Privacy policy

I. Name and address of data controller

Within the meaning of the General Data Protection Regulation and other national data protection laws of the Member States as well as any other data protection provisions, the controller is:

Hotel Ulli Gesellschaft m.b.H.
Hausnummer 264, 6763 Zürs
Tel.: +43 (0) 5583 2600

E-Mail: info@hotl-ulli.at
Web: www.hotel-ulli.at
Entered in the Commercial Register under no: 170770h
Commercial register court: Feldkirch
Supervisory authority: Bezirkshauptmannschaft Bludenz
Membership: WKO, ÖHV
Company ID no./VAT reg. no.: 45081405

II. Name and address of the data protection officer

The data protection officer of the data controller is:

Lukas Müller MSc
Hotel Ulli
6763 Zürs
T: +43 (0) 5583 2600
E-Mail: direktion@hotl-ulli.at

III. General Information on data processing

1. Scope of processing of personal data

Basically, we only collect and use the personal data of our users to the extent necessary to prepare a functional website as well as our contents and services. Personal data of our users is collected and used regularly only with the user’s consent. An exception to this is made in cases where it is not possible to obtain consent in advance for concrete reasons, and the processing of the data is permitted through legal provisions.

2. Legal basis for the processing of personal data

Insofar as we obtain the consent of the data subjects for the purpose of processing their personal data, Art. 6(1a) of the EU General Data Protection Regulation (GDPR) applies as the legal basis. When processing personal data that is necessary to perform a contract to which the data subject is party, Art. 6(1b) of the GDPR applies as the legal basis. This also applies to processing activities that are necessary to implement pre-contractual measures.

Insofar as it is necessary to process personal data to fulfill a legal obligation to which our enterprise is subject Art. 6(1c) of the GDPR applies as the legal basis. Should it be necessary to process personal data in order to protect the vital interests of the data subject or of another natural person, Art. 6(1d) of the GDPR applies as the legal basis.

Insofar as it is necessary to process personal data to protect a legitimate interest of our enterprise or of a third party, and if said interest is not overridden by the interests, basic rights and basic freedoms of the data subject, Art. 6(1f) of the GDPR applies as the legal basis.

3. Data erasure and duration of storage

The personal data of the data subject will be erased or blocked as soon as the purpose of storage ceases to exist. Data can also be stored if this was provided for by European or national legislation in other provisions under European Union law, to which the controller is subject. Data is also blocked or erased if a time-limit for storage prescribed by the aforementioned laws expires, unless it is necessary to continue to store the data for the conclusion or performance of a contract.

IV. Providing the Website and preparing logfiles

1. Description and scope of data processing

Each time our website is accessed, our system automatically collects data and information from the computer system of the calling computer.

The following data is collected:

Information about the browser type and the version used
The user’s operating system
The user’s Internet Service Provider
The user’s IP address
Date and time of access
Websites from which the user’s system reaches our website
Websites that are called from the user’s system via our website

The data is also stored in the log files of our system. This data is not stored together with other personal data of the user.

2. Legal basis for the processing of data

The legal basis for the temporary storage of data and the log files is Art. 6(1f) of the GDPR.

3. Purpose of data processing

It is necessary for the system to temporarily store the IP address in order to allow the website contents to be delivered to the user’s computer. For this reason, the user’s IP address must be stored for the duration of the session.

Storage in log files takes place in order to ensure the correct functioning of the website. We also need the data in order to optimize the website and to ensure the security of our IT systems. The data is not evaluated for marketing purposes in this connection.

These purposes also include our legitimate interest in the processing of the data in accordance with Art. 6(1f) of the GDPR.

4. Duration of storage

The data will be deleted as soon as it is no longer necessary to reach the purpose for which it has been collected. Where data has been collected to provide the website, this applies when the respective session has ended.

If data is stored in log files, this applies after seven days at the latest. Storage beyond this is possible. In this case, the IP addresses of the users are erased or scrambled so that they can no longer be allocated to the calling client.

5. Opportunity for objection and disposal

The collection of data to provide the website and the storage of data in log files is essential to operate the website. Consequently, the user does not have any opportunity to make an objection.

V. Use of cookie

a) description and scope of data processing

Our website uses cookies. Cookies are text files that are stored in, or respectively by the Internet browser on the user’s computer system. If a user calls up a website a cookie may be stored on the user’s operating system. This cookie contains a characteristic string of characters that makes it possible to clearly identify the browser when the website is called up again.

