1. Data controller
Thomas Kindler – Ertlschweigerhaus
Furrach 4 · 8953 Irdning-Donnersbachtal · Austria
Email: info@ertlschweigerhaus.at
Phone: +43 3683 2312
2. Hosting and server logs
When you visit, the hosting provider processes technically necessary data, particularly your IP address, date and time, requested URL, referrer, browser and operating system information, HTTP status and transferred data volume. This supports secure operation, error analysis and protection against misuse. The legal basis is Article 6(1)(f) GDPR; our legitimate interest is secure operation.
Hosting provider: ALL-INKL.COM – Neue Medien Münnich, proprietor René Münnich, Hauptstraße 68, 02742 Friedersdorf, Germany.
Logs are retained only as long as required for operation, error analysis and security. The specific retention period depends on the hosting configuration; data is then deleted or anonymised.
Hosting provider privacy information
3. Contact and enquiry form
We process your name, email address, optional phone number, travel dates, accommodation preference, number of guests and message to answer your enquiry and prepare an offer. The enquiry is stored in the protected CMS database; the operator may receive an email notification. An enquiry is not yet a booking.
The legal basis is Article 6(1)(b) GDPR for pre-contractual steps and Article 6(1)(f) GDPR for other communication. Acknowledging the privacy notice in the form is not consent to advertising.
Enquiries are deleted once processing is complete and no statutory retention or documentation obligations apply. The operator is responsible for regular deletion.
Form protection: a necessary PHP session stores CSRF tokens and the form start time. Pseudonymised rate-limit keys protect against misuse and are deleted during maintenance after no more than two days. No plain-text IP address is stored for this purpose in the CMS database.
4. Internal page-view statistics
To improve our website, we count visible page views only after 1.2 seconds. We record the path, time and a daily HMAC derived from the IP address and browser identifier. The IP address is not stored in plain text in these statistics. There are no tracking cookies, no fingerprinting using additional characteristics and no sharing with analytics providers. A maximum of one view per daily identifier and path is counted within 30 minutes; logged-in CMS users, recognised bots, preloads and error pages are excluded.
Daily identifiers change each day (UTC). Visitor identifiers are removed after 30 days; security and deduplication keys after two days. Cleanup runs during the next statistics maintenance cycle. Aggregated counts may be kept for longer. Legal basis: Article 6(1)(f) GDPR, our legitimate interest in restrained audience measurement. You may object on grounds relating to your particular situation; please contact us.
5. Cookies and local storage
Our choice management uses localStorage under ertl_privacy_v2_[Installationskennung]. We store your separate permissions for Book-in and Elfsight reviews, the notice version and a timestamp. Your choice remains valid for up to 180 days. We ask again when it expires or the notice version changes. This necessary storage remembers your privacy choice; it is not used for advertising or tracking across websites.
The necessary session cookie PHPSESSID is set for the enquiry form and CMS login. It applies to the installation path, is HttpOnly, SameSite=Lax and Secure when HTTPS is used; the browser session determines the cookie lifetime. CMS sessions expire after 30 minutes of inactivity. Legal basis: Article 6(1)(f) GDPR and, for the form, also point (b); technically necessary device storage under Section 165(3) of the Austrian Telecommunications Act 2021.
We obtain your consent before optional Book-in and Elfsight embeds under Article 6(1)(a) GDPR and Section 165(3) of the Austrian Telecommunications Act 2021. Without the respective permission, no connection is made to the booking or review service.
6. Online booking with Book-in
Book-in is loaded as an embedded booking interface only on the relevant booking pages and after your permission. Provider: book-in Hotelsoftware, Wilfried Reiter, Bahnhofstraße 429/3, 8970 Schladming, Austria. Provider privacy policy · Provider information. Domain: ibeserver02.book-in.eu; apartments: property code 123R4, camping: 12H8L. The service receives technically necessary connection data such as your IP address, browser information and the booking page visited. During booking, it processes the travel, contact, booking and, where applicable, payment information you enter.
