Privacy policy

privacy-policy

Last updated: 4 May 2026

1. General Information

Protecting your personal data is especially important to us. We process your personal data exclusively in accordance with the applicable legal provisions (GDPR, Austrian Data Protection Act, Austrian Telecommunications Act 2003).

To provide our website, process the sale of our goods and deliver our services, we process information about you, known as personal data—or simply “data” below. The term “processing” refers to any handling of data, including the collection, storage, use and deletion of personal data.

In our Privacy Policy, we are pleased to provide you with information about how we process your personal data, as well as the rights and claims available to you under data protection law.

The party responsible for processing your personal data is:

If you have any concerns, questions or suggestions regarding data protection, please feel free to contact us at any time using the contact details provided.

2. Data Processing in Connection with Our Website and Online Shop

2.1. General Information

As part of our website and online shop, we process data that you provide to us (for example, when placing an order), logs (for security reasons, our servers record who submits requests), and cookies (small text files stored on your device that contain information enabling us to recognize you).

The web server hosting our website is technically operated by Google Cloud Platform and Vercel Inc. as well as Sanity.io as data processors.

The information generated is generally transferred to and stored on Google/Vercel/Sanity servers in the USA/Europe. An adequate level of protection is ensured by standard contractual clauses pursuant to Art. 46 GDPR.

Google, Vercel and Sanity act as data processors on our behalf and may use the data solely to provide the contracted services.

To prevent third-party cookies from being set, you can block them in your browser. Below, you’ll find instructions for the most commonly used browsers:

  • Firefox
  • Chrome
  • Edge
  • Safari: Third-party cookies are blocked by default in Apple’s Safari browser.

2.2. Data Processing for the Operation and Security of Our Website and Online Shop (Server Logs)

2.2.1. Server Logs

Purpose of processing:
When you visit our website, the web server collects usage data (known as server logs). Collecting this data is necessary to technically enable the
connection to our server and the use of the website. This data is also used to prevent and analyse attacks.

The following server logs are collected: The IP address of the requesting device, together with the date, time, request, the file requested (name and URL), the amount of data transferred to you, a notification indicating whether the request was successful, identification data for the browser and operating system used, and the website from which the request originated (if accessed via a link).

Legal basis for processing: Your data is processed on the basis of our legitimate interest in ensuring the operation of the service and the security of our systems.

Recipients of the data: The web server used to operate our website is technically managed by Google Cloud Platform (frontend), Vercel Inc. (backend) and Sanity.io as data processors. In the event of a cyberattack, data from the server logs will be shared with law enforcement authorities. No further disclosure to third parties will take place.

Further information: Server logs are stored for a maximum of 30 days.

2.3. Data Processing for Marketing Purposes:

2.3.1. Web Analytics

We use the tool listed below to process data about how you use our website and online shop, enabling us to tailor them to your interests as effectively as possible.

GOOGLE ANALYTICS

A web analytics service provided by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland (“Google”)

Purpose of processing:
Google Analytics stores cookies to recognize you and subsequently compile personalized usage statistics based on your activities on the website. We have also enabled Google’s “anonymize IP” module. This means that Google anonymizes the IP address assigned to you within the European Union.
The cookies stored on your device by Google Analytics are determined by the privacy settings in the cookie banner provided by Usercentrics GmbH, Sendlinger Straße 7, 80331 Munich, Germany.

Legal basis for processing: Your data is processed on the basis of your consent. By consenting to the processing of your data via our cookie banner, you agree that we may process your data to the extent described here.

Recipients of the data: The information generated by the cookie about your use of the website is generally transferred to and stored on a Google server in the USA. An adequate level of protection for this transfer is ensured by standard contractual clauses pursuant to Article 46 of the GDPR. Further information on standard contractual clauses and suitable or appropriate safeguards is available at https://privacy.google.com/businesses/processorterms/. Google acts as a data processor on our behalf and may use the transferred data solely to fulfil the specific instructions given. Google is contractually obliged to comply with statutory data protection requirements.

Further information:
You can prevent cookies from being stored by adjusting your browser settings accordingly. However, please note that doing so may mean you are unable to use all website features to their full extent. You can also prevent Google from collecting the data generated by the cookie about your use of the websites (including your anonymised IP address) and from processing this data by downloading and installing the browser plug-in available at the following link (http://tools.google.com/dlpage/gaoptout?hl=de).

