Privacy policy
privacy-policy
Status: 19.07.2024
1. General information
The protection of your personal data is of particular concern to us. We process your personal data personal data exclusively on the basis of the statutory provisions (GDPR, DSG, TKG 2003).
For the provision of our website, for the processing of the sale of our goods and the provision of our services, we process information about you, so-called personal data - or ‘data’ for short in the following. The term ‘processing’ refers to any handling of data, such as the collection, storage, use and deletion of personal data. use and deletion of personal data.
We are happy to inform you about the processing of your personal data within the scope of the data protection your personal data and the claims and rights to which you are entitled under data protection and rights to which you are entitled under data protection regulations.
Responsible for the processing of your personal data is
LTR Thermenresort Loipersdorf GmbH
Thermenstraße 152, 8282 Bad Loipersdorf
Tel-Nr.: +43 3382 8204
E-Mail: [email protected]
If you have any complaints, questions or suggestions on the subject of data protection, please do not hesitate to contact us at any time using the contact details provided.
2 Data processing in the context of our website and our web shop
2.1 General information
In the context of our website and web shops, we process data that you disclose to us (e.g. in the context of orders), logs (our servers log who makes requests for security reasons) and cookies (these are small text files that are stored on your device and contain information to recognise you).
The web server for the operation of our website is technically supported by the Google Cloud platform and Contentful GmbH as the processor.
The information generated is usually transferred to a Google server in the USA and stored there. The appropriate level of protection for the transfer results from standard contractual clauses in accordance with Art 46 GDPR. Further information on the standard contractual clauses and suitable or appropriate safeguards can be found at https://privacy.google.com/businesses/processorterms/. Google acts as a processor for us and may only use the transmitted data to process the specific orders and is contractually obliged to comply with the statutory data protection regulations.
To prevent cookies from being set by third-party providers, you can deactivate so-called third-party cookies. in your browser. Here you will find instructions for the most common browsers:
Safari: In Apple's Safari, third-party cookies are blocked by default.
2.2 Data processing for the operation and security of our website and our webshop (server logs)
2.2.1 Server logs
Purpose of the processing: When you visit our website, the web server collects usage data (so-called server logs). The collection of this data is necessary in order to connection to our server and to technically enable the use of the website. use of the website. This data is also used to defend against and analyse attacks.
The following server logs are collected: The IP address of the requesting device, together with the date, time, request, which file is requested (name and URL), which data (name and URL), the amount of data transferred to you, a message as to whether the request was request was successful, identification data of the browser and operating system operating system used, as well as the website from which the access was made (if the access was made via a link).
Legal basis for processing: Your data is processed on the basis of our legitimate interest in ensuring the operation of the service and system security.
Recipient of the data: The web server for the operation of our website is technically operated by the IT service centre of the Google Cloud Platform and Contentful GmbH as the processor. The data from the server logs are - the event of a hacker attack - to the law enforcement authorities passed on. No other data is passed on to third parties.
Further information: The server logs are used for stored for a maximum of 30 days.
2.3 Data processing for marketing purposes:
2.3.1 Web analysis
We use the following tool to process data about your use of our website and our web shop in order to customise it to your interests in the best possible way.
GOOGLE ANALYTICS
A web analytics service provided by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland (‘Google’)
Purpose of the processing: Google Analytics stores cookies in order to recognise you and subsequently create personalised user statistics about your website activities. In addition, we have activated Google's ‘anonymise IP’ module. For this purpose the IP address assigned to you within the European Union is anonymised by anonymised by Google. The cookies stored on your device by Google Analytics result from the data protection settings of the cookie banner of Usercentrics GmbH, Sendlinger Straße 7, 80331 Munich Germany.
Legal basis for processing: Your data is processed on the basis of your consent. If you consent to the processing of your data on our cookie banner, you agree that we may process your data to the extent described here.
Recipient of the data: The information generated by the cookie about your use of the website will generally be transmitted to and stored by Google on servers in the United States. The appropriate level of protection for the transfer is based on standard contractual clauses pursuant to Art 46 GDPR. Further information on the standard contractual clauses and suitable or appropriate safeguards can be found at at https://privacy.google.com/businesses/processorterms/. Google acts as a processor for us and may only use the transmitted data to process the specific orders and is contractually obliged to comply with the statutory data protection regulations.
Further information: You may refuse the use of cookies by selecting the appropriate settings on your browser, however please note that if you do this you may not be able to use the full functionality of this website. You can also prevent Google from collecting the data generated by the cookie and relating to your use of the websites (including your anonymised IP address) and from processing this data by Google by downloading and installing the browser plug-in available at the following link (http://tools.google.com/dlpage/gaoptout?hl=de).
