This policy explains how we process personal data when you use our website, submit enquiries, make bookings, subscribe to our newsletter or apply for a job. Personal data is information relating to an identified or identifiable person, such as a name, email address or IP address.
Hotel Schwarzer Adler Fam. Tschol GmbH
Dorfstraße 35
6580 St. Anton am Arlberg, Austria
Telephone: +43 5446 2244-0
Email: hotel@schwarzeradler.com
Website: https://www.schwarzeradler.com
If you have questions about data protection or wish to exercise your rights, please contact us using the details above.
We process personal data on the following bases:
When storing or accessing information on your device, we also comply with section 165(3) of the Austrian Telecommunications Act 2021 (TKG 2021). Access without consent is limited to operations strictly necessary for transmitting communications or providing a service you have explicitly requested.
When you visit our website, our hosting provider processes technical access data. This includes, in particular, your IP address, date and time, requested page or file, status message, volume of data transferred, browser, operating system and, where applicable, the page previously visited.
This processing enables us to deliver the website, resolve errors and detect and prevent attacks. The legal basis is Article 6(1)(f) GDPR. Our legitimate interest is the secure and reliable operation of our website.
Server logs are generally deleted after one month. In the event of a specific security incident, relevant entries may be retained for longer where necessary for investigation or legal proceedings. Recipients are the service providers we engage for hosting and technical support.
If you contact us using a form, by email or by telephone, we process the data you provide. This may include your name, contact details, travel dates, the number and ages of accompanying guests, room preferences and the content of your message.
We use this information to handle your enquiry, prepare an offer and communicate with you further. For enquiries relating to a contract, the legal basis is Article 6(1)(b) GDPR. We handle general enquiries on the basis of Article 6(1)(f) GDPR; our legitimate interest is responding appropriately to your message.
Mandatory fields are identified in the relevant form. Without the required information, we may be unable to handle your enquiry. Consent to advertising is not a condition for submitting an enquiry or making a booking.
Enquiry data is deleted once processing of the enquiry is complete and further retention is no longer necessary for a contract, legal obligations or legal claims.
We use Seekda's booking solution for online bookings. In particular, names, contact details, travel dates, information about accompanying guests, booked services, booking preferences and, where applicable, payment information are processed. We also use re:Guest to handle offers and communicate with guests.
The purposes are preparing and managing offers and bookings, communicating about your stay, and providing and billing for the services booked. The legal basis is Article 6(1)(b) GDPR. Processing required by law, particularly for invoicing and guest registration, is based on Article 6(1)(c) GDPR.
Recipients are the booking, communications and IT service providers we engage and, where necessary, payment providers and authorities legally entitled to receive the data. Service providers processing personal data on our behalf are engaged under data processing agreements.
Information from Seekda: https://www.seekda.com/privacy-policy/
Booking and billing data is stored in accordance with statutory retention requirements and the documentation required for the contract. Use for optional advertising measurement takes place only after the relevant consent has been given.
Please provide sensitive information, such as allergies or health-related limitations, only where necessary for the service requested. Where explicit consent is required for this, we obtain it separately.
When you make a payment, the information necessary to process it is transmitted to the payment provider identified in the relevant payment process and to the financial institutions involved. This may include your name, billing details, amount, currency, transaction identifier and information about the payment method selected.
The legal basis for our processing is Article 6(1)(b) GDPR and, for statutory retention obligations, Article 6(1)(c) GDPR. Payment providers may also process data as independent controllers, for example to comply with regulatory obligations or prevent fraud. Further information is available from the provider identified in the payment process.
If you subscribe to our newsletter, we process your email address and, where applicable, optional information used to address you personally. Registration uses a double opt-in procedure: we send you a confirmation message, and the subscription is activated only after you confirm it. For documentation purposes, we store information about registration and confirmation, particularly the time and, where applicable, the IP address.
We send information about offers and news on the basis of your consent under Article 6(1)(a) GDPR and in compliance with section 174 TKG 2021. Processing to demonstrate consent is based on Article 6(1)(f) GDPR; our legitimate interest is demonstrating that messages were sent lawfully. Newsletter service providers engaged for sending and administration may have access to the necessary data.
Where you have separately consented to individually attributable performance measurement, tracking pixels and personalised links may be used to associate opens and clicks with your subscription. The time, IP address and technical information about your email application may be processed. This serves to evaluate and improve our newsletter. The legal basis is Article 6(1)(a) GDPR; section 165(3) TKG 2021 additionally applies to device access requiring consent.
