1.  General Information

This privacy notice provides you with information on the nature, scope and purposes of the collection and processing of your personal data by our company.

The data controller is:

Rainer Hotel Management Ges.m.b.H.

Wiedner Gürtel 3a

1040 Vienna

Austria

VAT No.: ATU64188319

Telephone number: +43 1 605 80 0

Email address: hello(at)rainer-hotels.at

Website: www.rainer-hotels.at

Data Protection Officer

Werner Magedler

Email address: werner.magedler(at)rainer-hotels.at

2.   Purposes of data processing

This privacy notice relates to all processing operations that are relevant to you as a prospective customer, customer, website visitor, newsletter subscriber, client, supplier or job applicant.

The purposes for which we process your personal data can be summarised as follows:

• our business activities (hotel, restaurant, event and seminar operations)
• marketing (including information sent by email, including text messages)
• newsletters
• the contact form on the website and other enquiries (e.g. by email)
• cookies and website tracking
• job applications
• voucher management

3.   Business activities (hotel operations)

We process your personal data in connection with your interest in or use of our services, namely

• Your master data (e.g. surname, first name, home address, email address, telephone number, date of birth, gender, country of origin)
• Data from travel documents provided, e.g. passport, identity card or driving licence (e.g. type of document, document number, date of issue, issuing authority, validity period, nationality, other passport details),
• Details of the payment method and other data relating to the payment (e.g. payment method, payment amount, card number, cardholder),
• Data relating to your booking or requested service (e.g. dates of arrival and departure booked or enquired about, your booked or enquired-about rooms, your language, your vehicle registration number (for issuing parking permits), number of people),
• other data provided or requested by you in connection with your booking or requested service  (e.g. details of fellow travellers (if you provide us with such details), details regarding destinations, contact persons, terms and conditions, special services, frequent flyer numbers, personal preferences, tour guides, catering, hire cars, transfers, check-in procedures, insurance, events, tours, accreditations, vouchers, invoicing and its verification (B2B, B2C, FIT), and ticket bookings.

No automated decision-making, including profiling, as defined in Article 22 of the GDPR, takes place.

We may also receive personal data from travel agencies, corporate clients, tour operators or online booking platforms when a booking or enquiry is made through them. Information regarding the respective data processing carried out by these entities can be found in their privacy notices. Where necessary, we provide data subjects with the information required under Article 14 of the GDPR.

We base the processing of the aforementioned data on the following legal grounds:

• the necessity of the relevant processing for the performance of the contract or for the implementation of pre-contractual measures (Article 6(1)(b) of the GDPR),
• your consent, provided you have given it to us (Article 6(1)(a) of the GDPR),
• the fulfilment of legal obligations (e.g. under accounting, tax and customs law, contract law, reporting requirements, etc.) to which we are subject (Article 6(1)(c) of the GDPR),
• the pursuit of our legitimate interests within the meaning of Article 6(1)(f) of the GDPR (e.g. improving our customer service or safeguarding our own legal interests, etc.).

The following applies to the retention period for your data:

Where statutory retention obligations or other legal obligations apply, we will retain your personal data for the period prescribed by law in each case. Accounting data (‘books and records’ and the associated supporting documents within the meaning of Section 132 of the Austrian Federal Tax Code (BAO)), as well as data to be included in the guest register in accordance with Section 10 of the Registration Act, are generally retained for a period of 7 years.

We generally store personal data of prospective customers and enquirers only for as long as is necessary to process the enquiry and fulfil the respective purpose of processing. Data may be retained beyond this period until the expiry of the relevant limitation periods, insofar as this is necessary to assert, exercise or defend legal claims.

If, after the expiry of the relevant retention period, further storage is necessary for the assertion, exercise or defence of legal claims, for the conduct of administrative or judicial proceedings, or due to other legal obligations, the data in question will continue to be stored until the final conclusion of the relevant proceedings or until the reason for retention ceases to apply, and will then be deleted.

4.   Marketing (including information sent by email)

We carry out marketing activities to inform you and the public about our services.

As part of our marketing activities, we may process your personal data (e.g. name, home address, work address or email address, date of birth, details of your most recent booking or enquiry).

We process this data on the following legal bases:

• the pursuit of our overriding legitimate interests within the meaning of Article 6(1)(f) of the GDPR (e.g. in the case of postal mailings or electronic marketing to existing customers)
• your separate consent within the meaning of Article 6(1)(a) of the GDPR, provided you have given us such consent (e.g. for other forms of direct marketing, such as via email and messaging services)

Where processing is carried out on the basis of our overriding legitimate interests, these interests consist of presenting our services or our range of products to you and thereby increasing our turnover (marketing). This applies to postal marketing and our marketing to existing customers.

In the case of electronic marketing, we distinguish between electronic marketing to existing customers and other direct marketing.

