Privacy policy declaration

in accordance with Art. 13 GDPR

Name and address of the person responsible

The controller within the meaning of the General Data Protection Regulation (GDPR) and other data protection regulations is
Katja Lerche
Rettenbach 38
AT-8081 Pirching am Traubenberg
Austria

Phone: 0043 677 / 617 232 00
E-Mail: holiday@themomentscottage.com

General information on data processing

Legal basis for the processing of personal data

In accordance with Art. 13 GDPR, we inform you of the legal basis of our data processing. If the legal basis is not specified in the data protection notice, the following applies:
The legal basis for obtaining consent is Art. 6 para. 1 lit. a i.V.m. Art. 7 GDPR. The legal basis for the processing for the fulfillment of our services and the implementation of contractual measures as well as for answering inquiries is Art. 6 para. 1 lit. b GDPR. The legal basis for processing for the fulfillment of our legal obligations is Art. 6 para. 1 lit. c GDPR. If the processing of your data is necessary to safeguard a legitimate interest of our company or a third party and if the interests, fundamental rights and freedoms of the data subject do not outweigh the first-mentioned interest, Art. 6 para. 1 lit. f GDPR serves as the legal basis for the processing. In the event that vital interests of the data subject or another natural person require the processing of personal data, Art. 6 para. 1 lit. d GDPR serves as the legal basis.

Data erasure and storage duration

We adhere to the principles of data minimization pursuant to Art. 5 para. 1 lit. c GDPR and storage limitation pursuant to Art. 5 para. 1 lit. e GDPR. We only store your personal data for as long as is necessary to achieve the purposes stated here or as provided for by the retention periods stipulated by law. After the respective purpose no longer applies or after these retention periods have expired, the corresponding data will be deleted as quickly as possible.

Note on the transfer of data to third countries

Tools from companies based in third countries (including the USA) are also integrated on our website. If these tools are active, your personal data may be transmitted to the servers of the respective companies. The level of data protection in third countries generally does not correspond to EU data protection law. There is therefore a risk that your data may be passed on to authorities in these countries. We have no influence on these processing activities.

External links

This website may contain links to third-party websites or to other websites under our responsibility. If you follow a link to a website outside our responsibility, please note that these websites have their own data protection information. We accept no responsibility or liability for these third-party websites and their data protection notices. Therefore, before using these websites, please check whether you agree with their data protection declarations.

You can recognize external links either by the fact that they are displayed in a different colour from the rest of the text or underlined. Your cursor will show you external links when you move it over such a link. Only when you click on an external link will your personal data be transferred to the destination of the link. In particular, the operator of the other website receives your IP address, the time at which you clicked on the link, the page on which you clicked on the link and other information that you can find in the data protection information of the respective provider.

Please also note that individual links may lead to data being transferred outside the European Economic Area. This could give foreign authorities access to your data. You may not have any legal remedies against this data access. If you do not want your personal data to be transferred to the link destination or even exposed to unwanted access by foreign authorities, please do not click on any links.

Rights of the data subject

As a data subject within the meaning of the GDPR, you have the opportunity to assert various rights. The data subject rights arising from the GDPR are the right of access (Article 15), the right to rectification (Article 16), the right to erasure (Article 17), the right to restriction of processing (Article 18), the right to object (Article 21), the right to lodge a complaint with a supervisory authority and the right to data portability (Article 20).

Right of withdrawal:

Some data processing can only take place with your express consent. You have the option to withdraw your consent at any time. However, this does not affect the lawfulness of data processing up to the point of withdrawal.

Right of objection:

If the processing is based on Art. 6 para. 1 lit. e or f GDPR, you as the data subject can object to the processing of your personal data at any time for reasons arising from your particular situation. You also have this right in the case of profiling based on these provisions within the meaning of Art. 4(4) GDPR. Unless we can demonstrate a legitimate interest in the processing that outweighs your interests, rights and freedoms or the processing serves to assert, exercise or defend legal claims, we will refrain from processing your data after the objection has been made.

If the processing of personal data serves the purpose of direct marketing, you also have the right to object to this at any time. The same applies to profiling in connection with direct advertising. Here too, we will no longer process personal data as soon as you object.

