DE EN

+43 (0) 3333 31065

Webcam
Offers
Book

Privacy

Last updated: 29 September 2026

Scope: This privacy policy applies to the main website www.sparesortstyria.com, including the forms and online functions offered there. The separate voucher web shop is not covered by this version and requires its own privacy information.

Language version: This English version is a translation provided for convenience. In the event of any discrepancies or differences in interpretation, the German version of this privacy policy shall prevail.

The protection of your personal data is important to us. We process personal data exclusively within the framework of the applicable legal provisions, in particular the General Data Protection Regulation (GDPR), the Austrian Data Protection Act (DSG) and the Austrian Telecommunications Act 2021 (TKG 2021).

This privacy policy informs you about which personal data we process, for what purposes, on which legal basis, how long data is stored and what rights you have.

1. Controller and data protection contact

The controller within the meaning of Art. 4(7) GDPR is:

Grand Spa Wellnesshotel Betriebs GmbH
SPA RESORT STYRIA****S
Bad Waltersdorf 351
8271 Bad Waltersdorf
Austria

Phone: +43 (0) 3333 31065
Email for data protection enquiries: direktion@sparesortstyria.com

No data protection officer has been appointed pursuant to Art. 37 GDPR. Data protection enquiries are handled directly by the management.

2. Principles of data processing

We only process personal data to the extent necessary for a specified purpose. Depending on the processing, we rely in particular on the following legal bases:

  • Art. 6(1)(a) GDPR: consent, e.g. for newsletters, non-essential cookies or marketing tracking;
  • Art. 6(1)(b) GDPR: pre-contractual measures and performance of a contract, e.g. for enquiries, reservations and stays;
  • Art. 6(1)(c) GDPR: compliance with legal obligations, e.g. registration, tax and retention obligations;
  • Art. 6(1)(f) GDPR: legitimate interests, e.g. IT security, prevention of misuse and efficient communication, provided your interests or fundamental rights do not override them.

Where special categories of personal data pursuant to Art. 9 GDPR are processed, this is done only on an appropriate legal basis provided for this purpose.

3. Accessing the website, hosting and server log files

When you access our website, technically necessary information is processed. This may include in particular your IP address, date and time of access, the page or file accessed, referrer URL, browser type and version, operating system, amount of data transferred and access status.

The processing serves the secure and stable provision of the website, error analysis and the detection and prevention of abusive or unlawful access. The legal basis is Art. 6(1)(f) GDPR. Our legitimate interest lies in the secure and trouble-free operation of our website.

External IT and hosting service providers may be used for hosting, maintenance and technical provision. They process data exclusively within the scope of the contractually agreed services and, where required, on the basis of data processing agreements pursuant to Art. 28 GDPR.

Server log files are generally stored only for as long as necessary for operation, security and error analysis. In the event of specific security incidents, the relevant log data may be retained until the incident has been fully resolved.

4. Cookies and consent management with Borlabs Cookie

Our website uses cookies and similar technologies. Technically necessary cookies may be used if they are required to provide a function you have expressly requested. For technically non-essential cookies and similar technologies, your consent is obtained before they are activated.

We use Borlabs Cookie to manage your consents. A technically necessary cookie (“borlabs-cookie”) is set, which stores in particular your consent settings. According to the provider, Borlabs Cookie does not transmit any visitor data to Borlabs; consent information is stored on the website’s server or in the cookie on your device.

The legal basis for cookies and technologies requiring consent is your consent pursuant to Art. 6(1)(a) GDPR in conjunction with Section 165(3) TKG 2021. You can change or withdraw your selection at any time via the cookie settings on the website. The lawfulness of processing carried out before withdrawal remains unaffected.

An up-to-date overview of the specific cookies, services, purposes and storage periods used is available via the cookie settings on the website.

5. Google Tag Manager

Our website uses Google Tag Manager, provided by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. Google Tag Manager is used for the technical management and control of website tags and integrated services, for example for analytics and marketing purposes.

Google Tag Manager itself does not independently analyse user behaviour. According to Google, technical log and diagnostic data is processed in connection with Tag Manager. Which further personal data is processed depends on the services integrated via Tag Manager.

