Privacy policy

The controller responsible for the processing of your personal data is:

Daniel Walser KG
Mandarfen 86
6481 St. Leonhard/Pitztal
Österreich

Tel.: +43 5413 86386
E-Mail: info@mittagskogel.at
Website: www.mittagskogel.at

The protection of your personal data is important to us. We process your data exclusively on the basis of the statutory provisions, in particular the General Data Protection Regulation (GDPR), the Austrian Data Protection Act (Datenschutzgesetz, DSG) and the Austrian Telecommunications Act 2021 (Telekommunikationsgesetz 2021, TKG 2021). This privacy policy informs you about which data we process when you visit our website, when you send us an enquiry or make a booking, for which purposes and on which legal basis this happens, to whom data is disclosed and which rights you have. It applies to all domains, subpages and online services on which it is linked. Where this privacy policy is published in several languages, the German version shall prevail.

If you have any questions about data protection or wish to exercise your rights, you can contact us at any time using the contact details above. Further information about our company can be found in our legal notice.

Principles and legal bases
We only process the data that is necessary for the respective purpose. Processing is based on the following legal bases:
 

• Consent (Art. 6(1)(a) GDPR) – in particular for non-essential cookies, analytics and marketing services and for our newsletter. You may withdraw your consent at any time with effect for the future; the lawfulness of the processing carried out until then remains unaffected.
• Performance of a contract and pre-contractual measures (Art. 6(1)(b) GDPR) – for enquiries, quotations, bookings and reservations as well as for the performance of a contract.
• Compliance with a legal obligation (Art. 6(1)(c) GDPR) – in particular retention and documentation obligations under the Austrian Federal Fiscal Code (Bundesabgabenordnung, BAO) and the Austrian Commercial Code (Unternehmensgesetzbuch, UGB).
• Legitimate interests (Art. 6(1)(f) GDPR) – in the secure and stable operation of our website, in protection against misuse and in responding to general enquiries.

Hosting, server log files and data security
Our website is operated by an external hosting provider which processes the data exclusively on our behalf and on the basis of a data processing agreement (Art. 28 GDPR). For faster and more secure delivery, technical services such as content delivery networks (CDN) may be used.

Every time the website is accessed, technical data is automatically stored in server log files: IP address, date and time of access, page or file accessed, amount of data transferred, access status, referrer URL as well as browser type and operating system. We need this data to deliver the website, to analyse errors and to ensure its stability and security (Art. 6(1)(f) GDPR). It is not combined with other data and is stored only for as long as is necessary for these purposes.

We take appropriate technical and organisational measures to protect your data against loss, manipulation and unauthorised access. Data transmission on our website is encrypted via SSL/TLS („https://“).

Cookies and consent management
Cookies are small text files that are stored on your device. We use strictly necessary cookies – for example to store your cookie selection or to ensure form and security functions – so that the website works (§ 165(3) TKG 2021, Art. 6(1)(f) GDPR).

All other cookies and comparable technologies, in particular for analytics, marketing or external content, are only loaded once you have previously given your express consent via our cookie banner (§ 165(3) TKG 2021, Art. 6(1)(a) GDPR). Without your consent, no data is transmitted to third parties in this respect. You can see at any time in the cookie settings of our website which services and cookies are used, together with their purpose, storage duration and provider. There you can also adjust or withdraw your consent at any time. In addition, you can delete or block cookies in your browser settings; individual functions of the website may then be restricted.

Web analytics and online marketing
Where we use services for audience measurement, usage analysis and advertising performance measurement – such as Google Analytics, Google Ads conversion tracking and remarketing, Google Tag Manager, the Meta Pixel or tools for analysing user behaviour such as heatmaps – these are loaded exclusively after your consent via the cookie banner (Art. 6(1)(a) GDPR, § 165(3) TKG 2021). This involves the processing of your IP address or pseudonymous identifiers, device and browser information and information about your use of the website (e.g. pages visited, duration of visit, origin of the visit, interactions), which is transmitted to the respective provider. This data may be used to create pseudonymous usage profiles in order to improve our services and to show you interest-based advertising.

The providers of these services are in particular Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland, and Meta Platforms Ireland Limited, Merrion Road, Dublin 4, D04 X2K5, Ireland. When the Meta Pixel is used, we are jointly responsible with Meta for the collection and transmission of the data (Art. 26 GDPR); further processing is carried out under Meta's sole responsibility. The services actually used are listed in the cookie settings, where you can withdraw your consent at any time. You can also deactivate personalised advertising in the settings of your Google or Meta account.

Enquiries and contact
If you contact us by e-mail, telephone or via a contact or enquiry form, we process the data you provide (e.g. name, contact details and your message) in order to answer your enquiry, clarify follow-up questions and prepare a quotation for you. The legal basis is the performance of pre-contractual measures (Art. 6(1)(b) GDPR) or, for general enquiries, our legitimate interest in responding to them (Art. 6(1)(f) GDPR).
For managing enquiries, we may use software solutions from specialised service providers acting as processors.

Newsletter and reviews
If we offer a newsletter on our website and you subscribe to it, we use your e-mail address and, where applicable, your name to send you information about offers, promotions and news. Subscription is based on the double opt-in procedure; for verification purposes we log the time and IP address of the subscription and of the confirmation. With your consent, we evaluate whether a newsletter was opened and which links were clicked in order to improve our content. The legal basis is your consent (Art. 6(1)(a) GDPR, § 174 TKG 2021). A specialised service provider may be used as a processor for sending the newsletter. You can unsubscribe from the newsletter at any time via the unsubscribe link in every e-mail or by sending us a message.

If you have consented or if this is legally permitted, we may ask you for a review by e-mail after a contact or after a service has been provided, or inform you about similar offers. You may object to such messages at any time free of charge.

Bookings, reservations and payments
Where we offer online booking or reservations, we use the booking system of an external provider. If you use this function, the data required for the booking is processed, in particular name, address, contact details, the desired period, the services booked and, if applicable, payment or credit card data to secure the booking or to settle deposits and cancellation fees. The legal basis is the performance or initiation of the contract (Art. 6(1)(b) GDPR). In addition, the privacy notices displayed to you during the booking process apply.

The same applies to reservations for other services that we may offer, such as table, course or appointment reservations. Payments are processed via banks and specialised payment service providers. We do not store complete credit card data ourselves, but only within the secure systems provided for this purpose (Art. 6(1)(b), (c) GDPR).

If you provide information about other persons in an enquiry or booking, please make sure that these persons are informed about the disclosure of their data and about this privacy policy.

External content, links and locally hosted resources
Our website does not automatically load content from third parties. In particular, fonts (web fonts) are loaded locally from our own server; no connection is established to third-party servers (e.g. Google Fonts) in this process.

References to external services – for example to our profiles on social networks (e.g. Facebook, Instagram, YouTube) or to webcams – are designed as simple links. No data is transmitted to these providers when you visit our website. Only when you click a link do you leave our website; in that case your IP address is transmitted to the respective provider for technical reasons, and its privacy policy applies. We have no influence on processing by these providers.

Should maps, videos or other third-party content exceptionally be embedded directly in the website, they are loaded exclusively after your consent via the cookie banner (Art. 6(1)(a) GDPR, § 165(3) TKG 2021).

Recipients of your data
Your data is only disclosed where this is necessary for the purposes mentioned or required by law. Recipients may include:
 

• IT, hosting and web service providers as well as providers of software for enquiries, website management and e-mail delivery
• providers of booking, reservation and newsletter systems acting as processors on our behalf
• booking platforms, where you make a booking through them
• payment service providers, credit card companies and banks, where a payment is made
• tax advisers, auditors and legal representatives
• authorities, where this is provided for by law
• providers of analytics, marketing and external content, where you have given your consent

Service providers acting on our behalf are contractually obliged to process your data exclusively in accordance with our instructions and in compliance with data protection law. Your data is not passed on to third parties for advertising purposes.

Transfers to third countries
For certain services, personal data may be transferred to countries outside the European Union or the European Economic Area, in particular to the USA. Such a transfer only takes place if an adequate level of data protection is ensured – for example on the basis of an adequacy decision of the EU Commission such as the EU-US Data Privacy Framework for certified companies (Art. 45 GDPR) or on the basis of standard contractual clauses of the EU Commission (Art. 46(2)(c) GDPR) – or if you have expressly consented.

Retention period
We store your personal data only for as long as is necessary for the respective purpose. The retention period is determined in particular by:
 

• the duration of the processing of your enquiry or of the contractual relationship,
• statutory retention and documentation obligations, in particular under the Austrian Federal Fiscal Code and the Austrian Commercial Code,
• statutory limitation and claim periods, where the data is required for the establishment, exercise or defence of legal claims,
• for processing based on consent: until it is withdrawn or in accordance with the information provided in the cookie settings.

Once the purpose ceases to apply or the relevant periods expire, the data is deleted or anonymised.

Your rights
In principle, you have the right of access (Art. 15 GDPR), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18) and data portability (Art. 20), as well as the right to withdraw consent you have given (Art. 7(3)).
Right to object (Art. 21 GDPR): Where we process your data on the basis of our legitimate interests, you may object at any time on grounds relating to your particular situation. You may object to processing for the purposes of direct marketing at any time without giving reasons.

To exercise your rights, an informal message to the contact details given above under "Controller" is sufficient. To prevent misuse, we may ask you to provide proof of your identity.

Right to lodge a complaint: If you believe that the processing of your data infringes data protection law, you can lodge a complaint with the Austrian Data Protection Authority: Barichgasse 40–42, 1030 Vienna, Austria, e-mail: dsb@dsb.gv.at, www.dsb.gv.at.

Obligation to provide data and automated decisions
In principle, you can use our website without providing personal data. However, in order to process an enquiry, booking or reservation we require the data marked as mandatory or prescribed by law; without this data we cannot process your enquiry or conclude the contract. Automated decision-making, including profiling, within the meaning of Art. 22 GDPR does not take place.

Changes
We will update this privacy policy if our website, the services used or the legal requirements change. The version published on this website at the time applies.