Right to lodge a complaint with a supervisory authority:

If you believe that the processing of personal data concerning you infringes the GDPR, you have the right to lodge a complaint with a supervisory authority, in particular in the Member State of your habitual residence, place of work or place of the alleged infringement, without prejudice to any other administrative or judicial remedy.

Right to data portability:

If your data is processed automatically on the basis of consent or fulfillment of a contract, you have the right to receive this data in a structured, commonly used and machine-readable format. You also have the right to request the transfer and provision of the data to another controller, insofar as this is technically feasible.

Right of access, rectification and erasure:

You have the right to obtain information about your processed personal data with regard to the purpose of the data processing, the categories, the recipients and the duration of storage. If you have any questions on this topic or other topics relating to personal data, you can of course contact us using the contact details provided in the legal notice.

Right to restriction of processing:

You can request the restriction of the processing of your personal data at any time. To do so, you must fulfill one of the following requirements:

You contest the accuracy of the personal data. You have the right to request the restriction of processing for the duration of the verification of accuracy.
If the processing is unlawful, you can request the restriction of the use of the data as an alternative to erasure.
If we no longer need your personal data for the purposes of processing, but you need the data for the assertion, exercise or defense of legal claims, you can request the restriction of processing as an alternative to erasure.
If you object to the processing pursuant to Art. 21 (1) GDPR, your interests and ours will be weighed up. Until this balancing has taken place, you have the right to request the restriction of processing.

Restriction of processing means that, with the exception of storage, personal data may only be processed with your consent or for the establishment, exercise or defense of legal claims or for the protection of the rights of another natural or legal person or for reasons of important public interest of the Union or of a Member State.

Provision of the website (web host)

Our website is hosted by:

Greenmark IT GmbH
represented by the managing directors Andreas Gundelach, Ali Jasarov
Leinstraße 3
31061 Alfeld (Leine)
Germany

When you visit our website, we automatically collect and store information in so-called server log files. Your browser automatically transmits this information to our server or to the server of our hosting company.

These are:

IP address of the website visitor’s end device
Device used
Host name of the accessing computer
Operating system of the visitor
Browser type and version
Name of the retrieved file
Time of the server request
Amount of data
Information on whether the retrieval of the data was successful

This data is not merged with other data sources.

Instead of operating this website on our own server, we can also have it operated on the server of an external service provider (hosting company), which we have named above in this case. The personal data collected by this website will then be stored on the hosting company’s servers. In addition to the data mentioned above, the web host also stores contact requests, contact data, names, website access data, meta and communication data, contract data and other data generated via a website for us, for example.

The legal basis for the processing of this data is Art. 6 para. 1 lit. f GDPR. Our legitimate interest is the technically error-free presentation and optimization of this website. If the website is accessed in order to enter into contractual negotiations with us or to conclude a contract, another legal basis is Art. 6 para. 1 lit. b GDPR. In the event that we have commissioned a hosting company, there is an order processing contract with this service provider.

Use of local storage items, session storage items and cookies

Our website uses local storage items, session storage items and/or cookies. Local storage is a mechanism that enables the storage of data within the browser on your end device. This data usually contains user preferences, such as the “day” or “night” mode of a website, and is retained until you delete the data manually. Session storage is very similar to local storage, whereas the storage period only lasts during the current session, i.e. until the current tab is closed. The session storage items are then deleted from your end device. Cookies are information that a web server (server that provides web content) stores on your end device in order to be able to identify this end device. They are either stored temporarily for the duration of a session (session cookies) and deleted at the end of your visit to a website or permanently (permanent cookies) on your end device until you delete them yourself or they are automatically deleted by your web browser.

These objects may also be stored on your device by third-party companies when you visit our website (third-party requests). This enables us as the operator and you as a visitor to this website to make use of certain third-party services that are installed on this website. Examples of this include the processing of payment services or the display of videos.

