Privacy Statement and Cookie Policy

Hintertuxerhof GesmbH & Co KG, based at Hintertux 780, A-6294 Hintertux (hereinafter referred to as "Hotel Hintertuxerhof"), is committed to protecting the online privacy of its users. This document has been drafted in accordance with Art. 13 of EU Regulation 2016/679 (hereinafter referred to as the "Regulation") to enable you to familiarize yourself with our privacy policy and understand how your personal information is handled when using our website, and—where applicable—to provide your express and informed consent to the processing of your personal data (valid only for persons aged 16 or older). The information and data provided by you, or otherwise obtained by us through your use of the services on the website (hereinafter referred to as the "Services"), will be processed in compliance with the provisions of the Regulation and the confidentiality obligations governing the activities of the Data Controller.

In accordance with the provisions of the Regulation, the processing carried out by Hotel Hintertuxerhof is based on the principles of lawfulness, fairness, transparency, purpose limitation, storage limitation, data minimization, accuracy, integrity, and confidentiality.

TABLE OF CONTENTS
1. Data Controller
2. Personal data subject to processing
a. Navigation data
b. Special categories of personal data
c. Data voluntarily provided by the data subject
d. Protection of our forms against misuse
3. Purpose of processing
4. Legal basis and mandatory or optional nature of processing
5. Recipients of personal data
6. Disclosure of personal data
7. Storage of personal data
8. Rights of data subjects
9. Website details
10. Changes
11. Contact

1. Data Controller
The data controller responsible for the processing activities carried out on the website is Hintertuxerhof GesmbH & Co KG, as specified above. For information regarding the processing of personal data by the data controller, including a list of the data processors commissioned to process the data, please write to the following address: info@hintertuxerhof.at 

2. Personal data subject to processing
We inform you that, as a result of your browsing on the website, the controller will process personal data—which may consist of an identifier such as your name, an identification number, an online identifier, a postal address, an email address, a telephone number (landline and/or mobile), or one or more elements specific to your physical, physiological, mental, economic, cultural, or social identity used to identify or make the data subject identifiable (hereinafter referred to as "personal data").

The personal data processed via the website are as follows:

a. Navigation data
The computer systems and software procedures used to operate the website collect certain personal data during their normal operation, the transmission of which is implicit in Internet communication protocols. This information is not collected to be associated with identified data subjects; however, due to its nature, it could allow for the identification of users through processing and association with data held by third parties. This category of data includes IP addresses or domain names of the computers used by users connecting to the website, URI (Uniform Resource Identifier) ​​addresses of the requested resources, the time of the request, the method used to submit the request to the server, the size of the file received in response, the numerical code indicating the status of the server's response (successful, error, etc.), and other parameters regarding the operating system and the user's computing environment. This data is used solely to obtain anonymous statistical information regarding website usage, to verify the website's proper functioning, and to detect anomalies and/or misuse; it is deleted immediately after processing. The data may be used to establish liability in the event of hypothetical cybercrimes committed against the website or third parties. Apart from this scenario, data collected via the website is deleted after a short period.

b. Special categories of personal data
If you use our website to submit an application (or send one to us via email), this may result in the transmission of personal data falling under the special categories of personal data pursuant to Art. 9 of the Regulation—specifically, “[…] personal data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, or trade union membership, as well as […] genetic data, biometric data for the purpose of uniquely identifying a natural person, data concerning health or data concerning a natural person’s sex life or sexual orientation.” Please do not disclose such data unless absolutely necessary. We expressly point out that the controller cannot be held liable or reproached in any way regarding the transmission of special categories of personal data in the absence of express consent for their processing (you are, of course, permitted to send a CV); in such cases, processing is lawful because it relates to data manifestly made public by the data subject, in accordance with Art. 9(1)(e) of the Regulation. However, as previously mentioned, we emphasize the importance of providing express consent for the processing of special categories of personal data should you decide to submit such information.

