Privacy policy
This policy explains how we process personal data when you visit our website and use our online services.
1. Controller and contact details
Johanna Köckeis-Grüner e.U. – Hotel Turmhof
Josef Schöffel-Straße 9, 2352 Gumpoldskirchen, Austria
Telephone: +43 2252 607 333
Email: office@hotel-turmhof.at
This policy covers our website and the services described below. Where necessary, additional information is provided for other processing during your stay, such as statutory guest registration.
2. Website, hosting and technical security
Our website is hosted by easyname GmbH in Austria. Visiting it involves processing technically necessary information, including your IP address, access time, requested page, browser information and, where transmitted, the referring page. Access and error logs support website operation, troubleshooting and protection against attacks.
The legal basis is Article 6(1)(f) GDPR. Our legitimate interest is the secure and reliable operation of the website. Access is limited to the people responsible and, where necessary, contracted hosting, email and IT service providers. Logs are retained only for as long as needed to maintain operation and investigate faults or security incidents. Data required for investigating a specific incident is handled separately where further retention is necessary.
3. Enquiries and correspondence
For room and meeting enquiries we process the information you submit: depending on the form, your name, email address, telephone number, address, company, dates, number of guests and rooms, children's ages, room or meeting preferences and message. This also applies to information supplied by email or telephone.
Website forms are processed on our hosting space. Enquiries are saved in the protected WordPress administration area and emailed to the hotel. There is no automatic addition to a newsletter mailing list.
Contract-related enquiries are processed under Article 6(1)(b) GDPR. General correspondence and communication with company representatives are processed under Article 6(1)(f) GDPR; our legitimate interest is responding appropriately to your request. Required fields are marked. Without the required information we cannot process the relevant form. Optional information is not mandatory. An enquiry does not constitute a binding booking.
To prevent abuse, we use local form checks and a network identifier derived from the IP address using a secret key. Rate limits apply for one hour; identifiers preventing duplicate submissions apply for one day. The legal basis is Article 6(1)(f) GDPR and our legitimate interest in preventing automated abuse. The plain IP address is not stored with the enquiry; separate technical server logs may still exist.
Completed, non-binding enquiries that do not result in a booking are deleted six months after the correspondence ends, unless statutory retention requirements or specific legal claims require otherwise. If you book, necessary information continues to be processed for that booking. Tax-relevant documents are generally retained for seven years; ongoing proceedings can require longer retention. Statutory retention is based on Article 6(1)(c) GDPR; necessary enforcement or defence of legal claims is based on Article 6(1)(f) GDPR.
4. Online bookings
“Book now” takes you to the separate OnePageBooking interface provided by HotelNetSolutions GmbH, Genthiner Straße 8, 10785 Berlin, Germany. It processes the contact, stay and reservation details required for your booking and, depending on your chosen payment method, payment information.
Your booking is processed to take steps towards and perform a contract under Article 6(1)(b) GDPR. Additional information on services and payment processing is provided within the booking interface. See the HotelNetSolutions privacy information.
5. Cookie settings and browser storage
“Cookie settings” in the footer lets you decide whether Google Analytics may be used. Declining does not affect basic website features or enquiry forms.
Your choice is saved in your browser's local storage under “turmhof-privacy-v2” and honoured for 180 days. We then ask again. The entry may remain in browser storage until overwritten or manually deleted. Saving your choice implements your decision under Article 6(1)(f) GDPR; the necessary storage of this expressly requested choice falls under section 165(3) of the Austrian Telecommunications Act 2021. Optional analytics instead requires your consent.
6. Google Analytics 4
Google Analytics 4 is loaded only with your consent. It is provided by Google Ireland Limited, Ireland. It processes page views, interactions, browser and device information, language, referring pages and pseudonymous identifiers. The statistics help us improve our website's content and usability.
The legal basis is Article 6(1)(a) GDPR and, for the relevant access to your device, section 165(3) of the Austrian Telecommunications Act 2021. Our integration disables Google signals and personalised advertising. The “_ga” and “_ga_*” analytics cookies are configured to last 180 days. This is distinct from Google's retention of measurement data: event data is subject to the retention settings in the Analytics account; aggregated statistical reports may remain available longer. See Google Analytics data retention.
Google states that EU users' IP addresses are discarded before logging; they are first used, among other things, to derive an approximate region. Measurement data may be processed outside the EEA, particularly by Google LLC in the USA. Google identifies the EU-US Data Privacy Framework for covered certified US recipients and, where applicable, standard contractual clauses as transfer mechanisms. See Google's transfer safeguards and privacy policy.
You can withdraw consent at any time through “Cookie settings”. Our integration then disables further measurement and removes the Analytics cookies it can access. Withdrawal does not affect the lawfulness of earlier processing.
7. Newsletter
If you subscribe to our newsletter, we use your email address and, where supplied, your name to send hotel news and offers. We use Campaign Monitor / Marigold for delivery. Recipient data and technical delivery information, such as delivery and error notifications, are processed for this purpose. Information on the provider and its international processing is available in the Campaign Monitor privacy and contractual information.
The newsletter option in our enquiry form is voluntary and independent of your enquiry. If you select the newsletter checkbox, we send your name and email address to Campaign Monitor to request a confirmation email. A new subscription becomes active for newsletter delivery only after you confirm it. We record the consent wording and the time of your request. Consent-based newsletter delivery relies on Article 6(1)(a) GDPR in conjunction with section 174 of the Austrian Telecommunications Act 2021. You can withdraw consent using the unsubscribe link in a newsletter or by emailing office@hotel-turmhof.at.
We use your data for delivery until you unsubscribe. Necessary consent records and suppression records are retained separately only for as long as required to demonstrate consent or honour your unsubscribe request.
8. Weather, webcam and external links
The weather forecast is retrieved server-side from MET Norway for the fixed location of Gumpoldskirchen and cached. Your personal location is not obtained for this purpose. Your browser receives the data from our website.
The current webcam image is also retrieved and cached server-side. Opening the webcam window connects your browser to our web server, not directly to the camera. These requests are subject to the technical processing described under “Website, hosting and technical security”.
External links lead to map providers, social networks, review platforms, hotel guides and event organisers. You visit the respective provider when you open its link. Location permission for route planning is handled by the map provider; our website does not request your location. Please also consult the respective provider's privacy information.
9. Your rights
Subject to the GDPR, you may request access, rectification, erasure, restriction and data portability. You may object to processing based on legitimate interests on grounds relating to your particular situation; you may object to direct marketing at any time. Consent may be withdrawn for the future. Contact office@hotel-turmhof.at to exercise your rights.
You may complain to a data protection supervisory authority, particularly in the country of your residence, workplace or a suspected infringement. In Austria: Austrian Data Protection Authority, Barichgasse 40–42, 1030 Vienna, dsb@dsb.gv.at, dsb.gv.at.
We do not make solely automated decisions with legal or similarly significant effects within the meaning of Article 22 GDPR in relation to the website enquiries described here.