1. Controller
The controller responsible for data processing on this website is:
2. Data Collected When You Visit the Website
When you access this website, our hosting provider automatically records technical data in so-called server logs:
- —IP address (processed in truncated form)
- —Date and time of access
- —Requested URL
- —Browser and operating system used
- —Referrer URL (the page previously visited)
The legal basis is Art. 6(1)(f) GDPR (legitimate interest in the stable operation of the website and in IT security). Server logs are retained for 7 days, except where a longer period is needed to investigate a specific security incident, and are then deleted automatically. We do not link this data to your person.
3. Enquiry Form
When you contact us via the enquiry form, we collect and store the following data:
- —Name
- —Email address
- —Phone number (optional)
- —Desired dates (arrival and departure)
- —Number of guests and dogs
- —Message (optional)
We use this data solely to process your inquiry and to get in touch with you. The legal basis is Art. 6(1)(b) GDPR (pre-contractual measures) and/or Art. 6(1)(a) GDPR (consent given by submitting the form).
The data is deleted as soon as it is no longer needed for the purpose for which it was collected — at the latest after the expiry of statutory retention periods (in particular under tax and VAT law, 7 years).
4. Data Processors and Service Providers
For the operation of the website and the handling of your inquiry, we use the following service providers, each of whom has concluded a data processing agreement (DPA) with us pursuant to Art. 28 GDPR:
Vercel (Hosting)
Vercel, Inc., 440 N Barranca Avenue #4133, Covina, CA 91723, USA. Processes IP addresses and server logs for the operation of the website (hosting/CDN). Vercel is certified under the EU-US Data Privacy Framework; data transfers to the USA are additionally based on the EU Standard Contractual Clauses (2021). Vercel also provides the cookieless audience-measurement tool "Vercel Web Analytics" (see section 5).
Resend (Email dispatch)
Resend, operated by Plus Five Five, Inc., 2261 Market Street #5039, San Francisco, CA 94114, USA. Sends the notification about your inquiry to us (Hans Leitner). Your email address is transmitted as the reply-to address so that we can reply to you directly; no automatic confirmation email is sent to you. Plus Five Five, Inc. is certified under the EU-US Data Privacy Framework (including the UK extension); data transfers to the USA are additionally based on the EU Standard Contractual Clauses (2021).
Anthropic (Chat assistant)
Anthropic, PBC, San Francisco, CA, USA. Processes messages entered in the chat assistant to generate AI-powered responses (model claude-haiku-4-5). The legal basis is our legitimate interest in answering your questions directly on the website (Art. 6(1)(f) GDPR). Under the Anthropic Commercial DPA, your messages are not used to train AI models and are not stored permanently. Data transfers to the USA are based on the EU Standard Contractual Clauses (2021), and the EU-US Data Privacy Framework where certified.
5. Cookies and Tracking
This website does not use tracking cookies or advertising services. For anonymous audience measurement we use Vercel Web Analytics (Vercel Inc., see section 4) — a cookieless analytics tool that performs no cross-device recognition and builds no personal profiles. Only aggregated usage data is collected (such as pages visited, referrer, approximate location at country/region level, device type), without cookies. The legal basis is Art. 6(1)(f) GDPR (legitimate interest in the statistical analysis of website usage). Technically necessary session cookies may be set by the hosting provider and are deleted at the end of your visit.
Since we do not use any cookies that require consent, we also do not display a cookie banner.
6. Your Rights
You have the following rights with regard to your personal data:
- —Right of access (Art. 15 GDPR)
- —Right to rectification (Art. 16 GDPR)
- —Right to erasure (Art. 17 GDPR)
- —Right to restriction of processing (Art. 18 GDPR)
- —Right to data portability (Art. 20 GDPR)
- —Right to object (Art. 21 GDPR)
- —Right to withdraw a given consent (Art. 7(3) GDPR)
To exercise your rights, a simple informal email to hans.leitner@aon.at is sufficient.
7. Right to Lodge a Complaint with the Supervisory Authority
You have the right to lodge a complaint with a data protection supervisory authority regarding our processing of your personal data.
Barichgasse 40–42
1030 Wien
Phone: +43 1 52 152-0
Email: dsb@dsb.gv.at
Web: www.dsb.gv.at
8. Changes to This Privacy Policy
We reserve the right to update this privacy policy from time to time to ensure it always reflects current legal requirements or to account for changes to our services, such as the introduction of new features. The updated privacy policy will apply from your next visit.