WEB ANALYTICS

Web analytics tool and voucher shop by INCERT eTourismus GmbH & Co KG:

Purpose of processing: We use a web analytics tool from INCERT eTourismus GmbH & Co KG on our website. The data is processed to generate statistical analyses and technically optimize our website. Web analytics allow us to determine how many users visit our website, which pages and categories are popular, and which content attracts less interest. The data required for the analysis is collected using tracking pixels (small image files embedded in our website that enable us to analyze your user behavior) or a server log file.

The following user data is collected through our web analytics:

  • Referrer (previously visited website)
  • Requested webpage or file
  • Browser type and browser version
  • Operating system used
  • Device type used
  • Time of access
  • IP address
  • App Updates
  • Click path
  • Date and time of your visit
  • Downloads
  • Flash Version
  • Location Information
  • JavaScript Support
  • Recently viewed pages
  • Purchase activity
  • Widget Interactions

To ensure that individual users of our website cannot be identified, the IP address is anonymised immediately. This means that no personal data is processed.

Recipients of the data: The collected data is analyzed exclusively by us and is not shared with third parties.

Further information: Your data will be stored for a maximum of 7 years.

Web analytics tool Microsoft Clarity:

This is a web analytics service provided by Microsoft Ireland Operations Limited, One Microsoft Place, South County Business Park, Leopardstown, Dublin 18 D18 P521, Ireland. It is used to collect data on user behaviour and analyse usability (e.g. heatmaps and session recordings with sensitive data masked).

Recipients of the data: The data collected is analyzed exclusively by us and is not shared with third parties.

For more information about Microsoft Clarity and the exact scope and purpose of data processing, please refer to the Microsoft Clarity privacy policy at https://learn.microsoft.com/en-us/clarity/faq#privacy. The entity responsible for data processing is Microsoft Ireland Operations Limited, One Microsoft Place, South County Business Park, Leopardstown, Dublin 18 D18 P521, Ireland

2.3.2. Remarketing

On our website, we also use the remarketing feature of Google Ads and Google DoubleClick, an online marketing service provided by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland (“Google”).

Purpose of processing: To display advertising tailored to you on our website and evaluate how you interact with these ads. This tool also enables us to show you advertisements based on your interests.

Legal basis for processing: Your data is processed based on your consent.

Recipients of the data: The information generated by the cookie about your use of the website is generally transmitted to and stored on a Google server in the USA. An adequate level of protection for this transfer is ensured by standard contractual clauses pursuant to Article 46 of the GDPR. Further information on standard contractual clauses and suitable or appropriate safeguards is available at https://privacy.google.com/businesses/processorterms/. Google acts as a data processor on our behalf and may use the transferred data solely to fulfil the specific instructions given. Google is contractually obliged to comply with statutory data protection requirements.

Other platforms: We advertise on Google Ads/YouTube, Microsoft Ads (including Edge), Meta Ads (Facebook/Instagram) and TikTok. Data is processed based on your consent and transferred to servers in the USA using SCCs. Details:

2.4. Data Processing in Connection with Our Social Media Activities:

We use what are known as “social media plugins”. These allow us to display interactive elements or content from social media services, such as text posts, graphics, images and videos. These plugins may transmit data, including personal data, to social media service providers, who may use this data where applicable.

When you visit our website, the social media plugins will only establish a direct connection between your browser and the social media service provider’s server if you have consented to the transfer of data.

We currently use social media plugins from the following services:

META (Facebook/Instagram)

The plugins may display interactive elements or content (e.g. videos, graphics or text posts). We use plugins from Meta services (recognisable by the Facebook “f” logo, the “Like” button or the Instagram icon). These plugins allow you to “Like” a post on our website or share it on Facebook. Data will only be transmitted to Meta once you have consented to their use.

The cookies stored on your device by Meta are determined by the privacy settings selected in the cookie banner provided by Usercentrics GmbH, Sendlinger Straße 7, 80331 Munich, Germany.

For more information about Meta and the exact scope and purpose of data processing, please refer to Meta’s Privacy Policy at https://www.facebook.com/privacy/explanation. The entity responsible for data processing is Meta Platforms Ireland Limited, 4 Grand Canal Square, Grand Canal Harbour, Dublin 2, Ireland

YOUTUBE

We use plugins from the YouTube service on our website. These plugins may display interactive elements or content (e.g. videos, graphics or text posts). Data may be sent to YouTube via these plugins and, where applicable, used by YouTube. Data will only be transferred to YouTube once you have consented to their use.

The Google cookies stored on your device are determined by the privacy settings selected in the cookie banner provided by Usercentrics GmbH, Sendlinger Straße 7, 80331 Munich, Germany.

