A privacy policy without the small print

1. Data controller

2. Principles of data processing

We always process personal data in line with the GDPR: only as much data as necessary (data minimisation), for a defined purpose, stored for as short a time as possible and protected by appropriate technical and organisational measures. The legal bases are in particular Art. 6 Abs. 1 lit. a, b, c or f GDPR.

3. Server log files

When the website is opened, access data is stored automatically in server log files (shortened IP address, date and time, page requested, HTTP status, browser and operating system, referrer). The legal basis is Art. 6 Abs. 1 lit. f GDPR (stable, secure operation). Deletion after 30 days at the latest.

4. Hosting with Vercel

This website is hosted with Vercel (Vercel Inc., 340 S Lemon Ave #4133, Walnut, CA 91789, USA). A data processing agreement is in place (Art. 28 GDPR). Transfers to the USA are covered by the EU-US Data Privacy Framework and additionally by standard contractual clauses (Art. 46 Abs. 2 lit. c GDPR).

5. Cookies and consent management

We use cookies in three categories: Necessary (Art. 6 Abs. 1 lit. f GDPR), Analytics and Marketing (the latter two only with consent, Art. 6 Abs. 1 lit. a GDPR). On your first visit you decide in the cookie banner what you allow. We store your choice for up to 180 days and you can change it at any time via “Cookie settings” in the footer. Without consent no analytics or marketing cookies are loaded (Google Consent Mode v2, default “denied”).

8. Contact form & email contact

When you contact us, we process the details you provide (name, email, phone if given, message) solely in order to answer your enquiry (Art. 6 Abs. 1 lit. b or f GDPR). For delivery we use Resend, Inc. (San Francisco, USA) as a data processor (Art. 28 GDPR, transfer to a third country based on standard contractual clauses).

9. Spam protection with Cloudflare Turnstile

To protect our forms against bots we use Cloudflare Turnstile (Cloudflare, Inc., San Francisco, USA). Technical data is processed in the process (including IP address, browser and interaction patterns). The legal basis is Art. 6 Abs. 1 lit. f GDPR. Turnstile does not set any tracking cookies that require consent.

Google Maps

Map content from Google Maps (Google Ireland Limited) is only loaded once you have given your consent (Art. 6 Abs. 1 lit. a GDPR). Your IP address may be transmitted to Google in the process.

Social media profiles

In the footer we link to our profiles on Instagram and Facebook. These are plain links: only when you click an icon are you forwarded to the platform in question, and the provider can then process data (including your IP address). If you are logged in there, your visit can be linked to your profile. No content or tracking pixels from these networks are loaded on this website. The legal basis is our legitimate interest in an up to date public presence (Art. 6 Abs. 1 lit. f GDPR). The providers themselves are responsible for the data processing on their own platforms. You will find the details in their privacy policies.

Recipients and data processors

We only pass data on to carefully selected service providers with a data processing agreement in place (Art. 28 GDPR):

• Vercel Inc., website hosting (USA)
• Resend, Inc., delivery of the form emails (USA)
• Cloudflare, Inc., Turnstile spam protection (USA)

Data transfers to third countries

Some of the services we use process data in the USA. Where there is no adequacy decision, we base the transfer on the EU-US Data Privacy Framework or on standard contractual clauses (Art. 46 Abs. 2 lit. c GDPR).

Your rights

You have the right at any time to:

• Access (Art. 15 GDPR)
• Rectification (Art. 16 GDPR)
• Erasure (Art. 17 GDPR)
• Restriction of processing (Art. 18 GDPR)
• Data portability (Art. 20 GDPR)
• Objection (Art. 21 GDPR)
• Withdrawal of consent already given (Art. 7 Abs. 3 GDPR)

An informal message is enough, simply write to info@dorfgasthaus-zur-linde.com. You also have the right to lodge a complaint with a supervisory authority (Art. 77 GDPR), for example Garante per la protezione dei dati personali (www.garanteprivacy.it).

Data security

We use SSL/TLS encryption and take appropriate technical and organisational measures to protect your data.

Changes to this privacy policy

We adapt this policy when legal requirements or technologies change. You will always find the current version on this page.