Privacy Policy

1. Data Controller

The controller responsible for the processing of personal data within the meaning of the General Data Protection Regulation (GDPR):

2. Data Collected

Contact forms and email enquiries: When you use the contact form or contact us by email, the data you provide (name, email address, phone number, message) is stored for the purpose of processing your enquiry. This data is not shared with third parties without your consent.

Server log data: When you visit this website, technical data is automatically recorded (IP address, browser type, pages accessed, date and time of access). This data is used exclusively for the technical administration of the website and is not linked to personal data.

3. Cookies

This website uses only technically necessary cookies required for the operation of the website (e.g. session cookies). No tracking cookies, advertising cookies, or third-party cookies are set. A cookie consent banner is therefore not required.

4. Third-Party Services

The following external services are used to operate this website:

Cloudflare (Hosting & CDN)

This website is served via Cloudflare, Inc. (USA). Technical access data (IP address, browser, timestamp) is processed. Legal basis: Art. 6(1)(f) GDPR. Cloudflare is certified under the EU-US Data Privacy Framework.

Formspree (Forms & Newsletter)

Contact and newsletter forms are processed via Formspree, Inc. (USA). Data entered (name, email, message) is transmitted to Formspree servers. Legal basis: Art. 6(1)(a) and (b) GDPR.

Stripe (Payment Processing)

Stripe, Inc. (USA) is used for bookings and payments. Stripe processes payment data (card number, name, email) as an independent controller. Legal basis: Art. 6(1)(b) GDPR. Stripe is certified under the EU-US Data Privacy Framework. More information: stripe.com/privacy.

AI Chat Assistant (Anthropic)

This website offers an AI-powered chat assistant operated by Anthropic, PBC (USA). When you use the chat, your messages are transmitted to Anthropic for processing. No personal data beyond the chat content is collected. Legal basis: Art. 6(1)(a) GDPR (consent through use). Anthropic is certified under the EU-US Data Privacy Framework.

5. Data Transfers to Third Countries

Some of the services listed above process data in the United States. These transfers are based on the EU-US Data Privacy Framework (adequacy decision by the European Commission under Art. 45 GDPR) or on Standard Contractual Clauses (Art. 46(2)(c) GDPR).

6. Legal Basis for Processing

The processing of personal data is carried out on the basis of:

• Art. 6(1)(b) GDPR (processing for pre-contractual measures)
• Art. 6(1)(f) GDPR (legitimate interests of the controller)
• Art. 6(1)(a) GDPR (consent, where given)

7. Retention Period

Personal data is stored only for as long as necessary for the respective purpose or as required by statutory retention obligations. Enquiries and correspondence are deleted after the completion of the respective process, unless a statutory retention obligation applies.

8. Your Rights under GDPR

Under the GDPR, you have the following rights regarding your personal data:

• Right of access (Art. 15 GDPR)
• Right to rectification (Art. 16 GDPR)
• Right to erasure (Art. 17 GDPR)
• Right to restriction of processing (Art. 18 GDPR)
• Right to data portability (Art. 20 GDPR)
• Right to object (Art. 21 GDPR)
• Right to withdraw consent (Art. 7(3) GDPR)

To exercise these rights, please contact: reservierung@schlossthalheim.at

9. Right to Lodge a Complaint

You have the right to lodge a complaint with the competent supervisory authority. In Austria, this is the Austrian Data Protection Authority (www.dsb.gv.at).

10. Changes to this Privacy Policy

This privacy policy may be updated as required. The current version is always available on this page.

Last updated: April 2026