Privacy Policy
Information on the processing of personal data in accordance with the General Data Protection Regulation (GDPR).
This English translation is provided for your convenience — the German version is legally binding.
1. Controller
The controller within the meaning of the General Data Protection Regulation (GDPR) for the processing of personal data on this website is:
Flügel, Lars und Freia GesbR
Mühlbach 530
5505 Mühlbach am Hochkönig
Österreich
Email: office@daskoeniglich.at
Telephone: +49 171 74 94 966
If you have any questions about the processing of your personal data, you are welcome to contact us at any time.
2. Principles of data processing
We process the personal data of our guests and website visitors exclusively in accordance with the principles of Art. 5 GDPR — in particular lawfully, fairly, transparently, for specified purposes and limited to what is necessary.
Depending on the operation, the legal bases for processing are:
- Art. 6(1)(a) GDPR — your consent, for example when signing up to the newsletter;
- Art. 6(1)(b) GDPR — the performance of a contract or pre-contractual measures, for example for enquiries and bookings;
- Art. 6(1)(c) GDPR — compliance with legal obligations, for example under tax and guest registration law;
- Art. 6(1)(f) GDPR — our legitimate interest in the secure, stable and appealing operation of this website.
3. Hosting & server log files
This website is hosted by Vercel Inc., 340 S Lemon Ave #4133, Walnut, CA 91789, USA. Vercel acts as our processor pursuant to Art. 28 GDPR; a corresponding data processing agreement has been concluded. The site is delivered via Vercel's global content delivery network, in the course of which data may also be transferred to the USA. Vercel bases this transfer on the EU Standard Contractual Clauses.
When the website is accessed, the hosting provider automatically collects data in so-called server log files, which your browser transmits. These typically include:
- the IP address of the accessing device,
- the date and time of access,
- the page or file accessed,
- the referrer URL (the page visited previously),
- the browser and operating system used.
This data is not combined with other data sources. Processing is carried out on the basis of Art. 6(1)(f) GDPR; our legitimate interest lies in the technically error-free presentation, stability and security of this website. Log data is deleted as soon as it is no longer required for these purposes.
4. Contacting us
If you contact us by email, telephone or WhatsApp, we process the data you provide (e.g. name, contact details, content of your enquiry) exclusively to deal with your request. The legal basis is Art. 6(1)(b) GDPR where your enquiry relates to a contract or its initiation, and otherwise Art. 6(1)(f) GDPR (legitimate interest in responding to enquiries).
The contact form on this website opens your local email application with a prepared message. Your entries are neither stored on nor transmitted to our servers — the message is sent exclusively via your own email application.
If you contact us via WhatsApp, please note that the service is operated by WhatsApp Ireland Limited and Meta Platforms. WhatsApp/Meta processes personal data (including your telephone number and communication metadata) under its own responsibility; a transfer to third countries, in particular the USA, is possible. For details, please refer to WhatsApp's privacy policy. If you would prefer to avoid this, please contact us by email or telephone.
5. Booking via HostCollect
For online bookings and availability enquiries, we use the booking platform HostCollect (app.hostcollect.com). When you make a reservation via our booking page, the data required for this purpose (e.g. name, address, email address, telephone number, travel dates, payment information) is processed via HostCollect. The legal basis is Art. 6(1)(b) GDPR (performance of a contract or implementation of pre-contractual measures).
This website also embeds a HostCollect script that records page views in order to provide the booking process technically and to trace its origin. In doing so, your IP address and information about the page accessed may be transmitted to HostCollect. Processing is carried out on the basis of Art. 6(1)(f) GDPR; our legitimate interest lies in providing a functioning online booking service.
6. Fonts
This website uses the Cormorant Garamond, Montserrat and Amsterdam Four typefaces. They are served locally from our own server. When the fonts are loaded, no connection is therefore made to Google servers, and no data – in particular no IP address – is transmitted to Google or any third party in this process. Independently of this, we use Google Analytics with your consent; see section 13.
7. Newsletter
You can sign up for our newsletter via the website. Registration takes place by email to us; the data processed is your email address. The legal basis is your consent pursuant to Art. 6(1)(a) GDPR.
You may withdraw your consent at any time with effect for the future — informally, by email to office@daskoeniglich.at. The lawfulness of the processing carried out up to the point of withdrawal remains unaffected. After your withdrawal, your email address will be deleted from the mailing list.
8. Social media links
On this website you will find links to our profiles on Instagram and Facebook (Meta Platforms) as well as a link to WhatsApp. These are simple links — no data is transferred to these providers merely by visiting our website.