You can unsubscribe at any time using the unsubscribe link or by contacting hotel@schwarzeradler.com. You can also withdraw separate tracking consent using this address. After you unsubscribe, the data used for sending is deleted unless another legal basis for retention exists. Records of consent and a suppression list limited to what is necessary may be retained for documentation and to prevent further messages.
Our website uses cookies and similar technologies. Cookies are small text files stored on your device. They may, for example, be used to save your privacy preferences, enable a booking or analyse the use of our website.
Strictly necessary cookies
Strictly necessary cookies enable basic website functions and the provision of services you have explicitly requested. This includes, in particular, saving your consent preferences.
This information is stored or accessed on the basis of the exception for strictly necessary operations under section 165(3) TKG 2021. Where personal data is processed in this context, the legal basis, depending on the purpose, is Article 6(1)(b), (c) or (f) GDPR. Our legitimate interest lies particularly in the secure and functional operation of our website.
Optional cookies and services
Optional analytics, marketing and external media services are used only on the basis of your corresponding consent. The legal bases are Article 6(1)(a) GDPR and section 165(3) TKG 2021 for storing or accessing information on your device where consent is required.
You can refuse optional processing. Basic use of our website remains possible; certain external content may then be unavailable.
Bakehouse Cookie Manager
We use the Bakehouse Cookie Manager to manage your preferences. The cookie pop-up allows you to accept or refuse the optional processing offered and, where category selection is available, to make your choices by category.
The Cookie Manager saves your preferences using strictly necessary cookies so that they can be taken into account on subsequent page visits. Information about detected cookies, their purposes and lifetimes is provided in the cookie pop-up. Cookie lifetimes must be distinguished from retention periods for data transmitted to service providers.
Where we process information to demonstrate your consent, this is based on Article 6(1)(c) GDPR in conjunction with Article 7(1) GDPR.
Technical control of services
The integrated analytics and advertising services are controlled according to your preferences. For Google services, consent signals may be used via Google Consent Mode v2. These signals replace neither your consent nor a required legal basis for the respective data processing.
Withdrawal of your consent
You can withdraw your consent at any time with effect for the future using the button provided on this privacy policy page to withdraw cookie consent. You can then make your choices in the cookie pop-up displayed again. The lawfulness of processing carried out before withdrawal remains unaffected.
You can also delete or block cookies through your browser settings. This may restrict certain functions. Data already transmitted to service providers is not automatically deleted when cookies are deleted. For this purpose, you can exercise your data protection rights against us or the relevant provider.
Where you have consented to web analytics, we use Google Analytics 4 to analyse the use of our website. The provider is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland.
Data processed may include page views, interactions, session and device identifiers, technical browser and device information, the source of a visit and approximate location information derived from this. We receive reports for the use and improvement of our services. According to Google, GA4 does not log or store IP addresses; this does not mean that the other usage data is anonymous.
The legal basis is Article 6(1)(a) GDPR and, for device access requiring consent, section 165(3) TKG 2021. Event and user data is stored according to the retention period configured in our Analytics account. Aggregated reports may remain available for longer. The specific retention period used is stated in the information about the service in our cookie settings.
Processing by Google LLC in the USA and other Google service providers is possible. Information: https://policies.google.com/privacy?hl=de
Where offered in our cookie settings and enabled by you, we use Matomo for statistical analysis of our website. Data processed may include pages visited, visit duration, interactions, referring pages, device and browser data and a truncated IP address. The recipient is the website service provider engaged to operate the Matomo installation.
The analysis serves to improve our website. The legal basis is Article 6(1)(a) GDPR and, where information is stored or accessed on your device, section 165(3) TKG 2021. Enabled functions, cookie lifetimes and retention periods are stated in the cookie settings. You can withdraw consent there at any time.
With your consent, we use Google Ads to measure the success of our advertisements and, where enabled, to reach website visitors again through interest-based advertising. The provider is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland.
Conversion tracking allows advertising clicks to be associated with subsequent actions, such as enquiries or bookings. Data processed may include click and cookie identifiers, pages visited, event times, device information and, where applicable, booking value and currency. Remarketing may use this information to create audiences. Google may combine information with other data, particularly for users signed in to Google.
Where “Enhanced Conversions” is used and covered by your consent, contact details you provide, such as an email address, may be normalised and hashed using SHA-256 before transmission. Hashing is neither anonymisation nor encryption. The data is used for matching and attributing conversions.
