Privacy policy

VERBUND Tourismus GmbH considers it important to protect your personal data and to inform you about how we handle it. In this privacy policy, you will find the essential data processing activities of VERBUND Tourismus GmbH. This privacy policy sets out how we process your personal data.
 

1. Name and contact details of the person responsible

The controller responsible for processing your data within the scope of the data processing activities listed below at Berghotel Malta is VERBUND Tourismus GmbH, Europaplatz 2, 1150 Vienna (“we”, “us”).

The contact details of the Data Protection Officer are:

Email: datenschutz@verbund.com

 

 

2. What data do we process, for what purposes and on what legal basis?

2.1 Website

When you visit our website www.berghotelmalta.at, we collect the following personal data in a server log file:

  • Accessed content
  • Time of the server request
  • Browser type / browser version
  • Operating system used
  • Referrer URL
  • IP address
  • Hostname
     

The collected access data within the scope of website use is processed for the purpose of operating and securing the website (predominantly legitimate interests). In the case of, for example, usage statistics or personalized advertising, we process your data based on your voluntary consent.

 

2.2 Cookies Policy

2.2.1 General

Cookies make websites more user-friendly and efficient. A cookie is a small text file used to store information. When visiting a website, the website may place a cookie on the website visitor’s computer. If the user visits the website again later, the website can read the data of the previously stored cookie and thus determine, for example, whether the user has visited the website before and which areas of the website the user is particularly interested in.

For the operation of our website, we use necessary cookies without which providing our website would not be possible. We rely on our legitimate interest pursuant to Art 6 para 1 lit f GDPR, which consists of designing our website to be user-friendly and protecting it against attacks. If you have given us your consent pursuant to Art 6 para 1 lit a GDPR in conjunction with § 165 para 3 TKG, we also use personal cookies to create usage statistics and to display personalized advertising. You may revoke your voluntarily given consent at any time.

If your selected settings or your voluntarily given consent also include providers that transfer data to countries without an adequacy decision pursuant to Art 45 para 3 GDPR and without appropriate safeguards pursuant to Art 46 GDPR (such as, in particular, the USA), your consent pursuant to Art 49 GDPR also applies to this. There is a risk that data transferred in this way may be subject to access by authorities in these third countries for control and monitoring purposes and that no effective legal remedies are available against this.

On our website, you have the option, via our cookie banner, which appears automatically on your first visit to our website or when changes occur, to generally accept the use of cookies/tools by clicking the “Allow all cookies” button. By clicking the “Only necessary cookies” button, you reject all non-essential cookies. In addition, you can individually “Allow” or “Reject” the tools.
 

2.2.2 Which cookies are used

Our website processes the following cookies:

  • Strictly necessary cookies to ensure basic website functions
  • CookieConsent: Used to store consent to cookie usage
  • gaOptout, maOptout, fbOptout: Used to store opt-out from Google Analytics
  • Functional cookies to ensure website performance
  • Performance cookies to improve user experience
  • Google Analytics, Google Adwords, Matomo Analytics (see below)
  • Advertising cookies to manage advertising campaigns
     


2.2.3 Google Analytics

If you have consented, VERBUND uses Google Analytics, a web analytics service provided by Google Ireland Limited (Google Ireland Limited, Google Building Gordon House, 4 Barrow Street, Dublin D04 E5W5, Ireland) (“Google”). Google Analytics also uses cookies that enable analysis of your use of the website. The information generated by the cookies about your use of this website is transmitted to a Google server in the USA and stored there.

We inform you that on this website Google Analytics has been extended by the code “gat._anonymizeIp();” to ensure anonymized collection of IP addresses. Therefore, the IP address of users is shortened before storage on Google servers (so-called IP masking). The full IP address is not transmitted to a Google server in the USA. Only in exceptional cases is the full IP address transmitted to a Google server in the USA and shortened there. Google will use this information on behalf of VERBUND to evaluate your use of the website, compile reports on website activity for website operators, and provide further services related to website and internet usage.

You can prevent the installation of cookies, for example, by adjusting your browser software settings (so-called “browser add-on”); however, we point out that in this case you may not be able to fully use all functions of this website.

You can also prevent the collection of data generated by the cookie and related to your use of the website (including your already anonymized IP address) by Google and the processing of this data by Google by downloading and installing the browser plug-in available at the following link:
http://tools.google.com/dlpage/gaoptout?hl=de

Further information on terms of use and data protection at Google can be found at:
http://www.google.com/analytics/terms/de.html

You can prevent the collection of your user data by Google Analytics on this website by clicking the link provided below. An opt-out cookie will be set to prevent the collection of your data during future visits to this website.