These mechanisms can be used in a variety of ways. They can improve the functionality of a website, control shopping cart functions, increase the security and convenience of website use and carry out analyses of visitor flows and behavior. Depending on the individual functions, these must be classified in terms of data protection law. If they are necessary for the operation of the website and intended to provide certain functions (shopping cart function) or serve to optimize the website (e.g. cookies to measure visitor behavior), they are used on the basis of Art. 6 para. 1 lit. f GDPR. As the website operator, we have a legitimate interest in the storage of local storage items, session storage items and cookies for the technically error-free and optimized provision of our services. In all other cases, local storage items, session storage items and cookies are only stored with your express consent (Art. 6 para. 1 lit. a GDPR).

If local storage items, session storage or cookies are used by third-party companies or for analysis purposes, we will inform you about this separately in this data protection notice. Your required consent will be requested and can be revoked at any time.

Booking enquiries and bookings (WP Booking System)

On the page “Availability and prices” you can send us a booking enquiry using a form. For this we use the WP Booking System plugin. It runs on the same web space as this website, so your details are not transmitted to any further service provider. We collect:

the arrival and departure date you select in the availability calendar
your email address (mandatory)
first name and surname (mandatory)
street and house number, postcode, town and country (optional)
your telephone number (optional)
your remarks on the enquiry (optional)
Only if you came to our website through a Google ad and agreed to marketing in the cookie dialog: the source of your enquiry (the number of the ad campaign and the keyword we booked, not your search query)

The purpose of the processing is to handle your enquiry and, if it leads to a booking, to carry out the rental agreement: we need to be able to reply to you, reserve the period bindingly and send you the confirmation and the arrival information. The legal basis is Art. 6 (1) (b) GDPR (pre-contractual measures and contract). We strictly need the mandatory details for this; the optional details make handling and a call back easier.

Your details are stored on the web space of this website and additionally forwarded to our email address. We do not pass your details on to third parties; service providers we use act for us as processors and are not third parties in the legal sense. The statutory guest registration in Croatia is excepted from this: for the stay we are obliged to report the guest data via the Croatian eVisitor system. We collect the details required for this separately, only after a booking.

We store your enquiry for as long as it is required to handle it and to carry out any rental agreement arising from it. If an enquiry does not lead to a booking, we delete it after 24 months at the latest. For bookings that have come about, the statutory retention periods apply, in particular the seven-year obligation to retain business records under § 212 UGB and § 132 BAO.

We use the source of your enquiry solely to measure whether and which ads lead to enquiries. The legal basis is your consent (Art. 6(1)(a) GDPR and Section 165(3) TKG 2021), which you give in the cookie dialog under the group “Marketing”. Without your consent we do not record the source. You can withdraw your consent at any time with effect for the future by opening the cookie settings at the bottom of the page; this also deletes the source stored in your browser. The source is not passed on to Google or any other recipient and stays on the web space of this website. We delete it together with the enquiry, and for bookings that were made after the annual evaluation, at the latest after 13 months.

Contact form (Ninja Forms)

In addition to the booking enquiry, a contact form is available for general questions. We use the Ninja Forms plugin for this. It runs on the same web space as this website, so your details are not transmitted to any further service provider. We collect:

your name (mandatory)
your email address (mandatory)
your message (mandatory)

There are no further fields. Your message is stored on our web space and additionally forwarded to our email address holiday@themomentscottage.com so that we can answer it.

The legal basis is Art. 6 (1) (b) GDPR where your enquiry is aimed at entering into or performing a contract, otherwise Art. 6 (1) (f) GDPR, our legitimate interest in answering enquiries. We delete your enquiry as soon as it has been dealt with and no statutory retention obligation applies, at the latest after 24 months.

To protect against automated submissions, we use Google reCAPTCHA when the form is sent. The separate section below applies to this.

Enquiries through the form in our Google ads

In our Google ads a form may appear through which you can send us an enquiry directly from the search results. This form is provided and displayed by Google (Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland; for visitors outside the European Economic Area Google LLC). You can see which data Google processes in the privacy notice in the form itself.

If you submit the form, we receive your first name, your surname, your email address and your telephone number from Google. We use these details solely to answer your enquiry and, if you wish, to make you an offer. The legal basis is the initiation of a contract at your request (Art. 6(1)(b) GDPR).

