Sitznische mit Sofa, Sesseln und dekorativen Beistelltischen im Eingangsbereich

Our website

We use the following data when you enter into a contract with us:

Personal data that you transmit electronically on this website, such as your name, email address, postal address or other personal details, is used by us only for the purpose specified in each case, stored securely and not passed on to third parties. Our provider automatically collects and stores information on the web server, such as the browser and operating system used, the referring page, IP address and time of access. Without consulting additional data sources, this data cannot be attributed to specific individuals, and we do not analyse it further unless there is evidence of unlawful use of our website.

Surname and first name, full address, all contact details (e.g. email address, telephone number), information on the nature and content of our contractual relationship.

Other personal data that you or third parties provide to us with your consent or otherwise lawfully when initiating a contract, during the contractual relationship (e.g. for issuing a guest card) or to fulfil legal obligations: date of birth or age, marital status, gender, occupation, ID document details, bank details, authority to sign or represent, contractual commitments, notice or cancellation periods, or other information about yourself that you have disclosed to us.

The protection of your data is important to us. Even when we use a processor (Protel Hotelsoftware GmbH; Feratel – guest register pursuant to Section 19 of the Austrian Registration Regulation, MeldeV), we ensure that processing takes place within the European Union.

  • We require the personal data collected to perform the contract, for invoicing, to assert contractual claims, for customer service purposes and for advertising purposes. The data is collected, stored, processed and used for these purposes.
  • The legal bases for processing your personal data are, on the one hand, the performance of a contract, legitimate interests and the fulfilment of our legal or contractual obligations and, on the other hand, your consent (e.g. contact form, newsletter, online booking, cookies). Failure to provide the data may have various consequences.
  • We process your personal data, where necessary, for the duration of the entire business relationship (from the initiation and performance to the termination of a contract) and beyond that in accordance with the statutory retention and documentation obligations arising, among other things, from the Austrian Commercial Code (UGB) and the Austrian Federal Fiscal Code (BAO), as well as until the conclusion of any legal dispute and the expiry of ongoing warranty and guarantee periods.

This website uses Google Tag Manager. Google Tag Manager is a solution that allows marketers to manage website tags via a single interface. The Tag Manager tool itself (which implements the tags) is a cookieless domain and does not collect any personal data. The tool triggers other tags, which may in turn collect data. Google Tag Manager does not access this data. If deactivation has been carried out at domain or cookie level, it remains in effect for all tracking tags implemented with Google Tag Manager.

This website uses Google Analytics, a web analytics service provided by Google Inc. (“Google”). Google Analytics uses so-called “cookies”, text files that are stored on your computer and enable an analysis of your use of the website. The information generated by the cookie about your use of this website (including your IP address) is transmitted to a Google server in the USA and stored there. Google will use this information to evaluate your use of the website, to compile reports on website activity for website operators and to provide further services related to website and internet use.

Google may also transfer this information to third parties where required to do so by law or where such third parties process this data on Google’s behalf. Under no circumstances will Google associate your IP address with other data held by Google. You can prevent cookies from being installed by adjusting the settings of your browser software accordingly; however, please note that in this case you may not be able to use all functions of this website to their full extent. By using this website, you consent to the processing of data collected about you by Google in the manner and for the purposes described above.

You can also prevent Google from collecting the data generated by the cookie and relating to your use of the website (including your IP address), and from processing this data, by downloading and installing the browser plug-in available at the following link: http://tools.google.com/dlpage/gaoptout?hl=en

Please note that this website uses Google Analytics with the extension “_anonymizeIp()”, meaning that IP addresses are only processed in truncated form in order to rule out direct personal identification.

Registration data & obligation to register

Under the Austrian Registration Act (Meldegesetz), you are required to register with us, providing the data specified in Sections 5 and 10 of the Act. This includes the following data: name, date of birth, gender, nationality, country of origin, address including postcode and – for foreign guests – the type, number, date of issue and issuing authority of a travel document, as well as the dates of arrival and departure.

Due to the legal obligation imposed on us under Section 19 of the Austrian Registration Regulation (Meldegesetz-Durchführungsverordnung), we keep this data in a guest register and store it for a period of seven (7) years, unless it is processed for longer for other purposes specified in this privacy policy. We maintain the guest register electronically and forward the data to an IT processor for this purpose. The data is stored locally by this processor. No transfer to a third country takes place.