After your requested permission, booking data is processed to prepare and perform a contract under Article 6(1)(b) GDPR. Book-in may use necessary cookies or other storage for its booking function. Their exact names, retention periods, contractual parties and any recipients are set out in the current booking information; further details about provider storage and the booking process are given there.
The embedded provider scripts may set the session cookies ertl_bookin_[Installationskennung]_appartements and ertl_bookin_[Installationskennung]_camping . They contain a booking session identifier, apply to path / and expire at the end of the browser session; the currently embedded script version sets SameSite=Strict. They are needed only after permission and are readable by JavaScript. Permission to load the service and processing of booking data serve the purposes described above. You can withdraw permission at any time in the cookie settings. Withdrawing removes embedded booking windows and ends ongoing connections. Both booking session cookies on our domain are deleted when permission is withdrawn. Our website cannot remove booking data already transferred or storage on other provider domains; you can additionally delete browser storage in your browser settings. Earlier processing remains lawful. You can also book by phone or email.
7. Guest reviews with Elfsight
With your separate consent, we offer an Elfsight All-in-One Reviews widget on the homepage. According to its information, the provider is Elfsight, SL, C. de la Constitució 17, AD700 Escaldes-Engordany, Andorra. Widget ID: b8edf81d-d212-413a-b0f0-da83c0722f8c. Loading it transfers connection data, particularly your IP address, browser and operating system, to Elfsight and the service providers required for the widget. Review images may be loaded from the respective review platforms.
Elfsight states that technical connection data is retained for seven days. The cookie described by the provider, elfsight_viewed_recently combines repeated widget views within 15 seconds. According to the provider documentation, it applies to core.service.elfsight.com, path /, 15 seconds, HttpOnly, Secure and SameSite=None. Depending on the widget configuration, additional provider storage and external font requests may be used. Elfsight privacy policy · Elfsight cookie information.
Legal basis for the optional embed and storage on your device: Article 6(1)(a) GDPR and Section 165(3) of the Austrian Telecommunications Act 2021. You can withdraw permission at any time in the cookie settings. The embedded window is then removed and further widget requests stop. Our website cannot delete data already transferred or storage on other domains. International transfers follow the provider’s and its service providers’ information and safeguards. Earlier processing remains lawful.
8. German and English versions
The German and English versions of this website are served locally by our web server. Changing language with DE / EN makes no connection to an external translation service. No additional cookie or language preference is stored in your browser for this purpose.
The English version is provided for information. If legal or booking details are unclear, please contact us and refer to the German original.
9. Local images, videos and fonts
Our own images, fonts and atmospheric videos are served locally by the web server. Elfsight reviews, which require separate permission, may load additional external media. Visiting makes no connection to Higgsfield or font providers. On mobile devices, with data-saving mode or reduced motion, the slideshow uses still images. Google Analytics, Meta Pixel, external maps and embedded social media feeds are not installed. Language switching is local and uses no external translation service.
10. Recipients and transfers
Data is received only by parties that need it for the stated purpose, particularly hosting and technical service providers and, after separate permission, the booking and review services. Data processing agreements are in place where required. External links connect to the respective provider only when clicked. Further international transfers depend on the recipients identified during booking.
11. Retention periods
Data is deleted when its purpose ends and no statutory retention, documentation or legal claim periods require continued storage. Backups are protected and deleted according to the operational backup plan. The operator implements retention periods in the CMS and with the hosting provider.
12. Your rights
Subject to the statutory conditions, you have rights of access, rectification, erasure, restriction, data portability and objection. You can withdraw consent at any time for the future. Please contact the email address above.
13. Right to complain
You may complain to a data protection supervisory authority. In Austria, this is in particular the Austrian Data Protection Authority. Current contact details are available on its website.
14. Security and updates
The live website uses HTTPS. Protected data areas, secure sessions and access controls help protect your data. This policy is updated when functions or service providers change.
Updated: 8 October 2026
