Data protection declaration according to GDPR
APPARTEMENT FRISCHMANN KLAUDIA
TALACKERWEG 17
6441 UMHAUSEN
We process the following data when you enter into a contract with us:
Basic Data:
Family and first name, full address, all contact information (e.g., email address, phone number), and details about the type and content of our contractual relationship.
Other Personal Data:
Other personal data that you or third parties provide to us with your consent or as otherwise permitted during contract initiation, during the contractual relationship (e.g., for issuing a guest card), or to fulfill legal obligations:
Date of birth or age
Marital status
Gender
Profession
Identification detail
Bank details
Authorization or representation rights
Contractual commitments, cancellation/termination periods, or other personal information you have disclosed to us.
Use of Processors:
Protecting your data is important to us. Even when we use a processor (e.g., Feratel – guest registry as per § 19 MeldeV), we ensure that data processing occurs within the European Union.
1. Registration Data
1.1. Registration Obligation:
Under Austrian registration law, you are required to register with us using the data specified in § 5 and § 10 of the Registration Act. This includes:
• Name, date of birth, gender, nationality, country of origin, address (including postal code), and for foreign guests, the type, number, place of issue, and issuing authority of a travel document, as well as the dates of arrival and departure.
1.2. Guest Registry
We are legally required to maintain a guest registry as per § 19 of the Registration Act Implementation Regulation and store the data for seven (7) years unless required longer for purposes mentioned in this Privacy Policy.
The guest registry is maintained electronically and manually (registration forms), and data is forwarded to an IT processor for local storage. No data is transferred to third countries.
1.3. Data Sharing:
The data categories "arrival" and "departure" linked with the country of origin are forwarded to the municipality where our accommodation is located, as per § 6 of the Tourism Statistics Regulation. Aggregated data about the number of overnight stays and persons liable for the local tax is also shared with the tourism association [Ötztal Tourism] and/or the municipality, based on § 9 of the Tyrolean Local Tax Act.
1.4. Legal Basis for Processing:
Processing under points 1.1 to 1.3 is based on Article 6(1)(c) GDPR (fulfillment of legal obligation).
1.5. Additional Data Transfers:
We also forward your postal code and year of birth (in pseudonymized or anonymized form) for statistical purposes to the tourism association and municipality for origin and age statistics. This transfer is based on Article 6(1)(e) (public interest) and (f) (legitimate interests) GDPR. You may object at any time for reasons arising from your particular situation (Article 21(1) GDPR).
2. Guest Card:
2.1. General Information:
You may request a guest card, which provides discounts and/or services from various regional companies (e.g., reduced entry fees). The guest card is valid for the duration of your stay with us.
2.2. Issuance of the Guest Card:
The guest card is issued upon your request and may be:
- Electronically generated,
- Derived from a copy of the registration form.
2.3. Processed Personal Data:
For both electronic and manual guest cards, the following personal data from registration data (see point 1) is processed:
• First name, last name, date of birth, duration of stay (arrival/departure), country of origin, and postal code.
If the guest card is issued as a "registration form," no electronic processing occurs.
When using the guest card, additional data is processed: usage cycle, services used, bookings, transaction logging, billing data, reference to registration data, and the accommodation provider. This data ensures identity verification, card validity, and billing for discounts between service providers, the tourism association, and accommodation providers.
2.4. Legal Basis for Processing:
Processing for the guest card is based on your consent (Article 6(1)(a) GDPR) or, if the guest card is part of the accommodation contract, for contract fulfillment (Article 6(1)(b) GDPR). Consent can be withdrawn orally or via email at [meldewesen@oetztal.com].
2.5. Operation of the Guest Card System:
The guest card system is operated by the local tourism association (TVB) and involves local accommodation providers and service providers. Data is deleted after 48 months.
2.6. Data Recipients:
The data processed for the purpose of the guest card is received by the local tourism association (TVB) for the purpose of billing with service providers and/or accommodation businesses.
The individual service providers who offer discounted services based on the guest card also receive the data, as long as you use the guest card services with these providers.
To avail of the discounts, you must present the respective guest card, on which the data is displayed, to the service provider, thus disclosing the information yourself. The service provider will then verify, usually by scanning the barcode on the guest card and transmitting the barcode data to our IT service provider, whether the card is still valid. Personal data is also transmitted to the service provider, particularly your identity data (for verification of identity and date of birth).