WEBANALYSIS
Web analysis tool and voucher shop from INCERT eTourismus GmbH & Co KG:
Purpose of processing: We use a web analysis tool from INCERT eTourismus GmbH & Co KG on our website. The data is processed for the creation of statistical evaluations and for the technical optimisation of the website. The web analysis enables us to determine how many users visit our website, which pages and categories are popular and which content is less interesting. The data required for the analysis is determined by so-called counting pixels (these are small image files that are integrated on our website and enable an analysis of your user behaviour) or by a server log file.
The following user data is collected by our web analysis:
Referrer (previously visited website)
Requested website or file
Browser type and browser version
Operating system used
Type of device used
Time of access
IP address
App updates
Click path
Date and time of visit
downloads
Flash version
Location information
JavaScript support
Pages visited
Purchase activity
Widget interactions
To ensure that no conclusions can be drawn about individual users of our website, the IP address is anonymised immediately. This means that no personal data is processed.
Recipient of the data: The data collected is analysed exclusively by us; the data is not transmitted to third parties. Further information: Your data will be stored for a maximum of 7 years.
Web analysis tool Microsoft Clarity:
This is a web analysis service. It is used to collect data on user behaviour.
Recipient of the data: Recipient of the data: The data collected is analysed exclusively by us; the data is not transmitted to third parties.
Further information on Microsoft Clarity and the exact scope and purpose of data processing can be found in Microsoft Clarity's privacy policy at https://learn.microsoft.com/en-us/clarity/faq#privacy. Responsible for data processing is Microsoft Ireland Operations Limited, One Microsoft Place, South County Business Park, Leopardstown, Dublin 18 D18 P521, Ireland
2.3.2 Re-marketing
We also use the re-marketing function of Google Ads and Google DoubleClick, an online marketing service of Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland (‘Google’), on our website.
Purpose of processing: To place adverts tailored to you on our website and to evaluate your interaction with these adverts. The use of this tool also enables us to present interest-based adverts. Legal basis for processing: Your data is processed on the basis of your consent.
Recipient of the data: The information generated by the cookie about your use of the website is usually transferred to a Google server in the USA and stored there. The appropriate level of protection for the transfer results from standard contractual clauses in accordance with Art 46 GDPR. Further information on the standard contractual clauses and suitable https://privacy.google.com/businesses/processorterms/. Google acts as a processor for us and may only use the transmitted data to process the specific orders and is contractually obliged to comply with the statutory data protection regulations
2.4 Data processing in the context of our social media activities:
We use so-called ‘social media plugins’. These enable us to display interaction elements or content (e.g. text posts, graphics, images and videos) from social media services. Data, including personal data, can be transmitted to the social media service providers via these plugins and may be used by them.
When you visit our website, a direct connection is only established between your browser and the server of the social media service provider via the social media plugins if you have consented to the transmission of the data.
We currently use social media plugins from the following services
We use plugins from the Facebook service on our website. The plugins can display interaction elements or content (e.g. videos, graphics or text contributions) and can be recognised by one of the Facebook logos (white ‘f’ on a blue tile, the terms ‘Like’, ‘Gefällt mir’ or a ‘thumbs up’ sign). The plugins allow you to ‘like’ a post on our website or share it on Facebook. A transmission of data to The plugins allow you to ‘like’ a post on our website or share it on Facebook. Data is only transmitted to Facebook if you have consented to its use.
The cookies stored by Facebook on your device can be found in the data protection settings of the cookie banner of Usercentrics GmbH, Sendlinger Straße 7, 80331 Munich Germany.
Further information about Facebook and the exact scope and purpose of data processing can be found in Facebook's privacy policy at https://www.facebook.com/privacy/explanation. Facebook Ireland Ltd, 4 Grand Canal Square, Grand Canal Harbour, Dublin 2 Ireland is responsible for data processing.
YOUTUBE
We use plugins from the YouTube service on our website. The plugins can interaction elements or content (e.g. videos, graphics or text contributions). Data can be sent to YouTube via these plugins and may be used by YouTube. Data is only transmitted to YouTube if you have consented to its use.
The cookies stored by Google on your device result from the data protection settings of the cookie banner of Usercentrics GmbH, Sendlinger Straße 7, 80331 Munich Germany
Further information about YouTube and the exact scope and purpose of data processing can be found in Google's privacy policy at https://policies.google.com/privacy. Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland is responsible for data processing.
2.5 Other third-party providers
We also use the following third-party providers to improve our website:
GOOGLE MAPS
By integrating Google Maps, we can display Google's map service directly on our website and thus enable you to use the map function. By integrating Google Maps, data can be sent to Google and possibly used by Google. When you visit our website, data is not automatically transmitted to Google.
