Privacy Policy

The following information explains how we process your data.

The controller within the meaning of the GDPR is:
Johann Unterkofler GmbH
Zaglausiedlung 11a
5600 St. Johann im Pongau
Austria
Telephone: +43 6412 94 150
Email: info@rosenstoa.com
Website: www.rosenstoa.com

The data we process includes:

  • Your first and last name
  • Your email address
  • Your telephone number
  • the information you provide when making a booking or enquiry

Personal data is processed for the following purposes:

  • Processing booking enquiries
  • Processing and managing online bookings
  • Communicating with guests and prospective guests
  • Performance of an accommodation contract or taking steps prior to entering into a contract

We will delete the data as soon as its storage is no longer required or restrict its processing where statutory retention obligations apply.

Disclosure of data

We will disclose your personal data to third parties only where this is necessary to fulfil our contractual and legal obligations or where you have expressly consented to such disclosure. Recipients may include service providers whom we engage to perform contracts with you; external service providers who assist us with IT system maintenance and development, analytics and marketing services and with whom we have entered into a data processing agreement; and public authorities and government institutions where we are legally obliged to disclose the data.

Security measures and transfers to third countries

We have implemented appropriate organisational and technical measures to protect your data against unauthorised access, loss or misuse. Our service providers are contractually and/or otherwise legally obliged to process the data solely in accordance with our instructions and to implement appropriate security measures.

Should we transfer your data to third parties outside the European Union (EU) or the European Economic Area (EEA), we will ensure that an adequate level of protection is in place, for example through the use of EU Standard Contractual Clauses or EU certification of the recipient.

Rights of data subjects

As a data subject, you have the right of access, rectification or erasure, restriction of processing and the right to object to the processing of your personal data. Where you have given us consent, you may withdraw it at any time with effect for the future.

You also have the right to data portability. Please send any requests, objections or withdrawals informally to the email address stated above.

Questions about data protection

If you have any questions or concerns regarding the processing of your personal data, please contact us using the contact details stated above. We will process your request as quickly as possible.

You also have the right to lodge a complaint with a data protection supervisory authority. The competent supervisory authority in Austria is:

Austrian Data Protection Authority
Barichgasse 40–42
1030 Vienna
Austria

Further information is available at:
https://www.dsb.gv.at

Online booking/enquiry via the website

1. Controller

Rosenstoa
Johann Unterkofler GmbH
+43 6412 941 50
info@rosenstoa.com

2. Description and scope of data processing

You can book rooms and offers or submit an enquiry via our website.
If you use this option, the data entered in the input form will be transmitted to us and stored. This includes:

  • Title, first name, last name
  • Email address, telephone number, postal address
  • Number of accompanying guests, special requests
  • Booking details (date, time, room selection, offers, price)

To process online bookings, we use the reservation system provided by our technical service provider:

Websline GmbH
Sägewerkstraße 24
83395 Freilassing
Germany
T: +49 8654 – 77 066 0
systems@websline.com

Websline GmbH processes booking data solely on our behalf and in accordance with our instructions on the basis of a data processing agreement pursuant to Art. 28 GDPR. All booking data entered by you is transmitted in encrypted form and protected by appropriate technical and organisational measures.

The data will not be disclosed to any other third parties. It will be used exclusively to process your booking, perform the accommodation contract and communicate with you.

2. Legal basis for data processing

The legal basis for processing the data is the conclusion of an accommodation contract with the user.

3. Purpose of data processing

We process the personal data from the input form solely to handle the booking enquiry and process payments.

4. Legal basis for processing

  • Art. 6(1)(b) GDPR: performance of an accommodation contract or taking steps prior to entering into a contract
  • Art. 6(1)(c) GDPR: compliance with legal obligations (e.g. retention obligations under tax and commercial law)
  • Art. 6(1)(a) GDPR: where you have given your explicit consent

5. Storage period

We retain your data only for as long as is necessary to perform the contract and comply with statutory obligations. Statutory retention periods under commercial and tax law may be up to ten years. Your data will be deleted once these periods have expired.

6. Transfers to third countries

Your data will not be transferred to countries outside the EU or EEA.

7. Right to object and request erasure

You may object to the processing of your personal data at any time.

Please note: if you object, the booking cannot be made or continued.

8. Your rights

Under the GDPR, you have the following rights:

  • Access (Art. 15 GDPR)
  • Rectification (Art. 16 GDPR)
  • Erasure (Art. 17 GDPR)
  • Restriction of processing (Art. 18 GDPR)
  • Data portability (Art. 20 GDPR)
  • Objection (Art. 21 GDPR)
  • Withdrawal of consent (Art. 7(3) GDPR)

To exercise these rights, please contact us using the contact details stated above.

