Privacy policy

1. Controller

Luxescape GmbH
Attn. Julia Kobermann
Feldweg 14
9562 Himmelberg
Carinthia, Austria

Phone: +43 664 3458434
E-Mail: info@luxescape-ferienwohnungen.at
WhatsApp: +43 664 3458434

Company register: FN 614148 i, Regional Court of Klagenfurt · VAT ID: ATU79972148

We have not appointed a data protection officer as we are not required to do so under Art. 37 GDPR. For any data protection questions, please contact us using the details above.

2. Summary

• Without your consent we only use strictly necessary cookies and load no analytics or advertising services.
• We currently do not use analytics or advertising services (Google Analytics, Google Ads, Meta, TikTok). Should we activate them in future, only with your consent.
• You can change or withdraw your choice at any time in the cookie settings.
• The website is hosted by Hostinger in the EU and fonts on our own server. There are no embedded maps or videos, and WhatsApp opens only when you send a message yourself.
• We never sell data.

3. Legal bases

We process personal data under the General Data Protection Regulation (GDPR), the Austrian Data Protection Act (DSG) and the Austrian Telecommunications Act 2021 (TKG 2021) on the following bases:

• Consent – Art. 6(1)(a) GDPR, for cookies and similar technologies also section 165(3) TKG 2021 (e.g. analytics, advertising)
• Contract and pre-contractual steps – Art. 6(1)(b) GDPR (enquiry, offer, booking, stay)
• Legal obligation – Art. 6(1)(c) GDPR (e.g. guest registration under the Registration Act, tourist tax, tax and commercial record-keeping)
• Legitimate interests – Art. 6(1)(f) GDPR (secure, functioning website, communication with guests, direct marketing to existing guests, asserting claims)

4. Hosting

This website is hosted by Hostinger International Ltd., 61 Lordou Vironos Street, 6023 Larnaca, Cyprus. Hostinger processes data on our behalf as a processor under Art. 28 GDPR based on a data processing agreement. Servers are located in the European Union.

Privacy information: hostinger.com/legal/privacy-policy

5. Server log files

Each time the website is accessed, the server automatically stores information sent by your browser: IP address, date and time, requested address, amount of data transferred, status code, browser type and version, operating system and – if transmitted – the referring page.

This is technically necessary to deliver the website, fend off attacks and find errors (Art. 6(1)(f) GDPR). The data is not combined with other data. Logs are deleted after 30 days at the latest unless needed longer to investigate a security incident.

6. Data security

This website is delivered exclusively over encrypted HTTPS (TLS). Security policies (including a Content Security Policy) also prevent third-party content from being injected unnoticed. We take appropriate technical and organisational measures under Art. 32 GDPR to protect your data against loss, manipulation and unauthorised access.

7. Cookies and consent management

Cookies are small text files stored by your browser. We distinguish:

• Necessary – stores your cookie choice (cookie lux_consent, 12 months). Legal basis: section 165(3) TKG 2021, Art. 6(1)(f) GDPR.
• Statistics – Google Analytics 4. Only with consent and only if we have activated the service.
• Marketing – Google Ads, Meta Pixel, TikTok Pixel. Only with consent and only if we have activated the service.

On your first visit a notice asks for your consent. “Accept all” and “Necessary only” carry equal weight; without consent no analytics or advertising service is loaded. We use Google Consent Mode v2: Google services receive your decision as a signal and may not set cookies without consent.

You can withdraw or change your consent at any time with effect for the future via the cookie settings in the footer of every page. All cookies with their lifetimes are listed in the cookie overview.

8. Google Analytics 4

With your consent we use Google Analytics 4, a web analytics service of Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland (“Google”). It records how visitors use the website – pages viewed, time spent, approximate region, device type, traffic source and clicks on “Book now”, WhatsApp or phone – so we can see which content helps and where to improve.

Google Analytics 4 does not store IP addresses; approximate location is derived from truncated data. Usage data is deleted automatically after 14 months. Google signals and ad personalisation via Analytics are not enabled unless you also consent to “Marketing”.

Legal basis: your consent (Art. 6(1)(a) GDPR, section 165(3) TKG 2021). A data processing agreement with Google is in place. Data may be transferred to Google LLC in the USA; Google LLC is certified under the EU-US Data Privacy Framework (adequacy decision of 10 July 2023), supplemented by standard contractual clauses.

Privacy policy: policies.google.com/privacy · Opt-out browser add-on: tools.google.com/dlpage/gaoptout

9. Google Ads, conversion tracking and remarketing

With your consent to “Marketing” we use Google Ads by Google Ireland Limited. We run ads in Google Search, on YouTube and on partner sites so that you find us when searching for a holiday apartment or holiday home in Carinthia.

