Privacy Policy
Stand: Juli 2026
Note: The legally binding version of this document is the German original.
1. Controller
The controller within the meaning of the General Data Protection Regulation (GDPR) and other national data protection laws as well as other data protection provisions is:
Wolfgang Strickner
Mützens 5
6143 Matrei am Brenner
Tyrol, Austria
Phone: +43 664 547 49 10
Email: info@stoacherhof.com
2. Overview of Data Processing
The following overview summarises the data processing activities that take place on this website:
- Server log files when visiting the website
- Contact enquiries via the contact form, email, phone and WhatsApp
- Embedding of Google Maps (after consent)
- Cookieless web analytics via Vercel Web Analytics
- Online payments (deposits) via HOBEX
- Bookings via third-party platforms (Booking.com, EasyBooking)
- Technical error monitoring via Sentry
3. Server Log Files
When you visit our website, information is automatically collected by the web server. These so-called server log files include, for example, the browser type and version, the operating system used, the referrer URL, the IP address of the accessing device, and the time of the server request.
Legal basis: Art. 6(1)(f) GDPR (legitimate interest in ensuring the operation of the website).
Retention period: Log files are automatically deleted after 30 days.
4. Hosting and Data Processors
Our website is hosted by Vercel Inc. (440 N Barranca Avenue #4133, Covina, CA 91723, USA). Data transfer to the USA is based on Standard Contractual Clauses (SCCs) pursuant to Art. 46(2)(c) GDPR.
For sending emails from the contact form, we use Resend Inc. (USA) as a data processor. Data transfer is also based on SCCs.
For processing online payments (deposits), we use HOBEX AG (Austria) as a payment service provider. Your payment data (card details or, for Pay by Bank, your bank account details) is transmitted encrypted directly to HOBEX and is not stored on our servers. Legal basis: Art. 6(1)(b) GDPR (performance of a contract).
To detect and fix technical errors, we use Sentry (Functional Software, Inc., USA) as a data processor. In the event of an error, technical data (e.g. error message, time, browser type) is processed to ensure the stability of the website. No session recording (session replay) takes place. Legal basis: Art. 6(1)(f) GDPR (legitimate interest in error-free operation); transfer to the USA is based on Standard Contractual Clauses (SCCs).
Data processors at a glance:
| Service | Provider | Purpose | Location |
|---|---|---|---|
| Hosting and CDN | Vercel Inc. | Website delivery | USA (SCCs) |
| Email delivery | Resend Inc. | Contact form | USA (SCCs) |
| Payment processing | HOBEX AG | Online payment (deposit) | Austria (EU) |
| Map | Google Ireland Ltd. | Location display | Ireland |
| Web analytics | Vercel Inc. | Anonymous statistics | USA (EU-US DPF) |
| Reach measurement (consent only) | Google Ireland Ltd. | Anonymous statistics (Google Analytics) | Ireland / USA (EU-US DPF) |
| Error monitoring | Sentry (Functional Software, Inc.) | Stability and error analysis | USA (SCCs) |
Further information: Vercel Privacy Policy · Resend Privacy Policy · HOBEX Privacy Policy
4b. Guest Registration (Reporting Obligation)
As a commercial accommodation provider, we are legally required to register all overnight guests. This data processing only takes place in the context of a confirmed booking — not when you simply visit this website.
Data collected:
- First and last name (including all accompanying persons)
- Date of birth
- Gender
- Nationality
- Place of residence / home address
- Travel document (type, number, date of issue, issuing authority, country)
- Date of arrival and departure
Recipients of the data:
- Municipality of Mühlbachl or the responsible registration authority (to fulfil the statutory reporting obligation)
- Wipptal Tourism Board (for the calculation of the tourism levy / local tax) — transmission takes place via the platform Feratel media technologies AG as data processor
- Channel manager (zadego GmbH / EasyBooking, in future Beds24 GmbH) as data processor for booking processing
Legal basis: Art. 6(1)(c) GDPR in conjunction with the Tyrolean Registration Act and § 6 Tyrolean Tourism Act (legal obligation).
Retention period: Statutory retention periods — registration data generally 7 years pursuant to § 132 of the Austrian Federal Fiscal Code (BAO); tourism levy records according to provincial law.
Note on pre-check-in: To prepare the statutory registration, we send you a link to a self-check-in form by email after your booking (service provider: Resend Inc., see point 4). The transmission of your passport and address data via this form is encrypted; you consent by transmitting the data to us.
5. Cookies and Local Storage
This website uses no own tracking cookies. Statistics cookies and cookies for measuring ad performance (Google Analytics / Google Ads) are set only after your explicit consent (see section 8a); without consent, no advertising or statistics cookies are set at all.
The following storage takes place:
- Cookie consent: Your decision on the cookie banner is stored in the local storage (localStorage) of your browser so that you are not asked again on every visit. Legal basis: Art. 6(1)(f) GDPR (legitimate interest).
- Google Maps cookies: Google Maps is only loaded after your explicit consent via the cookie banner. Google may set its own cookies. Legal basis: Art. 6(1)(a) GDPR (consent). You can withdraw your consent at any time by clearing your browser storage.
