Information on cookies and data protection

Data Protection Contact:

Maximilian Salcher

+43 5334 22742

gasthof@aschenwald.at

Principles of data processing
We process personal data exclusively in accordance with the applicable data protection regulations, in particular the General Data Protection Regulation (GDPR) and the relevant national data protection and telecommunications regulations. In doing so, we attach particular importance to lawful, transparent and purpose-limited processing.
Personal data is processed only to the extent necessary for the respective purposes. We take appropriate technical and organisational measures to ensure the security of the data and to prevent unauthorised or unlawful processing.
Processing is carried out in good faith and in accordance with the applicable legal provisions.

Server log files and hosting
When you visit our website, information is automatically collected by our hosting provider and stored in what are known as server log files. This data is technically necessary to ensure the secure and stable operation of the website.

The data processed may include, in particular:

• IP address of the requesting device
• Date and time of access
• Pages/files accessed
• Amount of data transferred
• Browser type and version
• Operating system used
• Referrer URL

Purpose of processing:
To ensure technical operation, system security, error analysis and protection against misuse and attacks.
Legal basis:
Article 6(1)(f) of the GDPR (legitimate interest in a secure, stable and fully functional website).
Retention period:
Server log files are stored for a limited period and then automatically deleted, unless security-related incidents require them to be retained for longer.
Hosting:
The website is hosted by an external hosting provider, which processes personal data exclusively within the framework of data processing on behalf of the controller in accordance with Article 28 of the GDPR.
Hosting provider:
Camyno GmbH, Aue 144, 6405 Pfaffenhofen / Austria, https://www.camyno.com

Use of data processors
To provide our website and its individual functions, we use external service providers who process personal data on our behalf (known as data processors).
These service providers are carefully selected, bound by contract and process data exclusively in accordance with our instructions and the applicable data protection regulations.
We have data processing agreements in place with all relevant service providers in accordance with Article 28 of the GDPR.

Contacting Us
If you contact us via a contact form on this website, by email or by telephone, we will process the personal data that you voluntarily provide to us when making contact. This may include, in particular, your name, your email address, your telephone number and the content of your enquiry.
This data is processed solely for the purpose of dealing with your enquiry, responding to any queries, carrying out pre-contractual measures or fulfilling an existing contractual relationship.

Purpose of processing:
Processing and responding to enquiries, communicating with prospective and existing customers, carrying out pre-contractual measures, and managing business correspondence.
Legal basis:
Article 6(1)(b) of the GDPR (contract or pre-contractual measures) and – where no contractual relationship exists – Article 6(1)(f) of the GDPR (legitimate interest in efficient and transparent communication).
Retention period:
The data provided when contacting us will only be stored for as long as is necessary to process the enquiry. Data will only be stored for any longer if there are statutory retention obligations or if the data is required to assert, exercise or defend legal claims.
Recipients:
Your data will be passed on exclusively to those internal departments responsible for processing your enquiry. Where external service providers (e.g. hosting or IT service providers) are involved, this will take place exclusively within the framework of data processing on behalf of the controller in accordance with Article 28 of the GDPR.

Spam protection
To prevent spam and the misuse of our contact forms by automated systems, we use a standalone, server-based ReCaptcha that does not store any third-party cookies.
This reCAPTCHA uses technical verification mechanisms to detect automated access. Only the information necessary to ensure the functionality and security of the forms is processed. The data is not passed on to third parties.

Purpose of processing:
To protect the website and the communications infrastructure from spam, misuse and automated attacks.
Legal basis:
Article 6(1)(f) of the GDPR (legitimate interest in the security and stability of the website).
Data processing:
Processing takes place exclusively within the European Union.

Spam protection with ALTCHA
We use ALTCHA to protect our website from automated access. ALTCHA is a privacy-friendly, cryptography-based method of bot detection that does not rely on tracking, cookies or profiling.
When using ALTCHA, no personal data is transferred to external third parties. The verification process is carried out anonymously and serves solely for the technical validation of form submissions.

Purpose of processing:
To protect the website and contact forms from automated misuse.
Legal basis:
Article 6(1)(f) of the GDPR (legitimate interest in the security and smooth operation of the website).
Data processing:
Processing takes place without the creation of user profiles and without the transfer of personal data to third countries.