In the case of electronic marketing to existing customers, we process your data exclusively in accordance with the relevant legal provisions. The processing of your data for this purpose is based on our overriding legitimate interests (‘marketing’), but only if you have provided us with your contact details in the course of a purchase, when using a service or making an enquiry, and we are using this electronic communication to promote our own, similar products or services. When collecting your contact details, we will inform you of this type of data processing and the sending of communications, and we will give you the option to opt out of this type of marketing at the time of data collection and with every communication sent.

In the case of other forms of electronic direct marketing, you give us your consent in advance, which you may withdraw at any time.

You have the right to object to processing on the grounds of legitimate interests at any time or to withdraw any consent you have given (see the section ‘Data subjects’ rights’). In this case, we will cease all further contact for marketing purposes. Withdrawal of consent or an objection on the grounds of legitimate interests does not affect the lawfulness of any processing carried out up to that point. The processing (further storage) of customer data, e.g. to fulfil obligations under accounting regulations, will continue.

We process marketing data until you withdraw your consent or until the relevant purpose of processing no longer applies.

5.   Newsletter

You have the option to subscribe to our newsletter. To subscribe to the newsletter, you must provide us with your email address.

In order to provide you with targeted information in our newsletter that is of particular interest to you, we give you the option, when you subscribe, to provide details of specific interests or other categories we ask about. Once provided, we will also process this data in order to provide you with more targeted information. When we send you a newsletter, the system we use enables us to receive feedback on your response (e.g. whether you open, delete or click on the newsletter) and the technical devices you use (e.g. including your IP address). We use this information, on the one hand, to improve our service from a technical perspective, and, on the other hand, to measure and adapt the effectiveness of our advertising measures, for example, to send specific information to specific recipient groups.

Your electronic subscription to the newsletter will only take effect once you have confirmed the subscription link sent to you by email. This serves to verify that you have completed the subscription process. Data processing in connection with our newsletter is carried out exclusively on the basis of the consent you have given (Article 6(1)(a) of the GDPR).

You may withdraw this consent at any time (see the section ‘Data subjects’ rights’). You will also find all the necessary information for easily unsubscribing from the newsletter in every single newsletter you receive from us. Withdrawal of consent does not affect the lawfulness of data processing carried out prior to such withdrawal or unsubscription.

We generally store data relating to our newsletter until consent is withdrawn.

6.   Contact form on the website and other enquiries (e.g. by email)

You can send us enquiries about our services or general enquiries via the chat window on our website or by email. Such enquiries may also be forwarded to us by third parties (e.g. a booking platform). The chat function is provided by our service provider, DialogShift GmbH.

We process the contact details provided and any other data you supply for the purpose of handling your enquiry. The legal basis for this processing is either Article 6(1)(b) of the GDPR (pre-contractual measures, performance of a contract) or Article 6(1)(f) of the GDPR (our overriding legitimate interests in ensuring smooth communication and documentation in relation to general enquiries).

We store this data only for as long as is necessary to process your enquiry and fulfil the relevant purpose of processing. If the enquiry does not result in a contractual relationship, the data will be deleted once the purpose of processing no longer applies, provided there are no statutory retention obligations or further storage is required to assert, exercise or defend legal claims. If the enquiry leads to the conclusion of a contract, the retention period is determined by the retention periods applicable to the relevant contractual relationship.

7.   Cookies and website tracking

When you visit our website, you will be asked whether you consent to the use of cookies. Cookies are small text files used to store information in web browsers. We use cookies to ensure the functionality of our website, to make it user-friendly, and to improve IT security.

You can prevent cookies from being stored by adjusting the settings in your browser, or you can delete cookies via your browser at a later date if they have already been set. However, please note that actively disabling such cookies may impair the functionality of our website and, in some cases, mean that not all features (e.g. the recognition of data entered in the event of a crash, pre-filled forms stored in your browser, or the loading of images or videos) of our website can be used.

We must use technically necessary or functional cookies to ensure that our website is usable for you. The legal basis for setting technically necessary cookies is our legitimate interests within the meaning of Article 6(1)(f) of the GDPR, namely ensuring the functionality of our website and IT security.

We only use non-essential technical cookies and similar technologies with your prior consent in accordance with Section 165(3) of the Telecommunications Act 2021. Where personal data is processed in this context, the legal basis is Article 6(1)(a) of the GDPR. You may withdraw your consent at any time via the cookie settings dialogue, with effect for the future.

Additional information on tracking cookies and the use of third-party applications:

Google Tag Manager

We use Google Tag Manager to manage the tags used on our website. Google Tag Manager is used solely for the technical management of other services. Tags that are not technically necessary or that process personal data for analytics or marketing purposes will only be activated once you have given your consent.

Tracking tags integrated via GTM that collect personal data will only be loaded once you have given your explicit consent. You can find the privacy notices for these services in the following sections of this privacy policy.

Google Analytics 4

We use Google Analytics 4 (GA4) to analyse website usage. The data obtained in this way is used to optimise our website and our advertising campaigns.

Google Analytics is provided to us by Google Ireland Limited (Gordon House, Barrow Street, Dublin 4, Ireland). Google processes the website usage data on our behalf and is contractually obliged to take measures to ensure the security and confidentiality of the data processed.