When integrating Google Maps into our website, we use the so-called ‘two-click solution’. When you visit our website, data is therefore not automatically transmitted to Google. Only when you click on the corresponding button on the Google Maps map will data be transmitted to Google.
The appropriate level of protection for the transmission results from standard contractual clauses in accordance with Art 46 GDPR. Further information on the standard contractual clauses and suitable or appropriate guarantees can be found at https://privacy.google.com/businesses/processorterms/. Google acts as a processor for us and may only use the transmitted data to process the specific orders and is contractually obliged to comply with the statutory data protection regulations.
CLOUDFLARE
This is a service that increases the security and performance of websites. By integrating Cloudflare, data can be sent to a server in the USA. The appropriate level of protection for the transfer results from standard contractual clauses in accordance with Art 46 GDPR. Further information on the standard contractual clauses and suitable or appropriate safeguards can be found at https://www.cloudflare.com/de-de/privacypolicy/?utm_referrer=https://www.google.com/. Cloudflare acts as a processor for us and may only use the transmitted data to process the specific orders and is contractually obliged to us to comply with the statutory data protection regulations data protection regulations.
HEYFLOW
By integrating Heyflow, we can display interactive web forms (also known as ‘flows’) and other Heyflow features on our website and in our web shop. display. Further information about Heyflow and the exact scope and purpose of data processing can be found here: Heyflow. Heyflow GmbH, Jungfernstieg 49, 20354 Hamburg, Germany, is responsible for data processing.
Enquiries about massage and cosmetic bookings are forwarded to our Wellness partner Merkur Lifestyle GmbH for further contact and appointment arrangements. Enquiries about the day package ‘Romantic Day Spa’ and ‘Breakfast and Spa’ will be forwarded to GSL Thermenhotel Loipersdorf Betriebs GmbH for further contact and appointment arrangements.
IMGIX
This service is used to optimise images in real time. Further information about Imgix and the exact scope and purpose of data processing can be found here: IMGIX. Responsible for data processing is Zebrafish Labs Inc. 423 Tehama St, San Francisco, CA 94103, United States of America
3. Data processing for the purpose of direct marketing:
Purpose and legal basis of the processing: if we have received your contact data in connection with the sale or a service, we also process this data in order to send you (advertising) information by post and e-mail (including newsletters) about our own similar products and services on the basis of our legitimate interest.
If you no longer wish to be contacted by us, no problem. Just let us know at [email protected].
Recipients of the data: The following service providers receive your data in order to create and send the newsletter on our behalf:
MAILCHIMP
an email marketing platform of the US provider The Rocket Science Group, LLC 675 Ponce de Leon Ave NE Suite 5000 Atlanta, GA 30308 USA. This company acts as a processor for us and may only process your data for the purpose of processing the contractually obliged to comply with the statutory data protection regulations. The appropriate level of protection for the transfer of data to the USA results from standard contractual clauses in accordance with Art 46 GDPR. Further information on the standard contractual clauses and suitable or appropriate safeguards can be found at https://mailchimp.com/legal/data-processing-addendum/.
Further information: We process your data on the basis of your consent until you withdraw your consent or unsubscribe from the newsletter.
DIALOGSHIFT (DialogShift chat application on our website)
Our website uses the chat application of DialogShift GmbH, Torstr. 201, 10115 Berlin. This application processes and stores data for the purpose of web analysis, operating the chat application and responding to enquiries. To operate the chat function, the chat texts are saved and a cookie with a unique ID is set - this is used to recognise the customer. A cookie is a small text file that is stored locally in the cache on your device. is stored on your device. With the help of this cookie, the application recognises the device and can call up past chat logs. This cookie is stored for 90 days from the last stored since the last use. The storage of cookies can be deactivated in the browser settings. However, without the use of cookies, the chat function chat function cannot be executed. The possible disclosure of e.g. name, e-mail address or a telephone number is provided voluntarily and with the consent to temporarily use and store this data for the purpose of establishing contact until the end of the contact. This personal data will be deleted after 90 days. The legal basis for data processing is in accordance with Art. 6 para. 1 lit. a GDPR, § 25 para. 1 TTDSG on the basis of your consent. DialogShift offers further information on the collection and use of data as well as your rights and options for protecting your privacy at https://www.dialogshift.com/datenschutz
4 Data processing in the context of business operations:
4.1 Data processing in the context of making contact:
Purpose of processing: If you contact us (e.g. by e-mail, contact form or telephone), we will process the data you provide when contacting us only to the extent necessary to process the enquiry or its handling.
Legal basis for processing: The processing of your data takes place for the implementation of pre-contractual measures or for the fulfilment of a contractual relationship or is based on our legitimate interest, namely for the organisation of the response to your enquiry.