• Conversion tracking: if you reach us via an ad and click “Book now”, WhatsApp, phone or e-mail, Google learns that the ad was successful. We only see aggregated figures, not individuals.
• Remarketing: Google may later show you our ads if you have already visited our website.

Cookies (e.g. _gcl_au, IDE) are set and device and usage data processed. Google may link this data to your Google account if you are signed in. Legal basis: your consent (Art. 6(1)(a) GDPR, section 165(3) TKG 2021). Third-country transfers as above (EU-US Data Privacy Framework, standard contractual clauses).

You can also turn off personalised ads at adssettings.google.com.

10. Google Tag Manager

Where used, we use Google Tag Manager by Google Ireland Limited to manage the services above. It is loaded only after your consent, sets no cookies itself and does not analyse data, but may technically transmit your IP address to Google. Legal basis: your consent (Art. 6(1)(a) GDPR).

11. Meta Pixel (Facebook and Instagram)

With your consent to “Marketing” we use the Meta Pixel of Meta Platforms Ireland Limited, Merrion Road, Dublin 4, D04 X2K5, Ireland (“Meta”). It measures the success of our ads on Facebook and Instagram and lets us show relevant offers there to visitors of our website (Custom Audiences). Data recorded includes pages viewed, clicks on “Book now” or WhatsApp, device and browser information and IP address; cookies: _fbp, fr.

We are joint controllers with Meta for collecting and transmitting the data (Art. 26 GDPR); the agreement is available at facebook.com/legal/controller_addendum. Meta is solely responsible for further processing. Data may be transferred to Meta Platforms Inc. in the USA; Meta is certified under the EU-US Data Privacy Framework.

Legal basis: your consent (Art. 6(1)(a) GDPR, section 165(3) TKG 2021). Privacy policy: facebook.com/privacy/policy · Ad preferences: facebook.com/adpreferences

12. TikTok Pixel

With your consent to “Marketing” we use the TikTok Pixel of TikTok Technology Limited, 10 Earlsfort Terrace, Dublin, D02 T380, Ireland. It measures the effect of our ads on TikTok and lets us show relevant ads there to visitors of our website. Data processed includes pages viewed, clicks, device and browser information and IP address; cookies: _ttp, _tt_enable_cookie, ttcsid.

We are joint controllers with TikTok for collection and transmission (Art. 26 GDPR). Data may be transferred to third countries including the USA, Singapore and China; TikTok relies on the European Commission’s standard contractual clauses. Legal basis: your consent (Art. 6(1)(a) GDPR, section 165(3) TKG 2021).

Privacy policy: tiktok.com/legal/privacy-policy-eea

13. Our social media profiles

We link to our profiles on Instagram and Facebook (Meta Platforms Ireland Ltd.). These are plain links – no content from these networks is embedded and no data is sent to them when you merely visit our website.

When you visit our profiles, the network’s privacy policy applies. For page statistics (e.g. “Insights” on Facebook and Instagram) we are joint controllers with the operator (Art. 26 GDPR). If you message us there, we use the message to answer your enquiry (Art. 6(1)(b) or (f) GDPR).

14. WhatsApp and WhatsApp chat

The WhatsApp icon opens a chat window on our website. What you enter there (topic, location, dates, guests, message) stays in your browser and is not sent to us or third parties until you click “Send on WhatsApp”. Only then does WhatsApp open with your prepared message, which you send yourself.

If you message us on WhatsApp, WhatsApp Ireland Limited, Merrion Road, Dublin 4, D04 X2K5, Ireland, processes your data as an independent controller. Message content is end-to-end encrypted, but metadata (who, when, with whom) is not; data may be transferred to the USA (EU-US Data Privacy Framework). We use WhatsApp to answer your enquiry and organise your stay (Art. 6(1)(b) GDPR) and delete chats once no longer needed, at the latest after statutory retention periods.

If you prefer not to use WhatsApp, please e-mail or call us. Privacy policy: whatsapp.com/legal/privacy-policy-eea

15. Fonts

The Jost and Newsreader fonts are hosted on our own server. No connection is made to Google Fonts or other font providers.

16. When you contact us

When you contact us by e-mail, phone, WhatsApp or social media, we process the information you provide – such as name, contact details, travel dates, number of guests, wishes and the content of your message – to answer your enquiry and make you an offer (Art. 6(1)(b) GDPR, otherwise (f)).

We do not record phone calls. Enquiries that do not lead to a booking are deleted after 12 months at the latest.

