Privacy policy

Last updated: 28 October 2026

1. Controller and contact

Steinacherhof – Erich Jankl, Innerteuchen 2, 9543 Arriach, Austria. Telephone: +43 650 2122880. Email for privacy enquiries: office@wurzelpark.at.

This information concerns the website wurzelpark.at and in particular our direct booking platform. We process personal data in accordance with the General Data Protection Regulation (GDPR) and take account of section 165(3) of the Austrian Telecommunications Act 2021 (TKG 2021) when storing and accessing information on terminal devices.

2. Technical operation and server logs

When you visit the website, the web server processes technically necessary connection data, including your IP address, time, requested address and browser and system information. The hosting provider may process this data in server logs for operation, error analysis and security. IP addresses may constitute personal data. This technical processing is separate from optional visitor statistics. The legal basis is our legitimate interest in secure, functional website operation under Article 6(1)(f) GDPR. Article 6(1)(b) GDPR may apply to services requested under a contract.

3. Contact, enquiries and bookings

When you contact us or make a booking, we process the information you provide, such as your name, contact and address details, travel dates, occupancy, selected services and messages. This is used to answer your enquiry, conclude and perform the contract and fulfil statutory obligations. The legal bases are Article 6(1)(b) and (c) GDPR. Any further purposes requiring consent are agreed separately.

Technical service providers engaged to perform these tasks may receive necessary data as processors. Data is disclosed only where necessary for the purpose concerned and legally permitted. We retain contract and billing data in accordance with the applicable statutory retention requirements; enquiry data is kept only as long as necessary to handle the enquiry and protect legitimate claims.

4. Essential functions and cookie preferences

The website works and bookings remain possible even if you decline optional statistics. Essential cookies or similar storage may be used, for example, for login, shopping baskets, security functions and requested booking steps.

The cookie sdb_privacy stores only your optional statistics preferences for six months. It contains no unique visitor identifier. This storage is necessary so that your choice can be respected on subsequent page visits. You can change your choice at any time using the permanently visible “Cookie settings” button. Once the validity period expires, you will be asked again.

5. Our optional visitor and booking statistics

Only if you actively consent do we record related visits and booking steps on our own servers. The legal basis is your consent under Article 6(1)(a) GDPR; the necessary storage on your device is based on your consent under section 165(3) TKG 2021.

We record: the time and order of pages visited on our website, excluding URL query parameters; the referring website's domain where transmitted; approximate country and region; operating system family and broad device category; estimated active visit time; submitted search dates including arrival, departure, apartment and numbers of adults and children; availability results; selected rate; and events for selecting services, opening the booking form, viewing the booking summary, submitting and successfully saving a booking.

These statistics do not store names, email addresses, phone numbers, postal addresses, messages, payment data, individual children's ages, full IP addresses or full browser identifiers. They are not linked to booking contact details. Successful completion of a booking is recorded as an event without a booking number.

The cookie sdb_visit contains a random, server-signed visit identifier and cannot be read by JavaScript (HttpOnly). It remains valid for up to 30 minutes without a new statistics event and is set only after consent to statistics. The identifier is pseudonymous; the analysis should therefore not be considered fully anonymous. After a longer period of inactivity, a new visit begins when recording resumes.

The approximate region is derived from the connection IP address using a locally available geographical database. The IP address is not sent to an additional geolocation service or stored in the statistics tables for this purpose. The result may be inaccurate, particularly due to mobile networks, VPNs, proxies or outdated geographical data. GPS tracking is not used. Operating system identification is also approximate.

Active time is estimated using visible pages and broad activity signals. Keystroke contents, mouse movement histories and screen recordings are not stored. “Last page” means only the last measured page; it does not reliably establish the actual browser exit. Without consent, no such visit history is created or added retrospectively.

Individual visit and event data is deleted after 90 days. To limit abusive access, a server-secret hash of the connection IP address is temporarily stored for up to one hour for rate limiting. This protection key is not used for visit profiles or region detection. Statistics are accessible only to authorised website administrators; administrators' own visits are excluded. The analysis serves to improve our website and booking offers and does not lead to any automated decision with legal effects on you.

6. Withdrawal of consent and previous analytics functions

You can withdraw consent at any time with future effect under “Cookie settings” by selecting “Essential only” or deselecting statistics and saving. The lawfulness of previous processing remains unaffected. Recording stops; the visit history attributable to the current visit identifier is additionally deleted upon withdrawal, provided a connection to the server is possible. The selection is reloaded so that it takes effect on all pages.

The previous automatic recording through Google Analytics, WP Statistics and automatic Telegram click notifications is disabled for new visits. Older statistics are not retrospectively extended or automatically linked to the new analysis. No data from these new statistics is sent to Google or Telegram. External Google web fonts are not loaded automatically.

7. External content and services

The website may contain external images, maps, videos, booking or contact offers. When external resources load, technically necessary connection data may be transmitted to their providers. For example, accommodation images on the direct booking page are provided through Cloudinary. After following external links, the relevant provider's privacy information applies. Consent to our own statistics does not constitute blanket consent to arbitrary external content or advertising services.

If you deliberately use a contact function provided by an external communications service, further processing is also governed by that service's privacy information. Declining statistics does not prevent you from using our usual contact and booking options.

8. Your rights

Subject to statutory requirements, you have rights of access, rectification, erasure, restriction of processing and data portability. You may object to processing based on legitimate interests for reasons relating to your particular situation. You may withdraw consent at any time with future effect. With pseudonymous statistics, linking data to a person without additional information may be limited or impossible; we do not collect additional data solely for identification.

For privacy enquiries, please contact office@wurzelpark.at. You can lodge a complaint with the Austrian Data Protection Authority: www.dsb.gv.at.

9. Updates

This information is updated when actual data processing changes. Changes to optional purposes are not automatically covered by earlier consent.