If the guest card is issued in the form of a "registration form" ("Meldezettel"), the service provider will verify its validity by checking the duplicate of the registration form.
3. Other Processing of Your Data
In principle, we only process the data that is absolutely necessary for the conclusion of the contract or for the fulfillment of the contract. If you have also given us your consent, we process your data in such a way that we send you information about our services until you withdraw your consent. We use the following communication channels, provided you have provided them to us:
Phone, email, SMS, mail, or social media channels.
3.1. Video Surveillance
(Source: https://www.oesterreich.gv.at/themen/gesetze_und_recht/verbraucherschutz/datenschutz/Videoueberwachung-durch-Private.html#Recht)
Image data, such as video recordings, are generally considered personal data (→ USP). Personal data is processed with cameras when individuals are clearly identifiable in the images or when their identity can be inferred. Identifiability is established if facial features are recognizable or the context of the recording allows a link to a specific person.
According to data protection law, the responsible party must assess before activation whether video surveillance can be considered permissible or if a data protection impact assessment (→ USP) is required in a specific case. The data protection authority does not provide prior assessments in this regard. Such video surveillance systems do not need to be reported to the data protection authority.
Legitimate Interests:
The use of video surveillance may be lawful in individual cases under the GDPR if the data processing is necessary for the protection of legitimate interests of the responsible party or third parties. These interests include:
• Protection of life
• Protection of health and physical integrity
• Protection of property (e.g., private home)
Even if there are legitimate interests, a balancing of these with the interests, fundamental rights, and freedoms of the affected person must be performed, especially if the person is a child. Video surveillance is only lawful in the private sector within very narrow legal limits:
• Video surveillance must be limited to what is absolutely necessary in terms of time and location. Recording of public areas (e.g., parts of sidewalks or streets) is only permissible if the purpose of the surveillance cannot otherwise be fulfilled. Adjacent houses, neighboring properties, or apartments must not be filmed under any circumstances.
• Video surveillance must be clearly marked, e.g., with signs or stickers.
• Recordings must be overwritten or deleted at regular intervals. The data protection authority considers a retention period of up to 72 hours as generally permissible.
• Recordings are only reviewed in case of a specific event (e.g., to determine who caused damage).
• Other, less intrusive means such as barrier systems or security systems must be considered insufficient.
In addition to predominant legitimate interests, data processing may also be lawful if the affected person has given their consent for the processing of their personal data for one or more specific purposes.
Video Cameras in Residential Buildings and Apartments:
Under certain conditions (requirements for spatial scope, storage duration, labeling, purpose of data processing), preventive protection of persons or property in private residences used exclusively by the responsible party and all other authorized users of the shared household may be exempt from a data protection impact assessment. Consent from all authorized users is required.
Another exception to the data protection impact assessment applies to the preventive protection of publicly accessible places under the control of the responsible party. Additional conditions include prior legal violations or special risk potential, and the absence of a less intrusive suitable means.
A proportionality check must be carried out for all video surveillance in residential buildings and apartments.
In the case of rental properties, privacy considerations must also be taken into account, and a balancing of interests must be performed, weighing the landlord's interest in securing the property against the tenant's right to privacy. Video surveillance of common areas (e.g., mailboxes, trash rooms) may interfere with the tenant's privacy. Surveillance of the general entrance area of a rental property is generally permissible. However, recording images of a tenant's apartment door by the landlord would be clearly impermissible.
We conduct video surveillance in the following areas::
• We have a camera at the parking lot (guest parking/private parking).
• We have a camera in the garden (playground).
• We have a camera at the entrance leading to the garage (ski cellar).
• We have a camera monitoring my private front door and entrance area (private terrace).
• We have a camera monitoring my private garden (west of the house).
All of the mentioned cameras only record images 24/7 (no audio).
-> We would like to emphasize that no part of the holiday apartment is monitored and we guarantee absolute privacy.
• Video surveillance is carried out solely to prevent criminal activity, ensure evidence, and exercise the right of residence.
• The legal basis for video surveillance is Article 6, paragraph 1, lit. f) GDPR.
The video footage is automatically deleted after 72 hours!
(See: https://www.jusline.at/gesetz/dsgvo/paragraf/6)
4. Data Deletion
Your master data and other personal data will be deleted when they are no longer required for the purpose for which they were stored – usually after 7 (seven) years – or when storage becomes unlawful due to legal reasons.
