Privacy

Protecting your personal data is very important to us. We process your data exclusively on the basis of the applicable law, in particular the General Data Protection Regulation (GDPR), the Austrian Data Protection Act (DSG) and the Austrian Telecommunications Act 2021 (TKG 2021). This privacy policy explains the key aspects of data processing on our website www.stadthotel-steyr.at.

1. Controller

Styria Hotelbetriebs GmbH
Eisenstraße 18, 4400 Steyr, Austria
Establishment: Stadthotel Styria, Stadtplatz 40–42, 4400 Steyr
Phone: +43 7252 5155 10
Email: info@stadthotel-steyr.at
Company register number: FN 123640 z

Please use the contact details above for any questions about data protection or to exercise your rights.

2. Hosting and server log files

Our website is hosted by AUTCOM Software Gesellschaft m.b.H., Ennser Straße 31, 4400 Steyr, Austria. The servers are located in Austria. We have concluded a data processing agreement with the host pursuant to Art. 28 GDPR.

When you visit our website, the web server automatically stores information transmitted by your browser (server log files): IP address, date and time of access, requested page or file, amount of data transferred, referrer URL, browser type and operating system. This data is technically required for the secure and stable operation of the website and is not combined with other data sources. The legal basis is our legitimate interest in operating the website securely (Art. 6(1)(f) GDPR). Log files are deleted after one year unless they are needed to investigate a security incident.

The connection to our website is encrypted via TLS/SSL, indicated by the padlock icon and “https://” in your browser’s address bar.

3. Contacting us and contact form

If you contact us via the contact form, email or phone, we process the data you provide (name, phone number, email address, message) to handle your enquiry and any follow-up questions. Data entered in the contact form is sent to us by email via our host’s mail server.

The legal basis is the performance of pre-contractual measures (Art. 6(1)(b) GDPR) if your enquiry relates to a booking, otherwise our legitimate interest in answering enquiries (Art. 6(1)(f) GDPR). We delete your enquiry once it has been fully dealt with, unless statutory retention obligations apply. If a booking is made, we retain the data in accordance with tax and commercial law requirements (generally seven years). We do not pass on your data without your consent.

4. Spam protection with Google reCAPTCHA

To protect our contact form against abuse by automated programs (spam bots), we use Google reCAPTCHA v3, provided by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland (“Google”). reCAPTCHA is only loaded once you start filling in the contact form. Among other things, your IP address, browser and device information, time spent on the page and mouse and keyboard input are transmitted to Google and analysed to determine whether the input comes from a human.

The legal basis is our legitimate interest in protecting our website against spam and abuse (Art. 6(1)(f) GDPR). Data may be transferred to the USA; Google is certified under the EU-US Data Privacy Framework. More information: Google Privacy Policy.

5. Online booking

For online bookings we use the booking engine of our hotel software partner Simplify Hospitality GmbH, Karolingerstraße 3, 5020 Salzburg, Austria (booking engine “Front Office Cloud”), which is embedded on our contact and booking page. The data required for the booking (e.g. name, address, email address, phone number, travel dates, number of guests, room preference, payment or guarantee details) is processed on the provider’s servers and transmitted to our hotel system. When the booking engine loads, scripts and fonts are retrieved from the provider’s servers, which transmits your IP address. The provider acts as our processor pursuant to Art. 28 GDPR.

The legal basis is the performance of the accommodation contract or pre-contractual measures (Art. 6(1)(b) GDPR) and compliance with legal obligations, for example under the Austrian Registration Act and tax retention requirements (Art. 6(1)(c) GDPR).

6. Cookies and consent management

Our website uses cookies, small text files stored on your device. We use technically necessary cookies on the basis of Section 165(3) TKG 2021 and our legitimate interest (Art. 6(1)(f) GDPR). All other cookies and similar technologies, for example for statistics, are only used with your consent (Section 165(3) TKG 2021 in conjunction with Art. 6(1)(a) GDPR).

We obtain your consent via the consent tool CookieScript (provider: Objectis Ltd., Vilnius, Lithuania). Your choice is stored in a cookie so that we can respect it on your next visit. The legal basis is compliance with our legal obligation to document consent (Art. 6(1)(c) in conjunction with Art. 7(1) GDPR). You can withdraw or change your consent at any time with effect for the future – directly on this page or via the cookie settings. An overview of all cookies used can be found in the table below.

7. Google Tag Manager and Google Analytics 4

We use Google Tag Manager to manage analytics services on our website. Tag Manager itself does not set cookies or analyse data; it only ensures that other services are loaded – subject to your consent. When it loads, your IP address is transmitted to Google.

With your consent we use Google Analytics 4 to evaluate the use of our website statistically and to improve our services. Both services are provided by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. Google Analytics uses cookies and records, among other things, pages viewed, time spent, approximate location (country, region), device, browser and interactions such as submitting the contact form. IP addresses are not stored in Google Analytics 4. The data is deleted automatically after 14 months.

The legal basis is your consent (Art. 6(1)(a) GDPR, Section 165(3) TKG 2021), which you can withdraw at any time. Data may be transferred to the USA; Google is certified under the EU-US Data Privacy Framework. More information: Google Privacy Policy.

8. Google Maps

We embed maps from Google Maps (provider: Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland) to help you find your way to us. When a map loads, your IP address and other technical data are transmitted to Google, and Google may set cookies. The legal basis is your consent (Art. 6(1)(a) GDPR, Section 165(3) TKG 2021). Data may be transferred to the USA; Google is certified under the EU-US Data Privacy Framework.

9. Our Facebook and Instagram pages

We operate pages on Facebook and Instagram, provided by Meta Platforms Ireland Ltd., Merrion Road, Dublin 4, Ireland (“Meta”). No social media plugins are embedded on our website; data is only transmitted to Meta when you visit our pages on these platforms.

When you visit our pages, Meta processes your data under its own terms. We are jointly responsible with Meta for the page statistics (“Insights”) (Art. 26 GDPR); Meta provides the essence of this arrangement at facebook.com/legal/terms/page_controller_addendum. If you send us messages or comment on posts there, we process this information to respond. The legal basis is our legitimate interest in modern communication with our guests (Art. 6(1)(f) GDPR). You can exercise your rights against us as well as against Meta. More information: Meta Privacy Policy.

10. Recipients and transfers to third countries

Within our company, only those persons who need your data to perform their duties have access to it. Beyond that, we only transfer data to the service providers named in this policy and to authorities where we are legally required to do so. Data is only transferred to countries outside the EU/EEA on the basis of an adequacy decision of the European Commission (e.g. the EU-US Data Privacy Framework) or appropriate safeguards such as EU standard contractual clauses.

11. Your rights

You have the right of access (Art. 15 GDPR), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20) and to object (Art. 21). You can withdraw any consent you have given at any time with effect for the future. Simply contact us at info@stadthotel-steyr.at.

If you believe that the processing of your data infringes data protection law, you can lodge a complaint with the supervisory authority. In Austria this is the Austrian Data Protection Authority (Datenschutzbehörde), Barichgasse 40–42, 1030 Vienna, www.dsb.gv.at.

12. Obligation to provide data and automated decision-making

You are under no legal or contractual obligation to provide us with personal data. However, without the information required for an enquiry or booking we cannot process it. We do not use automated decision-making, including profiling, within the meaning of Art. 22 GDPR.

13. Changes to this privacy policy

We update this privacy policy whenever our website or the legal framework changes. The version published here applies.

Last updated: October 2026