Privacy policy of the IMLAUER Hotel & Restaurant GmbH

We have a great interest in the careful handling of personal data and procedures. The protection of the personal rights of customers and business partners is our express goal.

Here you can find out how we ensure the confidentiality of your personal data and respect your right to informational self-determination.

Confidentiality of personal data

All our employees who handle personal data in the course of their work are obliged to maintain confidentiality and to handle data processing systems properly.

1. Basics

This Privacy Policy applies to all individuals who use the services of IMLAUER Hotel & Restaurant GmbH, hereinafter referred to as IMLAUER. We hereby inform you about the nature, scope, and purpose of our company’s collection and use of your personal data. We respect your privacy and are committed to strictly complying with the legal requirements for the processing of your personal data (in particular, EU Regulation No. 679/2016 — the General Data Protection Regulation (GDPR), the Data Protection Act (DSG), and the applicable data protection provisions of the Telecommunications Act (TKG 2021). All of your personal data is processed on this basis.
The data controller is IMLAUER Hotel & Restaurant GmbH,
, including the following establishments:

IMLAUER Palais Mirabell—formerly Hotel am Mirabellplatz Salzburg (Mirabellplatz 8, 5020 Salzburg, Austria)
Hotel IMLAUER & Bräu Salzburg (Rainerstr. 12-14, 5020 Salzburg, Austria)
IMLAUER Hotel Pitter Salzburg (Rainerstr. 6, 5020 Salzburg, Austria)

Hotel IMLAUER & Nestroy Vienna (Rotensterngasse 10-12, 1020 Vienna, Austria)

IMLAUER Hotel Schloss Pichlarn (Zur Linde 1, 8943 Aigen im Ennstal, Austria)

You can also find our data in the imprint of our website.

Data Protection Contact Point / Data Protection Coordination
For data protection-related inquiries, please contact us at:
datenschutz@imlauer.com – Salzburg

datenschutz-wien@imlauer.com – Vienna

datenschutz@schlosspichlarn.at – Pichlarn

By using our services and granting consent in accordance with this declaration, you confirm that you have reached the age of 14 and are in a position to give valid consent, or that you already have effective consent from your parent or guardian.

2. Information according to Art 13 GDPR

Your personal data, in particular
– Your master data (surname, first name, address, e-mail address, telephone and fax number, date of birth, customer number) as well as language and vehicle registration number,
– the data in travel documents (passport number, passport data, date of birth, issuing authority, duration, nationality) and identity documents (identity card, driving license, etc. including issuing authority and duration),
– the data on payment type and in connection with payments, in particular with EC cards, credit cards and bank cards,
– the length of stay requested by you and the destinations, hotels, contact persons, conditions, special services, health data, frequent flyer number, personal preferences associated with the stay, which you disclose to us, and
– special categories of data such as health data and data on special needs and marriage/partnership,
are required for our services and are processed for the following purposes:
Reservation of rooms and tables as well as other services, booking of rooms and services in our hotels and our gastronomy as well as their implementation, processing and invoicing and other hotel services and services (B2B, B2C, FIT).

– Customer service, including all necessary correspondence,
handling of customer requests, and billing for services.
– Sourcing, booking, and planning of events and functions of all kinds
– Arranging and providing transportation services and rental vehicles
-Video surveillance of all entrances to our hotels and publicly accessible areas within the hotel buildings for security purposes, e.g., to protect people and property, in particular the property of hotel guests and IMLAUER Hotels & Restaurants.
This also includes bookings for tour guides, dining services, rental vehicles, transfers, events, tours, and gift certificates—including customer account management, billing, and verification (B2B, B2C, FIT)—as well as ticket reservations. We therefore store and process this data for these purposes and, to the extent necessary, transmit it to third parties with whom we collaborate to provide the most effective and best possible service to our customers—this may also include service providers in third countries acting as data processors, as well as software and agency service providers— transmitted.