The data categories “arrival” and “departure”, linked to country of origin, are forwarded to the municipality in which our accommodation business is located, in accordance with Section 6 of the Austrian Tourism Statistics Regulation (Tourismus-Statistik-Verordnung). We are also required to transmit aggregated data on the total number of overnight stays and on the number of persons liable to pay the tourist tax to the tourism association of which we are a member, the Paznaun-Ischgl Tourism Association, and/or to the municipality. This is done on the basis of Section 9 of the Tyrolean Tourist Tax Act (Tiroler Aufenthaltsabgabegesetz).

The processing operations described above are based on Article 6(1)(c) GDPR.

In addition, we forward your postcode and year of birth (in pseudonymised or anonymised form) to our municipality and our tourism association for statistical purposes, so that the tourism association can compile and evaluate statistics on guests’ origin and age. This transfer is based on Article 6(1)(e) (performance of a task carried out in the public interest) and (f) (overriding legitimate interests) GDPR. You may object to this at any time on grounds relating to your particular situation (Article 21(1) GDPR).

Guest card

You have the option of using a guest card. The guest card entitles you to discounts and/or services from various businesses in the region (e.g. reduced admission prices). It is valid for the duration of your stay with us.

The guest card is only issued and handed out by the accommodation provider at your request. Depending on the guest card system used by the tourism association and/or the accommodation business, it is issued in the form of:

  • an electronically generated guest card,
  • a manually created guest card or
  • a copy of the registration form.

For both the electronically generated and the manually created guest card, the following personal data, taken from the registration data (see point 1 above), is processed: first name, surname, date of birth, duration of stay (arrival/departure), country of origin and postcode. If the guest card is issued in the form of the “registration form”, it contains the information specified in Section 5 in conjunction with Section 9 of the Registration Act (see “Registration data” 1.1 above).

In this case, no electronic processing takes place for guest card purposes. When the guest card is used, the following personal data is also processed: data on the usage cycle of the respective card, use of services, bookings, transaction logs, billing data, and references to the registration data and the accommodation business. This data is required, on the one hand, to verify your identity and, on the other, to determine the card’s period of validity with the respective service provider, and to enable the settlement of discounts between service providers, the tourism association and, where applicable, the accommodation businesses.

Data is processed for guest card purposes either on the basis of your consent (Article 6(1)(a) GDPR) or, where the guest card forms part of the services provided under the accommodation contract, for the performance of a contract (Article 6(1)(b) GDPR). You may withdraw your consent at any time by notifying the accommodation provider in writing at office@trofana.at.

The guest card system is operated by the local tourism association (“TVB”). Local accommodation businesses and local companies (“service providers”) are also involved. The data processed for the guest card is deleted after forty-eight (48) months.

The data processed for guest card purposes is received by the local tourism association for the purpose of settling accounts with the service providers and/or accommodation businesses. The individual service providers that grant discounted services on the basis of the guest card also receive the data insofar as you use guest card services with these businesses. To take advantage of discounts, you must present the respective guest card, on which the data is shown, to the service provider and thus disclose the data yourself.

The business then checks whether the guest card is (still) valid, usually by scanning the barcode on the card and transmitting the barcode data to our IT processor. In doing so, personal data is also transmitted to the business, in particular your identity data (to verify your identity and date of birth). If the guest card has been issued in the form of the “registration form”, the business checks its validity using the copy of the registration form.

Other processing of your data

When you visit our website, personal data is only processed to the extent necessary for the technical operation of the website, for handling your enquiries, for providing requested content and functions, or for fulfilling legal and contractual obligations.

The following sections explain in detail which data is processed, for what purposes and on what legal basis.

Our website is operated by a professional hosting provider. When our website is accessed, certain data is automatically processed and stored by the web server in so-called server log files:

  • IP address of the requesting device
  • Date and time of access
  • Name and URL of the retrieved file
  • Browser type and version
  • Operating system

This data is processed exclusively to ensure the stable operation of the website and for error analysis, and is automatically deleted after 30 days. This data is not combined with other data sources.

