Data protection

1. Controller

The controller within the meaning of the General Data Protection Regulation (GDPR) is:

Hotel zur Post GmbH

Maxglaner Hauptstraße 45

5020 Salzburg, Austria

For all data protection matters, you can reach us using the contact details provided above.

2. General Information on Data Processing

The protection of your personal data is important to us. We process personal data exclusively in accordance with the GDPR, the Austrian Data Protection Act (DSG) and other applicable legislation (e.g. the Telecommunications Act, the Artificial Intelligence Act).

Personal data means any information relating to an identified or identifiable natural person (e.g. name, email address).

Personal data may be processed when you visit and use this website.

Depending on the functions used, cookies may also be set and/or third-party services integrated. Details and the respective legal basis for the services used can be found in the corresponding section (Integrated Services and Tools).

3. Website Display and Hosting

This website is managed by our web service provider fluid frames gmbh, Aiglhofstraße 45/5, 5020 Salzburg, Austria (and hosted in the nearest data centre in the EU; any potential third-country transfer to the USA is covered by the EU-US Data Privacy Framework).

When you access the website, our web service provider processes, on our behalf, the technically necessary access data (IP address of the accessing device, date and time of access, page or file accessed, amount of data transferred, browser type and operating system used, previously visited page). These data are technically necessary in order to deliver the website correctly, display images and videos, ensure technical functionality, guarantee its stability and security and fend off attacks. These data are not combined with other data sources or analysed for marketing purposes. The legal basis for this processing is our legitimate interest in the secure and efficient provision and operation of the website and its fast, secure display (Art. 6(1)(f) GDPR). The provision of the personal data is neither required by law or contract nor necessary for the conclusion of a contract; however, it is not possible to display the website without providing the data. If a connection error occurs while the website is loading, your browser may also send a technical error report to our web service provider. This report contains, in particular, the address accessed, the type of error and your IP address, and serves exclusively to ensure the availability of the website.

4. Storage Period

We store personal data only for as long as is necessary for the stated purposes or as long as statutory retention obligations exist. Access data are not stored by us and are processed by our web service provider only for as long as they are necessary for delivery and security, and are deleted thereafter.

5. Integrated Services and Tools

The services and tools listed below are used on this website. For each service, we provide information on the provider, purpose, data processed, legal basis and storage period.

Statistics (Audience Measurement)

Provider: The measurement is operated by our web service provider fluid frames gmbh, Aiglhofstraße 45/5, 5020 Salzburg.
Purpose: statistical analysis of the use of this website (e.g. number of visits, pages accessed, time spent, origin of visits) in order to design and improve content and technology in line with requirements.
Data processed: page accessed, previously visited page (referrer) and campaign identifiers, time, country (derived from the IP address), device and browser type, screen size and individual actions on the website (e.g. submitting a form). Your IP address is not stored. To distinguish between visits, an encrypted identifier (hash) is generated from the IP address and browser identifier; it changes daily and does not allow any conclusions to be drawn about you as a person. No cookies are set and no information is stored in your browser.
Legal basis: Art. 6(1)(f) GDPR (legitimate interest in designing and improving our website in line with requirements). The provision of the personal data is neither required by law nor by contract. You can use the website without restriction even if you object to the measurement.
Third-country transfer: USA; EU-US Data Privacy Framework certification of Cloudflare (https://www.dataprivacyframework.gov/list) and standard contractual clauses.
Storage period: Individual data for 13 months, thereafter only aggregated daily values without identifier.
Objection: You can object to the measurement at any time via the “Disable statistics” link on this page; for this purpose, your decision is recorded in your browser’s local storage. If your browser sends the “Global Privacy Control” signal, no measurement takes place.

Consent management (cookies)

Provider: Cookie and consent management is operated using a solution provided by our web service provider fluid frames gmbh, Aiglhofstraße 45/5, 5020 Salzburg.
Purpose: Obtaining, storing and documenting your consent to embedded content and services. Your consent applies only to the respective service. Embedded content is not loaded before you have given your consent. In its place, we display a placeholder with information about the provider and a consent text. The content is only loaded once you click “Load …” there and thereby consent to the provider processing your data.
Data processed: Your choice for each service, the time of your choice and a randomly generated identifier of your browser. The identifier is stored in your browser’s local storage, and your choice is stored in a database of our web service provider. In the placeholder, you choose “load once” or “always load”. The “Always load” setting is stored in your browser’s local storage.
Legal basis: Art. 6(1)(c) GDPR in conjunction with Art. 7(1) GDPR (proof of consent). Storing your choice in the browser is strictly necessary for this purpose (Section 165(3) of the Austrian Telecommunications Act, TKG).
Storage period: Your saved choice is valid for 12 months, after which you will be asked again. The records are deleted after 3 years.
Withdrawal: You can withdraw your choice at any time using the “Manage consents” button directly below this section (without affecting the lawfulness of processing carried out on the basis of your consent before its withdrawal).

YouTube videos

Provider: Google Ireland Limited (YouTube), Gordon House, Barrow Street, Dublin 4, Ireland (Google LLC, USA).
Purpose: Embedding and playing videos.
Data processed: IP address, device and browser data, usage data; for logged-in users, assignment to their Google/YouTube account.
Legal basis: Art. 6(1)(a) GDPR (consent). The provision of the personal data is neither required by law nor by contract. If the data is not provided, video content from YouTube embedded on the website cannot be displayed.
Third-country transfer: USA; certification of Google under the EU-US Data Privacy Framework (https://www.dataprivacyframework.gov/list) and standard contractual clauses.
Storage period: YouTube cookies for up to 6 months (VISITOR_INFO1_LIVE) or 13 months (__Secure-YEC). Any further processing is governed by the provider’s terms.
Withdrawal: via the “Cookies” link at the bottom of every page (without affecting the lawfulness of processing carried out on the basis of your consent before its withdrawal).

6. Encryption

For security reasons, this website uses SSL or TLS encryption. You can recognise an encrypted connection by the padlock symbol in your browser’s address bar and by the prefix “https://”.

7. Your Rights as a Data Subject

You have the following rights with regard to your personal data:

Access (Art. 15 GDPR)
Rectification of inaccurate data (Art. 16 GDPR)
Erasure (Art. 17 GDPR)
Restriction of processing (Art. 18 GDPR)
Data portability (Art. 20 GDPR)
Objection to processing (Art. 21 GDPR)
Withdrawal of consent given, with effect for the future (Art. 7(3) GDPR)

To exercise these rights, an informal message to the contact details provided in section 1 is sufficient.

8. Right to Lodge a Complaint with the Supervisory Authority

If you consider that the processing of your data infringes data protection law, you have the right to lodge a complaint with the supervisory authority. The competent authority in Austria is:

Austrian Data Protection Authority (Datenschutzbehörde)

Barichgasse 40–42, 1030 Vienna

Email: dsb@dsb.gv.at

Web: www.dsb.gv.at