Spam protection with captcha.eu
To protect our forms against automated submissions, we use the captcha.eu service. The provider is Captcha GmbH, Muthgasse 36, 1190 Vienna, Austria.
captcha.eu uses data-minimal verification mechanisms to detect and prevent automated access. In doing so, it processes technical information necessary to distinguish between human users and bots. According to the provider, no personal data is transferred to third countries.

Purpose of processing:
To prevent spam and misuse, and to ensure the contact forms function correctly.
Legal basis:
Article 6(1)(f) of the GDPR (legitimate interest in the security and integrity of the website).
Data processing:
Processing takes place within the European Union.
Further information:
Privacy policy of captcha.eu.

Spam protection with Google reCAPTCHA v2
To protect our contact forms from automated misuse, we use Google reCAPTCHA v2. The provider is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland.
reCAPTCHA analyses user behaviour based on various characteristics (e.g. IP address, mouse movements, time spent on the page, browser and device settings) to assess whether the user is a human or an automated programme. Processing takes place in the background or through active user interaction (e.g. ticking a checkbox).

Purpose of processing:
To protect the website and contact forms from spam, misuse and automated attacks.
Legal basis:
Article 6(1)(f) of the GDPR (legitimate interest in protecting the website) and – where necessary – Article 6(1)(a) of the GDPR (consent).
Data transfer:
When using Google reCAPTCHA, data may be transferred to third countries (in particular to the USA). Further information on this can be found in the section ‘Data transfers to third countries’.
Further information:
Google’s privacy policy.

Cookies & similar technologies
Our website uses cookies and similar technologies (e.g. local storage). These are small files or pieces of information that can be stored on or read from your device to provide basic functions, save settings or enable audience measurement and marketing.

• Technically necessary cookies: required for the website to function properly (e.g. page navigation, security, storing consent).
• Optional cookies: statistics, marketing and convenience features (e.g. web analytics, embedded content).

Cookie consent:
Where cookies are not strictly necessary, we will only set them once you have given your consent via our consent banner. You may change or withdraw your consent at any time with future effect.
Retention period: depends on the specific cookie (session cookies until the browser is closed; persistent cookies until they expire or are manually deleted).
You can also delete or block cookies via your browser settings. If you disable cookies, the functionality of the website may be restricted.

Consent Management
We use a consent management tool integrated into our website to manage consent for the use of cookies and similar technologies.
This enables us to obtain, manage and document consent in a differentiated manner. In particular, information regarding the consent status, the time of the decision and the selected settings is processed in order to ensure compliance with data protection requirements in a transparent manner. This data is not passed on to third parties.

Purpose of processing:
To obtain, manage and document consent in accordance with the legal requirements of the General Data Protection Regulation.
Legal basis:
Article 6(1)(c) of the GDPR (compliance with a legal obligation) and Article 6(1)(f) of the GDPR (legitimate interest in legally compliant and transparent consent management).
Retention period:
Consent data will only be stored for as long as is necessary to fulfil the statutory obligations to retain records.

Consent Management with Cookiebot
We use the consent management service Cookiebot to manage consent to the use of cookies and similar technologies. The provider is Usercentrics A/S, Havnegade 39, 1058 Copenhagen, Denmark.
Cookiebot collects and stores information about the consents you have given or withdrawn. In particular, the consent status, the time of the decision and a pseudonymised identification number are processed in order to demonstrate compliance with data protection requirements.

Purpose of processing:
Obtaining, managing and documenting consents in accordance with legal requirements.
Legal basis:
Article 6(1)(c) of the GDPR (compliance with a legal obligation) and Article 6(1)(f) of the GDPR (legitimate interest in legally compliant and traceable consent management).
Retention period:
Consent data will be stored for as long as is necessary to fulfil the obligations to provide evidence.

Consent management with consentmanager
We use the consent management tool consentmanager to manage consent for the use of cookies and similar technologies. The provider is consentmanager AB, Håltegelvägen 1b, 72348 Västerås, Sweden.
Consentmanager stores information about consents granted or refused, including the time of the decision and the selection made in each case. This information is used for the legally compliant management and documentation of the services used.

Purpose of processing:
Obtaining, managing and providing evidence of consent in accordance with the GDPR and relevant data protection regulations.
Legal basis:
Article 6(1)(c) of the GDPR and Article 6(1)(f) of the GDPR (legitimate interest in ensuring the website complies with the law).
Retention period:
The consent information is stored in accordance with statutory record-keeping obligations.