Google keeps your submission available for us to retrieve; we retrieve it and answer by email. After that we treat it like any other enquiry (see “Booking enquiries and bookings”): if it does not lead to a booking, we delete it after 24 months at the latest. We do not pass your details on for other purposes; service providers we use act for us as processors. If you do not use the form, nothing is transmitted to us.

Use of external services

External services are used on our website. External services are services from third-party providers that are used on our website. This can be done for various reasons, for example for embedding videos or for the security of the website. When using these services, personal data is also passed on to the respective providers of these external services. If we do not have a legitimate interest in using these services, we will obtain your consent as a visitor to our website, which can be revoked at any time, before using them (Art. 6 para. 1 lit. a GDPR).

Consent Management

In order to comply with data protection requirements, we use a consent management tool on our website. We use this tool to obtain the necessary consent for the setting of cookies or the use of external services. The consents are stored.
The processing is necessary for compliance with a legal obligation to which the controller (website operator) is subject. Art. 6 para. 1 lit. c GDPR is therefore used as the legal basis for processing.

Content Management System

A content management system enables the creation, editing, organization and presentation of digital content. We use a content management system to create content for our website. This enables us to design a more appealing website.
We base this processing on a legitimate interest (Art. 6 para. 1 lit. f GDPR).
Our legitimate interest lies in the technically error-free presentation and optimization of the website.

WordPress

We use the WordPress service on our website. The provider of the service is Automattic Inc, 60 29th Street #343, 94110 San Francisco (CA), USA.
The use of the service may result in data being transferred to a third country (USA).
Further information can be found in the provider’s data protection information at the following URL: https://automattic.com/privacy/.

Hosting

Hosting is the provision of web space and the files on it by a web host.
This involves the transfer and storage of personal data on the web host’s servers. In particular, the IP addresses, meta and communication data of users and data on website access are processed. When a website visitor accesses the site, a connection to the web host’s servers is established. This results in the processing of the website visitor’s personal data.
We base this processing on a legitimate interest (Art. 6 para. 1 lit. f GDPR).
Our legitimate interest lies in being able to present our website and make it available on the internet.

Interface software

Business processes are cheaper, faster and more error-free when they are automated with the help of software via interfaces. This allows them to be efficiently integrated into company processes via your own website or social networks. We use interface software on our website to link different applications with each other and to transfer personal data securely from one application to another.
Processing only takes place if you consent to this data processing (via our consent banner on the website). The legal basis for this processing is consent (Art. 6 para. 1 lit. a GDPR). Without your consent, data will not be processed in the manner described above. If you withdraw your consent (e.g. via the consent banner or other options provided on this website), we will terminate this data processing. This does not affect the legality of the processing carried out up to the point of withdrawal.

Google Tag Manager

We use the Google Tag Manager service on our website. The provider of the service is Google Ireland Ltd, Gordon House, Barrow Street Dublin 4, Ireland.
The use of the service may result in data being transferred to a third country (USA).
Further information can be found in the provider’s data protection information at the following URL: https://policies.google.com/privacy.

Video/Music Service

Audio and videos are integrated into our website. These are retrieved from our provider’s server, the so-called audio or video platform. In order to be able to play an audio or video, your device connects to the audio or video platform and transmits personal data to it. This includes in particular the IP address, any location data or information about the user’s browser and device. Processing will only occur if you consent to this data processing (via our consent banner on the website). The legal basis for this processing is consent (Art. 6 Para. 1 lit. a GDPR). Without your consent, data processing will not take place in the manner described above. If you revoke your consent (e.g. via the consent banner or other options provided on this website), we will stop this data processing. The lawfulness of the processing carried out until the revocation remains unaffected.

YouTube

We use the YouTube service on our website. The service provider is Google Ireland Ltd., Gordon House, Barrow Street Dublin 4, Ireland. Using the service may result in data being transferred to a third country (USA). Further information can be found in the provider’s data protection information at the following URL: https://policies.google.com/privacy.