We also inform you that, for the purpose of candidate selection, the controller may analyze professional social media profiles that are publicly accessible on the internet (e.g., LinkedIn).

c. Data voluntarily provided by the data subject
When you use certain services on the website (e.g., the inquiry, contact, or reservation form), we may process personal data of third parties that you submit to the data controller. In such cases, you act as the data controller, assuming all associated legal obligations and liabilities. Accordingly, you agree to fully indemnify us against any allegations, claims, or demands for damages arising from the processing—or otherwise—that the controller may face from third parties whose personal data was processed through the use of website functions in violation of applicable personal data protection regulations. If you provide or otherwise process the personal data of third parties while using the website, you guarantee in every instance that the specific processing activity is based on an appropriate legal basis pursuant to Art. 6 of the Regulation, thereby legitimizing the processing of the information in question.

d. Protection of our forms against misuse
To protect our forms from automated submissions and spam, we technically verify upon submission whether the input originates from a real person (e.g., the origin of the request, an invisible calculation task in the browser, anomalies in the content, and the number of submissions). No third-party services are used for this purpose. We store the time of submission, the form used, the verification result, your IP address (encrypted), and your email address (truncated or as a hash value). This data is deleted after 30 days. If a submission is rejected due to its content, we additionally store the input in encrypted form for 14 days in order to identify erroneous rejections and contact you if necessary; access is restricted to authorized editors. The legal basis is our legitimate interest in protecting our website against misuse (Art. 6(1)(f) GDPR). You may object to the processing for reasons arising from your particular situation.

3. Purpose of processing
The processing activities we intend to carry out (where necessary, with your explicit consent) serve the following purposes:
a. To enable the provision of the services you have requested
b. To respond to customer service requests, inquiries for information, or reservation requests
c. To analyze CVs and contact applicants who have submitted an application
d. To fulfill all legal, accounting, and tax obligations
e. Marketing purposes: Subject to prior, explicit, and specific consent, the data provided may be processed for sending promotional and marketing communications—including newsletters and market research surveys—via automated systems (SMS, MMS, email, push notifications) and non-automated systems (postal mail, call centers). The legal basis for processing your data for these purposes is Art. 6(1)(a) of the Regulation. Consent to processing for direct marketing purposes is optional and entirely voluntary; therefore, withholding consent for this purpose will not affect your use of the services.

4. Legal basis and mandatory or optional nature of the processing
The legal basis for the processing of personal data for the purposes specified in Section 3 (a-b-c) is Article 6(1)(b) of the Regulation (performance of a contract), as the data processing is necessary for the provision of services or for responding to requests from the data subject. Providing personal data for these purposes is optional; however, failure to do so would make it impossible to activate the services provided by the website, process requests, or evaluate CVs. With specific reference to purpose 3.c and the associated analysis of professional social media profiles that are publicly accessible online (as described in Section 2.b), the legal basis for the data processing is Article 6(1)(f) of the Regulation—specifically, the controller's legitimate interest in assessing potential risks regarding the applicant's suitability for the specific vacant position.
The purpose mentioned in Section 3.d constitutes lawful processing of personal data under Article 6(1)(c) of the Regulation (compliance with a legal obligation). Once the personal data has been provided, processing is indeed necessary to comply with a legal obligation to which the controller is subject.
The legal basis for processing for the purposes mentioned in Section 3.e is Article 6(1)(a) of the Regulation (user consent). The Controller may, without your consent, use email and postal addresses to carry out processing for the purposes of directly sending advertising material, direct sales, conducting market research, or sending commercial communications regarding products or services of the Controller that are similar to those you have purchased; such use shall be in accordance with, and within the limits permitted by, Art. 130(4) of the Data Protection Code and the Order of the Data Protection Authority dated June 19, 2008. The legal basis for processing your data for this purpose is Art. 6(1)(f) of the Regulation (legitimate interest).

5. Recipients of personal data
Your personal data may be disclosed for the purposes specified in Section 3 to:
a. Entities acting as data processors, i.e.: i) individuals, companies, or professional firms providing assistance and advice to the Controller regarding accounting, administrative, legal, tax, financial, debt collection, marketing, and communication matters related to the provision of the services; ii) entities whose cooperation is necessary for the provision of the services (e.g., hosting providers); iii) entities tasked with performing technical maintenance (including the maintenance of network equipment and electronic communication networks) (collectively referred to as “Recipients”);
b. Entities, bodies, or authorities to whom your personal data must be disclosed pursuant to statutory provisions or official orders;
c. Individuals authorized by the Controller to process personal data necessary for carrying out activities related to the provision of the services or for the other purposes specified in Section 3, and who have committed to confidentiality or are subject to an appropriate statutory confidentiality obligation (e.g., employees of the Controller).

