entry “seitenblicke-sitzung” in your browser’s session storage. Details are in our Cookie Policy.

Web analytics (Google Analytics 4)

This website may use the web-analytics service Google Analytics 4. Where activated, it is used only after your explicit consent given via the cookie banner (Art. 6(1)(a) GDPR). The provider is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. Google Analytics processes pseudonymous usage data (including pages viewed, time spent, approximate location, and browser and device information) and sets _ga cookies (details and withdrawal in our Cookie Policy). According to Google, Google Analytics 4 does not log or store IP addresses; the IP address is processed only briefly during collection to derive coarse location data and is then discarded. Event data stored on Google servers is deleted automatically after the retention period configured in the Analytics property (2 or 14 months). Data may be transferred to Google LLC in the USA; Google is certified under the EU-US Data Privacy Framework, and standard contractual clauses pursuant to Art. 46 GDPR are in place as an additional safeguard. Google processes this data on our behalf under a data processing agreement pursuant to Art. 28 GDPR. You can withdraw a given consent at any time with effect for the future via the cookie settings.

3. Recipients and processors

To provide the website and deliver contact enquiries, we use carefully selected service providers (hosting, email delivery, the booking system easybooking and – where activated – web analytics). They process data only on our behalf and on the basis of data-processing agreements under Art. 28 GDPR. Any disclosure beyond this to third parties takes place only where we are legally required to do so. Our web host Kaino GmbH also processes Seitenblicke on our behalf.

4. Storage period

We store personal data only for as long as it is necessary for the purposes stated above or as required by statutory retention periods. After that, the data is deleted.

5. Security

We take appropriate technical and organisational measures to protect your data — including encrypted transmission (TLS/HTTPS).

6. External links

This privacy policy does not apply to third-party websites we link to. The respective providers are responsible for their content and data protection.

7. Your rights

Under the GDPR you have the following rights:

To exercise your rights, a message to is enough.

8. Right to lodge a complaint

You have the right to lodge a complaint with a supervisory authority. In Austria this is the Austrian Data Protection Authority (Österreichische Datenschutzbehörde,dsb.gv.at).

9. Changes to this privacy policy

We update this privacy policy when our processing or the legal situation changes. The version published on this page at the time applies.

Last updated: