Data protection
 

Privacy Policy

 

1. Fundamentals
 

In this data protection declaration, you will find out what personal data Sarstein  Landwirtschaftliche Betriebe GmbH processes automatically, how and for what purpose, and what rights you have as a data subject.

2. Responsible person  
 

The responsible party is Sarstein Landwirtschaftliche Betriebe GmbH, Fischerndorf 30, 8992 Altaussee, Austria; urlaub@schmiedgut-badaussee.at.

3. Collection and processing of data
when visiting the website
www.schmiedgut-badaussee.at
 

Each time our website is accessed, our system automatically collects data and information from the computer system of the accessing computer. The following data is collected:

• Information about the browser type and version used
• The user's operating system
• The user's internet service provider
• The IP address of the user
• Date and time of access
• Websites from which the user's system accesses our website
• Websites that are accessed by the user's system via our website

The data is stored in the log files of our system. This data is not stored together with other personal data of the user. Temporary storage of the IP address by the system is necessary to  enable delivery of the website to the user's computer. For this purpose, the user's IP address must remain stored for the duration of the session. The data is stored in log files to ensure the  functionality of the website. We also use the data to optimize the website and to ensure the security of our information technology systems. The data is not analyzed for marketing purposes in this context. These purposes also constitute our legitimate interest in data processing in accordance with Art. 6 para. 1 lit. f GDPR.  

If data is collected to provide the website, your data will be deleted at the end of the respective session. If the data is stored in log files, it will be deleted after seven days at the latest. Storage beyond this is possible if the IP addresses of the users are deleted or anonymized so that it is no longer possible to identify the accessing client.
  
To collect, measure and analyze visitor data, we use Matamo.org, an open source web analytics  platform, which is used to measure, collect, analyze and report visitor data in order to optimize the website. The personal data obtained via Matomo is transmitted to our company. We store the personal data collected in Matomo for a period of 180 days.

4. Collection and processing
of personal data
 

To protect your personal data, it will only be processed to the extent permitted by law and necessary to fulfill the respective purpose (e.g.: booking, registration, provision of services, contract processing, fulfillment of legal obligations, sending information material and advertising, carrying out customer analyses).

The following personal data is collected and processed as part of our services (processing  purpose and processed data):

Registration in the Schmiedgut and notification to the competent authority:

• First and last name
• Date of birth, place of birth
• Address (street, chalet number, country, zip code)
• Nationality
• Gender (f/m/i/d/not specified)
• ID card type and number, issuing authority, expiry date
• First and last name of the persons traveling with you  

Contract fulfillment:

• First and last name
• Gender (f/m/i/d/not specified)
• Nationality
• Address (street, chalet number, country, zip code)
• Contact details (telephone number, e-mail address)
• Date of birth
• ID card type and number, issuing authority, expiry date
• If applicable: Company, profession, tax number
• Credit card/payment details

Sending information about our company's services and products:

• First and last name
• Contact details (telephone number, e-mail address)

Measurement, collection and analysis of user data for the purpose of website optimization:

• IP address
• User ID
• Location of the user
• Date and time
• URL of the page that is displayed
• URL of the page that was accessed before the current page
• Files that have been clicked and downloaded
• Country, region, city

In order to inform you about offers and services and to contact you for customer surveys, we  require your express consent, which you can give in a "double opt-in" form. Without you  providing us with the data specified under "Sending information about our company's services  and products" and giving your express consent, we will not be able to send you any information  or contact you in this regard.

5. Photo shoots at events  
 

We have a legitimate interest in taking photographs at events for marketing purposes and  publishing them on our website. If you do not agree to this, you can object at any time by sending an e-mail to urlaub@schmiedgut-badaussee.at.

6. Disclosure to third parties  
 

Your personal data will not be passed on to third parties, except:

• in the event of a legal obligation, e.g. under the TKG, StGB or StPO,
• to authorized medical personnel in medical emergencies,
• on the basis of their express written consent,
• to external processors (see point 7 below),
• Your bank details to electronic payment service providers for the purpose of payment processing.

7. Data processing by order  
 

We transfer the data within the company: We may pass on individual data processing operations to specialized areas of our company. This is done so that we can process your data better, e.g. for internal administrative purposes. 
 
We commission external processors to carry out activities that are necessary for the provision of our services, such as booking your stay or servicing our IT systems. Data processing agreements  have been concluded with these processors in accordance with Art. 28 GDPR.  

Your personal data will be passed on to the following external data processors in compliance with legal requirements:

• net & web Consulting GmbH, AT
• Feratel Deskline
• Casablanca
• dr.mielke.systemtechnik GmbH

Outside the EU
 

Data may also be transferred to a third country if this third country has been confirmed by the  European Commission as having an adequate level of data protection or if other suitable data protection guarantees are in place (e.g. binding internal company data protection regulations or EU standard data protection clauses only with the inclusion of a documented case-by-case assessment of the adequacy of the level of protection).

With your express consent, data may be transferred to a third country (Art 49 para 1 lit a GDPR). We hereby inform you about possible risks in the event of an intended data transfer and the lack of suitable data protection guarantees. For example, we use various cookies and similar technologies on our website, which are sometimes used by us and third-party providers to process personal data. The European Court of Justice has ruled that the USA does not have an adequate level of data protection. In particular, there is a risk that your data may be subject to access by US authorities for control and monitoring purposes and that no effective legal remedies are available against this. Before we set cookies and transfer your data to these companies, we will ask you for your express consent (Art. 6 para. 1 lit. a GDPR in conjunction  with Art. 49 para. 1 lit. a GDPR). You can revoke your consent at any time with effect for the future by adjusting your preferences under "Edit cookie settings" on our website.

8. Duration of processing
 

We process your personal data – where necessary – for the duration of the entire business relationship (from the initiation and execution to the termination of the contract, including the settlement of outstanding claims). After the contract has been fully processed, your data will be stored until the expiry of the warranty, limitation and compensation periods and statutory retention periods applicable to us, and beyond that until the end of any legal disputes in which the data is required as evidence.

We store data that you have provided to us for marketing and information purposes until you withdraw your consent. We store personal data that we receive via the open source platform Matomo for a period of 180 days.

9. Data security
 

We use technical and organizational security measures to protect your data against accidental  or intentional manipulation, loss, destruction or access by unauthorized persons.

10. Your rights
 

With regard to the processing of your data, you have the rights to information, correction, deletion, restriction, data portability, revocation and objection in accordance with the General Data Protection Regulation and the national data protection law. If you believe that the processing of your data violates data protection law or your data protection rights have been violated in any other way, you can lodge a complaint with the supervisory authority. In Austria, this is the data protection authority.  

The following contact options are available to you for asserting your rights against us:

E-Mail: urlaub@schmiedgut-badaussee.at

Postal address: Sarstein Landwirtschaftliche Betriebe GmbH, Fischerndorf 30, 8992 Altaussee, Austria

If your identity cannot be determined on the basis of the data available to us, we are entitled to request additional information to determine your identity (e.g. photo ID).