For more information about YouTube and the precise scope and purpose of data processing, please refer to Google's Privacy Policy at
https://policies.google.com/privacy. The entity responsible for data processing is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland.

2.5. Other Third-Party Providers

To improve our website, we also use the following third-party providers:

GOOGLE MAPS

By integrating Google Maps, we can display Google's map service directly on our website, allowing you to use the map feature. The integration of Google Maps may result in data being sent to and used by Google. When you visit our website, no data is automatically transmitted to Google.

When embedding Google Maps on our website, we use what is known as the
“two-click solution”. This means that no data is automatically transmitted to Google when you visit our website. Data is only transmitted to Google once you click the relevant button on the Google Maps map.

The appropriate level of protection for the transfer is ensured by standard contractual clauses pursuant to Article 46 of the GDPR. Further information on the standard contractual clauses and
suitable or appropriate safeguards is available at https://privacy.google.com/businesses/processorterms/. Google acts as a data processor on our behalf and may use the transferred data solely to fulfil the specific instructions. Google is contractually obliged to comply with statutory data protection requirements.

CLOUDFLARE

This service enhances the security and performance of websites. By integrating Cloudflare, data may be sent to a server in the USA. The appropriate level of protection for this transfer is ensured by standard contractual clauses pursuant to Article 46 of the GDPR. Further information on the standard contractual clauses and suitable or appropriate safeguards is available at https://www.cloudflare.com/de-de/privacypolicy/?utm_referrer=https://www.google.com/. Cloudflare acts as a data processor on our behalf and may use the transferred data solely to fulfil the specific instructions given. Cloudflare is contractually obliged to comply with statutory data protection requirements.

HEYFLOW

By integrating Heyflow, we can display interactive web forms (also known as “flows”) and other Heyflow features on our website and in our online shop. The party responsible for data processing is Heyflow GmbH, Jungfernstieg 49, 20354 Hamburg, Germany. Further information about Heyflow and the precise scope and purpose of data processing.

Enquiries regarding massage and beauty treatment bookings will be forwarded to our wellness partner, Merkur Lifestyle GmbH, who will contact you to arrange an appointment. Enquiries regarding the “Romantic Day Spa” and “Breakfast and Spa” day packages will be forwarded to GSL Thermenhotel Loipersdorf Betriebs GmbH, who will contact you to arrange your visit.

3. Data processing for direct marketing purposes:

Purpose and legal basis of processing: If we have received your contact details in connection with a sale or service, we also process this data on the basis of our legitimate interest in sending you (promotional) information by post and email (including newsletters) about our own similar products and services.

If you no longer wish to hear from us, no problem. Simply contact us at [email protected].

Recipients of the data: The following service providers receive your data in order to create and send the newsletter
on our behalf:

MAILCHIMP

an email marketing platform operated by the US provider The Rocket Science Group, LLC, 675 Ponce de Leon Ave NE, Suite 5000, Atlanta, GA 30308, USA. This company acts as a data processor on our behalf and may use your data solely to fulfil the specific services commissioned. It is contractually obliged to comply with statutory data protection requirements. An adequate level of protection for the transfer of data to the USA is ensured by standard contractual clauses pursuant to Article 46 of the GDPR. Further information on the standard contractual clauses and suitable or appropriate safeguards is available at https://mailchimp.com/legal/data-processing-addendum/.

Further information: We process your data based on your consent until you withdraw it or unsubscribe from the newsletter.

DIALOGSHIFT (DialogShift chat application on our website)

Our website uses the chat application provided by DialogShift GmbH, Torstr. 201, 10115 Berlin. This application processes and stores data for the purposes of web analytics, operating the chat application and responding to enquiries. To operate the chat function, chat messages are stored and a cookie containing a unique ID is set to recognise returning customers. A cookie is a small text file stored locally in the cache on your device. This cookie enables the application to recognise the device and retrieve previous chat logs. The cookie is stored for 90 days from the date of its last use. You can disable the storage of cookies in your browser settings. However, the chat function cannot be used without cookies. Any disclosure of information such as your name, email address or telephone number is voluntary and constitutes consent for this data to be temporarily used and stored for the purpose of contacting you until the interaction has ended. This personal data is deleted after 90 days.
The legal basis for data processing is your consent pursuant to Art. 6(1)(a) GDPR and Section 25(1) TTDSG.
DialogShift provides further information at https://www.dialogshift.com/datenschutz about the collection and use of data, as well as your rights and options for protecting your privacy.