Advertising

Our website uses tools that facilitate or enable the placement of advertising and the evaluation of the success of the ads placed. For this purpose, personal data is processed, in particular the IP address, access times and device information. Processing will only occur if you consent to this data processing (via our consent banner on the website). The legal basis for this processing is consent (Art. 6 Para. 1 lit. a GDPR). Without your consent, data processing will not take place in the manner described above. If you revoke your consent (e.g. via the consent banner or other options provided on this website), we will stop this data processing. The lawfulness of the processing carried out until the revocation remains unaffected.

Google Ads

We use the Google Ads service on our website. The service provider is Google Ireland Ltd., Gordon House, Barrow Street Dublin 4, Ireland. Using the service may result in data being transferred to a third country (USA). Further information can be found in the provider’s data protection information at the following URL: https://policies.google.com/privacy.

Buttonizer

On our website we use Buttonizer, a service for the buttons shown at the edge of the screen that lead to contact options such as WhatsApp or email. The provider is Formilla, LLC, San Diego, California, USA.

The service is only loaded once you have given your consent via our consent banner. The legal basis is your consent pursuant to Art. 6 (1) (a) GDPR. Without your consent the buttons are not displayed and no data is transmitted to the provider. You can withdraw your consent at any time via the banner; the lawfulness of the processing carried out until then remains unaffected.

After your consent, the script and the styling of the buttons are loaded from cdn.buttonizer.io and the settings are retrieved from api.buttonizer.io; the icons come from cdnjs.cloudflare.com, a service provided by Cloudflare, Inc. In doing so, your IP address is transmitted to these providers. According to the provider, Buttonizer also processes browser type, language preference, referring page, device type as well as the date and time of your visit, and sets cookies that are required for the buttons to work. If you click a button, the time, the address of the page you were on, the country and the device type are also recorded so that the provider can evaluate usage.

The provider is based in the USA, so personal data may be transferred to a third country. Further information can be found in the provider’s privacy policy at https://www.formilla.com/privacy-policy.aspx.

Borlabs Cookie

This website uses Borlabs Cookie, which sets a technically necessary cookie (borlabs cookie) to store your cookie consent. The service provider is Borlabs GmbH, Hamburger Str. 11, 22083 Hamburg, Germany. Borlabs Cookie does not process any personal data. Since this service is hosted locally on the web server, no data is transferred to third parties. The borlabs cookie stores the consent you gave when you entered the website. If you would like to revoke this consent, simply delete the cookie in your browser. When you re-enter/reload the website, you will be asked again for your cookie consent.

Polylang (language switch)

The provider is WP SYNTEX, 28, rue Jean Sébastien Bach, 38090 Villefontaine, France. Polylang creates the functional cookie pll_language. It stores a language preference for the visitor to support multilingual websites. The use of Polylang is in the interest of an attractive presentation of our online offerings and is based on our legitimate interest. (Art. 6 para. 1 lit. f GDPR). The storage period is one year. Polylang’s privacy policy can be found here: https://polylang.pro/privacy-policy/

Google reCAPTCHA

We use “Google reCAPTCHA” (hereinafter “reCAPTCHA”) on our websites. The provider is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland (“Google”). For visitors outside the European Economic Area, Google LLC, 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA is responsible. The purpose of reCAPTCHA is to check whether data is entered on our websites (e.g. in a contact form) by a human or by an automated program. To do this, reCAPTCHA analyzes the behavior of the website visitor based on various characteristics. The analysis only begins once you have given your consent via our consent banner. Without your consent, reCAPTCHA is not loaded; the contact form then stays behind a notice through which you can release it if you wish. For analysis, reCAPTCHA evaluates various information (e.g. IP address, length of time the website visitor stays on the website or mouse movements made by the user). The data collected during the analysis is forwarded to Google. The reCAPTCHA analyzes run completely in the background. After your consent they run in the background while you fill in the form. The legal basis is your consent pursuant to Art. 6 (1) (a) GDPR, which you can withdraw at any time via the banner. We use reCAPTCHA to protect our forms against abusive automated use and SPAM.

Further information about Google reCAPTCHA and Google’s privacy policy can be found at the following links: https://www.google.com/intl/de/policies/privacy/ and https://www.google.com/recaptcha/intro/android. html.