Privacy Policy

1. Data controller

The controller responsible for processing personal data within the meaning of the General Data Protection Regulation (GDPR) is:

2. Collection and processing of personal data

We process personal data only where this is necessary to provide our website, respond to enquiries, process reservations or fulfil contractual and legal obligations.

Depending on how you use our website, the following data may be processed:

• Your name, telephone number and email address when you contact us.
• Reservation details, such as your requested stay, arrival date, departure date or room preference.
• Information that you voluntarily provide to us by email, telephone or through a form.

3. Purposes and legal bases of processing

We process your personal data for the following purposes:

• To provide and technically operate our website.
• To respond to enquiries and communicate with you.
• To prepare, process and manage reservations.
• To fulfil contractual or pre-contractual obligations.
• To comply with legal obligations where applicable.
• To protect our website and systems against misuse and security threats.

Depending on the specific purpose, processing is based on Article 6(1)(a), (b), (c) or (f) GDPR.

4. Cookies and analytics

Our website may use technically necessary cookies or comparable technologies that are required to provide essential website functions.

Technically necessary cookies do not require consent where they are strictly necessary for the operation of the website or for a service explicitly requested by you.

If we use analytics, marketing or other technologies that are not technically necessary, these will only be used after obtaining your prior consent, where required by law.

You can change or withdraw your consent at any time using the relevant settings of the cookie consent tool, if such a tool is provided on this website.

5. Server log files

When you visit our website, our hosting provider may automatically collect and temporarily store technical information in server log files.

This information may include:

• IP address of the requesting device
• Date and time of access
• Browser type and browser version
• Operating system
• Pages and files accessed
• Referring website, where available

This data is processed to ensure the secure and reliable operation of the website, to detect technical problems and to protect against misuse. The data is deleted when it is no longer required for these purposes, unless legal retention obligations apply.

The exact retention period may depend on the hosting provider's technical and legal requirements.

6. Recipients of personal data

We only disclose personal data to third parties where this is legally permitted or necessary for the purposes described in this privacy policy.

This may include service providers that support us with hosting, website operation, email communication or technical maintenance. Such service providers may only process data according to our instructions and within the scope of applicable data protection law.

7. Storage period

We store personal data only for as long as necessary for the respective processing purpose. After this period, the data is deleted unless statutory retention obligations or the establishment, exercise or defence of legal claims require longer storage.

8. Your rights

Subject to the legal requirements, you have the following rights regarding your personal data:

• Right of access to the personal data we process about you.
• Right to rectification of inaccurate or incomplete data.
• Right to erasure of your personal data.
• Right to restriction of processing.
• Right to data portability.
• Right to object to processing based on legitimate interests.
• Right to withdraw consent at any time, where processing is based on consent.

To exercise your rights, please contact us by email at info@gruenerbaum-stetten.com .

9. Right to lodge a complaint

You have the right to lodge a complaint with a data protection supervisory authority if you believe that the processing of your personal data violates applicable data protection law.

The competent supervisory authority may depend on your place of residence, place of work or the location of the alleged infringement.