The legal basis for this processing is Art. 6(1)(f) GDPR based on our legitimate interest in the secure operation of our website.

Our website uses SSL or TLS encryption to ensure the security of data transmission. You can recognise an encrypted connection by the fact that "https://" and a padlock symbol are displayed in your browser's address bar.

We use cookies on our website. These are small text files that are stored in your device's browser. We distinguish between technically necessary cookies and optional cookies.

  • Technically necessary cookies are required for the operation of our website and cannot be deactivated via our cookie banner. The legal basis for their use is Art. 6(1)(f) GDPR.
  • Optional cookies, for example for analytics or marketing purposes, are only set on the basis of your consent in accordance with Art. 6(1)(a) GDPR.

To manage and document your consent, we use the Cookies Manager of the Bakehouse CMS as a consent management tool (cookie banner). The provider is Cookis GmbH, Franz-Xaver-Rennstraße 4, 6460 Imst, Austria. It records whether and to which types of data processing you have given your consent. The processing is carried out for the purpose of managing, documenting and storing the consents granted on the basis of Art. 6(1)(c) GDPR and Art. 6(1)(f) GDPR. The storage period depends on the respective session and the technically necessary settings of the cookie banner.

You can adjust your cookie settings and withdraw your consent at any time via the designated button or link. In addition, you can delete cookies in your browser at any time or prevent their storage.

Disable Cookies

For statistical evaluation of the use of our website, we use Matomo, a web analytics service. Matomo is operated on servers of Cookis GmbH, Franz-Xaver-Renn-Straße 4, 6460 Imst, Austria.

Cookies are used as part of the analysis to enable an analysis of how our website is being used. Information about the use of our website is processed in order to improve our online offering technically and in terms of content. Your IP address is anonymised before being stored.

The processing is carried out exclusively on the basis of your consent in accordance with Art. 6(1)(a) GDPR via our cookie banner in the "Statistics" category.

No third-country transfer takes place, as the processing is carried out on servers in Austria.

You can withdraw your consent at any time with effect for the future via the settings of our cookie banner.

Further information on data protection at Matomo can be found at: matomo.org/privacy-policy

For the technical provision and support of our website, we use Cookis GmbH as an external service provider. This concerns in particular hosting, maintenance, technical support and central functions in connection with the Bakehouse CMS.

A transfer of personal data to this service provider only takes place to the extent that this is necessary for the operation of the website, the handling of enquiries or the fulfilment of legal or contractual obligations.

If additional external services are used on our website, we provide information about this in the respective sections of this privacy policy.

If you submit an enquiry to us via a contact or enquiry form on our website, we process the personal data you enter for the purpose of handling your enquiry and responding to any follow-up questions.

The specific data collected depends on the respective form. As a rule, this includes in particular your name, your email address, your telephone number, the content of your message and any other information you provide in the form.

Before submitting the form, confirmation of the relevant data protection notice by means of a checkbox is required. Without this confirmation, the enquiry cannot be submitted to us.

The legal basis for the processing is Art. 6(1)(b) GDPR if your enquiry is aimed at the conclusion or performance of a contract, or Art. 6(1)(f) GDPR based on our legitimate interest in the efficient handling and documentation of enquiries.

The personal data transmitted as part of the contact or enquiry form will be stored to the extent necessary for handling your enquiry, for further communication with you and for internal documentation purposes, provided that no statutory retention obligations prevent this.

If you apply for a position via the application form on our website, we process the personal data you enter as well as the documents you upload for the purpose of carrying out the application process.

This may include, in particular, your name, your contact details, information about the position you are applying for, details of your qualifications, other data you provide in the form and any uploaded application documents.

Before submitting the form, confirmation of the relevant data protection notice by means of a checkbox is required. Without this confirmation, the application cannot be submitted to us.

The processing is carried out for the purpose of handling and conducting the application process. The legal basis for the processing is Art. 6(1)(b) GDPR.

The personal data processed as part of the application process will only be stored for as long as this is necessary for carrying out the application process and for complying with statutory retention and documentation obligations.

We use the Bakehouse Newsletter of the Bakehouse CMS on our website, a service provided by Cookis GmbH, Franz-Xaver-Rennstraße 4, 6460 Imst, Austria.

