Privacy Policy
at Amolaris Garden Lodges & Guesthouse

Tel: +39 0473 74 20 57
Email: info@amolaris.com
PEC: obermuehle@pec.rolmail.net

g) Use of dialogue content and technical data by SaaS service providers
To operate the chatbot, we rely on the professional and technical support of a service provider that processes technical data, aggregated usage statistics and dialogue content for the provision of the chatbot in accordance with a contractual agreement with us (Article 6(1)(b) GDPR).

The service provider may also use this data under its own responsibility to train the algorithms and models underlying the chatbot, improve response quality and enhance system stability (Article 6(1)(f) GDPR). For this purpose, the service provider uses pseudonymised or, wherever possible, fully anonymised excerpts from dialogues and usage statistics. It is therefore not readily possible for the service provider to identify you personally.

You may object to the transfer of your data to the service provider at any time, unless compelling legitimate grounds override your objection. 
 

Recipients of Data – How and to Whom We Disclose Personal Data
Without prejudice to the recipients listed in our general Privacy Policy, we may forward certain excerpts from dialogues and contact information to affiliated companies within the tourism region for the purposes stated above. Each affiliated company receiving the data processes it under its own responsibility as a controller within the meaning of Article 4(7) GDPR and solely for the purpose of responding to your enquiry and ensuring service quality.

If you use the chatbot through our WhatsApp channel, your telephone number may additionally be stored and processed by WhatsApp Ireland Ltd. under its own responsibility for internal service purposes. We have no influence over this processing. Further details can be found in the privacy policy provided by WhatsApp: https://www.whatsapp.com/legal/privacy-policy-eea.
 

Retention Period for Personal Data
We process and store users’ personal data in accordance with our general Privacy Policy and, in all cases, only for as long as is strictly necessary to fulfil the purposes for which the data was collected.

In particular:
Plain-text dialogues: are retained for the period required to process user enquiries and provide information and are generally deleted or anonymised after 72 hours. If the chatbot is used through our WhatsApp channel, message content and the telephone number stored with WhatsApp may be retained for up to one year from the date on which the respective chat was created. Data may be processed for a longer period where circumstances justify an extension of the retention period. In such cases, the personal data will be deleted or anonymised no later than 30 days after the reason for extended retention ceases to apply. 

System and security logs: are retained for as long as required to ensure stable operation and network security, but generally for no longer than 90 days.

Once the above retention periods have expired, the data will be deleted from our live and backup systems or anonymised for statistical purposes.

Rights of Data Subjects
As a data subject, the user may exercise the rights granted under the GDPR (Articles 15 to 21), in particular:

Right to withdraw consent (Article 7 GDPR): you may withdraw consent previously given for any processing activities for which consent is required at any time. The lawfulness of processing carried out before the withdrawal remains unaffected. Once consent has been withdrawn, the relevant personal data will no longer be processed for the purposes covered by that consent.

Right of access (Article 15 GDPR): you have the right to obtain confirmation as to whether or not personal data concerning you is being processed and, where this is the case, to receive information about the purposes of processing, the categories of personal data concerned, the recipients or categories of recipients, the retention period and other relevant information.

Right to rectification (Article 16 GDPR): you may request the correction of inaccurate personal data and/or the completion of incomplete personal data.

Right to erasure (Article 17 GDPR): you may request the deletion of your personal data in the cases and under the conditions provided for by law.

Right to restriction of processing (Article 18 GDPR): you may request that processing be restricted in the cases and under the conditions provided for by law.

Right to data portability (Article 20 GDPR): you may request the portability of personal data, i.e. the transfer of personal data, where technically feasible, from one data controller to another in the cases and under the conditions provided for by law.

Right to object (Article 21 GDPR): you may object to the processing of personal data on grounds relating to your particular situation or where personal data is processed for direct marketing purposes.

You may exercise your rights by submitting a request to the data controller using the contact details stated above. 