The legal basis is Article 6(1)(a) GDPR and section 165(3) TKG 2021 for device access requiring consent. The functions enabled and cookie lifetimes are explained in the cookie settings. Data may also be processed in the USA.
Privacy: https://policies.google.com/privacy?hl=de
Advertising settings: https://myadcenter.google.com/
To control optional services, we may transmit your consent preferences to the respective services through technical consent signals, such as Google Consent Mode or Microsoft Consent Mode. These signals do not replace your consent and do not establish an independent legal basis.
Analytics and advertising tags are activated or blocked according to your preferences. This also applies to server-side transmissions. Where a tag management system is used, it serves to manage these integrations. Its own technical data processing is explained separately in the cookie settings. Consent to one service does not automatically apply to all services managed through the system.
With your consent, we use the Meta Pixel to measure and optimise our advertising on Facebook and Instagram and to create advertising audiences. The provider is Meta Platforms Ireland Limited, Merrion Road, Dublin 4, D04 X2K5, Ireland.
Data processed may include IP address, browser and device information, page views, click and cookie identifiers, times and events such as enquiries or bookings, and their value and currency. Meta may associate the data with a user account and process it for the advertising purposes described in its terms. We receive evaluations of the effectiveness of our advertising.
Where enabled and covered by your consent, advanced matching using hashed contact details and server-side transmission of events through the Conversions API may also take place. Server-side transmission does not replace the required consent. Hashed contact details remain personal data.
The joint controllership agreement under Article 26 GDPR applies to the joint collection and transmission of event data insofar as the processing falls within the relevant Meta Business Tools terms. It sets out the respective obligations, particularly regarding information, security and data subject rights. Meta is responsible for subsequent processing outside this joint controllership. You can exercise your rights against both controllers.
The legal basis is Article 6(1)(a) GDPR and section 165(3) TKG 2021 for device access requiring consent. Withdrawal and information about enabled functions and cookie lifetimes are available in the cookie settings. Data may also be processed, in particular, by Meta Platforms, Inc. in the USA.
Privacy: https://www.facebook.com/privacy/policy/
Agreement: https://www.facebook.com/legal/controller_addendum
With your consent, we use Microsoft Advertising, including Universal Event Tracking (UET), to measure the effectiveness of our advertisements and, where enabled, to reach visitors again through interest-based advertising. The provider is Microsoft Corporation, One Microsoft Way, Redmond, WA 98052-6399, USA.
Data processed may include IP address, browser and device information, pages visited, click and cookie identifiers, event times and conversion data such as enquiry, booking, value and currency. This information serves to associate advertising clicks with actions and to create advertising audiences. Microsoft may combine data with other information it holds.
The legal basis is Article 6(1)(a) GDPR and section 165(3) TKG 2021 for device access requiring consent. We take your preferences into account through the corresponding consent controls. The functions used and cookie lifetimes are stated in the cookie settings. Processing in the USA is possible.
Privacy: https://privacy.microsoft.com/de-de/privacystatement
With your consent, we use the OpenAI Ads Measurement Pixel to measure the success of our ChatGPT advertisements. The provider for the EEA is OpenAI Ireland Limited, 1st Floor, The Liffey Trust Centre, 117–126 Sheriff Street Upper, Dublin 1, D01 YC43, Ireland.
The browser loads the script via bzrcdn.openai.com and transmits measurement events to bzr.openai.com. Data processed may include IP address, browser and device information, page address, time, event type, conversion value and currency, and advertising click and browser identifiers.
Cookies: “__oppref” stores a click identifier for a standard period of 30 days; “__obref” stores a browser identifier for a standard period of 365 days. Both are removed when consent withdrawal is implemented accordingly.
Where enabled and consented to, Advanced Matching transmits contact details normalised and SHA-256-hashed in the browser for conversion attribution. Hashing means neither encryption nor anonymisation.
Legal bases: Article 6(1)(a) GDPR and section 165(3) TKG 2021. Withdrawal: at any time through the cookie settings. OpenAI is a data recipient; the roles are determined by the applicable contractual terms. Processing outside the EEA is possible; see “Recipients and transfers to third countries”.
Further information:
https://developers.openai.com/ads/measurement-pixel
https://openai.com/policies/eu-privacy-policy/
https://openai.com/policies/cookie-policy/
Where offered on individual pages, you can load external content such as Google Maps, YouTube videos or Facebook and Instagram posts after giving your consent. The provider for Google Maps and YouTube is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland; for Facebook and Instagram it is Meta Platforms Ireland Limited, Merrion Road, Dublin 4, D04 X2K5, Ireland.
