Privacy Policy

This is an English translation of our Datenschutzerklärung. In case of doubt, the German version applies.

1. Controller

Petra Schurz
Dürnstein 19, 9323 Wildbad Einöd, Austria
Owner and host of Casa Di Pietra – Das Steinhaus, Domgasse 5, 9063 Maria Saal
Phone: +43 676 7706407
Email: cdp.steinhaus@gmail.com

We have not appointed a data protection officer, as there is no legal obligation to do so.

2. General

We process personal data only to the extent necessary to provide this website, answer enquiries and handle bookings. We do not use any analytics, tracking or advertising services. Third-party services (booking form, map) are loaded only if you explicitly ask for them. There is no automated decision-making, including profiling (Art. 22 GDPR).

3. Hosting and server log files

This website is hosted by Hostinger International Ltd., 61 Lordou Vironos Street, 6023 Larnaca, Cyprus. The servers are located in Germany (Frankfurt); backups are stored in France – both within the EU. Hostinger processes the data on our behalf; the data processing agreement (Art. 28 GDPR) forms part of Hostinger’s terms of service.

Each time the website is accessed, the server automatically records: IP address, date and time, page requested, amount of data transferred, the previously visited page (referrer), browser type and operating system. This is necessary for secure and stable operation, for example to detect attacks. The legal basis is our legitimate interest (Art. 6(1)(f) GDPR). The log files are deleted automatically once the retention period set by Hostinger has expired.

The website is transmitted with TLS encryption (indicated by “https://” in the address bar).

4. Contact by email, phone and enquiry form

If you write to us or call us, we process the details you provide (name, email address and, where given, phone number, travel dates, number of guests and your message) in order to answer your enquiry. The enquiry form transmits your details in encrypted form to our web server at Hostinger (see section 3), which forwards them as an email to our mailbox. Your details are not stored on the web server itself. If sending is not possible at that moment, you can send your enquiry with your own email program instead.

For enquiries about a booking, the legal basis is Art. 6(1)(b) GDPR (pre-contractual measures); otherwise it is our legitimate interest in answering you (Art. 6(1)(f) GDPR). We need your name, email address and message to be able to reply; all other details are optional. We delete the data once your enquiry has been dealt with, unless it leads to a booking (see section 5).

Our mailbox is operated via Gmail, a service of Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. Emails sent to us are therefore stored by Google. This may involve a transfer to Google LLC in the USA; Google LLC is certified under the EU-US Data Privacy Framework, for which an adequacy decision of the European Commission exists (Art. 45 GDPR).

5. Booking and stay

To handle your booking and your stay, we process the data required for this (in particular name, address, contact details, travel dates and payment details). The legal basis is the performance of a contract (Art. 6(1)(b) GDPR). We are also legally obliged to keep a guest register under § 10 of the Austrian Registration Act (Meldegesetz; retention period seven years), to account for the local tourist tax under regional law and to retain accounting records under § 132 of the Austrian Federal Fiscal Code (BAO; seven years) – the legal basis for this is Art. 6(1)(c) GDPR.

If you book via a booking portal (such as Booking.com), we receive the necessary data from that portal. The portal’s own privacy policy applies to its processing.

6. Booking form (Smoobu)

For availability and online booking we use the booking system of Smoobu GmbH, Pappelallee 78/79, 10437 Berlin, Germany. The form is only loaded when you click “Load booking form”; no connection to Smoobu is made before then.

When it loads, your IP address and technical information about your browser and device are transmitted to Smoobu; Smoobu may use cookies or similar technologies in your browser. If you book via the form, Smoobu processes your booking and contact details on our behalf (Art. 28 GDPR). The legal basis for loading the form is your consent (Art. 6(1)(a) GDPR, § 165(3) Austrian Telecommunications Act 2021); for the booking it is the performance of a contract (Art. 6(1)(b) GDPR). Further information: privacy policy of Smoobu GmbH.

7. Map (OpenStreetMap)

On the contact page you can display a map from OpenStreetMap. It, too, is only loaded after you click “Load map”. In the process, your IP address and technical information about your browser and device are transmitted to the OpenStreetMap Foundation, St John’s Innovation Centre, Cowley Road, Cambridge, CB4 0WS, United Kingdom; cookies may be set. An adequacy decision of the European Commission exists for the United Kingdom (Art. 45 GDPR). The legal basis is your consent (Art. 6(1)(a) GDPR, § 165(3) Austrian Telecommunications Act 2021). Your consent is not stored and applies only to the current page view.

8. Fonts

The fonts are stored on our own server. No connection to Google or any other font provider is made when the website loads.

9. Cookies and browser storage

We do not set any cookies ourselves and do not use any analytics or advertising services. That is why there is no cookie banner on this website.

Only one thing is stored, and only after you have clicked “Load booking form”: in your browser’s local storage (localStorage) we save the entry cdp-smoobu-consent. It remembers that you have agreed to load the booking form, so that we do not have to ask you again on every visit. The entry contains no personal data, does not leave your device and remains until you withdraw it here or delete your browser data (§ 165(3) Austrian Telecommunications Act 2021).

Any cookies that Smoobu or OpenStreetMap may set are only created after your consent (see sections 6 and 7).

10. Your rights

You have the right of access (Art. 15 GDPR), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20) and objection to processing based on legitimate interests (Art. 21). You can withdraw any consent at any time with effect for the future (Art. 7(3) GDPR). Simply write to us at cdp.steinhaus@gmail.com.

If you believe that the processing of your data infringes data protection law, you can lodge a complaint with the supervisory authority: Austrian Data Protection Authority (Österreichische Datenschutzbehörde), Barichgasse 40–42, 1030 Vienna, www.dsb.gv.at.

Last updated: October 2026