6. Transfer of personal data
Some of your personal data is transferred to recipients who may be located outside the European Economic Area. The data controller ensures that the processing of your personal data by these recipients takes place in accordance with the Regulation. Such transfers may be based on an adequacy decision, on contractual clauses approved by the European Commission, or on another appropriate legal basis. You can obtain further information from the data controller at the following address: info@hintertuxerhof.at

7. Retention of Personal Data
Personal data processed for the purposes specified in Section 3(a-b) will be retained for as long as is strictly necessary to achieve those purposes. Since the data processing is carried out for the provision of services, the Controller will, in any event, process the personal data until the time prescribed by Austrian law for the protection of interests. With regard to CVs submitted via the website or by email in accordance with Section 3.c, personal data will be retained for a period deemed appropriate for the purpose for which the data were collected. This applies notwithstanding the Controller's option to contact the applicant again shortly before the specified period expires to request an extension of this retention period.

Personal data processed for the purposes specified in Section 3.d will be stored until the time prescribed by the specific obligation or applicable law.
Personal data processed for the purposes specified in Section 3.e will be retained until the data subject withdraws their consent or, if no such withdrawal occurs, for a specific maximum period deemed appropriate.

Further information regarding data retention periods and the criteria for determining them can be obtained from the Controller at the following address: info@hintertuxerhof.at

8. Rights of the Data Subject
In accordance with Article 15 et seq. of the Regulation, you have the right to request information about your personal data from the controller at any time, to ask for it to be rectified or erased, or to object to its processing. You have the right to request a restriction on processing in the cases provided for in Art. 18 of the Regulation, as well as the right to receive the data concerning you in a structured, commonly used, and machine-readable format in the cases provided for in Art. 20 of the Regulation.
Any request must be submitted in writing to the controller at the following address: info@hintertuxerhof.at
You have the right at any time to lodge a complaint with the competent supervisory authority (Data Protection Authority) in accordance with Art. 77 of the Regulation if you believe that the processing of your personal data violates applicable law.

9. Website Details

Cookies
Our website uses cookies. These are small text files that are stored on your device via your browser. They do not cause any damage. We use cookies to make our website more user-friendly. Some cookies remain stored on your device until you delete them. They enable us to recognize your browser on your next visit. If you do not wish for this to happen, you can configure your browser to notify you about the setting of cookies and allow them only on a case-by-case basis. Disabling cookies may limit the functionality of our website.

Web Analytics – Use of Matomo
We use Matomo for the statistical analysis of how our website is used. The service is only activated once you have consented under "Tracking & Analytics." We use it to analyze, in particular, the pages visited, the time and duration of visits, referring pages, and technical details regarding your browser and device. This analysis helps us improve our content and user-friendliness. The legal basis is your consent pursuant to Art. 6(1)(a) GDPR and, insofar as information is stored on or retrieved from your device, Section 165(3) of the TKG 2021. You can withdraw your consent via the "Cookies" link in the footer.

Web Analytics – Use of Google Analytics
This website uses Google Analytics, a web analytics service provided by Google Inc. ("Google"). Google Analytics uses "cookies," which are text files placed on your computer, to help the website analyze how users use the site. These include cookies from Google itself (Google Analytics cookies) and so-called third-party cookies (DoubleClick cookies). The information generated by the cookie about your use of this website is generally transmitted to and stored on a Google server in the USA. However, if IP anonymization is activated on this website, your IP address will be truncated beforehand by Google within the member states of the European Union or in other states party to the Agreement on the European Economic Area. Only in exceptional cases will the full IP address be transmitted to a Google server in the USA and truncated there. On behalf of the website operator, Google will use this information to evaluate your use of the website, compile reports on website activity, and provide the website operator with other services related to website and internet usage—specifically display advertising features such as Google Analytics reports on performance based on demographics and interests. Google may also transfer this information to third parties where required to do so by law or where such third parties process the data on Google's behalf. The Google Analytics reports on performance based on demographics and interests utilize data obtained from Google's interest-based advertising and visitor data from third-party providers (such as age, gender, and interests). Under no circumstances will Google associate your IP address with any other data held by Google. You may refuse the use of cookies by selecting the appropriate settings on your browser software; however, please note that if you do so, you may not be able to use the full functionality of this website. Furthermore, you can prevent Google from collecting the data generated by the cookie and relating to your use of the website (including your IP address), as well as from processing this data, by downloading and installing the browser plugin available at the following link: [http://tools.google.com/dlpage/gaoptout?hl=de].