4. Data Processing in the Course of Business Operations:

4.1. Data processing when contacting us:

Purpose of processing: If you contact us (e.g. by email, contact form or telephone), we will process the data you provide when contacting us only to the extent necessary to respond to and handle your enquiry.

Legal basis for processing: Your data is processed in order to take steps prior to entering into a contract or to fulfil a contractual relationship, or is based on
our legitimate interest in organising the response to your enquiry.

Recipients of the data: This data will only be transferred if doing so is necessary to respond to your enquiry.

Further information: We process your data for as long as necessary to handle your enquiry and, in the event of a follow-up enquiry, for a further seven years after our last contact with you.

4.2. Data Processing in Connection with Orders and Customer Accounts:

Purpose of processing: If you register for our online shop (ticket shop or voucher shop) on our website, we process the data you provide during registration to establish our business relationship under the contractual agreement and to provide the services we offer.

Legal basis for processing: Your data is processed in order to take steps prior to entering into a contract or to fulfil a contractual relationship.

Recipients of the data: Where the transfer of data relevant to your specific case is necessary for the performance of the contractual relationship or on the basis of a legal requirement,
such data will be transferred to the following recipients:

  • INCERT eTourismus GmbH & Co KG

Further information: You can delete your user account at any time. To request the deletion of your user account, please email [email protected]. Once you have requested the deletion of your user account, INCERT eTourismus GmbH & Co KG will delete your data no later than 14 days after your user account has been deleted.

  • TAC Informationstechnologie GmbH

Further information: You can delete your user account at any time. You can request the deletion of your user account by emailing [email protected]. Once you have requested the deletion of your user account, TAC Informationstechnologie GmbH will delete your data no later than 14 days after your user account has been deleted.

4.3. General Data Processing in Connection with a Customer Order:

Purpose of processing: When you place an order with us, we process your data to fulfil your order, respond to any questions you may have regarding your order, and formally handle the business transactions we are responsible for as part of our business relationship.

Legal basis for processing: Your data is processed for the performance of a contract or on the basis of a legal obligation within the scope of a business relationship (or for the purpose of managing that relationship).

Recipients of the data: Where the transfer of data relevant to your specific case is necessary for the performance of the contractual relationship or on the basis of a legal requirement,
it will be transferred to the following categories of recipients:

  • Banks
  • Legal Representative
  • Chartered Accountant, Auditor and Tax Advisor
  • Dishes
  • Competent Administrative Authorities
  • Debt collection agency
  • External financiers
  • Contractual and Business Partners
  • Insurance
  • Statistics Austria
  • Transport companies
  • Suppliers

Further information: We process your data only for as long as necessary to fulfil our contractual relationship or comply with legal obligations (such as retention requirements under tax and corporate law). As a rule,
we retain data for seven years.

4.4. Data Processing for Administrative Purposes

Purpose of processing: We operate a customer relationship management system and process your data to document and improve our relationship with you as a customer (including documenting the content of communications between you and our employees).

Legal basis for processing: Your data is processed on the basis of our legitimate interest in optimizing personalized communication with you.

Recipients of the data: Your data will not be shared with third parties for their own purposes.

Further information: We retain your data until the end of the third year following our last contact with you.

5. Privacy Policy for Video Surveillance

Video surveillance on the premises of Thermenresort Loipersdorf

Selected areas of Therme Loipersdorf resort are monitored by video surveillance.

Personal data is processed in compliance with the applicable data protection regulations, in particular the General Data Protection Regulation (GDPR) and the Austrian Data Protection Act (DSG).

5.1. Data Controller

LTR Thermenresort Loipersdorf GmbH
Thermenstraße 152
8282 Bad Loipersdorf
Austria

Email: [email protected]

5.2. Data Protection Officer

The Data Protection Officer of Thermenresort Loipersdorf can be contacted at:

Email: [email protected]

Postal address:
Data Protection Officer
LTR Thermenresort Loipersdorf GmbH
Thermenstraße 152
8282 Bad Loipersdorf

5.3. Purposes of Processing

Video surveillance is used for the following purposes:

  • Protecting guests, employees and visitors
  • Protection of Therme Loipersdorf’s Property and Assets
  • Prevention and investigation of theft, property damage and other security-related incidents
  • Enforcement of House Rules
  • Enforcement of and defense against legal claims
  • Assistance in investigating accidents and safety-related incidents

Monitoring is carried out exclusively in those areas where it is necessary to achieve the stated purposes.