If you believe that the processing of personal data relating to you infringes the GDPR, you have the right to lodge a complaint with the supervisory authority: Italian Data Protection Authority, Piazza Venezia 11, 00187 Rome, https://www.garanteprivacy.it/.
 

Use by Minors
The chatbot is intended exclusively for persons aged 18 and over. If we become aware that a person under the age of 18 is using our chatbot, we will prevent further use and delete all associated personal data.

If you have reason to believe that a minor has submitted personal data to the chatbot, please contact us immediately using the contact details provided in Section 1 (Who We Are). We will endeavour to remove the relevant information from our systems without delay.
 

Contact Form
If you send us an enquiry via the contact form, the information you enter in the form, including the contact details provided there, will be stored by us for the purpose of processing your enquiry and any follow-up questions. We will not disclose this data without your consent.

This data is processed on the basis of Article 6(1)(b) GDPR where your enquiry relates to the performance of a contract or is necessary in order to take steps prior to entering into a contract. In all other cases, processing is based on our legitimate interest in handling enquiries addressed to us efficiently (Article 6(1)(f) GDPR) or on your consent (Article 6(1)(a) GDPR), where such consent has been requested.

The data entered by you in the contact form will remain with us until you request its deletion, withdraw your consent to storage, or the purpose for storing the data no longer applies, for example once your enquiry has been fully processed. Mandatory statutory provisions, in particular statutory retention periods, remain unaffected.

Enquiries by Email, Telephone or Fax
If you contact us by email, telephone or fax, your enquiry, including any personal data arising from it, such as your name and the content of your enquiry, will be stored and processed by us for the purpose of handling your request. We will not disclose this data without your consent.

This data is processed on the basis of Article 6(1)(b) GDPR where your enquiry relates to the performance of a contract or is necessary in order to take steps prior to entering into a contract. In all other cases, processing is based on our legitimate interest in handling enquiries addressed to us efficiently (Article 6(1)(f) GDPR) or on your consent (Article 6(1)(a) GDPR), where such consent has been requested.

The data sent to us as part of your enquiry will remain with us until you request its deletion, withdraw your consent to storage, or the purpose for storing the data no longer applies, for example once your request has been fully processed. Mandatory statutory provisions, in particular statutory retention periods, remain unaffected.

Newsletter Data
If you would like to receive the newsletter offered on our website, we require your email address as well as information that enables us to verify that you are the owner of the email address provided and that you consent to receiving the newsletter. No additional data is collected, or only on a voluntary basis. We use this data exclusively to send the requested information and do not disclose it to third parties.

The data entered into the newsletter registration form is processed exclusively on the basis of your consent (Article 6(1)(a) GDPR). You may withdraw your consent to the storage of the data, your email address and its use for sending the newsletter at any time, for example by using the unsubscribe link in the newsletter. The lawfulness of data processing carried out before withdrawal remains unaffected.

The data you provide for the purpose of receiving the newsletter will be stored by us until you unsubscribe and will be deleted following cancellation of your subscription. Data stored by us for other purposes, such as email addresses for a members’ area, remains unaffected.

Google Tag Manager
For reasons of transparency, please note that we use Google Tag Manager. Google Tag Manager itself does not collect personal data. It facilitates the integration and management of our tags. Tags are small pieces of code used to measure traffic and visitor behaviour, evaluate the impact of online advertising, or test and optimise our websites. Further information about Google Tag Manager is available at: https://marketingplatform.google.com/intl/de/about/analytics/tag-manager/use-policy/

Google Conversion Tracking
This website uses Google Conversion Tracking. The provider is Google Ireland Limited (“Google”), Gordon House, Barrow Street, Dublin 4, Ireland.

With the help of Google Conversion Tracking, Google and we can determine whether users have carried out certain actions. For example, we can evaluate which buttons on our website are clicked, how often they are clicked, and which products are viewed or purchased particularly frequently. This information is used to create conversion statistics. We are informed of the total number of users who clicked on our advertisements and the actions they performed. We do not receive information that allows us to identify individual users personally. Google itself uses cookies or comparable recognition technologies for identification purposes.