Use of Facebook Plugins
These websites use plugins from the social network facebook.com, operated by Facebook Inc., 1601 S. California Ave, Palo Alto, CA 94304, USA ("Facebook"). When you access pages on our website that contain such a plugin, a connection to the Facebook servers is established, and the plugin is displayed on the webpage via a notification sent to your browser. This transmits information to the Facebook server regarding which of our webpages you have visited. If you are logged into Facebook as a member, Facebook associates this information with your personal Facebook user account. When using plugin functions (e.g., clicking the "Like" button or posting a comment), this information is also associated with your Facebook account; you can prevent this only by logging out before using the plugin. Further information regarding Facebook's data collection and usage, your related rights, and options for protecting your privacy can be found in Facebook's privacy policy.

Use of Meta Remarketing
The provider uses the "Custom Audiences" remarketing feature from Meta Platforms Inc., 1601 S. California Ave, Palo Alto, CA 94304, USA ("Facebook") on this website. This feature allows the provider to target website visitors with advertising by displaying personalized, interest-based Facebook ads when they visit the Facebook social network. To enable this feature, a Facebook remarketing tag is implemented on the provider's website. When you visit the website, this tag establishes a direct connection to Facebook's servers. This transmits information to the Facebook server regarding which of our web pages you have visited. Facebook associates this information with your personal Facebook user account. Further information regarding Facebook's data collection and usage, your related rights, and options for protecting your privacy can be found in Facebook's privacy policy at https://www.facebook.com/about/privacy/. If you do not wish for Facebook to directly associate the collected information with your Facebook user account, you can deactivate the "Custom Audiences" remarketing feature here. You must be logged into Facebook to do so.

Meta Pixel and Custom Audience
We use advertising measurement technology from Meta Platforms Ireland Limited (Merrion Road, Dublin 4, D04 X2K5, Ireland) that is integrated into our website. This enables us to evaluate the effectiveness of our Facebook and Instagram ads and to target website visitors with relevant ads. Upon your consent to "Marketing & Advertising," information regarding visited pages, events, timestamps, online identifiers, and technical device or connection data may be transmitted to Meta. Meta may associate this information with a user account. We receive analyses regarding advertising effectiveness. The legal bases are Art. 6(1)(a) GDPR and Section 165(3) TKG 2021. You can revoke your consent via the "Cookies" settings. Data transfers to the USA may occur.

Use of Google Ads Conversion Tracking
We use the online advertising program "Google Ads" and, within the scope of Google Ads, conversion tracking. Google Conversion Tracking is an analytics service provided by Google Inc. (1600 Amphitheatre Parkway, Mountain View, CA 94043, USA; "Google"). When you click on an ad placed by Google, a cookie for conversion tracking is stored on your computer. These cookies expire after 30 days, do not contain personal data, and are therefore not used for personal identification. If you visit specific pages on our website and the cookie has not yet expired, both Google and we can recognize that you clicked on the ad and were redirected to that page. Each Google Ads customer receives a different cookie. Consequently, there is no possibility for cookies to be tracked across the websites of different Ads customers. The information obtained via the conversion cookie is used to generate conversion statistics for Ads customers who have opted for conversion tracking. In this process, customers learn the total number of users who clicked on their ad and were redirected to a page equipped with a conversion tracking tag. However, they do not receive information that would allow for the personal identification of users. If you do not wish to participate in tracking, you can object to this usage by preventing the installation of cookies through the appropriate settings in your browser software (deactivation option). You will then not be included in the conversion tracking statistics. Further information and Google's privacy policy can be found at: http://www.google.com/policies/technologies/ads/, http://www.google.de/policies/privacy/