Profiling within the meaning of Art. 4 (4) GDPR may be carried out to a limited extent to improve our guest service, for personalized guest communication and for interest-related offers. There is no exclusively automated decision-making in accordance with Art. 22 GDPR.

The legal bases for these data processing activities are
– the fulfillment of our pre-contractual and contractual obligations to you (Art. 6(1)(b) GDPR),
– consent provided by you (Art. 6(1)(a) GDPR),
– statutory, contractual, or other legal obligations on our part (Art. 6(1)(c) GDPR), such as, in particular, retention and documentation requirements under tax, corporate, and reporting regulations, accounting, customs law, contract management, and legal disputes), as well as our legitimate interests (Art. 6(1)(f) GDPR), in particular to improve our customer service, for direct marketing, IT security, quality improvement, and the protection of our own legal interests.

The duration of storage depends on the duration of our business relationship, the consent you have given, statutory retention periods and our legitimate interests.

Insofar as statutory retention obligations exist (e.g. under company or tax law), the data will be stored for the duration stipulated by law. We store data that is processed exclusively on the basis of consent until consent is withdrawn, provided that there are no other legal obligations to the contrary.

3. Our websites

When you visit our website, your access data is automatically collected and stored. This access data may include, in particular, the page accessed, the files viewed, the date and time of access, the user’s IP address, data of the accessing computer, in particular the browser and operating system, as well as the data volume and the notification of successful access. This access data is used by us for internal statistical purposes to ensure the security of our offer and to optimize the offer. If an illegal act is suspected, the access data is analyzed to preserve evidence.

The legal bases for this data processing are your consent, our pre-contractual and contractual obligations towards you, our legitimate interests and legal obligations of all kinds and § 96 TKG.

The content of our websites has been carefully prepared and reviewed multiple times; however, we assume no liability for the timeliness, accuracy, or completeness of the information provided. Claims for damages arising from the use or non-use of the information, or from the use of incorrect or incomplete information, are excluded. All offers are subject to change and non-binding. We reserve the right to modify, supplement, or delete the offer or parts thereof without prior notice, or to suspend publication of the website temporarily or permanently.
The content and programming of our websites are protected by copyright and related rights. Any reproduction—including in part—and public dissemination, in particular the copying of texts, graphics, and photos, is prohibited without our prior written consent.

4. Newsletter

You are free to subscribe to our newsletter. The registration process—which requires you to provide your email address and give us your consent to receive the newsletter—does not take effect until you confirm it via the “double opt-in” process. To ensure that the newsletter provides you with targeted information that is of particular interest to you, we give you the option during registration to provide details about specific interests, location information (IMLAUER Hotels in Vienna or Salzburg, IMLAUER Restaurants), and similar details.
Every newsletter you receive will include all the necessary information on how to unsubscribe. For more information about our newsletters, please contact us at datenschutz@imlauer.com. We’re happy to assist you.

5. use of AI-supported voice, chat and email systems in customer contact.

When you contact us, your communication may be processed in whole or in part by an AI-based assistance system. The following data will be processed:

– Your phone number and email address
– Time and duration of contact
– Content (e.g., inquiries, responses)
– Technical metadata

This processing is carried out on the basis of Art. 6 para. 1 lit. b GDPR (for contract fulfillment or initiation) and, if applicable, Art. 6 para. 1 lit. f GDPR (legitimate interest in efficient customer service). Automated decision-making within the meaning of Art. 22 GDPR does not take place.

Data processing is carried out exclusively for specific purposes.
Our service providers responsible for technical implementation are contractually obligated to comply with the GDPR (Data Processing Agreement pursuant to Art. 28 of the GDPR).

6. transfer to third parties / obligations of processors

We may share your personal data
– within IMLAUER Hotel & Restaurant GmbH, in accordance with the permitted purposes of use,
– to data processors (e.g., for our electronic advertising in the form of newsletters) as well as to third parties who must be engaged to provide the services you have requested, all of whom have committed to us to comply with applicable data protection standards,
. If compliance with European data protection standards is not possible—for example, because standard contractual clauses, adequacy decisions, or certifications cannot be guaranteed in a specific case—we will inform you in a timely manner and also obtain the necessary consents from you. For further information, please contact us at datenschutz@imlauer.com.