Where technically non-essential analytics, marketing or other services requiring consent are triggered via Google Tag Manager, they are only activated after you have given your consent via our consent management. The legal basis depends on the respective integrated service and is described in the relevant sections of this privacy policy.

6. Google Analytics

With your consent, we use Google Analytics for the statistical analysis of the use of our website. The provider in the European Economic Area is generally Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland.

In particular, information about page views, session duration, interactions, approximate location, device, browser and technical identifiers may be processed. The processing serves to measure reach, analyse website usage and improve our online offering.

The legal basis is your consent pursuant to Art. 6(1)(a) GDPR in conjunction with Section 165(3) TKG 2021. Google Analytics is only activated after approval via our consent management. Consent can be withdrawn at any time via the cookie settings.

Further information: Google Privacy Policy

7. Google Ads and conversion tracking

With your consent, we use Google Ads including conversion tracking. This allows us to measure whether users perform certain actions on our website after clicking on a Google ad, e.g. starting an enquiry or visiting a booking page.

Technical identifiers, information on ad interactions, browser and device data and data on the use of our website may be processed. The processing serves to measure the success of and optimise our advertising.

The legal basis is your consent pursuant to Art. 6(1)(a) GDPR in conjunction with Section 165(3) TKG 2021. Activation only takes place after your consent via the consent management.

8. Meta Pixel

Where activated on our website, we use the Meta Pixel with your consent for advertising and conversion measurement on Facebook and Instagram. The provider is Meta Platforms Ireland Limited, Merrion Road, Ballsbridge, Dublin D04 X2K5, Ireland.

The Meta Pixel may process information about page views, interactions, technical identifiers and browser and device data. This enables us to measure the effectiveness of ads and to create target audiences for advertising.

The legal basis is your consent pursuant to Art. 6(1)(a) GDPR in conjunction with Section 165(3) TKG 2021. The service is only activated after the corresponding selection in the consent management. You can withdraw your consent there at any time.

Further information: Meta Privacy Policy

9. Google reCAPTCHA and protection against automated access

Google reCAPTCHA may be used to protect forms against spam and automated access. In particular, IP address, browser and device data, referrer information and interactions on the website may be transmitted to and evaluated by Google.

Where consent is required, reCAPTCHA is only activated after approval via the consent management. In this case, the legal basis is Art. 6(1)(a) GDPR in conjunction with Section 165(3) TKG 2021.

Where a technically necessary protection mechanism is used without access to the device requiring consent, the processing may be based on Art. 6(1)(f) GDPR. Our legitimate interest lies in the security of our forms and the prevention of misuse.

10. Google Maps and embedded external media

Where we embed Google Maps, YouTube, Vimeo or comparable external content on our website, data may be transmitted to the respective provider when this content is loaded. This may include in particular IP address, browser and device data and information about the page visited.

Where consent is required, such external content is only loaded after your prior consent. The legal basis is Art. 6(1)(a) GDPR in conjunction with Section 165(3) TKG 2021. Without consent, the external content is not loaded; the remaining functions of the website generally remain usable.

11. Contact, enquiry, order and feedback forms

Our website provides several forms for different purposes. These include in particular the general contact form, seminar and Christmas party enquiries, day spa registration, minibar orders, Porsche dinner registration and a feedback questionnaire.

Depending on the form, we process the master and contact data you enter, details of the desired service or event, reservation or stay data and the content of your message. Which details are mandatory is indicated in the respective form.

We process general enquiries as well as seminar, Christmas party and day spa enquiries in order to handle your enquiry and to carry out pre-contractual measures or perform a contract pursuant to Art. 6(1)(b) GDPR. Where an enquiry has no specific contractual connection, the processing may be based on our legitimate interest in efficient handling and communication pursuant to Art. 6(1)(f) GDPR.

We process data from minibar orders and Porsche dinner registrations in order to carry out the order, reservation or service you have requested, on the basis of Art. 6(1)(b) GDPR.

We process information from the feedback questionnaire to evaluate feedback, ensure quality and improve our services on the basis of our legitimate interest pursuant to Art. 6(1)(f) GDPR. If you wish to be contacted about your feedback or if contact is necessary to process it, we use the contact details you provided for this purpose.