- Google Analytics cookies: Statistics cookies for anonymous reach measurement are set only after your explicit consent via the cookie banner (details in section 8a). Legal basis: Art. 6(1)(a) GDPR (consent), withdrawable at any time.
6. Contact Form
When you use our contact form, the following data is processed:
- Name, email address (required fields)
- Apartment selection, check-in/check-out dates, number of guests, message (optional)
Purpose: Processing your enquiry and initiating a rental agreement.
Legal basis: Art. 6(1)(b) GDPR (pre-contractual measures).
Recipient: The data is transmitted via Resend Inc. (USA, SCCs) by email to info@stoacherhof.com.
Retention period: Contact enquiries are deleted after full processing or at the latest after 6 months, provided no booking is made. In the event of a booking, the statutory retention periods apply (7 years pursuant to the Austrian Federal Fiscal Code / BAO).
7. Contact via Email, Phone and WhatsApp
If you contact us by email, phone or via WhatsApp, your details will be stored for the purpose of processing your enquiry.
Legal basis: Art. 6(1)(b) and (f) GDPR.
Retention period: As with the contact form (6 months or statutory retention periods in the event of a booking).
When using WhatsApp, the WhatsApp Privacy Policy (Meta) also applies.
8. Web Analytics — Vercel Web Analytics
This website uses Vercel Web Analytics — a privacy-friendly web analytics service by Vercel Inc. (USA), which is also our hosting provider.
This service collects no personal data, uses no cookies and creates no individual user profiles. Only aggregated statistics (page views, referrer, approximate location at country level) are collected. No cross-site tracking takes place.
Legal basis: Art. 6(1)(f) GDPR (legitimate interest in website optimisation). Consent is not required as no personal data is processed.
Transfer to the USA: Vercel Inc. is certified under the EU-US Data Privacy Framework; the transfer takes place on that basis (Art. 45 GDPR).
8a. Reach measurement (Google Analytics 4)
In addition, and only with your explicit consent, we use Google Analytics 4, a web analytics service by Google Ireland Limited (Gordon House, Barrow Street, Dublin 4, Ireland; “Google”).
Google Analytics uses cookies that enable an analysis of your use of the website (including pages viewed, referrer/traffic source, approximate location at country level, device and browser). Google truncates IP addresses on the server side before storage (GA4 default); we do not combine this data with other data.
Legal basis: Art. 6(1)(a) GDPR (consent). You give consent via the cookie notice (“Accept all”); without consent, Google Analytics is not loaded. You can withdraw your consent at any time with future effect via the “Cookie settings” link in the footer (reopens the choice) or by deleting the cookies stored in your browser.
Ad performance measurement (Google Ads): If we run online ads, we also measure — again only with your consent and via the same Google technology — whether a visit originated from an ad and whether it led to an enquiry or booking (conversion measurement; cookies such as “_gcl_aw” may be set). Without consent, no ad performance measurement takes place.
Transfer to the USA: Google LLC (USA) may access the data. Google is certified under the EU-US Data Privacy Framework (Art. 45 GDPR).
More: policies.google.com/privacy · Opt-out browser add-on: tools.google.com/dlpage/gaoptout
9. Google Maps
On our contact page, we offer an embedded map from Google Maps. The map is only loaded after your explicit consent via the cookie banner.
When loading the map, data (including your IP address) is transferred to Google servers. Google may set its own cookies.
Legal basis: Art. 6(1)(a) GDPR (consent).
Provider: Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland.
10. Booking Platforms
Bookings via Booking.com and EasyBooking are subject to the respective privacy policies of these providers. We have no influence on the data processing by these platforms.
Legal basis: Art. 6(1)(b) GDPR (performance of a contract).
11. Fonts
This website uses the fonts Playfair Display and Source Sans 3 from Google Fonts. The fonts are served locally from our server (self-hosted via Next.js). No direct connection to Google servers is made by your browser.
12. Your Rights
Under the GDPR, you have the right at any time to:
- Access the data stored about you (Art. 15 GDPR)
- Rectification of inaccurate data (Art. 16 GDPR)
- Erasure of your data (Art. 17 GDPR)
- Restriction of processing (Art. 18 GDPR)
- Object to processing (Art. 21 GDPR)
- Data portability (Art. 20 GDPR)
- Withdrawal of consent with effect for the future (Art. 7(3) GDPR)
To exercise your rights, please contact us at: info@stoacherhof.com
13. Right to Lodge a Complaint with a Supervisory Authority
You have the right to lodge a complaint with the competent data protection authority:
Austrian Data Protection Authority
Barichgasse 40–42, 1030 Vienna
Phone: +43 1 52 152-0
Email: dsb@dsb.gv.at
Website: www.dsb.gv.at
14. Currency and Changes to This Privacy Policy
This privacy policy is currently valid (as of: July 2026). We reserve the right to amend this privacy policy to reflect changes in the legal situation or changes to our data processing activities. The current version is always available on this page.