We use cookies in order to make our website more user-friendly. A few elements of our website make it necessary for the calling browser to be identifiable even after a page change.

In this process, the following data is stored and transferred:

Language settings
Articles in a shopping cart
Log-in information

On our website, we also use cookies that make it possible to analyze the surfing habits of the user.

In this way, the following data can be transferred:

Any search terms entered
Frequency of site visits
Use of website functions

The user data collected in this way is pseudonymized by technical precautions. Therefore, the data can no longer be allocated to the calling user. The data is not collected together with any other personal data of the users.

When our website is accessed, users are informed about the use of cookies for analytical purposes and referred to this data policy by means of an info banner. In this context, an indication is also given of how the storage of cookies in the browser settings can be prevented.

b) Legal basis for the processing of data

The legal basis for the processing of personal data by using cookies is Art. 6(1f) of the GDPR.

c) Purpose of data processing

The purpose of the use of technically required cookies is that of making websites more user-friendly. If cookies are not used, some functions of our website may not be offered. These require the browser to be recognised even after a page change.

User data that is collected through required cookies is not used to create user profiles.

Analysis cookies are used in order to improve the quality of our website and its contents. Through the analysis cookies, we are able to learn how the website is used and are thus able to constantly optimize our website contents.

These purposes also include our legitimate interest in the processing of the personal data in accordance with Art. 6(1f) of the GDPR.

e) Duration of storage, opportunity for objection and disposal

Cookies are stored on the user’s computer and are transferred from there to our website. Consequently, you as user also have full control over the use of cookies. By changing the settings of your Internet browser, you can disable or restrict the transfer of cookies. Cookies that have already been stored can be erased at any time. This can also be done automatically. If cookies are disabled for our website, there is a possibility that not all the functions can still be used to the full extent.

VI. Newsletter

1. Description and scope of data processing

An unsere Gäste versenden wir regelmäßig Newsletter. Wenn Sie auf unserer Internetseite Dienstleistungen erwerben (Reservierungen oder Anfragen tätigen) und hierbei Ihre E-Mail-Adresse hinterlegen, kann diese in der Folge durch uns für den Versand eines Newsletters verwendet werden. In einem solchen Fall wird über den Newsletter ausschließlich Direktwerbung für unsere oder ähnliche Dienstleistungen versendet.

In connection with the data processing for sending newsletters, no data will be passed onto third parties. The data will be used exclusively for sending the newsletter.

2. Legal basis for the processing of data

The legal basis for the processing of data after the user has registered for the newsletter, if the user’s consent has been received, is Art. 6(1a) of the GDPR.

The legal basis for sending the newsletter following the sale of goods or services is Section 7(3) UWG [Gesetz gegen unlauteren Wettbewerb = Law against Unfair Competition].

3. Purpose of data processing

The user’s e-mail address is collected for the purpose of delivering the newsletter.

The collection of other personal data during the registration process services the purpose of preventing any abuse of the services or of the e-mail address used.

4. Duration of storage

The data will be deleted as soon as it is no longer necessary to reach the purpose for which it has been collected. Accordingly, the user’s e-mail address will be stored for as long as the newsletter subscription is active.

Any other personal data collected during the registration process will generally be deleted after a period of seven days.

5. Opportunity for objection and disposal

Subscription to the newsletter can be terminated by the user concerned at any time. A link is provided for this purpose in each newsletter.

This also makes it possible to revoke consent to the store of the personal data collected during the registration process.

VII. Registration and E-Mail contact

1. Description and scope of data processing

On our website, we offer users the possibility to register by entering their personal data. In this processes, the data is entered in an input screen and is sent to us and stored. The data is not passed onto third parties. The following data is collected during the registration process.

At the time of registration, the following data is also stored:

The user’s IP address
Date and time of registration

In order to process this data, during the registration process the user’s consent is obtained.

Alternatively, it is possible to contact us via the e-mail address provided. In this case, the personal data of the user transmitted with the e-mail will be stored.

In this context, the data will not be passed on to third parties. The data is used exclusively for the processing of the conversation.

2. Legal basis for the processing of data

The legal basis for the processing of data, if the user’s consent has been received, is Art. 6(1a) of the GDPR.

If registration serves to fulfill a contract to which the user is party or to implement pre-contractual measures, a further legal basis for the processing of data is Art. 6(1b) of the GDPR.