Google Conversion Tracking is used on the basis of Article 6(1)(f) GDPR. The website operator has a legitimate interest in analysing user behaviour in order to optimise both its website and its advertising. Where corresponding consent has been requested, for example consent to the storage of cookies, processing takes place exclusively on the basis of Article 6(1)(a) GDPR; consent may be withdrawn at any time.

Further information on Google Conversion Tracking can be found in Google’s Privacy Policy: https://policies.google.com/privacy?hl=en.

Payment Providers
Processing of Data (Customer and Contract Data)
We collect, process and use personal data only to the extent necessary to establish, define the content of, or amend a legal relationship (master data). This takes place on the basis of Article 6(1)(b) GDPR, which permits the processing of data for the performance of a contract or in order to take steps prior to entering into a contract. Personal data relating to the use of our websites (usage data) is collected, processed and used only insofar as this is necessary to enable the user to make use of the service or for billing purposes.

Customer data collected will be deleted once the order has been completed or the business relationship has ended. Statutory retention periods remain unaffected.

Data transfer upon conclusion of a contract for services and digital content
We transfer personal data to third parties only where this is necessary for the performance of the contract, for example to the financial institution responsible for processing payments.

No further transfer of data will take place unless you have expressly consented to such transfer. Your data will not be passed on to third parties without your express consent, for example for advertising purposes.

The legal basis for data processing is Article 6(1)(b) GDPR, which permits the processing of data for the performance of a contract or in order to take steps prior to entering into a contract.

Review Tool
HolidayCheck
This website integrates a HolidayCheck widget to display reviews. The provider is HolidayCheck AG, Bahnweg 8, CH-8598 Bottighofen, Switzerland (https://www.holidaycheck.de/impressum).

To use the functions of the HolidayCheck widget, it is necessary to store your IP address, browser information (name, version), website, the user’s operating system, screen resolution and the language settings of the browser and/or operating system. Clicking the “Rate now” button opens a pop-up window. If you enter and submit a review there, this data is generally transferred to and stored on a HolidayCheck server in Switzerland. The provider of this website has no influence over this data transfer.

The HolidayCheck widget is used in our legitimate interest in displaying reviews of our hotel submitted on HolidayCheck and in providing guests with the opportunity to write a review on HolidayCheck. This constitutes a legitimate interest within the meaning of Article 6(1)(f) GDPR.

Further information on how HolidayCheck handles user data can be found in the HolidayCheck Privacy Policy: https://www.holidaycheck.de/datenschutz.

Wellness Heaven
This website integrates a Wellness Heaven widget to display reviews. The provider is Wellness Heaven® Hotel Guide, Klosterweg 41, D-82335 Berg am Starnberger See, Germany.

To use the functions of the Wellness Heaven widget, it is necessary to store your IP address, browser information (name, version), website, the user’s operating system, screen resolution and the language settings of the browser and/or operating system. Your data is generally transferred to and stored on a Wellness Heaven server. The provider of this website has no influence over this data transfer.

The Wellness Heaven widget is used in our legitimate interest in displaying reviews of our hotel submitted on Wellness Heaven. This constitutes a legitimate interest within the meaning of Article 6(1)(f) GDPR.

Further information on how Wellness Heaven handles user data can be found in its Privacy Policy at https://www.wellness-heaven.de/wellness/datenschutz/.

Content Delivery Network (CDN)

Google CDN
Content on this website is delivered via a so-called Content Delivery Network (CDN). The provider is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland.

To use content hosted by Google, it is necessary to store your IP address, browser information (name, version), website, the user’s operating system, screen resolution and the language settings of the browser and/or operating system. Your data is generally transferred to and stored on a Google server. The provider of this website has no influence over this data transfer.

The content is used in our legitimate interest in ensuring high-performance delivery of the content on our website. This constitutes a legitimate interest within the meaning of Article 6(1)(f) GDPR.