Consent management with Usercentrics
We use the Usercentrics consent management tool to manage your consents. The provider is Usercentrics GmbH, Sendlinger Straße 7, 80331 Munich, Germany.
Usercentrics enables us to obtain, manage and document consent for individual categories of cookies and services. In doing so, information regarding the consent status, the time of the decision and the selected settings is processed.

Purpose of processing:
To obtain, manage and document consents in accordance with the law.
Legal basis:
Article 6(1)(c) of the GDPR (legal obligation) and Article 6(1)(f) of the GDPR (legitimate interest in compliance with data protection regulations).
Retention period:
The stored consent data will only be retained for as long as is necessary to fulfil the statutory obligations to provide evidence.

Consent management with CookieYes
We use the CookieYes consent management tool to manage consent for cookies and similar technologies. The provider is Mozilor Limited, 3 Warren Yard, Wolverton Mill, Milton Keynes, MK12 5NW, United Kingdom.
CookieYes stores information about your cookie settings, including the consents you have given or withdrawn, as well as the time of your decision. This data is used to control and document the use of cookies on the website in accordance with your choices.

Purpose of processing:
To obtain, manage and document cookie consents.
Legal basis:
Article 6(1)(c) of the GDPR and Article 6(1)(f) of the GDPR (legitimate interest in designing a website that complies with data protection regulations).
Retention period:
Consent data is stored in accordance with statutory record-keeping obligations.

Web analytics with Google Analytics 4 (GA4)
Provided you have given your express consent, we use the web analytics service Google Analytics 4 (GA4) on our website. The provider is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland.

Google Analytics 4 uses cookies and similar technologies to collect and analyse information about website usage. The reports generated by Google Analytics 4 are provided exclusively in aggregated form. In particular, the following data may be processed:

• pages visited and interactions
• technical information about the device (e.g. browser type, operating system)
• Approximate location information
• truncated IP address

The information collected is used to analyse user behaviour on the website, to generate reports on website activity and to continuously improve our online offering.

Purpose of processing:
Audience measurement, analysis of user behaviour, and optimisation of the website’s content, structure and performance.
Legal basis:
Article 6(1)(a) of the GDPR (consent). Processing takes place exclusively following your active consent via the consent management tool used.
Recipients / Data processing:
Google processes the data on our behalf. When using Google Analytics 4, data may be transferred to third countries (in particular to the USA). Further information on this can be found in the section ‘Data transfer to third countries’.
Retention period:
The retention period for the data collected depends on the settings configured in Google Analytics 4 and shall not exceed the periods specified by Google. Event data is automatically deleted once the specified retention period has elapsed.
Withdrawal of consent:
You may withdraw your consent at any time with future effect via the cookie settings on this website.
Further information:
Details on data processing by Google can be found in Google’s privacy policy.
Note: Details on data processing by Google can be found in Google’s privacy policy: https://policies.google.com/privacy?hl=de

Web analytics with Matomo
Provided you have given your express consent, we use the Matomo web analytics service on our website. Matomo is open-source software for the statistical analysis of visitor traffic.
Matomo processes information about website usage in order to analyse user behaviour anonymously and to continuously improve our online service. In particular, the following data may be processed:

• pages visited and interactions
• truncated IP address
• technical information about the device (e.g. browser type, operating system)
• Date and time of access

The IP address is anonymised before being stored, thereby ruling out any direct link to an individual.

Purpose of processing:
Audience measurement, analysis of user behaviour, and optimisation of the website’s content, structure and performance.
Legal basis:
Article 6(1)(a) of the GDPR (consent). Processing takes place exclusively following your active consent via the consent management tool used.
Data processing / hosting:
Matomo is operated either on our own servers or via an external hosting provider. In both cases, the data is processed exclusively on our behalf and in accordance with the applicable data protection regulations.
No personal data is transferred to third countries.
Retention period:
The retention period for the data collected depends on the settings configured in Matomo. Visit data is stored only for as long as is necessary for analysis purposes and is subsequently deleted or anonymised.
Withdrawal of consent:
You may withdraw your consent at any time with future effect via the cookie settings on this website.
Further information:
Further information on data processing by Matomo can be found on the provider’s website. https://matomo.org/gdpr-analytics/

IP anonymisation
We use Google Analytics with IP anonymisation enabled. This means that your IP address is truncated before further processing, so that it cannot be readily linked to you personally.
In exceptional cases, a full IP address may be transmitted to a Google server and truncated there. Google uses the processed information to analyse website usage, compile reports on website activity and provide other services relating to website usage.

