Privacy Policy of the Wilderer Group

1. General information on data processing

This privacy policy explains which personal data are processed when you use our website. Personal data are information relating to an identified or identifiable natural person (e.g. name, address, email address, IP address, user behaviour).

We process personal data in particular on the basis of Art. 6(1) GDPR – e.g. for performance of a contract or pre-contractual measures (lit. b), due to legal obligations (lit. c), based on consent (lit. a), or to safeguard legitimate interests (lit. f), provided that the rights of the data subject do not override those interests.

2. Collection of personal data when visiting our website (server logs & hosting)

When you use our website for information purposes only – i.e. if you do not register and do not otherwise transmit information to us – we process technically necessary data that your browser transmits. This data is required in order to display our website to you in a stable and secure manner (Art. 6(1) lit. f GDPR).

This includes in particular:

Our website is operated on infrastructure of Amazon Web Services (AWS). AWS processes data on our behalf for the provision, delivery and protection of the website (processing under Art. 28 GDPR).

Server log data are processed for troubleshooting, detecting abuse and attacks and for system security, and are generally stored for 30 days and then deleted, unless longer retention is required in individual cases for security reasons.

• IP address
• date and time of the request
• time zone difference to Greenwich Mean Time (GMT)
• content of the request (specific page / URL)
• access status / HTTP status code
• amount of data transferred in each case
• website from which the request originates (referrer)
• browser, operating system and its interface
• language and version of the browser software

3. Contact via email or contact form

If you contact us by email or via a contact form, we process the data you provide (e.g. name, email address, optionally telephone number and the content of the message) in order to handle your request and answer follow-up questions.

The legal basis is regularly Art. 6(1) lit. b GDPR (pre-contractual measures or contract performance) or – in the case of general inquiries – our legitimate interest in efficient communication (Art. 6(1) lit. f GDPR).

We store data from inquiries until processing is completed, but no longer than 12 months, unless statutory retention obligations require longer storage.

For email communication, we use Microsoft 365 as a service provider (processing under Art. 28 GDPR).

4. Cookies & consent management

Our website uses cookies and similar technologies. These are small text files or technical identifiers that are stored on your device and through which certain information flows back to us or to the services used. Cookies cannot run programs or transmit viruses.

In particular, we use the following categories:

Statistics and marketing technologies (e.g. Google Analytics / Google Tag Manager) are only used after you have consented in the cookie banner (Art. 6(1) lit. a GDPR). Consent given can be withdrawn or changed at any time via the cookie settings.

You can also delete or block cookies in your browser settings. Please note that in this case not all functions of our website may be fully available.

• Technically necessary cookies: required for basic functions and security of the website.
• Statistics/marketing cookies: e.g. for reach measurement and optimisation (only with consent).

5. Booking inquiries, reservations & payments (Odoo, Avantio, Stripe)

If you request a booking or make a reservation, we process the data required for this (e.g. name, contact details, travel dates, number of guests and other booking-related information).

Processing is carried out to perform pre-contractual measures and to perform the contract (Art. 6(1) lit. b GDPR) and – where necessary – to comply with legal obligations (Art. 6(1) lit. c GDPR), e.g. in connection with invoicing and retention.

We use external systems to handle booking processes and manage reservations (e.g. Odoo as a booking/administration system and Avantio as a property management system). These providers process data on our behalf or as independent controllers – depending on the specific integration and role in the booking process.

Payments can be processed via Stripe (via Odoo integration). Payment data (e.g. card information) are generally processed directly by Stripe. We typically only receive information required for payment confirmation and processing (e.g. payment status, transaction reference).

6. Web analytics (Google Analytics 4) & tag management (Google Tag Manager)

If you have consented in the cookie banner, we use Google Analytics 4 to analyse use of our website and improve our offering. Among other things, usage data (e.g. page views, interactions, technical information) are processed. The legal basis is your consent (Art. 6(1) lit. a GDPR).