3. Purpose of data processing

Registration of the user is necessary in order to have certain contents and services ready on our website. Registration of the user is necessary in order to fulfill a contract to which the user is party or to implement pre-contractual measures.

The other personal data processed during the submission process is used to prevent misuse of the contact form and to ensure the security of our information technology systems.

4. Duration of storage

The data will be deleted as soon as it is no longer necessary to reach the purpose for which it has been collected. This applies to the data collected during the registration process if the registration on our website is cancelled or modified. This applies to any [data collected] during the registration process for the fulfillment of a contract or for the implementation of pre-contractual measures, if the data is no longer necessary for the fulfillment of the contract.

The additional personal data collected during the sending process will be deleted after a period of seven days at the latest.

5. Opportunity for objection and disposal

The user has the possibility, at any time, to revoke consent for the processing of personal data. If the user contacts us by e-mail, he/she may object to the storage of his/her personal data at any time. In such a case, the conversation cannot be continued.

Revocation must be made by sending an e-mail to direktion@hotel-ulli.at.

All personal data that has been stored during the contact process will be deleted in this case.

VIII. Web analysis via Google analytics and Facebook social plug-ins

1. Scope of processing of personal data

This website uses Google Analytics, a web analysis service of Google Inc, (1600 Amphitheatre Parkway Mountain View, CA 94043, USA). This usage includes the Universal Analytics operating mode. This makes it possible to allocate data, sessions and interactions via several devices to a pseudonymous user ID, and thus analyze the activities of a user on different devices.

Google Analytics uses so-called cookies, text files that are stored on your computer and allow your use of the web to be analyzed. The information generated by the cookie on your use of this website is, as a rule, transferred to a service of Google in the USA, where it is stored. Should the IP anonymization be enabled on this website, however, Google will shorten your IP address within the member States of the European Union or in other States party to the Agreement on the European Economic Area. Only in exceptional cases is the full IP address transferred to a server of Google in the USA and shortened there. The IP address transferred from your browser with regard to Google Analytics is not merged with other data by Google. On behalf of the owner of this website, Google will use this information to evaluate your usage of the website, in order to assemble reports on the website activities and to provide the website owner with further services connected with the website usage and internet usage. These purposes also include our legitimate interest in the processing of the data. The legal basis for the use of Google Analytics is Art. 6(1f) of the GDPR. The data sent by us and linked with cookies, user recognitions (e.g. user IDs) or promotion IDs will be deleted automatically after 60 months. The deletion of data for which the storage period has expired will be automatically deleted once a month. Further information on the conditions of use and data protection can be found under

https://www.google.com/analytics/terms/de.html

https://policies.google.com/

You can prevent cookies from being stored by appropriately setting your browser software; we must point out, however, that in this case you may not be able to use all functions of this website to their full extent. In addition, you may prevent any data that is generated by the cookie and relates to your use of the website (incl. your IP address) being sent to Goodle, as well as the processing of this data by Google, by downloading and installing the browser add-on under https://tools.google.com/dlpage/gaoptout. Opt-out cookies prevent your data from being collected on future visits to this website. In order to prevent data from being collected by Universal Analytics via other devices, you must carry out the opt-out procedure on all systems used.

We use Facebook social plug-ins of the social network Facebook, operated by the enterprise Facebook Ireland Limited, 4 Grand Canal Square Dublin 2, Ireland, and Facebook Inc., 1601 S. California Avenue, Palo Alto, CA 94303, USA. These plug-ins are switches that Facebook uses to measure who calls up our website. If the visitor is registered on Facebook as a user and logged in at the same time, further information will also be stored by Facebook. For technical reasons, Facebook receives your IP address. We do not have any influence on how Facebook uses this data. In this respect, we refer to the data policies of Facebook, in particular the information that can be retrieved via the following link:

https://www.facebook.com/help/568137493302217

There, you can also receive information on how you can block Facebook social plug-ins with your browser.

2. Legal basis for the processing of personal data

The legal basis for the processing of the personal data of the user is Art. 6(1f) of the GDPR.

3. Purpose of data processing

The processing of the personal data of the user allows us to analyze the surfing habits of our users. Thanks to an evaluation of the data obtained, we are able to gather information on the use of the single components of our website. This helps us to constantly improve our website and make it more user-friendly. These purposes also include our legitimate interest in the processing of data in accordance with Art. 6(1f) of the GDPR. Through the anonymization of the IP address, the interest of the user to safeguard his/her personal data is sufficiently taken into account.