Further information on how Google handles user data can be found in its Privacy Policy at https://www.google.com/policies/technologies/ads/.

Online Booking
Kognitiv

Insurance
Ergo Travel Insurance ERV
To offer the services of Ergo Travel Insurance ERV, this website integrates a widget provided by Ergo Travel Insurance ERV. The provider of this widget is ERV (Europäische Reiseversicherung AG), Rosenheimer Straße 116, 81669 Munich, Germany.

To use the functions of the Ergo Travel Insurance ERV widget, it is necessary to store your IP address, browser information (name, version), website, the user’s operating system, screen resolution and the language settings of the browser and/or operating system. If you use Ergo Travel Insurance ERV, this data is generally transferred to and stored on a server operated by Ergo Travel Insurance ERV. The provider of this website has no influence over this data transfer.

Ergo Travel Insurance ERV is used in our legitimate interest in offering guests a simple and convenient way to take out travel insurance. This constitutes a legitimate interest within the meaning of Article 6(1)(f) GDPR.

Further information on how Ergo Travel Insurance ERV handles user data can be found in its Privacy Policy at https://www.reiseversicherung.de/de/datenschutz.html.

Widgets
Giggle Events
This website integrates a Giggle widget that enables events to be displayed. The provider is Giggle GmbH, Müllerstraße 1, 6020 Innsbruck, Austria, EU.

To use the functions of the Giggle widget, it is necessary to store your IP address, browser information (name, version), website, the user’s operating system, screen resolution and the language settings of the browser and/or operating system. If you use Giggle, this data is generally transferred to and stored on a Giggle server. The provider of this website has no influence over this data transfer.

Giggle is used in our legitimate interest in presenting events in a simple and convenient way. This constitutes a legitimate interest within the meaning of Article 6(1)(f) GDPR.

Further information on how Giggle handles user data can be found in its Privacy Policy at https://www.giggle.tips/privacy.

Forms
Handling of Applicant Data
We offer you the opportunity to apply to work with us, for example by email, post or via an online application form. Below, we provide information about the scope, purpose and use of the personal data collected as part of the application process. We assure you that your data is collected, processed and used in accordance with applicable data protection law and all other statutory provisions, and that your data is treated as strictly confidential.

Push Notifications
PushPanda
We use web push notifications from PushPanda.io. Web push notifications are messages that can be displayed on your device without you having to open the website or the relevant app.

No unique user data such as IP addresses or similar information that would allow a direct conclusion to be drawn about an individual user is stored. When you subscribe to the notification distribution list using the opt-in procedure, only an identification key and geographical IP information (country and federal state/region) are transmitted and stored in the PushPanda.io database. This key is assigned by the relevant browser provider (Google, Mozilla, Apple, etc.) and enables notifications to be sent to the respective browser at a later stage. Notifications are delivered directly via the browser providers.

If consent to push notifications is withdrawn (opt-out), all data stored by PushPanda.io is deleted and the identification key becomes invalid. PushPanda.io is a service provided by Project K GmbH, based in Innsbruck, Austria.

Consent to the Use of Cookies
We use cookies to ensure that our website functions properly. In order to obtain your valid consent to the use and storage of cookies in the browser you use to access our website, and to document this consent correctly, we use a consent management platform: CookieFirst. This technology is provided by Digital Data Solutions BV, Plantage Middenlaan 42a, 1018 DH Amsterdam, the Netherlands. Website: https://cookiefirst.com – hereinafter referred to as CookieFirst.

When you access our website, a connection is established with the CookieFirst server so that we can obtain your valid consent to the use of certain cookies. CookieFirst then stores a cookie in your browser in order to activate only those cookies to which you have consented and to document your consent correctly. The processed data is stored until the specified retention period expires or until you request deletion of the data. Different statutory retention periods may apply where required by law.

CookieFirst is used to obtain the consent required by law for the use of cookies. The legal basis for this is Article 6(1)(c) of the General Data Protection Regulation (GDPR).