Privacy Policy
Last updated: May 2026
The protection of your personal data is of particular importance to us. We therefore process your data exclusively on the basis of the statutory provisions (GDPR, DSG, TKG 2003).
1) Controller
Owner: Harald Stocker (Zechmannhof)
Address: Vorberg 25, A-8972 Ramsau am Dachstein
E: [email protected]
2) Purposes of Processing & Legal Basis
We process your personal data exclusively for the following purposes:
- Processing and handling your booking and fulfilling obligations as a tourism business (Registration Act, local/tourist tax, etc.)
- Processing and handling orders or commissions requested by you
Only such personal data is collected as is necessary for the fulfilment of the contract, the fulfilment of legal obligations, or which you have provided to us voluntarily. This includes, for example, name, address, e-mail address, telephone number, date of birth or account number.
Legal basis: Art. 6(1)(b) GDPR (performance of a contract) and Art. 6(1)(c) GDPR (legal obligation).
The provision of your data is voluntary unless required by law or contract. Please note, however, that without the necessary data, bookings or orders may not be able to be processed.
3) Recipients of Your Data
For the purposes mentioned above, your personal data may be transmitted to the following recipients:
- Tourism association
- Municipal registration office
- Statistics Austria
- Legal representatives, debt collection agencies
- Tax advisors, auditors
- IT service providers engaged by us
4) Retention Period
We do not retain your personal data for longer than is necessary to fulfil our contractual or legal obligations. Data is retained for as long as statutory retention obligations exist or limitation periods for potential legal claims have not yet expired.
5) Hosting & Server Log Files
Our website is operated on servers of our hosting provider. A data processing agreement in accordance with Art. 28 GDPR has been concluded with the provider.
The provider automatically collects and stores information in so-called server log files:
- IP address of the visitor
- Date and time of access
- Page or file accessed
- Referrer URL (previously visited page)
- Browser and operating system used
- Data volume transferred and notification of successful retrieval
This data is technically necessary to display the website and serves system security (e.g. to defend against attacks).
Legal basis: Art. 6(1)(f) GDPR (legitimate interest in secure operation).
Retention period: maximum 14 days; longer retention only in the case of a legal obligation or to investigate detected attacks.
6) Contact
If you contact us by e-mail or via a form, the data you provide (e.g. name, e-mail, telephone number, message) will be stored for the purpose of processing your enquiry and for follow-up questions. We do not pass on this data without your consent.
You may revoke your consent at any time by sending an informal e-mail to [email protected]. The lawfulness of processing carried out prior to revocation remains unaffected.
Legal basis:
Art. 6(1)(b) GDPR (pre-contractual/contractual communication) and
Art. 6(1)(f) GDPR (legitimate interest in efficient communication).
Retention period: until your enquiry has been dealt with or in accordance with statutory retention periods; generally a maximum of 1 month unless otherwise required.
7) Contact Form 7 (CF7)
We use the WordPress plugin Contact Form 7 to provide you with a user-friendly contact form. Contact Form 7 does not store any data in the database by default. Your entries are sent to us exclusively by e-mail.
Recipient: our hosting provider (e-mail transport).
Legal basis: Art. 6(1)(b) GDPR.
No data is passed on to third parties.
8) Google reCAPTCHA v3
To protect against spam and misuse, we use Google reCAPTCHA v3 (provider: Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland; parent company: Google LLC, 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA). reCAPTCHA v3 operates entirely in the background – without any visible prompt – and analyses visitor behaviour (e.g. mouse movements, time spent on page) to detect automated access. Cookies may be set and technical data transmitted to Google in the process.
Legal basis: Art. 6(1)(f) GDPR (legitimate interest in defending against automated access).
Recipient: Google Ireland Limited / Google LLC (USA). Data may be transferred to the USA based on the EU Commission's Standard Contractual Clauses (SCC).
Further information: https://policies.google.com/privacy
9) Cookies
Our website uses technically necessary cookies that are required for operation. In addition, cookies may be set by Google through the use of reCAPTCHA (see section 8).
| Name | Purpose | Duration | Type |
|---|
| wordpress_test_cookie | Checks whether cookies are permitted in the browser | Session | technically necessary |
| wordpress_logged_in_* / wordpress_sec_* | Login session (backend only) | Session | technically necessary |
| wp-settings-* / wp-settings-time-* | Backend/editor settings | up to 1 year | technically necessary |
| _GRECAPTCHA | Bot/spam protection (Google reCAPTCHA v3) | up to 6 months | security |
You can block or delete cookies at any time via your browser settings. Please note that blocking cookies may restrict the functionality of the website.
Legal basis: Art. 6(1)(f) GDPR (legitimate interest in secure operation).
10) WordPress & Oxygen
Our website is based on WordPress and the website builder Oxygen. Oxygen does not process any personal data and does not set its own tracking cookies. WordPress uses only functional cookies that are necessary for login, security and usability.
11) No Further Third-Party Providers
With the exception of Google reCAPTCHA (see section 8), we deliberately refrain from using tools such as Google Analytics, external Google Fonts, advertising networks or social media plugins. No profiling or reach measurement takes place.
12) Your Rights
You have the right to:
- Access to your stored data (Art. 15 GDPR)
- Rectification of inaccurate data (Art. 16 GDPR)
- Erasure ("right to be forgotten", Art. 17 GDPR)
- Restriction of processing (Art. 18 GDPR)
- Data portability (Art. 20 GDPR)
- Objection to certain processing operations (Art. 21 GDPR)
If you believe that the processing of your data violates data protection law, you may lodge a complaint with the competent supervisory authority:
Austrian Data Protection Authority
Barichgasse 40–42, 1030 Vienna
Web: www.dsb.gv.at
13) Security
We use technical and organisational measures (e.g. SSL/TLS encryption) to protect your personal data against loss, manipulation or unauthorised access. These security measures are regularly reviewed and adapted to the state of the art.
Notwithstanding our efforts, it cannot be entirely ruled out that information transmitted electronically may be viewed by third parties. We therefore accept no liability for the disclosure of information due to transmission errors or unauthorised access by third parties that are not attributable to us.
14) Changes to this Privacy Policy
We reserve the right to update this Privacy Policy as necessary, e.g. in the event of changes to legal requirements or the use of new features. The current version is available on this page at any time.
© 2026 Zechmannhof – Ramsau am Dachstein