We also use Google Tag Manager to integrate and manage website tags. The tag manager itself generally does not create user profiles, but depending on configuration it can load tags that collect data (e.g. analytics).

Google may also transfer data to third countries (in particular the USA). For such transfers, appropriate safeguards pursuant to Art. 46 GDPR are used (e.g. standard contractual clauses) and/or, where applicable, certification under the EU-U.S. Data Privacy Framework may be relied upon.

You can withdraw your consent at any time via the cookie settings. From the moment of withdrawal, analytics/tags will no longer be loaded.

7. Maps & location services (Google Maps)

Google Maps may be embedded on our website (e.g. on the contact page) to provide convenient directions and location display. In doing so, data (e.g. IP address, technical information) may be transmitted to Google.

Depending on implementation, Google Maps is embedded only after your consent via the cookie/consent banner or via upstream activation (e.g. “Load map”). The legal basis is then Art. 6(1) lit. a GDPR.

Google may also transfer data to third countries (in particular the USA). For such transfers, appropriate safeguards pursuant to Art. 46 GDPR are used (e.g. standard contractual clauses) and/or, where applicable, certification under the EU-U.S. Data Privacy Framework may be relied upon.

8. Images and videos (Cloudinary)

Images and videos on this website are delivered via the Cloudinary service (Cloudinary Ltd., Israel/USA). When you access a page, your browser transmits technically necessary data (including IP address, browser type, time of access) to Cloudinary for this purpose.

The legal basis is our legitimate interest in fast, reliable display (Art. 6(1) lit. f GDPR). For transfers to third countries, appropriate safeguards pursuant to Art. 46 GDPR apply (standard contractual clauses); for Israel, there is an adequacy decision of the European Commission.

9. WhatsApp

On the contact page you will find a link to WhatsApp (WhatsApp Ireland Ltd.). Only when you click it do you leave our website; processing within WhatsApp is governed by the WhatsApp privacy policy.

If you write to us via WhatsApp, we process your message in order to respond to your enquiry (Art. 6(1) lit. b or f GDPR).

10. Children

Our services are generally intended for adults. Persons under 18 should not submit personal data to us without the consent of a parent or guardian.

11. Your rights as a data subject

You have extensive rights with regard to the processing of your personal data. A summary of the most important rights under the GDPR can be found below.

Withdrawal of consent

You can withdraw consent you have given at any time with effect for the future, without affecting the lawfulness of processing carried out up to that point.

Access & confirmation

You have the right to know whether we process data relating to you and which data these are in detail (Art. 15 GDPR).

Rectification & completion

If data is incorrect or incomplete, you can request its rectification or completion (Art. 16 GDPR).

Erasure (“right to be forgotten”)

Under the conditions of Art. 17 GDPR, you can request the erasure of your personal data, e.g. if it is no longer necessary for the purposes of processing.

Restriction of processing

In certain cases, you can request that the processing of your data be restricted (Art. 18 GDPR), for example while your objections are being examined.

Data portability

You have the right to receive the data you have provided in a structured, commonly used and machine-readable format or – where technically feasible – to have it transmitted directly to another controller (Art. 20 GDPR).

Right to object

If we process data on the basis of Art. 6(1) lit. e or f GDPR, you can object at any time on grounds relating to your particular situation. This applies in particular to direct marketing (Art. 21 GDPR).

Right to lodge a complaint with a supervisory authority

You also have the right to lodge a complaint with a competent data protection supervisory authority regarding the processing of your data (Art. 77 GDPR).

12. Data security

We implement technical and organisational security measures to protect your data against manipulation, loss, unauthorised access or other misuse. This includes in particular encrypted transmission of content where technically provided (e.g. via TLS/SSL).

Our security measures are regularly reviewed and continuously improved in line with technological developments.

13. Keeping this privacy policy up to date

We update this privacy policy as soon as changes to the data processing we carry out or to legal requirements make this necessary. The version currently published on this website applies in each case.