Your personal data will not be passed on to uninvolved third parties unless there is a legal obligation to do so or you have given your prior consent.

7. cookies and tracking services

We use cookies, which are small text files used to store information in web browsers. Cookies are recognized the next time you visit our website and play a significant role in speeding up loading times and making it convenient for you to use our services. The information recognized and stored by cookies is used to identify you and to analyze your user behavior. It is stored on the server of the respective provider, who, as our data processor, has committed to complying with applicable data protection standards
.

After you visit our website, cookies will remain stored on your device unless you refuse them from the outset or actively delete them. Actively disabling cookies may impair the functionality of our websites for you. You can also prevent cookies from being stored by adjusting your browser settings accordingly. However, please note that in this case, you may not be able to use all features of our website.
You can also prevent the data generated by the cookie and related to your use of the website (including your IP address) from being transmitted to Google, as well as the processing of this data by Google, by downloading and installing the browser plug-in available on the website google.com. It is available at the following link: Download and install the browser plugin.
However, the plugin is only available for certain browsers.

We also use third-party content on our website to make our site as informative and user-friendly as possible for you. This includes, for example, Google Maps, RSS feeds, and YouTube. For technical reasons, these third-party providers receive your IP address. We have no control over how these third-party providers use this data. In this regard, we refer you to the privacy policies of the respective providers.
We make every effort to use only content from providers who use the IP address solely for the purpose of delivering the content. However, we have no control over whether third-party providers store the IP address, for example, for statistical purposes. To the best of our knowledge, we inform users of this.
We use Google Analytics, a web analytics service provided by Google Inc., 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA (“Google”). Google Analytics uses cookies. The information generated by the cookie about your user behavior is generally transmitted to a Google server in the United States and stored there. Your IP address is first truncated within the European Union and thus anonymized or at least pseudonymized. Only in exceptional cases is the full IP address transmitted to a Google server in the United States and truncated there.
Google uses this information to evaluate your use of the website, to compile reports on website activity, and to provide other services related to website and internet usage to the website operator. The IP address transmitted by your browser as part of Google Analytics is not combined with other data held by Google.

Google Analytics on our website has been enhanced with code for the anonymous collection of IP addresses (known as IP masking). As a result, your IP address is truncated by Google within member states of the European Union or in other signatory states to the Agreement on the European Economic Area.Only in exceptional cases is the full IP address transmitted to a Google server in the U.S. and truncated there.
We also use Google Analytics to evaluate data from AdWords and the DoubleClick cookie for statistical purposes. If you do not agree to this, you can disable it via the Ads Preferences Manager:
We use plugins from the Google+ social network on our website. This service is operated by Google Inc., 1600 Amphitheatre Parkway, Mountain View, CA 94043.
We have integrated the plugins into our website in such a way that no automatic connection to the Google+ servers is established. You can recognize the Google+ button by the white “+1” on a differently colored background. If you wish to use the social plugins, click on the respective button. Only then will a connection to the Google+ servers be established.
As soon as you activate the button by clicking on it, a connection to the Google+ servers is established. This informs Google that you have visited our site. In addition to your IP address, data about the web browser you are using may also be collected. You can find the exact scope of this data collection in Google’s Privacy Policy.

If you wish to prevent Google from associating this information with your account, you must log out of Google+ before visiting our website:
We have no control over Google+’s use of this data. In this regard, please refer to Google+’s privacy policy, particularly the information available at the following link: https://policies.google.com/privacy?hl=de

We use Facebook social plug-ins from the social network Facebook, operated by the companies Facebook Ireland Limited, 4 Grand Canal Square Dublin 2, Ireland, and Facebook Inc, 1601 S. California Avenue, Palo Alto, CA 94303, USA. These plug-ins are buttons that Facebook uses to measure who visits our website. If the visitor is also registered with Facebook as a user and logged in, further information is also stored by Facebook. Facebook receives your IP address for technical reasons. We have no influence on the use of this data by Facebook. In this regard, we refer you to Facebook’s privacy policy, in particular the information available at the following link:
– https://www.facebook.com/help/568137493302217.
– https://www.facebook.com/help/568137493302217.

