Privacy policy

The controller responsible for data processing on this website is Thomas Achrainer, MSc, Talhäuslweg 12, 6361 Hopfgarten/Brixental, Österreich, buero@tachrainer.at. No data protection officer has been appointed.

This website is provided via the Lovable platform. When you visit, the server processes technically necessary connection data (in particular IP address, date and time, page requested, browser identifier) to deliver the website and protect it against misuse.

The legal basis is our legitimate interest in secure and functional operation (Art. 6(1)(f) GDPR).

Fonts are loaded locally from this website; no content is loaded from Google Fonts or other third-party servers. No analytics, tracking or marketing services are integrated.

Open: details on the hosting provider as processor, server locations and log retention will be added after review of the data processing agreement.

Availability and prices are retrieved server-side from the controller's management system (EPU Manager). Only accommodation, period and number of guests are transmitted.

For a booking we process first and last name, email address, optionally phone number, country, preferred language and stay details. This data is sent directly to the EPU Manager and stored there; this website stores no booking data.

The purpose is performance of the accommodation contract and pre-contractual steps (Art. 6(1)(b) GDPR) and compliance with legal obligations such as tax and registration rules (Art. 6(1)(c) GDPR). Booking is not possible without this data.

Your preferred language is used to communicate with you in your language.

If you contact us by phone or email, we process your details (name, email, optionally phone, message, preferred language) to handle your request.

The legal basis is the initiation or performance of a contract (Art. 6(1)(b) GDPR) or our legitimate interest in answering enquiries (Art. 6(1)(f) GDPR).

In the help panel a digital assistant answers questions based on the published accommodation information. A conversation is only created when you start it. Your messages, the language and how it was determined (detected or chosen) are sent server-side to the EPU Manager, stored there and passed to Lovable's AI service (Lovable AI Gateway) to generate answers. There is no automated decision with legal effect; only details in the booking flow are binding.

When handed over to Rosi, your request and optional details (name, contact, request) are saved in the EPU Manager; Rosi is not notified automatically. Once Rosi takes over, the assistant is paused.

Legal basis: Art. 6(1)(b) or (f) GDPR. Please do not enter sensitive data in the chat. Open: the model providers used behind the Lovable AI Gateway, data processing agreement, processing location and retention will be added once clarified.

Only if you expressly agree in the booking form will we occasionally send you news by email (Art. 6(1)(a) GDPR, § 174 TKG 2021). Consent is voluntary and not a condition for booking.

You can withdraw consent at any time with effect for the future, e.g. via the unsubscribe link in every email or by writing to the address in the imprint.

We only use technically necessary storage (§ 165(3) TKG 2021): the cookie “rosi_lang” (only if you choose a language yourself, 1 year) and the HttpOnly cookie “rosi_chat” (only after starting a conversation, until the chat session expires). No optional services are integrated; therefore no consent banner is shown.

Without a stored choice, the language is selected based on your browser's language settings. The current overview is always available under “Privacy settings” in the footer.

Recipients are the hosting provider of this website, the operation of the EPU Manager as the controller's management system and – for chat answers – Lovable's AI service, each only to the extent necessary.

Open: processors of the EPU Manager and any third-country transfers (including safeguards under Art. 44 et seq. GDPR) will be added after review.

Booking and invoice data is kept as long as statutory retention obligations apply, in particular seven years under § 132 of the Austrian Federal Fiscal Code (BAO). Enquiries are deleted once handled and no retention obligation applies. Marketing consents are stored until withdrawn.

You have the right of access, rectification, erasure, restriction of processing, data portability and objection (Art. 15–21 GDPR) and the right to withdraw consent at any time. Please use the contact details in the imprint.

If you believe that the processing of your data violates data protection law, you may lodge a complaint with the supervisory authority: Österreichische Datenschutzbehörde, Barichgasse 40–42, 1030 Wien, dsb@dsb.gv.at, www.dsb.gv.at