Changing rooms, sanitary facilities, showers, relaxation areas and other similarly sensitive areas are not monitored.

5.4. Legal Basis

Processing is carried out on the basis of

Art. 6(1)(f) GDPR (legitimate interest).

The legitimate interest lies in protecting individuals, property and operational facilities against misuse, theft, vandalism and other security-related incidents.

5.5. Categories of Data Processed

The following data may be processed as part of video surveillance:

  • Video recordings of individuals
  • Place of stay
  • Time of entering or leaving a monitored area
  • Procedures in the monitored area

No audio recording will be made.

5.6. Recipients of the Data

Recordings are only viewed by authorized employees of Thermenresort Loipersdorf.

Information will only be shared where necessary:

  • to security service providers
  • to an IT service provider as part of system maintenance
  • to insurance companies for claims processing
  • to legal representatives
  • on dishes
  • to public authorities and law enforcement agencies where required by law or where there are legitimate grounds to do so

5.7. Storage Period

The retention period for video recordings depends on the respective purpose of processing and is limited to what is necessary.

Provided there are no security-related incidents and no legal obligation to retain them, the recordings will be automatically deleted once the specified retention period has expired.

Where necessary, data may be retained for a longer period to preserve evidence, establish, exercise or defend legal claims, or comply with legal obligations.

Video surveillance is used in the following areas for the purposes specified:

  • Thermal spa entrance area: Security
  • Checkout area: Theft prevention
  • Car parks: Protection of people and property
  • Technical areas: Access control
  • Changing rooms: Theft prevention

Storage period: Recordings from all the areas mentioned are stored for 72 hours.

5.8. Data Subject Rights

Subject to the applicable legal requirements, data subjects have, in particular, the right to:

  • Right of access pursuant to Article 15 GDPR
  • Rectification pursuant to Art. 16 GDPR
  • Erasure pursuant to Art. 17 GDPR
  • Restriction of processing pursuant to Art. 18 GDPR
  • Right to object to processing pursuant to Art. 21 GDPR

To exercise your rights, please contact:

[email protected]

To protect the rights of others, it may be necessary to verify the identity of the person making the request.

5.9. Right to Lodge a Complaint

If you believe that the processing of your personal data violates data protection regulations, you have the right to lodge a complaint with the competent supervisory authority.

Austrian Data Protection Authority
Barichgasse 40-42
1030 Vienna

Website: https://www.dsb.gv.at

5.10. Information on Site

Appropriate signs in the monitored areas indicate that video surveillance is in use.

This Privacy Policy supplements the information provided on site in accordance with Article 13 of the GDPR.

6. Your Rights

6.1. Right of access to stored data pursuant to Article 15 GDPR

You have the right to request information as to whether we process your personal data. If so, you have the right to access this personal data and receive further information related to its processing.

6.2. Right to rectification of inaccurate data pursuant to Art. 16 GDPR

If the personal data we process about you is no longer accurate or is incomplete, you may request that it be corrected and, where applicable, completed.

6.3. Right to erasure of data pursuant to Art. 17 GDPR

If the legal requirements are met, you may request the deletion of your personal data.

6.4. Right to Restriction of Data Processing Pursuant to Art. 18 GDPR

If the legal requirements are met, you may request the restriction of the
processing of your personal data.

6.5. Right to data portability pursuant to Article 20 GDPR

Where the legal requirements are met, you may request that your data be transferred in a structured, commonly used and machine-readable format.

6.6. Right to object to unreasonable data processing pursuant to Article 21 GDPR

For reasons arising from your particular situation, you may object at any time to the processing of your personal data that we process on the basis of a legitimate interest pursuant to Article 6(1)(f) of the GDPR.

6.7. Right to Withdraw Consent

Where processing is based on your consent, you may withdraw it at any time without affecting the lawfulness of any processing carried out on the basis of your consent before its withdrawal.

6.8. Right to Lodge a Complaint with the Data Protection Authority

If you believe that our processing of your personal data violates applicable data protection law or that your data protection rights have otherwise been infringed, you may lodge a complaint with the competent supervisory authority (Austrian Data Protection Authority). The address is:

7. Further information:

We require the information we ask you to provide in order to process the sale of our products and deliver our services as part of our contractual relationship, to provide information you have requested, or to send you our newsletters and other communications.

If you do not provide the data, we will be unable to provide our services.

We do not use automated decision-making, including profiling. If we process your personal data for a purpose other than the one for which it was collected, we will notify you and inform you of this other purpose.