Instead of deletion, the data may also be anonymized, meaning that any personal reference will be irreversibly removed.
5. Cookies
Our website (www.oetztalurlaub.at or fewo-umhausen.at) uses so-called cookies. These are small text files that are stored on your device with the help of your browser. They do not cause any harm.
We use cookies to make our services more user-friendly. Some cookies remain stored on your device until you delete them. They allow us to recognize your browser on your next visit.
If you do not wish this, you can configure your browser to notify you about the setting of cookies and allow them only on a case-by-case basis.
Please note that disabling cookies may limit the functionality of our website.
6. Web Analysis
Our website (www.oetztalurlaub.at or fewo-umhausen.at) uses features of the web analytics service Google Analytics, a web analysis service provided by Google Inc. ("Google"). Cookies are used to enable an analysis of the website's usage by its users. The information generated in this process is transferred to the provider's server and stored there.
You can prevent this by configuring your browser to not store cookies. We have concluded an appropriate data processing agreement with the provider.
7. Newsletter
You have the option to subscribe to our newsletter via our website. For this, we need your email address and your confirmation that you agree to receive the newsletter.
To provide you with targeted information, we also collect and process voluntarily provided details such as areas of interest, birthday, and postal code [...].
Once you have subscribed to the newsletter, we will send you a confirmation email with a link to verify your subscription.
You can cancel the newsletter subscription at any time. Please send your cancellation to the following email address: [Insert email address]. We will then promptly delete your data related to the newsletter dispatch.
8. Social Media Plug-Ins
The operator uses so-called "embedded" social media plug-ins (interfaces to social networks) on the website. When visiting the website, the system automatically establishes a connection with the respective social network due to the integration of the plug-ins and transmits data (IP address, website visit, etc.).
The data transmission occurs without the operator's involvement and is outside of their responsibility. The user can prevent this data transmission by logging out of the respective social networks before visiting the website. Only when "logged in" can the social network associate specific data with the user's activity profile through automatic data transmission.
The automatically transmitted data is used exclusively by the operators of the social networks and not by the operator. For more information, including the content of data collection by the social networks, you can refer directly to the website of the respective social network. There, privacy settings can also be adjusted.
The social networks embedded on the website are:
• Facebook ("Like")
Facebook Inc., 1601 S California Ave, Palo Alto, CA, 94304, USA
More information at: https://de-de.facebook.com/policy.php
• Twitter
Twitter Inc., 795 Folsom St., Suite 600, San Francisco, CA 94107, USA
More information at: https://twitter.com/de/privacy
• Google ("+1")
Google Inc., Amphitheatre Parkway, Mountain View, CA 94043, USA
More information at: https://policies.google.com/terms?hl=de
• Instagram
Instagram, LLC Instagram Inc., 1601 Willow Road, Menlo Park, CA 94025, USA
Nähere Informationen unter https://help.instagram.com/155833707900388
9. The following rights can be asserted regarding the processing of your data:
9.1. Right to access:
You have the right to know whether and to what extent we process your data.
Contact / Responsible party:
Appartement FRISCHMANN Klaudia – Mr. Harald Frischmann
9.2. Your rights:
You generally have the rights to access, correction, deletion, restriction, data portability, withdrawal, and objection. If you believe that the processing of your data violates data protection law or that your data protection rights have been infringed in any way, you can file a complaint with the supervisory authority. In Austria, this is the Data Protection Authority.
If you believe that the processing of your personal data violates Austrian or European data protection law, please contact us to clarify any questions. Of course, you have the right to lodge a complaint with the Austrian Data Protection Authority or with a supervisory authority within the EU.
10. Confirmation of Identity:
To protect your rights and privacy, we are entitled to request proof of identity if there is any doubt.
11. Excessive Claiming of Rights:
If you request one of the aforementioned rights in a clearly unfounded or particularly frequent manner, we are entitled to charge a reasonable processing fee or refuse to process the request.
As part of our obligations to cooperate, we are required to provide data in accordance with legal provisions (e.g., BAO, Registration Act, Code of Civil Procedure, Criminal Procedure Code, etc.) upon request.
13. Duration of validity:
This privacy policy is effective as of May 25, 2018, and supersedes the previous data protection provisions.