Browser plug-in
Regardless of whether you have given your consent via the consent banner, you can also prevent Google Analytics from collecting and processing your usage data by installing the browser add-on provided by Google:
https://tools.google.com/dlpage/gaoptout?hl=de
Please note: If you have blockers or restrictions enabled, certain website functions may be limited.

Demographic characteristics
Provided that this feature is enabled and you have given your consent, Google Analytics may provide reports on demographic characteristics (e.g. age ranges, gender, interests). According to Google, this information is derived, amongst other sources, from interest-based advertising and third-party data, and is generally presented in aggregated form.

• Purpose: to gain a better understanding of target audience interests and to optimise content.
• Legal basis: Article 6(1)(a) of the GDPR (consent).
• Opting out: You can reduce or disable personalised advertising in your Google Account or via Google’s advertising settings. Click here to visit the Google Safety Centre: https://safety.google/intl/de_ALL/settings/privacy-settings/

Google Maps
Maps from the Google Maps service may be embedded on our website. The provider is usually Google Ireland Limited (see above). OpenCorpData
When you access pages containing embedded maps, data (in particular your IP address and technical information; and, where applicable, location data if authorised by your device) may be transmitted to Google and processed there. Processing may take place in third countries.

• Purpose: convenient display of maps and locations, route planning.
• Legal basis: Article 6(1)(a) of the GDPR (consent) – provided that the map is only embedded after consent has been given; otherwise, Article 6(1)(f) of the GDPR applies only where embedding is technically essential (which is generally not required in practice).
• Further information: Google Privacy Policy: https://policies.google.com/privacy?hl=de

OpenStreetMap
Our website may incorporate maps from the OpenStreetMap service. OpenStreetMap is a collaborative project for the creation of freely usable geographical data.
When you access a page containing embedded OpenStreetMap maps, the processing of personal data may occur for technical reasons, in particular your IP address and technical information about the device you are using. This data is required to display the map content correctly.

Purpose of processing:
To display geographical information, maps and locations, and to improve user-friendliness.
Legal basis:
Article 6(1)(f) of the GDPR (legitimate interest in the user-friendly display of locations and information).
Data processing:
Processing takes place within the framework of the use of publicly available OpenStreetMap services. No targeted profiling takes place.
Further information:
Information on data protection at OpenStreetMap can be found in the OpenStreetMap Foundation’s privacy policy.

Contwise Maps (General Solutions)
Our website may incorporate map services from Contwise Maps. The provider is General Solutions Steiner GmbH, Austria.
Contwise Maps enables the display of interactive maps and location information. During use, technically necessary data may be processed, in particular the IP address and device-related information, in order to provide the map content.

Purpose of processing:
To display maps, locations and additional geographical information, and to assist users with navigation.
Legal basis:
Article 6(1)(f) of the GDPR (legitimate interest in a functional and user-friendly map display).
Data processing:
Processing is carried out in accordance with data protection regulations within the European Union. No personal data is transferred to third countries.
Further information:
Please refer to the provider’s privacy policy for further details on data processing. https://www.general-solutions.eu/php/datenschutz,22860.html

YouTube
We can embed videos from the YouTube platform. YouTube is a service provided by Google. Google Privacy Policy & Terms of Service
When you visit a page containing embedded YouTube content, a connection is established with YouTube/Google servers. In doing so, personal data (e.g. IP address, device information, page visited) may be processed. If you are logged into your YouTube/Google account, YouTube may associate your use of the service with your profile; you can prevent this by logging out.

• Purpose: Display of video content.
• Legal basis: Article 6(1)(a) of the GDPR (consent) – recommended in particular for active embeds/tracking.
• Further information: Google/YouTube privacy policy: https://www.google.de/intl/de/policies/privacy

Meta plugins (Facebook, Instagram, WhatsApp)
Our website may incorporate features or plugins from Meta’s social networks. The data controller in the EU is generally Meta Platforms Ireland Limited, Merrion Road, Dublin 4, Ireland. https://opencorporates.com/companies/ie/462932
When you visit a page containing a Meta plugin, a direct connection may be established between your browser and Meta’s servers. In doing so, data (e.g. IP address, device/browser information, page visited) may be transmitted to Meta. If you are logged in to Facebook, Meta may associate your visit with your user account. If you do not wish this to happen, please log out before visiting our website.