You also have the right to lodge a complaint with a data protection supervisory authority. The competent authority is the supervisory authority responsible for your place of residence or our registered office.

Cookiebot

We use the Cookiebot consent management service provided by Usercentrics A/S, Havnegade 39, 1058 Copenhagen, Denmark (Usercentrics). This enables us to obtain and manage website users’ consent to data processing. Processing is necessary to comply with a legal obligation to which we are subject (Art. 7(1) and Art. 6(1)(c) GDPR). The following data is processed using cookies:

Your IP address (the final three digits are set to “0”); date and time of consent; browser information; the URL from which consent was submitted; an anonymous, random and encrypted key; and your consent status as an end user, serving as evidence of consent.

The key and consent status are stored in your browser for 12 months using the “CookieConsent” cookie. This preserves your cookie preferences for subsequent page requests and enables your consent to be demonstrated and verified.

If you enable the “bulk consent” service function to provide consent for multiple websites with a single end-user consent, the service also stores a separate, random and unique ID together with your consent. If all of the following criteria are met, this key is stored in encrypted form in the third-party “CookieConsentBulkTicket” cookie in your browser: you enable bulk consent in the service configuration; you permit third-party cookies in your browser settings; you have disabled “Do Not Track” in your browser settings; and you accept all or at least certain types of cookies when providing consent.

The website cannot function properly without this processing.

Usercentrics receives your personal data and acts as a processor on our behalf.

Processing takes place within the European Union. Further information on your rights to object and request erasure is available from Usercentrics at: https://www.cookiebot.com/de/privacy-policy/

Your personal data is deleted on an ongoing basis after 12 months or immediately after termination of the contract between us and Usercentrics.

Please also refer to our general information above concerning the deletion and disabling of cookies.

Cloudflare

We use the content delivery network (CDN) provided by Cloudflare Germany GmbH, Rosental 7, c/o Mindspace, 80331 Munich, Germany (Cloudflare), to enhance the security and delivery speed of our website. This is based on our legitimate interest pursuant to Art. 6(1)(f) GDPR. A CDN is a network of servers distributed around the world that can deliver content to website users in an optimised manner. For this purpose, personal data may be processed in Cloudflare server log files. Please also refer to the information under “Hosting”.

Cloudflare receives your personal data and acts as a processor on our behalf. This reflects our legitimate interest under Art. 6(1)(f) GDPR in not operating our own content delivery network.

You have the right to object to this processing. Whether an objection is successful will be determined by balancing the interests involved.

Processing of the data described in this section is neither legally nor contractually required. The website cannot function properly without this processing.

Cloudflare stores your personal data for as long as necessary for the purposes described.

Further information on your rights to object and request erasure is available from Cloudflare at: Cloudflare DPA

Cloudflare has implemented compliance measures for international data transfers. These apply to all global activities in which Cloudflare processes personal data relating to individuals in the EU. These measures are based on the EU Standard Contractual Clauses (SCCs). Further information is available at: https://www.cloudflare.com/cloudflare_customer_SCCs-German.pdf

Hosting & Content Delivery Network

When you visit our website, we collect the following data transmitted by your browser in server log files:

IP address, date and time of the request, time-zone difference from Greenwich Mean Time, content of the request, HTTP status code, amount of data transferred, referring website, and information about the browser and operating system.

This is necessary to display our website, ensure its stability and security, enable our hosting provider to bill us for its services and facilitate efficient delivery of the website. This is based on our legitimate interest pursuant to Art. 6(1)(f) GDPR.

We use the following hosting provider to make our website available:

Kinsta Inc.
Attn: Privacy and Data Protection Team
8605 Santa Monica Blvd #92581
West Hollywood, CA 90069
USA
privacy@kinsta.com

Kinsta primarily uses the Google Cloud Platform service provided by Google LLC, 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA (Google), for its infrastructure.

Kinsta has implemented compliance measures for international data transfers with Google. These apply to all global activities in which Kinsta processes personal data relating to individuals in the EU. These measures are based on the EU Standard Contractual Clauses (SCCs).

Kinsta receives your personal data and acts as a processor on our behalf. This is based on our legitimate interest under Art. 6(1)(f) GDPR in not having to maintain servers on our own premises. The server location is Germany.

Further information on your rights to object and request erasure is available from Kinsta Inc. at: https://kinsta.com/legal/privacy-policy/

You have the right to object to this processing. Whether an objection is successful will be determined by balancing the interests involved.

The data will be deleted after 30 days.

Processing of the data described in this section is neither legally nor contractually required. The website cannot function properly without this processing.