4. Duration of storage

The data will be deleted as soon as it is no longer necessary for our recording purposes.

5. Opportunity for objection and disposal

On our website, we offer our users the chance to opt out of the analysis procedure. For this purpose, you must follow the appropriate link. In this way, a further cookie is stored in your system that signals to our system that it must not store the user’s data. If, in the meantime, the user deletes the relevant cookie from the system, he/she must reset the opt-out cookie.

IX. Rights of the data subject

If your personal data is processed, you are the data subject within the meaning of the GDPR and you have the following rights vis-à-vis the controller:

1. Right of access

You can demand confirmation from the controller whether your personal data is processed by us.

If such processing takes place, you can demand access to the following information from the controller:

(1) the purposes for which the personal data is processed;

(2) the categories of personal data that is processed;

(3) the recipients and/or the categories of recipients to whom your personal data has been disclosed or is still being disclosed;

(4) the planned duration of storage of your personal data or, if specific details on this are not possible, criteria for establishing the duration of storage;

(5) the existence of a right to correct or delete your personal data, of a right to restrict the processing by the controller or a right to object to this processing;

(6) the existence of a right to complain with a supervisory authority;

(7) all available information on the origin of the data, if the personal data is not collected from the data subject;

(8) the existence of an automatic decision making process, including profiling in accordance with Art. 22(1) and (4) of the GDPR and – at least in these cases – significant information on the logic involved as well as the scope and the desired effects of such processing for the data subject.

You have the right to be told if your personal data is transferred to a third country or to an international organzation. In this regard, you can demand to know about the appropriate safeguards in accordance with Art. 46 of the GDPR in connection with such transfer.

2. Right to rectification

You have a right to rectification and/or completion vis-à-vis the controller, if your processed personal data is incorrect or incomplete. The controller must immediately implement the rectification.

3. Right to restriction of processing

You may demand the restriction of the processing of your personal data under the following conditions:

(1) if you dispute the accuracy of your personal data for a period of time that allows the controller to check the accuracy of the personal data;

(2) the processing is unlawful, and you reject the deletion of the personal data, demanding in lieu of this a restriction of the use of the personal data;

(3) the controller no longer needs the personal data for the purposes of the processing, but you require this in order to assert, exercise or defend legal claims, or

(4) if you have submitted an objection to the processing in accordance with Art. 21(1) of the GDPR, and it has not yet been established whether the justified reasons of the controller override your own reasons.

If the processing of your personal data has been restricted, this data – apart from the storage thereof – may only be processed with your consent or for the assertion, exercise or defence of legal claims, or to safeguard the rights of another natural or legal person, or for reasons of an important public interest of the Union or a member State.

If the restriction of processing is restricted in line with the above conditions, you will be informed by the controller before the restriction is lifted.

4. Right to erasure

a) Obligation of erasure

You can demand the controller to have your personal data immediately erased, and the controller is obligated to erase this data immediately, provided one of the following reasons applies:

(1) Your personal data is no longer necessary for the purposes for which it was collected or has otherwise been processed.

(2) You revoke your consent supporting the processing in accordance with Art. 6(1a) or Art. 9(2a) GDPR, and there is no other legal basis for the processing thereof.

(3) In accordance with Art. 21(1) GDPR you submit an objection to the processing and there are no overriding legitimate reasons for the processing to continue or, in accordance with Art. 21(2) GDPR you submit an objection to the processing.

(4) Your personal data has been unlawfully processed.

(5) The erasure of your personal data is necessary to fulfill a legal obligation under Union law, or the law of the member States, to which the controller is subject.

