Privacy policy

Protecting your data is very important to us. To inform you fully about how personal data is used on www.alpinfamily.at, we ask you to take note of the following privacy information.

Controller

The controller responsible for data processing on this website is:

Alpin Family GmbH
Bauernmarkt 10, Top 8+9
1010 Wien
Österreich

Telefon: +43 6547 20 600
E-Mail: reservation@alpinfamily.at

For all matters relating to data protection, you can reach us using the contact details above.

Hosting and Server Log Files

Personal data that you transmit electronically on this website – such as your name, e-mail address or postal address – is used by us only for the purpose stated in each case, stored securely and not passed on to third parties without a legal basis.

When you visit our website, the web server automatically collects and stores information in so-called server log files: the browser used, operating system, referrer URL, IP address, and the date and time of access. The IP address is also personal data. We process this data to provide the website technically, to ensure its stability and security, and to defend against attacks. The legal basis is our legitimate interest in the secure and trouble-free operation of the website (Art. 6(1)(f) GDPR). Our hosting provider processes this data on our behalf on the basis of a data processing agreement (Art. 28 GDPR). Server log files are deleted after 14 days at the latest, unless a security-relevant incident requires longer retention.

Contact and Inquiry Forms

If you contact us via the contact or inquiry form, by e-mail or by phone, we process the data you provide (e.g. name, e-mail address, phone number, travel requests, content of your message) to handle your inquiry and to carry out pre-contractual measures (Art. 6(1)(b) GDPR). We delete this data no later than six months after your inquiry has been dealt with conclusively; if a booking is made, the retention periods stated in the section “Online Booking” apply.

Online Booking

Via the booking engine embedded on our website, you can book stays at our properties directly. In doing so, we process the data required for the booking: name and contact details, arrival and departure dates, number and age of guests, promo codes where applicable, and your payment details. This processing is carried out for the performance of the accommodation contract or for pre-contractual measures (Art. 6(1)(b) GDPR). The booking engine is operated by a specialised technical service provider acting as our processor; payment is handled by a payment service provider that processes your payment data under its own responsibility in accordance with the applicable security standards. We retain booking and invoicing data in line with statutory retention obligations, as a rule for seven years (§ 132 of the Austrian Federal Fiscal Code, BAO); statutory reporting obligations (such as guest registration) remain unaffected.

Cookies and Consent

Cookies are small files that are stored on your device when you visit our website. Technically necessary cookies are required for the operation of the website – for example for the booking engine or to store your cookie preferences. The legal basis for these is our legitimate interest in the technical provision of the website (Art. 6(1)(f) GDPR).

We only use cookies that are not technically necessary, and comparable technologies (e.g. pixels, web storage), after you have given your consent via our cookie banner (§ 165 (3) of the Austrian Telecommunications Act 2021 (TKG 2021), Art. 6(1)(a) GDPR). On your first visit, the banner lets you accept all categories, reject all, or make your own selection; we distinguish between the categories Necessary, Statistics and Marketing. We document your decision; the consent log is retained for three years (accountability, Art. 5(2) GDPR).

You can change or withdraw your consent at any time with effect for the future via the “Cookie settings” link in the footer of every page. There you will also find the always up-to-date list of all cookies used, including provider, purpose and storage period.

Google Tag Manager

We use Google Tag Manager, provided by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland, to manage services on our website. The Tag Manager itself does not set cookies and does not collect personal data; it triggers other services, which in turn are only loaded after you have given your consent.

Google Analytics 4

If you have consented to the “Statistics” category (Art. 6(1)(a) GDPR), we use Google Analytics 4, a web analytics service provided by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. Google Analytics 4 uses cookies and similar technologies to analyse the use of our website and to provide us with reports on website activity. IP addresses are not logged or stored by Google Analytics 4. We transmit your consent decision to Google via Google Consent Mode; without your consent, no analytics cookies are set. The data collected may also be transferred to servers of Google LLC in the USA; this is based on the EU-US Data Privacy Framework, under which Google is certified, and additionally on standard contractual clauses (Art. 46 GDPR). Analytics data is deleted automatically after 14 months. You can withdraw your consent at any time via the “Cookie settings”.