• Purpose: Interaction and reach via social media functions.
• Legal basis: Article 6(1)(a) of the GDPR (consent), provided that the plugin is only loaded after consent has been given (recommended, e.g. a two-click solution or consent-controlled loading).
• Further information: Meta’s (Facebook) privacy policy: https://de-de.facebook.com/policy.php

Links to social media platforms only
Our website contains links to external social networks (e.g. Facebook, Instagram, LinkedIn). These are links only and not plugins that transmit data to the respective providers as soon as the website is loaded.
It is only when you click on the relevant link that a connection to the servers of the corresponding social network is established. In doing so, personal data (e.g. IP address, page visited) may be transmitted to the respective provider.
The processing of this data falls exclusively within the remit of the respective social network. For information on data processing, please refer to the privacy policies of the respective providers.

Data transfers to third countries
When using certain services and functions on our website (in particular analytics, marketing and multimedia services such as those offered by Google, Meta or YouTube), personal data may be transferred to countries outside the European Union or the European Economic Area (so-called third countries), in particular to the USA.
Such data transfers take place only if you have given your express prior consent or if they are strictly necessary for technical reasons.

Data transfers based on consent
In the case of services requiring consent (e.g. web analytics, embedded content, social media plugins), data transfers to third countries take place exclusively on the basis of your explicit consent in accordance with Article 6(1)(a) of the GDPR, which you provide via the consent management tool used and which you may withdraw at any time with future effect.

Data transfers required for technical reasons
Where, in exceptional cases, a transfer to a third country is strictly necessary for the technically secure operation of the website, this is carried out on the basis of our legitimate interest pursuant to Article 6(1)(f) of the GDPR, in particular to ensure the security, stability and functionality of our online service.

Safeguards
Where necessary, appropriate safeguards are put in place for data transfers to third countries, in particular:

• Adequacy decisions by the European Commission (e.g. the EU-US Data Privacy Framework) and/or
• Standard contractual clauses approved by the European Commission in accordance with Article 46 of the GDPR.

Despite these measures, it cannot be ruled out that public authorities in the relevant third country may access personal data. By giving your consent, you expressly acknowledge this residual risk.

Legal basis for data processing
We process personal data exclusively in accordance with the statutory provisions. Depending on the nature and purpose of the processing, the following legal bases apply in particular:

• Article 6(1)(a) of the GDPR – Consent
• Article 6(1)(b) of the GDPR – Contract or pre-contractual measures
• Article 6(1)(c) of the GDPR – legal obligation
• Article 6(1)(f) of the GDPR – legitimate interest

This legitimate interest relates in particular to the commercial operation, security, optimisation and user-friendly design of our online services.

Storage and deletion
We process personal data only for as long as is necessary for the respective purposes or where statutory retention obligations apply.
If the purpose of the processing no longer applies or if consent has been withdrawn, the data in question will be deleted, provided that there are no legal obligations or overriding legitimate interests that prevent such deletion.
Statutory retention periods arise in particular from tax and company law provisions.

Your rights
In accordance with the GDPR, you are entitled to the following rights in particular:

• Right of access ( Art. 15 GDPR)
• Rectification (Art. 16 GDPR)
• Erasure (Art. 17 GDPR)
• Restriction of processing (Art. 18 GDPR)
• Data portability (Art. 20 GDPR)
• Objection to processing on the basis of legitimate interests (Art. 21 GDPR)
• Withdrawal of consent with effect for the future (Article 7(3) of the GDPR)

If you believe that the processing of your personal data infringes data protection law, you may lodge a complaint with a supervisory authority. In Austria, this is the Data Protection Authority.
Exercising your rights:
Please address your enquiry to: Maximilian Salcher + 43 5334 22742

Updates and changes to this privacy policy
This privacy policy will be updated as necessary to reflect changes in the law, technical developments or new services.
The latest version is available on this website at all times.

Final Provision
Should any individual provisions of this privacy policy be or become invalid, this shall not affect the validity of the remaining provisions.
This Privacy Policy applies in its current version and is available on our website at all times.