Privacy policy
VERBUND Tourismus GmbH is committed to protecting your personal data and informing you about how we handle it. In this data protection declaration you will find the main data processing procedures of VERBUND Tourismus GmbH. This data protection declaration defines how we process your personal data.
1. Name and contact details of the person responsible
The person responsible for processing your data in the context of the data processing activities at Berghotel Malta listed below is VERBUND Tourismus GmbH, Europaplatz 2, 1150 Vienna ("we", "us").
The contact details of the data protection officer are:
Email: datenschutz@verbund.com.
2. What data do we process, for what purposes and on what legal basis?
2.1 Website
When you visit our website www.berghotelmalta.at, we collect the following personal data in a server log file:
content accessed
Time of the server request
browser type / browser version
operating system used
referrer URL
IP address
Host name
The access data collected in the course of website use is used for the purpose of website operation and security (predominantly legitimate interests). In the case of e.g. usage statistics or personalized advertising, we process your data on the basis of your voluntary consent,
2.2 Cookies Policy
2.2.1 General
Cookies make websites more user-friendly and efficient for the user. A cookie is a small text file that is used to store information. When a website is visited, the website may place a cookie on the website visitor's computer. If the user visits the website again later, the website can read the data from the previously stored cookie and thus determine, for example, whether the user has visited the website before and which areas of the website the user was particularly interested in.
We use necessary cookies for the operation of our website, without which the provision of our website would not be possible. We base this on our legitimate interest according to Art 6 para 1 lit f DSGVO, which is to make our website user-friendly and to protect it from attacks. If you have given us your consent pursuant to Art 6 (1) (a) DSGVO in conjunction with § 165 (3) TKG, we also use personal cookies to compile usage statistics and to display personalized advertising. You can revoke your voluntarily given consent at any time.
If the settings you have made or the voluntary consent you have given also include providers who transfer data to countries without an adequacy decision pursuant to Art 45 (3) DSGVO and without suitable guarantees pursuant to Art 46 DSGVO (such as the USA in particular), your consent pursuant to Art 49 DSGVO also applies to these countries. There is a risk that your data transferred in this way may be subject to access by authorities in these third countries for control and monitoring purposes and that no effective legal remedies are available against this.
On our website, you have the option to accept the use of cookies /tools in principle by clicking the button "Allow all cookies " via our cookie banner, which appears automatically when you visit our website for the first time or when changes are made. By clicking the "Only necessary cookies" button, you reject all cookies that are not necessary. In addition, you can also "Allow" or "Reject" the tools individually.
2.2.2 Which cookies are used
Our website processes the following cookies:
Absolutely necessary cookies to ensure basic website functions.
CookieConsent: Used to store consent to cookie use.
gaOptout, maOptout, fbOptout: Used to store the opt-out from Google Analytics.
Functional cookies, to ensure the performance of the website
Performance cookies, to improve the user experience
Google Analytics, Google Adwords, Matomo Analytics (see there).
Advertising cookies, to control advertising campaigns
2.2.3 Google Analytics
VERBUND uses, if you have consented, Google Analytics, a web analytics service provided by Google Ireland Limited (Google Ireland Limited, Google Building Gordon House, 4 Barrow Street, Dublin D04 E5W5, Ireland) ("Google"). Google Analytics also uses cookies that enable an analysis of your use of the website. The information generated by the cookies about your use of this website will be transmitted to and stored by Google on servers in the United States. We would like to point out that on this website Google Analytics has been extended by the code "gat._anonymizeIp();" to ensure this anonymized collection of IP addresses. On the website, the IP address of users is therefore shortened before being stored on the Google servers (so-called IP masking). The full IP address is therefore not transmitted to a Google server in the USA. Only in exceptional cases is the full IP address transmitted to a Google server in the USA and shortened there. Google will use the information on behalf of VERBUND for the purpose of evaluating your use of the website, compiling reports on website activity for website operators and providing other services relating to website activity and internet usage.
You may refuse the use of cookies by selecting the appropriate settings on your browser, however please note that if you do this you may not be able to use the full functionality of this website.
You can also prevent the collection of data generated by the cookie and related to your use of the website (including your already anonymized IP address) to Google and the processing of this data by Google by downloading and installing the browser plugin available at the following link. The current link is: http://tools.google.com/dlpage/gaoptout?hl=de.Nähere Information on Google's terms of use and privacy policy can be found at http://www.google.com/analytics/terms/de.html. You can prevent the collection of your user data by Google Analytics on this website by clicking on the link below. An opt-out cookie will be set that prevents the collection of your data during future visits to this website.