Data submitted via forms is forwarded to the responsible internal departments and, where necessary, processed by technical service providers. Data is deleted as soon as it is no longer required for handling or carrying out the respective process and there are no statutory retention obligations, ongoing contractual relationships or legitimate reasons for further storage.

12. Online booking, reservations and hotel stays

Online room booking takes place via an external booking environment to which you are redirected from our main website. When you access this booking environment, the privacy information provided there also applies.

In the context of an enquiry, reservation or stay, we process in particular master and contact data, reservation and stay data, booked services, correspondence, price and payment information and any wishes and preferences you voluntarily disclose. For bookings via external booking platforms, we may also receive this data from the respective platform operator.

For hotel and reservation management, we use in particular protel and Amadeus. Amadeus is used for booking/reservations, guest communication, CRM and newsletter functions. The service providers used process data within their respective contractual roles and, where they act as processors, on the basis of corresponding agreements pursuant to Art. 28 GDPR.

The legal basis for processing in connection with entering into and performing a contract is Art. 6(1)(b) GDPR. Where statutory retention obligations exist, further storage is based on Art. 6(1)(c) GDPR.

13. Statutory guest register

As an accommodation provider, we are obliged to record the legally required data of our guests in the guest register. The processing is carried out to comply with legal obligations on the basis of Art. 6(1)(c) GDPR in conjunction with the Austrian Registration Act (Meldegesetz).

Guest register records are retained for seven years from the date of entry pursuant to Section 10 of the Registration Act. Legally authorised authorities and bodies are granted access or provided with data to the extent provided for by law.

14. Special requests, allergies and health-related information

If you voluntarily provide us with information about allergies, intolerances, health restrictions or other special needs, this may involve the processing of health data and thus special categories of personal data within the meaning of Art. 9 GDPR.

Such information is only processed to the extent necessary for the service you have requested and where an appropriate legal basis exists. Where explicit consent is required, processing is based on Art. 9(2)(a) GDPR. Please only provide health-related information that is actually necessary for the requested service.

15. Payment and invoice data

For chargeable services, we process the data required for billing and payment. Depending on the payment method chosen, in particular credit card, debit card or cash, payment data may be transmitted to banks, card companies, acquirers or other payment service providers.

The legal basis is Art. 6(1)(b) GDPR. For tax and commercial law retention obligations, further processing is based on Art. 6(1)(c) GDPR. Invoices and accounting records are stored in accordance with the applicable statutory retention periods.

16. Newsletter and performance measurement

You can subscribe to our newsletter on our website. Registration takes place using the double opt-in procedure. After registering, you will receive a confirmation email; registration is only completed once you have confirmed it.

For the newsletter, we process the data provided in the registration form as well as technical evidence data relating to registration and confirmation. Newsletter dispatch and guest communication are supported, among other things, by Amadeus.

To measure performance, we evaluate newsletter opens and clicks. This makes it possible to see whether a newsletter was opened and which links it contains were clicked. This evaluation helps us to better tailor content and offers to the interests of recipients.

The legal basis for sending the newsletter and for personalised performance measurement is your consent pursuant to Art. 6(1)(a) GDPR. You can withdraw your consent at any time with effect for the future, in particular via the unsubscribe link in the newsletter or by email to direktion@sparesortstyria.com.

Newsletter data is generally stored until you withdraw your consent or unsubscribe. Data required to prove that consent was given or withdrawn may be retained beyond this for the duration of the relevant evidentiary and limitation periods.

17. Guest club / KunLeiSys

We use KunLeiSys for our guest club. The provider is GASTROpoint GmbH, Pommernstraße 17, 83395 Freilassing, Germany.

KunLeiSys is used in particular to manage the guest club, offers, loyalty points, occasion-based emails and other guest loyalty functions. Depending on use, master and contact data, guest club details, booking information, preferences and loyalty information may be processed.

Depending on the function, processing is based on your consent pursuant to Art. 6(1)(a) GDPR or on the performance of the guest club relationship you have requested pursuant to Art. 6(1)(b) GDPR. Consent given can be withdrawn at any time with effect for the future.