Loading this content may transmit your IP address, browser and device information, the page visited and usage information to the provider. Cookies or other identifiers may be stored or accessed. If you are signed in to a user account, the provider may associate the access with your account. Processing serves to display the content you have enabled. The legal basis is Article 6(1)(a) GDPR and section 165(3) TKG 2021 for device access requiring consent.
Even a privacy-enhanced mode for videos does not necessarily prevent all transmissions. You can withdraw your consent through the cookie settings. Data may be transmitted to the USA. Further information is available in the Google and Meta privacy policies linked above.
For simple external links, redirection takes place only when you click the link. The respective operator's privacy information applies on the destination website.
Locally provided fonts are loaded from our own website. This alone does not transmit any data to the original font provider.
Where external fonts or other optional external content are integrated, they are retrieved after you have given the corresponding consent. In particular, IP address, browser information and the page visited may be transmitted to the respective provider. Providers, purposes, possible transfers to third countries and, where applicable, retention periods are explained for the respective service in the cookie settings. The legal basis is Article 6(1)(a) GDPR and, for device access requiring consent, section 165(3) TKG 2021.
If you apply for a job with us, we process your contact details, application documents, qualifications and information provided during the recruitment process to assess your application and conduct the selection procedure. The legal basis is Article 6(1)(b) GDPR. Access is granted to those involved in staff selection and, where applicable, technical service providers we engage.
If you are hired, necessary data is transferred to personnel administration. If your application is unsuccessful, we retain the documents only for as long as necessary to defend against possible claims arising from the recruitment process, taking account of the applicable Austrian time limits; the legal basis is Article 6(1)(f) GDPR. Longer inclusion in a candidate pool takes place only with separate consent and for the period specified at that time.
Personal data is provided only to persons and organisations that need it for the purposes described. These include, in particular, hosting and IT service providers, booking and communications providers, newsletter providers, payment providers, tax advisers and authorities legally entitled to receive the data. Processors are bound by contracts under Article 28 GDPR. Other recipients may be independent or joint controllers within the scope explained in the relevant section.
For international services, data may be processed outside the European Economic Area. Transfers take place only under the conditions of Articles 44 et seq. GDPR, particularly on the basis of an applicable adequacy decision or appropriate safeguards such as the European Commission's Standard Contractual Clauses and any necessary supplementary protective measures.
For US recipients, the EU-US Data Privacy Framework is relevant only where the specific recipient is validly certified and the respective processing falls within the scope of that certification. We do not rely generally on certification of a corporate group for transfers. Information about the safeguards used for a specific transfer and a copy of the relevant clauses are available on request at hotel@schwarzeradler.com.
We retain personal data only for as long as necessary for the purposes stated or as required by legal obligations. Relevant factors include, in particular, performance of the contract, tax and commercial law retention requirements, and the necessary preservation or defence of legal claims. Once the purpose no longer applies and the relevant periods have expired, we delete or anonymise the data.
For services dependent on consent, further processing for the respective purpose ends after withdrawal unless another legal basis exists. Data already transmitted to providers acting as independent controllers is not automatically deleted by deleting a cookie. You can also exercise the corresponding data subject rights against the provider for this purpose.
Subject to the statutory conditions, you have the right of access, rectification, erasure, restriction of processing and data portability. You can withdraw consent at any time with effect for the future.
You may object, on grounds relating to your particular situation, to processing based on Article 6(1)(f) GDPR. You may object to processing for direct marketing at any time without giving reasons; this also applies to related profiling.
To exercise your rights, please contact hotel@schwarzeradler.com. Where there are reasonable doubts about your identity, we may request additional information necessary to confirm it.
You may lodge a complaint with a data protection supervisory authority, particularly in the Member State of your habitual residence, place of work or the alleged infringement. In Austria, this is the Austrian Data Protection Authority: https://www.dsb.gv.at/
Information required for a contract or legal obligation must be provided so that we can supply the relevant service. Optional information and consent to analytics and advertising are not conditions for making a booking.
In the enquiry and booking procedures described here, we do not make decisions based solely on automated processing that produce legal effects concerning you or similarly significantly affect you. The creation of audiences described in the advertising sections may constitute profiling for advertising purposes.
We use technical and organisational protective measures and HTTPS-encrypted transmission for our website. Complete protection against all risks of electronic communications cannot be guaranteed.
We update this privacy policy when our processing activities, services used or legal requirements change. The version published on our website at the relevant time applies.