2.2.4 Google Adwords Conversion Tracking/Google Ads.
This website uses, if you have consented, the service Google Conversion Tracking of Google Ireland Limited. (Google Ireland Limited, Google Building Gordon House, 4 Barrow Street, Dublin D04 E5W5, Ireland). Google Adwords sets a cookie on the visitor's computer if the visitor has accessed our website via a Google ad. These cookies lose their validity after 30 days and are not used for personal identification. If the user visits certain pages of the Adwords customer's website and the cookie has not yet expired, Google and the customer can recognize that the user clicked on the ad and was redirected to this page. Each Adwords customer receives a different cookie. Cookies can therefore not be tracked across Adwords customers' websites. The information obtained using the conversion cookie is used to create conversion statistics for Adwords customers who have opted in to conversion tracking. In this way, we can improve the performance of our Ads ads in Google search results and target returning visitors more effectively. Adwords customers learn the total number of users who clicked on their ad and were redirected to a page tagged with a conversion tracking tag. However, they do not receive information that personally identifies users. If the visitor does not wish to participate in the tracking process, he can also refuse the setting of a cookie required for this - for example, via a browser setting that generally disables the automatic setting of cookies. The visitor can also disable cookies for conversion tracking by setting his browser to block cookies from the domain "www.googleadservices.com".
Further information on the use of data by Google can be found at https://www.google.com/intl/de/policies/privacy.
2.3 Contact / Inquiry
If you contact us or make an inquiry, in particular about room bookings, packages, seminar rooms or restaurant reservations, the following data provided by you will be processed, depending on the chosen method of contact (online via the contact or inquiry form, e-mail, telephone) and your inquiry: Personal data such as title, name, address, e-mail address, telephone number, as well as travel dates, room category, number of rooms and persons, as well as other data relating to the request as well as comments.
Your data will be processed for the purpose of contacting you and providing information or fulfilling your request. The legal basis for the processing of this data, if the request is aimed at the conclusion of a booking, is Art 6 para 1 lit b DSGVO (necessary for the (pre-)contractual performance of the contract), the legitimate interest (Art 6 para 1 lit f DGSVO), which lies in the processing of your request or your consent (Art 6 para 1 lit a DSGVO), if you disclose particularly sensitive data.
The provision of this data by you is voluntary. If you do not provide the data necessary for the processing of your request, we cannot process your request accordingly.
2.4 Bookings
If you book rooms or packages with us directly or via a booking portal or make bookings for seminar rooms, other offers/activities or also restaurant visits at Berghotel Malta (e.g. by telephone, e-mail, online form or on site), we process the following data in particular for the purpose of making and handling the respective booking: Salutation, name, e-mail address, telephone number, address, nationality, if applicable your message to us, the name of your accompanying person(s), billing address, credit card data or other payment data. In addition, we process information about your stay, including arrival and departure dates, special requests or comments (including room requests, amenities or other services used). The processing of the data is necessary to fulfill the contract you have concluded with us (Art 6 para 1 lit b DSGVO). If you also voluntarily provide us with particularly sensitive data (e.g. allergies), we base the processing on your consent (Art 6 para 1 lit a and Art 9 para 2 lit a DSGVO).
At Berghotel Malta, additional data is collected for room bookings, which is necessary due to legal obligations (registration law), such as: Date of birth, place of birth, gender, if applicable a travel document (type, number, date of issue, issuing authority), as well as data of fellow travelers (first name, last name, date of birth, if applicable travel document, nationality). The processing of this personal data is necessary to comply with legal obligations (Art 6 para 1 lit c DSGVO).
The provision of data by you is voluntary; however, if you do not provide necessary data, we cannot process and manage your booking accordingly.
2.5 Applications
Your application data, which we receive from you for a position at Berghotel Malta and which is contained in the documents sent to us (in particular name, address, telephone number, e-mail address, date of birth, education, professional history, details of the desired position, etc.), is processed by us for the purpose of evaluating and assigning your application and matching it with vacancies. The processing of your data is carried out in the context of the implementation of pre-contractual measures in accordance with Art 6 para 1 lit b DSGVO. If you also voluntarily provide us with data that is particularly worthy of protection (e.g. religious confession), we base the processing on your consent (Art 6 para 1 lit a and Art 9 para 2 lit a DSGVO). If you give us your consent to keep records, Art 6 para 1 lit a DSGVO is the legal basis.
The provision of your personal data by you is voluntary; should you not provide the data required for the evaluation of your application, we will not be able to process your application.
