2.3 Contact / Inquiry
If you contact us or make an inquiry, in particular about room bookings, packages, seminar rooms or restaurant reservations, the following data provided by you will be processed, depending on the chosen method of contact (online via the contact or inquiry form, e-mail, telephone) and your inquiry: Personal data such as title, name, address, e-mail address, telephone number, as well as travel dates, room category, number of rooms and persons, as well as other data relating to the request as well as comments.
Your data will be processed for the purpose of contacting you and providing information or fulfilling your request. The legal basis for the processing of this data, if the request is aimed at the conclusion of a booking, is Art 6 para 1 lit b DSGVO (necessary for the (pre-)contractual performance of the contract), the legitimate interest (Art 6 para 1 lit f DGSVO), which lies in the processing of your request or your consent (Art 6 para 1 lit a DSGVO), if you disclose particularly sensitive data.
The provision of this data by you is voluntary. If you do not provide the data necessary for the processing of your request, we cannot process your request accordingly.
If you book rooms or packages with us directly or via a booking portal or make bookings for seminar rooms, other offers/activities or also restaurant visits at Berghotel Malta (e.g. by telephone, e-mail, online form or on site), we process the following data in particular for the purpose of making and handling the respective booking: Salutation, name, e-mail address, telephone number, address, nationality, if applicable your message to us, the name of your accompanying person(s), billing address, credit card data or other payment data. In addition, we process information about your stay, including arrival and departure dates, special requests or comments (including room requests, amenities or other services used). The processing of the data is necessary to fulfill the contract you have concluded with us (Art 6 para 1 lit b DSGVO). If you also voluntarily provide us with particularly sensitive data (e.g. allergies), we base the processing on your consent (Art 6 para 1 lit a and Art 9 para 2 lit a DSGVO).
At Berghotel Malta, additional data is collected for room bookings, which is necessary due to legal obligations (registration law), such as: Date of birth, place of birth, gender, if applicable a travel document (type, number, date of issue, issuing authority), as well as data of fellow travelers (first name, last name, date of birth, if applicable travel document, nationality). The processing of this personal data is necessary to comply with legal obligations (Art 6 para 1 lit c DSGVO).
The provision of data by you is voluntary; however, if you do not provide necessary data, we cannot process and manage your booking accordingly.
Your application data, which we receive from you for a position at Berghotel Malta and which is contained in the documents sent to us (in particular name, address, telephone number, e-mail address, date of birth, education, professional history, details of the desired position, etc.), is processed by us for the purpose of evaluating and assigning your application and matching it with vacancies. The processing of your data is carried out in the context of the implementation of pre-contractual measures in accordance with Art 6 para 1 lit b DSGVO. If you also voluntarily provide us with data that is particularly worthy of protection (e.g. religious confession), we base the processing on your consent (Art 6 para 1 lit a and Art 9 para 2 lit a DSGVO). If you give us your consent to keep records, Art 6 para 1 lit a DSGVO is the legal basis.
The provision of your personal data by you is voluntary; should you not provide the data required for the evaluation of your application, we will not be able to process your application.
2.6 Social Media Channels
You can interact with us on our social media pages by clicking various buttons (e.g. "Like", "Share", "Subscribe", "Follow") or commenting on content. In this case, we will process your interaction as well as your ("user") name, profile photo and IP address and, if applicable, personal data of invited or tagged third parties.
We use this information in accordance with Art 6 para 1 lit a or f DSGVO to answer your questions and comments, to comment on your opinion/feedback, to give you the opportunity to express yourself or to promote us and our product offering on the platform. We store this self-provided data until you revoke your interaction or as long as our content (images, videos, etc) is online.
On our social media pages, we process personal data automatically via the page insight tools of Facebook, Instagram and Pinterest, in each case together with the platform operator, which provide information about the interaction of visitors and users and serve to optimize your experience on the website or to optimize marketing activities ("tracking data").
For our Facebook and Instagram profiles, we have entered into the following shared responsibility agreement with Meta Platforms Ireland Ltd, 4 Grand Canal Square, Grand Canal Harbour, Dublin 2, Ireland: https://www.facebook.com/legal/controller_addendum
You can find out which personal data we process jointly under the heading "How is this information shared?" in the subheading "Partners who use our analytics services" in Facebook's privacy notice at https://www.facebook.com/policy.php.
We therefore use this information in accordance with Art 6 para 1 lit f DSGVO both to create aggregated evaluations of the use of our social media presence and to optimize our marketing activities.
This data is stored by Meta in accordance with the time limits described at https://www.facebook.com/policy.php (subsection: "Data storage, deactivation and deletion of accounts").
3. data transfer
Insofar as service providers commissioned for data processing ("order processors" such as IT service providers, service providers for marketing services, etc.) are involved, they may also have access to personal data under certain circumstances in accordance with our order and instructions. Processing by a processor is always based on a contract.
In addition, we may transfer your personal data to the following recipients to the extent necessary:
To any third parties involved in the fulfillment of our obligations to you (e.g. payment service providers or banks for payment processing; cooperation partners);
to other external third parties in the event of an incident to the extent necessary on the basis of our legitimate interests (e.g. auditors, insurance companies in the event of an insurance claim, legal representatives in the event of an incident);
Courts, responsible authorities and other public bodies to the extent required by law (e.g. municipality in connection with the registration law, tax authorities).
4. storage period
We store your personal data, only as long as they are necessary to fulfill our obligations to you. However, for reasons of the statutory retention obligations that apply to us, we generally store your data provided in connection with bookings for seven years after fulfillment of the contract. We store data from other inquiries/contacts for up to 12 months after the response in order to be able to respond appropriately to any follow-up questions. If you have given us your consent, we will store the data until you revoke your consent.
Should an employment relationship come about with you, we will retain your data for the duration of your employment and delete it after your employment has ended and the legal time limits have expired. If no employment relationship is established and no consent to keep records was given, the applicant data will be deleted at the latest after expiry of the statutory periods (7 months) after the end of the application process.
In addition, we store personal data for as long as necessary for the detection and prevention of fraud and other illegal activities. In case of cause, we also store your personal data beyond the above-mentioned periods, as long as legal claims can be asserted from the relationship between you and us or until the final clarification of a specific incident or legal dispute. This longer storage is done to protect our legitimate interests in the assertion, clarification and defense of legal claims.
5. your data subject rights
You have the right to information, correction, deletion and restriction of the processing of personal data.
Insofar as the legal basis for the processing of your personal data is your consent or a contract concluded with you, you also have the right to data portability.
You have the right to revoke any consent you may have given for the processing of your personal data. The lawfulness of the processing of the personal data until the revocation is not affected by the revocation.
You have the right to object to the processing of your personal data for the purpose of direct marketing. In the event of an objection, your personal data will no longer be processed for the purpose of direct marketing.
If you have any questions about the processing of your personal data or wish to exercise your data subject rights, please contact us at email@example.com or our data protection officer at firstname.lastname@example.org. In order for us to process your request and to ensure that personal data is not disclosed to unauthorized third parties, please submit the request clearly identifying yourself and briefly describing the scope of the exercise of your data subject rights listed above. You also have the option of submitting a complaint to a data protection authority. The competent authority for us is the Austrian Data Protection Authority.