Google Analytics 4

This website uses Google Analytics 4, a web analytics service provided by Google Inc. (“Google”). Google Analytics 4 uses cookies, which are text files stored on your computer that enable analysis of your use of the website. The information generated by the cookie about your use of this website is generally transferred to and stored on a Google server in the USA.
IP anonymisation is enabled on this website. Google will therefore truncate your IP address within Member States of the European Union or other states party to the Agreement on the European Economic Area before transmission. Only in exceptional cases will the full IP address be transferred to a Google server in the USA and truncated there. On behalf of the website operator, Google will use this information to analyse your use of the website, compile reports on website activity and provide the website operator with other services relating to website and internet usage.

Google Analytics is activated only after you have given your consent via our consent management system. We use Google Consent Mode v2, and IP anonymisation is enabled.

Data is processed on the basis of your consent pursuant to Art. 6(1)(a) GDPR, where you have provided it. You may withdraw your consent at any time with effect for the future.

This website also uses Google Analytics 4 to analyse visitor flows across devices using a User ID. You can disable cross-device analysis of your usage in your customer account under “My data” and “Personal data”.

You can prevent cookies from being stored by selecting the appropriate settings in your browser. Please note, however, that you may then be unable to use all features of this website in full. You can also prevent Google from collecting and processing the data generated by the cookie relating to your use of the website, including your IP address, by changing your cookie consent settings: [borlabs-cookie type=”btn-cookie-preference” title=”Cookie settings” element=”link”/]

Further information on terms of use and data protection is available at: https://www.google.com/analytics/terms/de.html and https://policies.google.com/privacy.

Google Tag Manager

We use Google Tag Manager, provided by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland, on our website.

Google Tag Manager is used to manage and deploy website tags. Google Tag Manager itself does not create user profiles, carry out independent analyses or store cookies on your device. However, your IP address may be transmitted to Google as part of the technical provision of the service.

Google Tag Manager is used to integrate other services such as Google Analytics or Google Ads. Where consent is required, these services are activated only after you have given your consent via our consent management system.

Processing is based on our legitimate interest in the technically reliable and efficient management of the services used on our website pursuant to Art. 6(1)(f) GDPR. Where services integrated through Google Tag Manager process personal data, the legal basis is determined by the service concerned.

Further information about data protection at Google is available at:
https://policies.google.com/privacy

SSL or TLS encryption

Our website uses SSL (Secure Socket Layer) and TLS (Transport Layer Security) technology to encrypt data transmissions. These technologies protect the integrity, confidentiality and authenticity of transmitted data and prevent unauthorised parties from reading or modifying it.

When you visit our website, your browser automatically establishes an SSL/TLS-encrypted connection to our server. You can identify this by the change from “http” to “https” in your browser’s address bar and the padlock symbol displayed there.

Google Ads and Google Conversion Tracking

Our website uses Google Ads, an online advertising programme provided by Google Inc. We also use conversion tracking in connection with Google Ads. When you click on an advertisement placed by Google, a cookie is set that remains valid for 30 days and is not used to identify users personally. The cookie enables us and Google to recognise that you clicked on the advertisement and were redirected to our website. Each Google Ads customer receives a different cookie, and cookies cannot be tracked across the websites of Google Ads customers. You may object to conversion tracking at any time by disabling the cookie in your browser. Please note that disabling cookies may limit the functionality of our website. Further information is available in Google’s privacy policy.

Our website also uses Google Conversion Tracking. This analytics tool enables us to determine whether a specific action on our website, such as a purchase or registration, resulted from a click on an advertisement placed by Google. When you click on a Google advertisement, a cookie is stored on your computer or mobile device. These cookies generally expire after 30 days and are not used to identify users personally. You may object to data collection through Google Conversion Tracking at any time by disabling the relevant cookie in your browser. Further information about Google Ads and Google Conversion Tracking is available in Google’s privacy policy.

Meta Pixel

To measure the effectiveness of our advertising campaigns, we use the Meta Pixel provided by Meta Platforms Ireland Limited,
Merrion Road,
Dublin 4,
D04 X2K5,
Ireland (“Meta”). This pixel enables us to track the behaviour of visitors who reach our website through a Facebook advertisement. This allows us to evaluate the effectiveness of Facebook advertisements and improve our advertising activities in the future.

The data collected is anonymous to us and does not enable us to draw conclusions about the identity of users. However, Facebook stores and processes the data, which may enable it to be linked to the relevant user profile. Facebook may then use this data for its own advertising purposes as described in Facebook’s Data Use Policy. We, as the website operator, have no influence over this use of the data.

Further information on protecting your privacy is available in Facebook’s privacy policy. You can also disable the “Custom Audiences” remarketing function by logging in to Facebook and opening your advertising settings. If you do not have a Facebook account, you can opt out of Facebook’s interest-based advertising via the European Interactive Digital Advertising Alliance website.

Copyright: Gipfelgold GmbH
Last updated: 3 August 2026