17. When we contact you

We are entitled to contact you where necessary to answer your enquiry, process your booking and look after you during your stay – by e-mail, phone, text message or WhatsApp, depending on the contact details you have given us. This includes in particular:

• questions about your enquiry, offers, booking confirmation, payment reminders and invoices
• arrival information, key handover and important notices about your stay (e.g. weather, road conditions, disruptions)
• follow-ups on items left behind or damage after departure

Legal basis: Art. 6(1)(b) GDPR (contract and pre-contractual steps) or (f) GDPR (legitimate interest in smooth communication with our guests).

After your stay we may ask you once for a review and occasionally send information about our own similar offers (e.g. seasonal offers, free dates) to the e-mail address you gave us when booking. This is permitted without prior consent under section 174(4) TKG 2021 and Art. 6(1)(f) GDPR. You can object at any time free of charge – with a short message to us or via the unsubscribe link in every e-mail. We send other marketing by e-mail, text message or WhatsApp only with your express consent.

18. Bookings and booking system

The “Book now” buttons take you to the booking calendar of each location. There we process the data needed for the booking: name, address, e-mail, phone, travel dates, number and age of guests, property, prices, payment details and your message. Legal basis: Art. 6(1)(b) GDPR.

Provider: Smartpms (Buchungssoftware der Smartness-Gruppe) – Buchungsseite luxescape.bookpage.io
Privacy policy: luxescape.bookpage.io/de/privacy-policy

The provider processes booking data on our behalf (Art. 28 GDPR). In addition, the booking, payment and cancellation terms shown to you in the booking system before you confirm apply, together with our terms and conditions.

Depending on the payment method chosen, payments are processed via your bank or a payment service provider acting as an independent controller.

19. Guest registration, tourist tax and legal obligations

As an accommodation provider we are legally required to keep a guest register under the Austrian Registration Act 1991 and to report the local tourist tax under Carinthian regulations. For this we process name, date of birth, nationality, home address, ID details and arrival and departure dates and transmit them, where required, to the municipality or tourism board (Art. 6(1)(c) GDPR).

Booking and invoice data are kept for seven years under section 132 Austrian Federal Fiscal Code and section 212 Austrian Business Code; guest registers as required by the Registration Act.

20. Recipients of your data

We only pass on your data where necessary or required by law, in particular to:

• our hosting provider and booking system provider (processors)
• Google, Meta and TikTok – only with your consent (see above)
• banks and payment service providers to process payments
• our tax adviser, authorities, municipality and tourism board where required by law
• lawyers and courts where needed to assert or defend claims

We never sell data. There is no automated decision-making including profiling under Art. 22 GDPR.

21. Transfers to third countries

Some providers named above (Google, Meta, TikTok, WhatsApp) may process data outside the EU/EEA. We only allow this where an EU adequacy decision exists (e.g. the EU-US Data Privacy Framework for certified US companies) or appropriate safeguards such as standard contractual clauses (Art. 46 GDPR) are in place. Analytics and advertising services are only loaded with your consent, which also covers these transfers (Art. 49(1)(a) GDPR).

22. Retention

We store personal data only as long as needed for the purpose or required by statutory retention periods; afterwards it is deleted or anonymised. Specific periods are given in each section and in the cookie overview.

23. Your rights

You have the right at any time to:

• access your stored data (Art. 15 GDPR)
• rectification of inaccurate data (Art. 16 GDPR)
• erasure (Art. 17 GDPR)
• restriction of processing (Art. 18 GDPR)
• data portability (Art. 20 GDPR)
• object to processing based on legitimate interests and at any time to direct marketing (Art. 21 GDPR)
• withdraw consent with effect for the future (Art. 7(3) GDPR) – for cookies via the cookie settings

A short message to info@luxescape-ferienwohnungen.at is enough. We reply within one month and may ask for proof of identity to protect your data.

24. Right to lodge a complaint

If you believe we are not processing your data lawfully, please talk to us first. You also have the right to lodge a complaint with the supervisory authority:

Austrian Data Protection Authority (Datenschutzbehörde)
Barichgasse 40–42, 1030 Vienna, Austria
Phone: +43 1 52 152-0
www.dsb.gv.at

25. Obligation to provide data

You can use the website without providing personal data. For a booking we need the necessary details; without them we cannot conclude a contract. Guest register details are required by law.

26. Changes, no warranty, questions

We update this privacy policy when the law, services or processing change. The version published here applies.

We have prepared this policy carefully and to the best of our knowledge. Information about external providers (e.g. Hostinger, Smartpms, WhatsApp) is based on their own publications; we accept no liability for its accuracy, completeness or currency. The privacy notices of the respective provider prevail. Further information on liability is given in our legal notice.

Questions? Write to us at any time at info@luxescape-ferienwohnungen.at or call +43 664 3458434. We reply as quickly as possible, at the latest within one month.

Version: 14 October 2026