Only when you follow a link does the respective provider process your data under its own responsibility. For the scope and purpose of this processing, please refer to the privacy information of the respective provider.
9. External booking platforms
Our chalet can also be booked via external booking platforms such as Booking.com, to which we may refer. If you book via such a platform, the respective platform operator processes your data under its own responsibility in accordance with its privacy policy. We receive from the platform the booking data required to manage your stay (Art. 6(1)(b) GDPR).
10. Data subject rights
As a data subject, you have the following rights under the GDPR:
- Right of access to the data processed (Art. 15 GDPR)
- Right to rectification of inaccurate data (Art. 16 GDPR)
- Right to erasure (Art. 17 GDPR)
- Right to restriction of processing (Art. 18 GDPR)
- Right to data portability (Art. 20 GDPR)
- Right to object to processing based on legitimate interests (Art. 21 GDPR)
- Right to withdraw consent given, with effect for the future (Art. 7(3) GDPR)
To exercise your rights, an informal message to office@daskoeniglich.at is sufficient.
You also have the right to lodge a complaint with a data protection supervisory authority. In Austria, this is the Austrian Data Protection Authority (Österreichische Datenschutzbehörde), Barichgasse 40–42, 1030 Vienna, www.dsb.gv.at.
11. Storage period
We store personal data only for as long as is necessary for the respective purposes or as required by statutory retention obligations. Booking and invoicing data are subject in particular to the retention periods under tax and company law (in Austria, generally seven years). Once the respective periods have expired, the data is deleted unless there are legitimate grounds for further storage.
12. Real-time visit notification
To be informed in real time when our website is visited, our server sends us a brief notification via the messenger service Telegram (Telegram FZ-LLC, United Arab Emirates) whenever a page is accessed. The data transmitted comprises the pages viewed during the visit together with the approximate time spent on each, the referring source page, an approximate location derived from your IP address (city/region/country, or approximate coordinates as a map link), as well as the type of device and the time. To classify the network access (e.g. in the case of roaming or a VPN), your IP address is additionally transmitted to the service ipwho.is (US) in order to determine the name of the network operator. No cookies are set and none of this data is stored permanently — the notification is delivered solely to us and is not logged. The notification is updated while the visit continues; for this purpose the page history is kept only for the duration of the visit in your browser (sessionStorage).
The legal basis is our legitimate interest in knowing the current use of our website (Art. 6(1)(f) GDPR). The transmission to Telegram and ipwho.is involves a transfer to third countries; the corresponding safeguards are governed by the respective providers' data protection terms. You may object to this processing at any time (contact details under "Controller").
If you have given your consent, we additionally include the visit counter described in section 13 (number and time of your last visit) in this notification. Without your consent no such counter is stored and none is transmitted.
13. Google Analytics 4 (only with your consent)
With your consent, we use Google Analytics 4 (measurement ID G-XH02M4VGS1), a web analytics service provided by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. The service helps us understand how our website is used so that we can improve it.
Without your consent, Google Analytics is not loaded — no scripts are retrieved from Google and no data is transmitted to Google. The service is activated only once you click the consent button in the cookie notice. The legal basis is your consent pursuant to Art. 6(1)(a) GDPR (and § 165(3) of the Austrian Telecommunications Act 2021 (TKG 2021) for the storage of information on your device).
The data processed includes in particular: your truncated IP address (IP anonymisation is enabled), the pages you visit and the time spent on them, the referrer, your approximate location (country/region), device and browser data, as well as interactions that we record as events (availability enquiry, submission of the contact form, clicks on telephone, email, WhatsApp and booking links, newsletter sign-up). For this purpose, Google stores identifiers in your browser's storage. We receive aggregated reports only; the data is not used for advertising or cross-site tracking.
Google also processes data in the USA. Google Ireland Limited is our processor pursuant to Art. 28 GDPR; the transfer to third countries is based on the EU Standard Contractual Clauses as well as Google LLC's certification under the EU-U.S. Data Privacy Framework. We point out that US authorities may under certain circumstances gain access to such data.
Likewise only after your consent, we store a small visit counter (the number and time of your last visit) in your browser's localStorage; it identifies a browser, not a person. If you decline or withdraw your consent, this entry is deleted or is not created in the first place.
Withdrawal: You may withdraw your consent at any time with effect for the future — via Change cookie settings / withdraw consent. In addition, you can prevent the collection of data by using Google's browser add-on: tools.google.com/dlpage/gaoptout. Further information: Google's privacy policy.
14. Version of this privacy policy
Last updated: July 2026. We will amend this privacy policy whenever the legal situation, our services or the services we use change. The current version published here applies to each new visit.
This privacy policy has been prepared with care but does not constitute legal advice.