 

2.2.4 Google Adwords Conversion Tracking/Google Ads.

If you have consented, this website uses Google Conversion Tracking by Google Ireland Limited (Google Ireland Limited, Google Building Gordon House, 4 Barrow Street, Dublin D04 E5W5, Ireland). A cookie is set by Google Adwords on the visitor’s computer if the visitor reached our website via a Google ad. These cookies expire after 30 days and are not used for personal identification.

If the user visits certain pages of the Adwords customer’s website and the cookie has not yet expired, Google and the customer can recognize that the user clicked on the ad and was redirected to that page. Each Adwords customer receives a different cookie. Cookies cannot therefore be tracked across the websites of Adwords customers.

The information obtained using the conversion cookie is used to create conversion statistics for Adwords customers who have opted for conversion tracking. This allows us to improve the performance of our ads in Google search results and to target returning visitors more effectively. Adwords customers receive the total number of users who clicked on their ad and were redirected to a page with a conversion tracking tag. However, they do not receive information that personally identifies users.

If the visitor does not wish to participate in the tracking process, they can refuse the setting of the required cookie – for example, via browser settings that generally deactivate automatic cookie setting. The visitor can also deactivate cookies for conversion tracking by setting their browser to block cookies from the domain “www.googleadservices.com”.

Further information on Google’s data usage can be found at:
https://www.google.com/intl/de/policies/privacy

 

2.3 Contact / Inquiry

If you contact us or submit an inquiry, in particular regarding room bookings, packages, seminar rooms, or restaurant reservations, the following data provided by you will be processed – depending on the chosen contact method (online contact or inquiry form, email, telephone) and your inquiry: personal details such as salutation, title, name, address, email address, telephone number, as well as travel data, room category, number of rooms and persons, and, if applicable, further data relating to the inquiry, including comments.

Your data will be processed for the purpose of contacting you and providing information or handling your inquiry. The legal basis for processing mandatory data, if the inquiry aims at concluding a booking, is Art 6 para 1 lit b GDPR (necessary for (pre-)contractual performance), legitimate interest (Art 6 para 1 lit f GDPR) in handling your inquiry, or your consent (Art 6 para 1 lit a GDPR in conjunction with Art 9 para 2 lit a GDPR) if you provide special categories of data.

The provision of this data is voluntary. However, if you do not provide the data necessary to handle your inquiry, we cannot process your inquiry accordingly.
 

2.4 Bookings

If you book rooms or packages directly with us or via a booking portal, or make bookings for seminar rooms, other offers/activities, or restaurant visits at Berghotel Malta (e.g. by telephone, email, online form, or on site), we process the following data in particular for the execution and handling of the respective booking: salutation, name, email address, telephone number, address, nationality, possibly your message to us, the name of accompanying person(s), billing address, payment data.

In addition, we process information about your stay, including arrival and departure dates, special requests or comments (including room preferences, equipment, or other services used). Processing of mandatory data is required to fulfill the contract concluded with you (Art 6 para 1 lit b GDPR).

Data optionally provided during booking is processed based on legitimate interest (Art 6 para 1 lit f GDPR), particularly to interact with you appropriately.

If you voluntarily provide special categories of data (e.g. allergies), we base processing on your consent (Art 6 para 1 lit a and Art 9 para 2 lit a GDPR).

At Berghotel Malta, additional data required by law (Registration Act) is collected for room bookings, such as date of birth, gender, place of residence, possibly travel document (type, number, date of issue, issuing authority), as well as data of accompanying persons (first name, last name, date of birth, possibly travel document, nationality). Processing is necessary to comply with legal obligations (Art 6 para 1 lit c GDPR).

Provision of data is voluntary; however, if you do not provide necessary data, we cannot process and manage your booking.
 

2.5 Applications

Applicant data that we receive from you for a position at Berghotel Malta and contained in the documents submitted to us (in particular name, address, telephone number, email address, date of birth, education, professional background, information on desired position) is processed to evaluate and assign your application, compare it with open positions, select suitable candidates, and fill vacancies.

Processing of data necessary for the application is carried out as part of pre-contractual measures pursuant to Art 6 para 1 lit b GDPR. Voluntarily provided data (e.g. salutation) is processed based on legitimate interest (Art 6 para 1 lit f GDPR) to interact with you appropriately.

