Privacy Policy

Controller

Peter Möschl, Salzburger Str. 61, 5110 Oberndorf Österreich. Email: info@tauernstays.com.

Hosting

This website is hosted by Vercel Inc., 340 S Lemon Ave #4133, Walnut, CA 91789, USA. Technical data (IP address, browser, timestamp, requested URL) is processed when the site is accessed, as far as required for operation.

AI Concierge (Hawi)

We offer an AI-powered concierge on this website named "Hawi". When you use the concierge, your queries are sent to our API at api.tauernstays.com and from there forwarded to Google Vertex AI (Google Cloud EMEA Limited, 70 Sir John Rogerson's Quay, Dublin 2, Ireland) in an EU data centre to generate the response (region europe-west1, Belgium; if it is briefly overloaded, europe-west4, Netherlands, as a fallback). No data is transferred to the USA.

The legal basis is our legitimate interest in answering your enquiry under Art. 6 (1) (f) GDPR and, for enquiries about a specific offer, the initiation of a contract under Art. 6 (1) (b) GDPR. Processing takes place exclusively within the EU; no transfer to third countries occurs. You decide what you type into the chat — please do not enter special categories of personal data such as health data.

So that Hawi can follow the conversation, show suitable accommodation and pre-fill the booking form for you, we store a conversation state for each conversation in a database on a server of Hetzner Online GmbH (Frankfurt am Main, Germany): your search details (place, travel dates, number of guests, children's ages), the accommodation shown to you and — only if you mention them in the chat yourself — first name, last name, email address and phone number. The state is linked to a random conversation ID, not to your IP address, and is deleted automatically 30 days after the last activity.

We do not store the wording of the conversation on our server. It is kept only in your browser's session storage (sessionStorage) so that the conversation continues, for example after the payment page, and is deleted when you close the tab.

If you ask Hawi to send us an enquiry, this only happens after you have explicitly confirmed it in the chat. We then process it like an enquiry via the form (see next section).

For quality assurance we also record usage metrics (e.g. number and quality of responses, features used) with the conversation ID but without conversation content, IP address or other direct personal identifiers. Single exception: queries the concierge could not answer are stored for up to 90 days to improve the knowledge base; email addresses and phone numbers are automatically masked.

WhatsApp

You can message us on WhatsApp at +43 650 8007048. For this we use the WhatsApp Business Platform (Cloud API) of WhatsApp Ireland Limited (4 Grand Canal Square, Grand Canal Harbour, Dublin 2, Ireland) as a processor. We process your phone number, your WhatsApp profile name, the content of the messages as well as times and delivery status. Meta may also process this data outside the EU, in particular in the USA; Meta is certified under the EU-US Data Privacy Framework, and the European Commission's standard contractual clauses apply in addition.

Your messages are first answered automatically by our AI concierge Hawi (via Google Vertex AI in the EU, as described in the section "AI Concierge (Hawi)"); we point this out in the first reply. If you would like to talk to a person, someone from the tauernstays team takes over personally. If you do not write in German, we use the same AI to translate your messages for the team and its replies into your language.

We store messages and the conversation state in a database on a server of Hetzner Online GmbH (Frankfurt am Main, Germany) and delete them automatically 90 days after your last message. We only message you on WhatsApp if you have written to us first, and we do not send advertising there.

The legal basis is Art. 6(1)(b) GDPR where accommodation or a booking is concerned, otherwise Art. 6(1)(f) GDPR (legitimate interest in answering your message).

Internal notification via Telegram

So that the tauernstays team can respond quickly, we notify it via the messenger Telegram (Telegram FZ-LLC, Dubai, United Arab Emirates) when something important happens in a conversation with Hawi on the website or via WhatsApp — for example when you ask for a person, request specific availability or write to the team after it has taken over. The notification contains the type of request, a short summary (e.g. travel dates or the name of the accommodation), a conversation ID and, if available, your contact details (email address or phone number); for WhatsApp also your phone number and the text of your message. The team's replies are sent from there back into your conversation.

Telegram processes this data on servers outside the EU. There is no adequacy decision of the European Commission for the United Arab Emirates, and there are no other safeguards under Art. 46 GDPR. A level of data protection equivalent to EU law is therefore not ensured; in particular, authorities there may gain access, and your rights are harder to enforce. We delete the notifications regularly, at the latest after 90 days.

The legal basis is Art. 6(1)(f) GDPR (legitimate interest in answering your enquiry personally and promptly). If you do not want this, please use the enquiry form or send us an email; you can object to the processing at any time.

Enquiries via the form

When you contact us using the enquiry form, we process the details you provide: name, email address, phone number where given, number of people, travel dates and your message. We use them solely to answer your enquiry and to put a suitable offer to you. The legal basis is the initiation of a contract under Art. 6(1)(b) GDPR and our legitimate interest in answering your enquiry under Art. 6(1)(f) GDPR.

Your enquiry reaches us as an email and is additionally stored in our enquiry system on a server of Hetzner Online GmbH (Germany) so that we can handle it traceably. We delete it once it has been dealt with and no statutory retention periods apply, at the latest twelve months after your enquiry. If the enquiry leads to a booking, the following section applies to the booking data.

Booking and payment

When you book accommodation directly with us on tauernstays.com, we process the data required for it: first and last names of all travelling persons (for children also their age), email address, phone number, country of residence as well as the accommodation, travel dates and amount paid. The legal basis is performance of the contract under Art. 6(1)(b) GDPR. Without this information the booking cannot be carried out.

Recipients of this data are the accommodation provider you stay with and the supply partner the accommodation is sourced from: Leaside Services Limited (Emerging Travel Group), Ifigeneias 17, 2007 Nicosia, Zypern. The transfer serves solely to carry out your booking and takes place within the European Union.

For accommodation we arrange as an intermediary (marked during booking), we pass the same data to the provider as your contractual partner, currently Belvilla AG, c/o Dr. Christian Hochstrasser, Elisabethenstraße 15, 4051 Basel, Schweiz. The provider processes it under its own responsibility and handles payment, confirmation and invoice directly with you. Switzerland is covered by an adequacy decision of the European Commission (Art. 45 GDPR).

Payment is handled by Mollie B.V., Keizersgracht 126, 1015 CW Amsterdam, Netherlands. You enter your payment details — such as card or account number — exclusively there; we do not receive them, only the information whether the payment succeeded.

We retain booking data for the duration of the statutory retention periods for business records and delete it afterwards.

Web analytics

We use Plausible Analytics for privacy-friendly reach measurement. Plausible is self-hosted by us on a server of Hetzner Online GmbH in Frankfurt am Main (Germany). There is no data transfer to third parties and no transfer to the USA.

Plausible sets no cookies, does not build user profiles, and does not use cross-site tracking. Only aggregated statistics are collected: page viewed, referring domain, browser/device class, country (based on IP — the IP is never stored, only hashed with a daily-rotating salt). Identification of individual persons is not possible.

Legal basis is Art. 6(1)(f) GDPR (legitimate interest in privacy-friendly reach measurement). You can object at any time — for instance via your browser's Do-Not-Track setting or by using an ad blocker with a Plausible filter. More at plausible.io/data-policy.

Your rights

You have the right of access, rectification, erasure, restriction of processing, data portability and objection. Please use the contact details in the imprint.

You also have the right to complain to the Austrian Data Protection Authority.