Use of the OpenAI Measurement Pixel (conversion tracking for advertisements in ChatGPT)
Provided you have consented to the “Marketing & Advertising” category in the cookie banner, we use the “Measurement Pixel” from OpenAI Ireland Limited, 1st Floor, The Liffey Trust Centre, 117-126 Sheriff Street Upper, Dublin 1, D01 YC43, Ireland (“OpenAI”) on our website. We use this to measure whether visitors who reached our website via one of our advertisements in ChatGPT subsequently submit an inquiry (conversion). To this end, a click identifier from the advertising link is stored in the “__oppref” cookie on your device. In the event of a conversion, the following data in particular is transmitted to OpenAI: type of event (e.g., “inquiry submitted”), time, page visited, click identifier, a random event ID, technical device and browser information, and your IP address. Additionally, contact details present on the page (e.g., email address, telephone number, or name) may be hashed—i.e., pseudonymized—within your browser and transmitted in this form so that OpenAI can attribute the conversion to an advertisement. The text of your message is not transmitted to OpenAI. OpenAI processes this data as an independent controller; we receive only aggregated statistics from OpenAI regarding the effectiveness of our advertisements.
The legal basis is your consent pursuant to Art. 6(1)(a) GDPR and Section 165(3) of the TKG 2021 (Telecommunications Act). The pixel will not be loaded without your consent. You may revoke your consent at any time with future effect by deactivating the “Marketing & Advertising” category via the “Cookies” link in the footer.
As part of the processing, personal data may be transmitted to OpenAI OpCo, LLC in the USA. The USA is a third country whose level of data protection does not correspond to that of the EU in every respect; in particular, US authorities may access the data without effective legal remedies necessarily being available to you. Further information can be found in OpenAI’s privacy policy: https://openai.com/policies/privacy-policy/

Instagram
Features of the Instagram service are integrated into our pages. These features are provided by Instagram Inc., 1601 Willow Road, Menlo Park, CA 94025, USA. If you are logged into your Instagram account, you can link the content of our pages to your Instagram profile by clicking the Instagram button. This allows Instagram to associate your visit to our pages with your user account. Please note that, as the provider of these pages, we have no knowledge of the content of the transmitted data or how it is used by Instagram.
For further information, please refer to Instagram’s privacy policy: http://instagram.com/about/legal/privacy/.

Google Maps
This website uses the Google Maps service provided by Google Inc. By using this website, you consent to the collection, processing, and use of automatically collected data by Google Inc., its representatives, and third parties.
You can find the Google Maps Terms of Service at https://www.google.com/intl/de_de/help/terms_maps.html

YouTube
Our website uses plugins from the Google-operated site YouTube. The operator of the site is YouTube, LLC, 901 Cherry Ave., San Bruno, CA 94066, USA. When you visit one of our pages equipped with a YouTube plugin, a connection to the YouTube servers is established. This informs the YouTube server which of our pages you have visited. If you are logged into your YouTube account, you allow YouTube to associate your browsing behavior directly with your personal profile. You can prevent this by logging out of your YouTube account. YouTube is used in the interest of presenting our online offerings in an appealing manner. This constitutes a legitimate interest within the meaning of Art. 6 (1) (f) GDPR. Further information on the handling of user data can be found in YouTube’s privacy policy at: https://www.google.de/intl/de/policies/privacy.

Newsletter
You have the option to subscribe to our newsletter via our website or by contacting us directly. To do so, we require your email address and your consent to receive the newsletter. In order to provide you with targeted information, we also collect and process voluntary details regarding your areas of interest, date of birth, and postcode. You may cancel your newsletter subscription at any time. Please send your cancellation request to the following email address: marketing@hintertuxerhof.at. We will then promptly delete the data associated with your newsletter subscription.

10. Changes
This privacy policy is effective as of May 25, 2018, and was last updated on October 14, 2026. The controller reserves the right to modify or update the content, in whole or in part, including in response to changes in applicable legislation. Therefore, the controller encourages you to visit this section regularly to stay informed about the latest version of this privacy policy.

11. Contact
You can reach us using the following contact details:
Kinder- & Gletscherhotel Hintertuxerhof
Hintertuxerhof GesmbH & Co KG
Kofler Family
Hintertux 780
A-6294 Hintertux
Tel.: +43 5287 8530
Fax: +43 5287 85305
Email: info@hintertuxerhof.at
www.hintertuxerhof.at