Meta Pixel and Retargeting (Facebook, Instagram)

If you have consented to the “Marketing” category (Art. 6(1)(a) GDPR, § 165 (3) TKG 2021), we use the Meta Pixel provided by Meta Platforms Ireland Limited, Merrion Road, Dublin 4, Ireland. The pixel enables us to measure the effectiveness of our advertising and to show visitors to our website interest-based advertising on Facebook and Instagram (retargeting, custom audiences). In doing so, data such as your IP address and information about your browser and the pages you visited is transmitted to Meta; Meta may link this data to your user account. For the collection and transmission of this data, we and Meta are joint controllers (Art. 26 GDPR); the subsequent processing is carried out under Meta's sole responsibility. Data may be transferred to the USA in this context; this is based on the EU-US Data Privacy Framework, under which Meta is certified, and additionally on standard contractual clauses. Without your consent, the pixel is not loaded; you can withdraw consent you have given at any time via the “Cookie settings”. Further information can be found in Meta's privacy policy (www.facebook.com/privacy) and in the ad settings of your Meta account.

HERE Maps

To display maps, we use HERE Maps, provided by HERE Global B.V., Kennedyplein 222–226, 5611 ZT Eindhoven, Netherlands. The map is only loaded after you have actively clicked on it or given your consent via the cookie banner (Art. 6(1)(a) GDPR). When the map is loaded, your IP address is transmitted to HERE. Further information: https://legal.here.com/en-gb/privacy/policy

YouTube Videos

We embed videos from YouTube, a service of Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland, on our website. The videos are embedded in privacy-enhanced mode and are only loaded once you actively start them or have given your consent via the cookie banner (Art. 6(1)(a) GDPR). When a video is played, data (including your IP address) is transmitted to Google and cookies are set; a transfer to the USA is possible (EU-US Data Privacy Framework, standard contractual clauses).

Links to Social Networks

Our website contains links to our profiles on Facebook, Instagram and YouTube. These are plain links – simply visiting our website does not transmit any data to the networks. Only once you follow a link do the privacy policies of the respective provider apply.

Job Applications

We accept applications via our careers portal www.alpinfamily-jobs.at. The privacy policy of the careers portal applies to the data processing carried out there.

Data Transfers to Third Countries

Where we use services whose providers transfer data to the USA or other third countries (see the respective sections), we base these transfers on an adequacy decision of the European Commission – for the USA, the EU-US Data Privacy Framework for providers certified under it – and additionally on standard contractual clauses pursuant to Art. 46 GDPR.

Your Rights

With regard to your personal data, you have the rights of access (Art. 15 GDPR), rectification (Art. 16 GDPR), erasure (Art. 17 GDPR), restriction of processing (Art. 18 GDPR) and data portability (Art. 20 GDPR). You also have the right to object, on grounds relating to your particular situation, to processing based on our legitimate interest (Art. 21 GDPR). You can withdraw any consent you have given at any time with effect for the future; the lawfulness of processing carried out before the withdrawal remains unaffected. To exercise your rights, an informal message to reservation@alpinfamily.at is sufficient. If you believe that the processing of your data violates data protection law, you can lodge a complaint with the Austrian Data Protection Authority (Österreichische Datenschutzbehörde): Barichgasse 40–42, 1030 Vienna, Austria, www.dsb.gv.at.

Data Security

This website uses TLS encryption (“https”). Data that you transmit via our forms or the booking engine is thereby protected against access by third parties while in transit. In addition, we protect our systems against loss, misuse and unauthorised access through technical and organisational measures.

Changes to this Privacy Policy

We will amend this privacy policy whenever our website, the services we use or the legal situation change. The version published on this page at the relevant time applies.

Version: August 2026