(6) Your personal data was cancelled in reference to information society service offered in accordance with Art. 8(1) GDPR.

b) Information to third parties

If the controller has made your personal data publicly available and if he is obligated, in accordance with Art. 17(1) of the GDPR to erase such data, he will take suitable measures, including technical measures, in line with the available technology and the implementation costs, in order to inform the data processors of the personal data that you as a data subject have demanded them to delete all links to this personal data, or copies or reproductions of this personal data.

c) Exceptions

The right to erasure does not apply insofar as processing of the data is necessary

(1) to exercise the right to freedom of expression and information;

(2) to fulfill a legal obligation, which requires the data to be processed in accordance with the law of the Union or the member States to which the controller is subject, or to carry out a task that lies in the public interest or is carried out in the exercise of official authority, that has been transferred to the controller;

(3) for reasons of public interest concerning public health in accordance with Art. 9(2h) and (2i) as well as Art. 9(3) of the GDPR;

(4) for archive purposes that lie in the public interest, scientific or historic research purposes or for statistical purposes in accordance with Art. 89(1) of the GDPR, insofar as the right mentioned in para. 1) is expected to make it impossible to achieve the objectives of this processing or seriously impair them, or

(5) to assert, exercise or defend legal claims.

5. Right to information

If you have asserted your right to rectification, erasure or restriction of processing vis the controller, the latter is obligated to inform all recipients to which your personal data has been disclosed about this rectification or erasure of data or the restriction of processing, unless this proves to be impossible or would involve an unreasonable amount of time and money.

You have the right to demand the controller to inform you about these recipients.

6. Right to data portability

You have the right to receive any of your personal data, which you have provided to the controller, in a structured, common and machine-readable format. You also have the right to transfer this data to another controller without any impediment from the controller to whom the personal data was provided, provided

(1) the data processing is based on consent given in accordance with Art. 6(1a) GDPR or Art. 9(2a) of the GDPR, or on a contract in accordance with Art. 6(1b) of the GDPR and

(2) the data is processed using automated procedures.

When exercising this right, you also have the right to demand that your personal data is transferred directly from one controller to another controller, provided this is technically feasible. Freedoms and rights of other persons may not be impaired by this.

The right to data portability does not apply to the processing of personal data that is necessary to carry out a task that lies in the public interest or is carried out in the exercise of official authority, that has been transferred to the controller.

7. Right to object

You have the right, for reasons deriving from your own personal situation, to submit an objection at any time to the processing of your personal data, based on Art. 6(1e) or (1f) of the GDPR; this also applies to a profiling based on these provisions.

The controller will no longer process your personal data unless he is able to prove compelling legitimate grounds for doing so that override your own interests, rights and freedoms, or if the processing is necessary to assert, exercise or defend legal claims.

If your personal data is processed for the purposes of direct advertising, you have the right to object at any time to the processing of your personal data for the purposes of such advertising; this also applies to profiling if this is connected with such direct advertising.

If you object to the processing for purposes of direct advertising, your personal data will no longer be processed for these purposes.

You have the chance, in connection with the use of information society services – irrespective of Directive 2002/58/EG – to exercise your right of objection using automated procedures in which technical specifications are used.

8. Right to objection to the declaration of consent under the data protection law

You have the right to revoke your declaration of consent under the data protection law at any time. By revoking such consent, the lawfulness of the data processing that has been carried out based on such consent up to the time of revocation will be unaffected.

9. Automated decisions in individual cases, including profiling

You have the right not to be subject to a decision that is based exclusively on an automated processing – including profiling, which has a legal effect against you or causes considerable detriment to you in a similar way. This does not apply if the decision

(1) is necessary for the conclusion or fulfillment of a contract between you and the controller,

(2) is permissible based on legal provisions of the Union or the member States, to which the controller is subject, and these legal provisions contain appropriate measures to safeguard your rights and freedoms and your legitimate interests or

(3) is taken with your express consent.

These decisions may not, however, be based on particular categories of personal data in accordance with Art. 9(1) of the GDPR, unless Art. 9(2a) or (2g) of the GDPR applies and appropriate measures have been taken to safeguard rights and freedoms as well as your legitimate interests.

With regard to the cases named in (1) and (3), the controller will take appropriate measures to safeguard the rights and freedoms and your legitimate interests, at least including the right to obtain the intervention of a person on the part of the controller, to represent his own viewpoint and challenge the decision.

10. Right to complain with a supervisory authority

Irrespective of any other administrative or judicial remedy, you have the right to lodge a complaint with a supervisory authority, in particular in the member State of your habitual residence, your place of work or the place of the presumable breach, if you are of the opinion that the processing of your personal data breaches the GDPR.

The supervisory authority to which the complaint was submitted will inform the complainant about the status and the results of the complaint, including the possibility to a judicial remedy in accordance with Art. 78 of the GDPR.

Hotel Ulli****

Impressions

Webcam

+43 5583 2600-0

info@hotel-ulli.at