Privacy policy

Controller

Free Walking Tour Salzburg e.U., owner Gerhard Reus,
Ignaz-Härtl-Straße 8, 5020 Salzburg, Austria
Email: [email protected]

The request form

When you ask about the apartment we process what you enter: your name, email address, optionally a phone number, your rough dates and your message.

The legal basis is Art 6(1)(b) GDPR: processing takes place to carry out pre-contractual steps at your request. Name, email address and message are needed to handle the enquiry; without them we cannot reply. Everything else is optional.

The data is stored in our own system on servers in Germany and is not passed to third parties. When an enquiry arrives we receive an email notification with your address as the reply-to.

To keep automated submissions out, the form contains a hidden field you never see, and the number of submissions per connection is capped. Your IP address is processed only temporarily for that and stored solely as a non-reversible hash, never in clear text. The legal basis is Art 6(1)(f) GDPR: our legitimate interest in protection against automated requests. No external verification service is involved.

Retention: 365 days at most, after which enquiries are deleted.

If a tenancy comes about, the associated contract and invoice data fall under statutory retention obligations, in particular the seven-year period under § 132 of the Austrian Federal Fiscal Code. Those periods take precedence over the retention stated above.

Analytics

This website uses Cloudflare Web Analytics, a cookieless measurement of reach with no cross-device tracking.

The analytics beacon measures which pages are opened and technical figures such as load time and browser type, without setting a persistent identifier and without following you across websites. The legal basis is Art 6(1)(f) GDPR: our legitimate interest in a data-minimal measurement of how this website is used.

No cookies, no embeds

This website sets no cookies and embeds no videos, maps, fonts or scripts from other servers, which is why it needs no consent banner. The fonts it uses are served from our own server.

Hosting

This website runs at Hetzner Online GmbH on servers in Germany. Opening the site produces server logs (IP address, time, page requested, user agent), which are kept for operational security and deleted after 14 days at the latest. Cloudflare, Inc. sits in front as the DNS and security service. Cloudflare is certified under the EU-US Data Privacy Framework, so where data is transferred to the USA an adequacy decision of the EU Commission applies. The legal basis is Art 6(1)(f) GDPR: our legitimate interest in secure and stable operation.

Your rights

You have the right of access, rectification, erasure, restriction of processing, data portability and objection. Simply write to the email address given above.

You also have the right to complain to the Austrian data protection authority:dsb.gv.at.