There, you’ll also find information on how to block Facebook social plug-ins using your browser.

The Facebook “Like” plugin is not used on our website.

We have integrated the plugins into our website in such a way that no automatic connection to Facebook’s servers is established. You can recognize the Facebook button by the white “f” on a blue background. If you would like to use the social plugins, simply click on the corresponding button. Only then will a connection to Facebook be established.

Mouseflow

Purpose of processing: We use Mouseflow to analyze user behavior on our website and to continuously improve the user experience. The data collected in this process helps us make our website more user-friendly and optimize its functionality.

Your personal data is processed, in particular, for the following purposes:

– Creation of anonymized user profiles and session tracking to improve the user-friendliness of our website

– Ensuring the smooth operation of our website

– Improving ease of use and user guidance

– Analysis of user behavior to optimize our website to meet user needs

Legal basis: Your personal data is processed on the basis of your explicit consent in accordance with Article 6(1)(a) of the GDPR.

You may revoke your consent at any time, effective for the future. The lawfulness of the data processing carried out up to the time of revocation remains unaffected.

Recipient Categories: When using Mouseflow, we receive anonymized usage data, which we use exclusively for the purposes listed above.

The service provider Mouseflow ApS also receives this data. It is contractually agreed that the data will be stored exclusively on European servers and will be completely anonymized.

Data Storage: Mouseflow uses two types of cookies to analyze how our website is used. For more information, please see Mouseflow’s Cookie Policy.

– mf_[website-id]: This cookie is set exclusively for the duration of a session and contains information about your current use of our website. It is automatically deleted when the session ends.

– mf_user: This cookie is used to distinguish between new and returning users. No other information is stored. The cookie is automatically deleted after 90 days.

8. contact

You may request information about your personal data stored by us at any time, free of charge. As the data subject, you also have the right to withdraw consent, request access to, deletion, correction, restriction, and portability of your personal data, provided that this does not conflict with any legal retention obligations on our part.
The consequences of withdrawal are the erasure, rectification, or restriction of your data, to the extent permitted by law.
For more information about your rights as a data subject, please contact us at datenschutz@imlauer.com or by phone at +43 662 88 978 808, Rainerstr. 6, 5020 Salzburg. We’re happy to assist you. Furthermore, you have the right to lodge a complaint with the supervisory authority—the Austrian Data Protection Authority (DSB), Wickenburggasse 8–10, 1080 Vienna, dsb@dsb.gv.at.

9. other

We have implemented organizational and technical safeguards, which we continuously evaluate and adapt as needed, to protect your personal data that we store and process.
We reserve the right to amend this privacy policy at any time and adapt it to new developments. The new version will apply from the date it is published on our website. The current version of the privacy policy can be accessed at any time on the website at https://imlauer.com/datenschutz/ .
Our legal notice can be found at https://imlauer.com/impressum/

10. management of the cookies used

We use the “Real Cookie Banner” consent tool to manage the cookies and similar technologies used (tracking pixels, web beacons, etc.) and related consents. Details on how “Real Cookie Banner” works can be found at https://devowl.io/de/rcb/datenverarbeitung/.

The legal basis for the processing of personal data in this context is Art. 6 para. 1 lit. c GDPR and Art. 6 para. 1 lit. f GDPR. Our legitimate interest is the management of the cookies and similar technologies used and the related consents.

The provision of personal data is neither contractually required nor necessary for the conclusion of a contract. You are not obliged to provide the personal data. If you do not provide the personal data, we will not be able to manage your consents.