If you subscribe to our newsletter, we process the personal data you provide during registration, in particular your email address and, where applicable, other voluntary information such as your name.

Registration takes place using the double opt-in procedure. This means that after registering, you will receive an email in which you must confirm your subscription. Only then will your email address be added to our newsletter distribution list.

The newsletter is sent via the Amazon SES mail cluster provided by Bakehouse. In this context, a transfer of personal data to third countries, in particular to the USA, cannot be excluded. The transfer is carried out on the basis of appropriate safeguards pursuant to Art. 46 GDPR, in particular on the basis of standard contractual clauses.

Processing is carried out exclusively on the basis of your consent in accordance with Art. 6(1)(a) GDPR.

You can withdraw your consent at any time with effect for the future by using the unsubscribe link in the newsletter or by contacting us directly.

The data stored in connection with the newsletter will be retained until you withdraw your consent, provided that no statutory retention obligations prevent this.

We integrate map material from the Google Maps service on our website, a service provided by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland.

The integration takes place via an iFrame or a comparable technical embed solution. If you access a page with an embedded map, personal data may be processed by Google, in particular your IP address and technical usage data.

Processing is carried out exclusively on the basis of your consent in accordance with Art. 6(1)(a) GDPR via our cookie banner. You can withdraw your consent at any time with effect for the future via the settings of our cookie banner.

The storage period depends on the systems used in each case and the configurations selected there.

In the context of the use of Google Maps, personal data may also be transferred to third countries, in particular to the USA. Further information on data processing by Google can be found at: policies.google.com/privacy

We integrate digital publications from the ISSUU service on our website, such as brochures, magazines or other documents. The provider is Bending Spoons US Inc., 1521 Concord Pike, Suite 201, Wilmington, Delaware 19803, USA.

The integration is carried out in order to provide digital publications directly on our website. If you access a page with embedded ISSUU content, personal data may be processed by ISSUU, in particular your IP address and technical usage data such as browser and device information.

Processing is carried out exclusively on the basis of your consent in accordance with Art. 6(1)(a) GDPR via our cookie banner. You can withdraw your consent at any time with effect for the future via the settings of our cookie banner.

The storage period depends on the systems used in each case and the configurations selected there.

In the context of the use of ISSUU, personal data may also be transferred to third countries, in particular to the USA. Further information on data processing by ISSUU can be found at: issuu.com/legal/privacy

We integrate a social media wall on our website through which content from social networks such as Instagram, Facebook and LinkedIn is displayed. The providers are Meta Platforms Ireland Limited, 4 Grand Canal Square, Dublin 2, Ireland, for Instagram and Facebook, and LinkedIn Ireland Unlimited Company, Wilton Plaza, Wilton Place, Dublin 2, Ireland, for LinkedIn.

The integration is carried out in order to provide you with current content, posts and impressions from our social media channels directly on our website. If you access a page with an embedded social media wall, personal data may already be processed by the respective providers, in particular your IP address and technical usage data.

If you click on a post or link within the social media wall, you will be redirected directly to the respective platform. Any further processing of personal data is then carried out directly by the respective provider.

Processing is carried out exclusively on the basis of your consent in accordance with Art. 6(1)(a) GDPR via our cookie banner. You can withdraw your consent at any time with effect for the future via the settings of our cookie banner.

The storage period depends on the systems used in each case and the configurations selected there.

In the context of the use of the social media wall and when being redirected to the respective platform, personal data may also be transferred to third countries, in particular to the USA.

Further information on data processing by the respective providers can be found at:

We use locally embedded fonts on our website.

The font files are loaded from our own web server. No connection to Google servers is established for the purpose of providing the fonts in this context. No personal data is transferred to third countries in this connection.

We use the Bakehouse Voucher Shop of the Bakehouse CMS on our website, a service provided by Cookis GmbH, Franz-Xaver-Renn-Straße 4, 6460 Imst, Austria.

If you place an order via the voucher shop, we process the personal data you enter for the purpose of handling your order and performing the contract. This may include, in particular, your name, your contact details, order data and – depending on the selected payment method – such data as is required for payment processing.