After membership ends, the data is deleted unless statutory retention obligations or other permissible reasons for further storage exist.

Further information: KunLeiSys / GASTROpoint

18. Social media presence

We operate company profiles on social networks, in particular Facebook and Instagram. When you visit our profiles or interact with us there, the respective platform operator processes personal data in accordance with its own privacy policy.

For Facebook and Instagram, the provider for users in the European Economic Area is Meta Platforms Ireland Limited. Joint controllership between us and Meta may exist in connection with certain statistics and page insights functions.

If our website merely links to a social media profile, no data is transmitted to the platform simply by visiting our website. Tracking technologies such as the Meta Pixel are only used in accordance with the consent settings described in this privacy policy.

19. Photo and video recordings at events

Photos and videos may be taken at events, functions and similar occasions at SPA RESORT STYRIA. These may be used for documentation, public relations and to provide information about our events and offers.

For general overview, group or event shots, processing may be based on our legitimate interest in documentation and public relations pursuant to Art. 6(1)(f) GDPR, provided the interests or fundamental rights of the persons depicted do not override this. We take care to give appropriate consideration to the legitimate interests of the persons concerned.

Targeted individual shots, interviews or recordings in which one person is the focus and which are intended in particular for advertising purposes are generally made on the basis of corresponding consent pursuant to Art. 6(1)(a) GDPR or a required usage release. Consent given under data protection law can be withdrawn at any time with effect for the future.

Recordings may be published in particular on our website, on our social media channels, in print media, press releases or other communication channels. In addition to our internal departments, recipients may include commissioned agencies, printers, media companies and operators of social media platforms. Printed materials that have already been published cannot technically be recalled; online publications are deleted within the limits of what is technically and legally possible.

If you do not wish to be photographed or filmed at an event, please contact the responsible staff on site or direktion@sparesortstyria.com.

20. Guest Wi-Fi

We provide our guests with an open Wi-Fi network without mandatory registration or login. The technical provision is handled by A1.

When using the Wi-Fi, the technical provider may process connection and communication data to the extent necessary to provide the service, ensure the secure operation of the network or comply with legal obligations. SPA RESORT STYRIA itself does not collect names or email addresses for registration to access the network.

Where we ourselves process technical data in connection with the Wi-Fi, this is done on the basis of Art. 6(1)(b) GDPR to provide the service or Art. 6(1)(f) GDPR to ensure IT and network security.

21. Applications and online application form

You can apply to us via the online application form on our website or by email. In addition to the requested master and contact data, application documents can be uploaded as files in the online application form.

We process in particular your name, contact details, information on your professional background and qualifications, the content of your application and the documents you submit, such as your CV, references, cover letter or other certificates. Which details are mandatory is indicated in the application form.

Processing is carried out to handle your application, to communicate during the application process and to decide on establishing an employment relationship on the basis of Art. 6(1)(b) GDPR. Application data is only made accessible to the persons and departments involved in the application process and, where technically necessary, processed by IT or hosting service providers used.

Should application documents voluntarily contain special categories of personal data pursuant to Art. 9 GDPR, these will only be processed where a legally permissible basis exists. Please only provide such information if it is necessary for your application.

Application data is deleted after the application process has been completed, as soon as it is no longer required for the process and there are no longer any statutory retention, evidentiary or defence interests. Retaining your application for future vacancies only takes place on the basis of separate consent.

22. Whistleblower platform

We provide a whistleblower platform on our website. Reports can be submitted with contact details or anonymously. For non-anonymous reports, in particular first name, last name, email address, telephone number and the content of the report may be processed. For anonymous reports, the optional personal data fields are not required.

Processing is carried out to receive, review, document and handle reports under the Austrian Whistleblower Protection Act (HinweisgeberInnenschutzgesetz, HSchG). The legal basis is in particular Art. 6(1)(c) GDPR in conjunction with the relevant provisions of the HSchG.

Personal data that is not required to handle a report is not collected or, if collected unintentionally, is deleted without delay. Pursuant to Section 8 HSchG, necessary personal data must generally be retained for five years from its last processing or transmission; longer retention may be required where official or court proceedings have already been initiated.

Access to reports is restricted to those persons entrusted with their confidential handling.