2.6 Social Media Channels
You can interact with us on our social media pages by clicking various buttons (e.g. "Like", "Share", "Subscribe", "Follow") or commenting on content. In this case, we will process your interaction as well as your ("user") name, profile photo and IP address and, if applicable, personal data of invited or tagged third parties.
We use this information in accordance with Art 6 para 1 lit a or f DSGVO to answer your questions and comments, to comment on your opinion/feedback, to give you the opportunity to express yourself or to promote us and our product offering on the platform. We store this self-provided data until you revoke your interaction or as long as our content (images, videos, etc) is online.
On our social media pages, we process personal data automatically via the page insight tools of Facebook, Instagram and Pinterest, in each case together with the platform operator, which provide information about the interaction of visitors and users and serve to optimize your experience on the website or to optimize marketing activities ("tracking data").
For our Facebook and Instagram profiles, we have entered into the following shared responsibility agreement with Meta Platforms Ireland Ltd, 4 Grand Canal Square, Grand Canal Harbour, Dublin 2, Ireland: https://www.facebook.com/legal/controller_addendum
You can find out which personal data we process jointly under the heading "How is this information shared?" in the subheading "Partners who use our analytics services" in Facebook's privacy notice at https://www.facebook.com/policy.php.
We therefore use this information in accordance with Art 6 para 1 lit f DSGVO both to create aggregated evaluations of the use of our social media presence and to optimize our marketing activities.
This data is stored by Meta in accordance with the time limits described at https://www.facebook.com/policy.php (subsection: "Data storage, deactivation and deletion of accounts").
3. data transfer
Insofar as service providers commissioned for data processing ("order processors" such as IT service providers, service providers for marketing services, etc.) are involved, they may also have access to personal data under certain circumstances in accordance with our order and instructions. Processing by a processor is always based on a contract.
In addition, we may transfer your personal data to the following recipients to the extent necessary:
To any third parties involved in the fulfillment of our obligations to you (e.g. payment service providers or banks for payment processing; cooperation partners);
to other external third parties in the event of an incident to the extent necessary on the basis of our legitimate interests (e.g. auditors, insurance companies in the event of an insurance claim, legal representatives in the event of an incident);
Courts, responsible authorities and other public bodies to the extent required by law (e.g. municipality in connection with the registration law, tax authorities).
4. storage period
We store your personal data, only as long as they are necessary to fulfill our obligations to you. However, for reasons of the statutory retention obligations that apply to us, we generally store your data provided in connection with bookings for seven years after fulfillment of the contract. We store data from other inquiries/contacts for up to 12 months after the response in order to be able to respond appropriately to any follow-up questions. If you have given us your consent, we will store the data until you revoke your consent.
Should an employment relationship come about with you, we will retain your data for the duration of your employment and delete it after your employment has ended and the legal time limits have expired. If no employment relationship is established and no consent to keep records was given, the applicant data will be deleted at the latest after expiry of the statutory periods (7 months) after the end of the application process.
We store the personal data voluntarily provided on our social media pages (e.g. name, comments, interactions, etc.) as long as you have not removed the corresponding information (e.g. "like" statement) or have not deleted the comment or these have been lawfully deleted by the platform operator within the framework of the terms of use (e.g. in cases of abuse).
In addition, we store personal data for as long as necessary for the detection and prevention of fraud and other illegal activities. In case of cause, we also store your personal data beyond the above-mentioned periods, as long as legal claims can be asserted from the relationship between you and us or until the final clarification of a specific incident or legal dispute. This longer storage is done to protect our legitimate interests in the assertion, clarification and defense of legal claims.
5. your data subject rights
You have the right to information, correction, deletion and restriction of the processing of personal data.
Insofar as the legal basis for the processing of your personal data is your consent or a contract concluded with you, you also have the right to data portability.
You have the right to revoke any consent you may have given for the processing of your personal data. The lawfulness of the processing of the personal data until the revocation is not affected by the revocation.
You have the right to object to the processing of your personal data for the purpose of direct marketing. In the event of an objection, your personal data will no longer be processed for the purpose of direct marketing.
If you have any questions about the processing of your personal data or wish to exercise your data subject rights, please contact us at office@berghotelmalta.at or our data protection officer at datenschutz@verbund.com. In order for us to process your request and to ensure that personal data is not disclosed to unauthorized third parties, please submit the request clearly identifying yourself and briefly describing the scope of the exercise of your data subject rights listed above. You also have the option of submitting a complaint to a data protection authority. The competent authority for us is the Austrian Data Protection Authority.