Recipient of the data: This data will only be transmitted on condition that the transmission is necessary for answering the enquiry.
Further information: We process your data for as long as is necessary to process the enquiry and, in the event of a follow-up enquiry, for a further seven years after the last contact with you.
4.2 Data processing in the context of orders and the customer account:
Purpose of processing: If you register on our website for our web shop (ticket shop or voucher shop), we process the data disclosed as part of your registration for the establishment of the business relationship within the framework of the contractual relationship and for the processing of the services offered by us.
Legal basis for processing: Your data is processed to carry out pre-contractual measures or to fulfil a contractual relationship.
Recipients of the data: If a transfer of your data relevant in the respective individual case for the fulfilment of the contractual relationship or on the basis of a legal basis is required, this is done to the following recipients:
INCERT eTourismus GmbH & Co KG
Further information: You can delete your user account at any time. Youcan request the deletion of your user account by e-mail at [email protected]. After requesting the deletion of your user account, your data will be deleted by INCERT eTourismus GmbH & Co KG no later than 14 days after the deletion of your user account.
TAC Informationstechnologie GmbH
4.3 General data processing in the context of a customer order:
Purpose of processing: When you place an order with us, we process your data for the purpose of processing the order, answering any questions you may have in connection with your order and for the formal handling of business cases to be dealt with by us as part of the business relationship.
Legal basis for processing: Your data is processed to fulfil a contractual relationship or is based on a legal basis in the context of a business relationship (or to process this relationship).
Recipients of the data: If a transfer of your data relevant in the respective individual case for the fulfilment of the contractual relationship or on the basis of a legal basis is necessary, this is done to the following categories of recipients:
Banks
Legal representatives
Public accountants, auditors and tax consultants
Courts
Competent administrative authorities
Debt collection companies
External financiers
Contractual and business partners
Insurance companies
Statistics Austria
Transport companies
Suppliers
Further information: We only process your data for as long as is necessary for the fulfilment of the contractual relationship or due to legal obligations (such as retention obligations under tax and company law). As a rule we store data for seven years.
4.4 Data processing for the purposes of carrying out administrative activities
Purpose of processing: We operate a customer relationship management system and process your data in order to document and improve our customer relationships with you (documentation of the content of communication between our employees and you).
Legal basis for processing: Your data is processed on the basis of our legitimate interest in optimising customer-specific communication with you.
Recipients of the data: Your data will not be transferred to third parties who pursue their own purposes.
Further information: We store your data until the end of the third year after the last contact with you.
5 Your rights
5.1 Right to information about the stored data in accordance with Art 15 GDPR
You have the right to request information about whether we process your personal data. If this is the case, you have a right of access to this personal data and to further information related to the processing.
5.2 Right to rectification of inaccurate data in accordance with Art. 16 GDPR
In the event that personal data that we process about you is (no longer) accurate or incomplete, you can request that this data be corrected and, if necessary, completed.
5.3 Right to erasure of data pursuant to Art. 17 GDPR
If the legal requirements are met, you can request the erasure of your personal data.
5.4 Right to restriction of data pursuant to Art 18 GDPR
If the legal requirements are met, you can request the restriction of the processing of the processing of the data concerning you.
5.5 Right to data portability pursuant to Art. 20 GDPR
If the legal requirements are met, you can request the transfer of your data in a structured, commonly used and machine-readable format.
5.6 Right to object to unreasonable data processing in accordance with Art 21 GDPR
For reasons arising from your particular situation, you can object at any time to the processing of data concerning you that we process on the basis of a legitimate interest in accordance with Art. 6 para. 1 lit. f GDPR.
5.7 Right to withdraw consent
If the processing is based on a declaration of consent, you have the option of withdrawing this consent at any time without affecting the lawfulness of processing based on consent before its withdrawal. processing carried out on the basis of the consent until revocation is affected.
5.8 Right to lodge a complaint with the data protection authority
If you are of the opinion that the processing of your personal data by us violates the applicable data protection law or your data protection claims have been violated in any other way, you have the option of lodging a complaint with the data protection authority (Austrian Data Protection Authority) to lodge a complaint. The address is:
Österreichische Datenschutzbehörde
Barichgasse 40-42, 1030 Wien
Telefon: +43 1 52 152-0
E-Mail: [email protected]
6. Further information:
We require the data that we ask you to provide in order to process the sale of our goods and the provision of our services within the scope of the contractual relationship or for the provision of information that you have requested from us or when sending our newsletter and other information.
If you do not provide the data, we will not be able to provide our services. provide our services.
Automated decision-making, including profiling, does not take place. If we process your personal data for a purpose other than that for which we have collected this data, we will inform you of this fact and inform you of this other purpose.