The processing is carried out for the purpose of handling the order, processing the payment, sending the voucher and dealing with any follow-up questions. The legal basis for the processing is Art. 6(1)(b) GDPR. Where statutory retention obligations apply, the processing is also carried out on the basis of Art. 6(1)(c) GDPR.

After successful payment, the voucher is automatically sent by email as a PDF.

Payment processing is carried out via the respective integrated payment service provider. If additional payment services are used on our website, we provide information about them in the respective sections of this Privacy Policy.

The data processed as part of the voucher purchase is stored in accordance with statutory retention obligations and then deleted, unless there is another legal basis for storage.

If you make a payment on our website, payment processing is carried out via Stripe, a service provided by Stripe Technology Company Limited (STC), One Wilton Park, Wilton Place, Dublin 2, D02 FX04, Ireland.

If you make a payment, the payment data you enter, as well as any other data required for payment processing, is transmitted directly to Stripe and processed there. This may include, in particular, payment data, transaction data, and contact and order data.

The processing is carried out for the purpose of executing the payment transaction. The legal basis for the processing is Art. 6(1)(b) GDPR.

The data processed as part of the payment transaction is stored in accordance with statutory retention obligations, in particular tax law requirements, and then deleted unless there is another legal basis for storage.

In the context of the use of Stripe, personal data may also be transferred to third countries, in particular to the USA. Further information on data processing by Stripe can be found at: stripe.com/privacy

We use Bakehouse KUBE on our website, an extension of the Seekda booking platform with widgets from the Bakehouse CMS. The provider of Bakehouse KUBE is Cookis GmbH, Franz-Xaver-Renn-Straße 4, 6460 Imst, Austria. The underlying booking platform is provided by Seekda; the provider is Seekda Hospitality Solutions GmbH, Neubaugasse 10/15, 1070 Vienna, Austria.

If you use Bakehouse KUBE to check availability, view offers or make a booking or enquiry, the personal data you enter will be processed for the handling and execution of your booking or enquiry. This may include, in particular, your name, your contact details, stay-related data and, where applicable, payment information.

The processing is carried out for the purpose of providing and operating the booking platform as well as for handling and executing your booking or enquiry. The legal basis for the processing is Art. 6(1)(b) GDPR.

The data processed as part of the booking or enquiry process is stored in accordance with statutory retention obligations and then deleted unless there is another legal basis for storage.

Further information on the data protection notices relating to the booking platform will also be displayed directly within the booking platform. Further information on data processing by Seekda can be found at: seekda.com/privacy-policy

As a general rule, we store personal data only for as long as this is necessary to fulfil the respective purposes or as long as statutory retention obligations apply.

If no separate storage period is specified in the individual sections of this Privacy Policy, personal data will be deleted as soon as the purpose of the processing no longer applies and there is no legal basis for further storage.

Where statutory retention periods, contractual obligations or legitimate interests – for example for the assertion, exercise or defence of legal claims – prevent deletion, the data will only be deleted after these periods have expired.

Your rights

Under the applicable legal provisions, you have the following rights:

  • Right of access to the personal data we process
  • Right to rectification of inaccurate or incomplete data
  • Right to erasure of your personal data
  • Right to restriction of processing
  • Right to data portability
  • Right to object to the processing of your personal data
  • Right to withdraw consent previously given with effect for the future

If you wish to exercise any of these rights, you may contact us at any time using the contact details provided in this Privacy Policy.

Other

To protect your rights and your privacy, we are entitled to request proof of identity in case of doubt.

If you assert any of the rights mentioned in a manner that is manifestly unfounded or particularly frequent, we are entitled to charge a reasonable processing fee or to refuse to act on the request.

As part of our duty to cooperate, we are obliged to disclose data upon request in accordance with the statutory provisions (e.g. the Federal Fiscal Code (BAO), the Registration Act (Meldegesetz), the Code of Civil Procedure (ZPO) and the Code of Criminal Procedure (StPO)).

This privacy policy applies from 25 May 2018 and replaces the previous data protection provisions.

Further information and contact

If you have any questions about this privacy policy, please contact us. You can find our contact details here. You can enquire at any time whether and which of your data is stored by us. You are also welcome to send us requests for information, deletion or correction, as well as any suggestions, by email or by post.