23. Competitions and marketing campaigns

If we run competitions or similar campaigns via our website, we process the personal data required for participation and execution, in particular name and contact details. For winners, additional data such as a delivery address may be required.

Processing to carry out the competition is generally based on Art. 6(1)(b) GDPR or the respective published terms of participation. The data is only used for newsletters or other direct marketing if there is a separate legal basis for this, in particular consent.

Participation data is deleted after the competition has ended, as soon as it is no longer required for execution, documentation or compliance with legal obligations.

24. Recipients and processors

We only transfer personal data where this is necessary for the respective purpose and legally permissible. Recipients or categories of recipients may include in particular:

  • IT, hosting, form and website service providers;
  • providers of hotel, reservation, CRM and guest management systems, in particular protel and Amadeus;
  • GASTROpoint GmbH / KunLeiSys for the guest club;
  • Google and Meta for activated analytics, tag manager, advertising or external media services;
  • A1 in connection with the technical provision of guest Wi-Fi;
  • banks, card companies and payment service providers;
  • tax advisors, auditors and other professional advisors, where necessary;
  • authorities and public bodies where there is a legal obligation;
  • external booking platforms and other partners, where necessary for a booking or service you have initiated.

Where a service provider processes personal data exclusively on our behalf, we conclude a data processing agreement pursuant to Art. 28 GDPR where legally required.

25. Data transfers outside the EEA

For individual services, in particular those of internationally operating technology providers such as Google or Meta, personal data may also be processed outside the European Union or the European Economic Area.

Such transfers only take place in compliance with Art. 44 et seq. GDPR. For recipients in countries with an adequacy decision of the European Commission, the transfer may be based on this decision. For appropriately certified US companies, the adequacy decision on the EU-US Data Privacy Framework may be relevant in particular. In other cases, appropriate safeguards such as the standard contractual clauses approved by the European Commission may be used.

26. Storage period

We generally only store personal data for as long as necessary for the respective purpose of processing. In addition, we store data if and as long as statutory retention obligations exist or storage is necessary for the establishment, exercise or defence of legal claims.

Where specific periods are stated in this privacy policy, these take precedence. Once the purpose of processing no longer applies and the relevant retention and limitation periods have expired, personal data is deleted or anonymised.

27. Your rights

Subject to the statutory requirements, you have in particular the following rights:

  • right of access to the data processed about you (Art. 15 GDPR);
  • right to rectification of inaccurate data or completion of incomplete data (Art. 16 GDPR);
  • right to erasure (“right to be forgotten”) under the conditions of Art. 17 GDPR;
  • right to restriction of processing (Art. 18 GDPR);
  • right to data portability, where the statutory requirements are met (Art. 20 GDPR);
  • right to object to processing based on legitimate interests (Art. 21 GDPR);
  • right to withdraw consent at any time with effect for the future (Art. 7(3) GDPR).

To exercise your rights, please contact:
Email: direktion@sparesortstyria.com

To protect your data, we may request additional information to verify your identity if there are reasonable doubts about it.

28. Right to lodge a complaint

If you believe that the processing of your personal data violates data protection law, you have the right to lodge a complaint with a data protection supervisory authority. In Austria, this is:

Austrian Data Protection Authority (Österreichische Datenschutzbehörde)
Barichgasse 40–42
1030 Vienna
Austria

Phone: +43 1 52 152-0
Email: dsb@dsb.gv.at
Website: https://www.dsb.gv.at

29. Data security

Taking into account the state of the art, the costs of implementation, the nature, scope and purposes of processing and the risks to the rights and freedoms of natural persons, we implement appropriate technical and organisational measures pursuant to Art. 32 GDPR.

These include in particular measures to ensure the confidentiality, integrity and availability of systems, access restrictions, appropriate authorisation concepts, data backups and encrypted transmission of our website via HTTPS/TLS.

30. External links

Our website contains links to external websites and services. When you follow such a link, you leave our area of responsibility. The respective external provider is generally responsible for any subsequent processing of personal data. Please refer to their privacy information.

31. Changes to this privacy policy

We update this privacy policy when legal requirements, our data processing or the services used on the website change. The current version published on our website applies.