We point out that you are not required to provide special categories of personal data within the meaning of Art 9 GDPR (e.g. health data, religious affiliation) as part of your application. If you nevertheless disclose such information or if it results from uploaded documents, we will not take it into account. Such data will be deleted or redacted immediately.

If you give your consent to keep your application on file, the legal basis is Art 6 para 1 lit a GDPR.

Provision of personal data is voluntary; however, if you do not provide the data required for evaluating your application, we cannot process it.
 

2.6 Newsletter

If you subscribe to our newsletter, we process the following data: personal details such as name and email address. Provision of this data is voluntary. However, if you do not provide it, no newsletter can be sent to you.

The legal basis is Art 6 para 1 lit a GDPR, i.e., your voluntary consent to receive the newsletter. You may revoke your consent at any time without giving reasons and with effect for the future at no additional cost, for example via the link contained in the email or by email to office@berghotelmalta.at.

Your personal data is processed for the purpose of sending information about activities, offers and services, competitions, or events, as well as invitations to events.
 

2.7 Social Media Channels

You can interact with us on our social media pages by clicking various buttons (e.g. “Like”, “Share”, “Subscribe”, “Follow”) or commenting on content. In this case, we process your interaction, your (user) name, profile picture, IP address, and possibly personal data of invited or tagged third parties.

We use this information based on our legitimate interests pursuant to Art 6 para 1 lit f GDPR to answer your questions and comments, respond to your feedback, give you the opportunity to express your opinion, and promote ourselves and our product offerings on the platform.

Your data may also be processed by the platform operators. In this case, we and the respective platform operator are joint controllers pursuant to Art 26 GDPR. We have concluded agreements on joint controllership. Further information on data processing by the platforms can be found at:

Facebook and Instagram: https://www.facebook.com/privacy/policy/

Pinterest: https://policy.pinterest.com/de/privacy-policy
 

3. Data Transfer

If service providers (“processors”, e.g. IT service providers, marketing service providers, etc.) are commissioned for data processing, they may have access to personal data in accordance with our instructions. Processing by a processor is always based on a contract.

Furthermore, we may transfer your personal data to the following recipients to the extent necessary:

  • Third parties involved in fulfilling our obligations towards you (e.g. payment service providers or banks for payment processing; cooperation partners);
  • Other external third parties on a case-by-case basis based on our legitimate interests (e.g. auditors, insurance companies in insurance cases, legal representatives where necessary);
  • Courts, competent authorities, and other public bodies to the extent required by law (e.g. municipality in connection with the Registration Act, tax authorities).

 

4. Storage Period

We store your personal data only as long as necessary to fulfill our obligations towards you. Due to statutory retention obligations, we generally store data provided in connection with bookings for seven years after contract fulfillment. Data from other inquiries/contacts is stored for up to 18 months after response to adequately address possible follow-up questions.

If you have given consent, we store the data until you revoke your consent.

If an employment relationship is established, we store your data for the duration of employment and delete it after termination in accordance with statutory deadlines. If no employment relationship is established and no consent for retention is given, applicant data is deleted no later than after expiry of statutory deadlines (7 months) following completion of the application process.

Personal data voluntarily provided on our social media pages (e.g. name, comments, interactions) is stored until you remove the respective information (e.g. “like”) or delete the comment, or until it is lawfully deleted by the platform operator (e.g. in cases of misuse).

We also store personal data as long as necessary to detect and prevent fraud and other illegal activities. In individual cases, we store personal data beyond the above periods as long as legal claims arising from the relationship between you and us may be asserted or until final clarification of a specific incident or legal dispute. This extended retention serves to safeguard our legitimate interests in asserting, clarifying, and defending legal claims.
 

5. Your Rights

You have the right to access, rectification, erasure, and restriction of processing of your personal data.

If the legal basis for processing your personal data is your consent or a contract concluded with you, you also have the right to data portability.

You have the right to withdraw any consent given for the processing of your personal data. Withdrawal does not affect the lawfulness of processing based on consent before its withdrawal.

You have the right to object to the processing of your personal data for the purpose of direct marketing. In the event of objection, your personal data will no longer be processed for direct marketing purposes.

If you have questions regarding the processing of your personal data or wish to exercise your rights, please contact us at office@berghotelmalta.at or our Data Protection Officer at datenschutz@verbund.com. In order to process your request and ensure that personal data is not disclosed to unauthorized third parties, please submit your request with clear identification of your person and a brief description of the scope in which you wish to exercise your rights listed above.

You also have the right to lodge a complaint with a data protection authority. The authority responsible for us is the Austrian Data Protection Authority.