During your visit to the website, the following data, amongst others, is transmitted to Google:

• Pages viewed
• Orders, including the value and the products ordered
• The achievement of ‘website goals’ (e.g. contact enquiries and newsletter subscriptions)
• Your behaviour on the pages (e.g. time spent on the site, clicks, scroll depth)
• Your approximate location (country and town)
• Your internet address (IP address) — this is transmitted to Google but is truncated before being stored
• Technical information such as browser, internet service provider, device and screen resolution
• The source of your visit (i.e. via which website or advertising medium you arrived at our site)
• A randomly generated user ID

According to our configuration, no directly identifying information such as your name, postal address or email address is transmitted to this service. However, the online identifiers, IP addresses, device information and usage data transmitted may constitute personal data within the meaning of the GDPR.

This data is transferred to Google’s servers in the USA. Google LLC is certified under the EU-US Data Privacy Framework (DPF). Appropriate safeguards within the meaning of Article 45 of the GDPR are therefore in place for data transfers to the USA.

Google Analytics stores cookies in your web browser for a period of two years from your last visit. These cookies contain a randomly generated user ID, which can be used to recognise you during future visits to the website.

The recorded data is stored together with the randomly generated user ID, which enables the analysis of pseudonymous user profiles. This user-related data is automatically deleted after 14 months. Other data remains stored in aggregated form indefinitely.

If you do not consent to this data collection, you can prevent it by installing the browser add-on (https://tools.google.com/dlpage/gaoptout?hl=de) to deactivate Google Analytics, or by rejecting cookies via our cookie settings dialogue.

Google Remarketing

We also use Google’s remarketing feature. This means that if you have visited our website, we may display targeted adverts to you on other websites via the Google Display Network, based on your behaviour on our website. For example, whether you have viewed certain products or visited a page multiple times will influence which adverts are shown to you. Google stores the information required for this purpose for a maximum of 13 months.

Further information on this can be found in Google’s Privacy Policy (https://policies.google.com/technologies/ads?hl=de). You can opt out of interest-based advertising by installing this browser plug-in (https://support.google.com/My-Ad-Center-Help/answer/12155656).

Google Ads Conversion Tracking

We run adverts on Google Search and on other websites via the Google Ads service. In this context, we have integrated Google’s conversion tracking into our website.

Google Ads conversion tracking enables us to measure the success of our Google advertising campaigns. If you click on one of our adverts and then visit our website, a cookie is set in your browser. This cookie allows us to track whether, after clicking on one of our adverts, you have carried out a desired action on our website – for example, filled in a form, made an enquiry or purchased a product.

Google Ads Conversion Tracking is provided to us by Google Ireland Limited (Gordon House, Barrow Street, Dublin 4, Ireland). Google processes the data on our behalf and is contractually obliged to take measures to ensure the security and confidentiality of the data processed.

During your visit to our website, the following data, amongst others, is transmitted to Google:

• Pages or URLs visited
• The achievement of conversion goals (e.g. contact enquiries, newsletter subscriptions, orders including turnover)
• Your Internet address (IP address)
• Technical information such as browser, device and screen resolution
• A randomly generated user ID
• This data is transferred to Google’s servers in the USA. Google LLC is certified under the EU-US Data Privacy Framework (DPF). This means that adequate safeguards within the meaning of Article 45 of the GDPR are in place for data transfers to the USA.

The conversion tracking cookie and the click ID (gclid) set when you click on an advert are stored in your web browser for a period of 90 days.

The legal basis for this processing is your consent in accordance with Article 6(1)(a) of the GDPR. You can withdraw your consent at any time via our cookie settings dialogue or disable data collection via Google’s ad settings (https://adssettings.google.com/anonymous?hl=de).

Meta Pixel

We run adverts on Facebook and Instagram. As part of this, we have integrated the ‘Meta Pixel’ into our website.

The Meta Pixel enables us to:

• Den Erfolg unserer Werbemaßnahmen auf Facebook und Instagram zu messen (Conversion Tracking).
• Besucher unserer Website erneut mit Werbeanzeigen auf Facebook und Instagram anzusprechen (Remarketing).
• Werbeanzeigen personalisiert auf zuvor aufgerufene Seiten bzw. Produkte abzustimmen.

The Meta Pixel is provided to us by Meta Platforms Ireland Limited (Merrion Road, Dublin 4, D04 X2K5, Ireland). Meta processes the data on our behalf and is contractually obliged to take measures to ensure the security and confidentiality of the data processed.

During your visit to the website, the following data, amongst others, is transmitted to Meta:

• Pages viewed
• Orders, including the value and the products ordered
• The achievement of website objectives (e.g. contact enquiries and newsletter subscriptions)
• Your internet address (IP address)
• Technical information such as browser, device and screen resolution
• A randomly generated user ID
• A randomly generated ad-click ID, if you arrived at our website via an advert

According to our configuration, no directly identifying details such as name, postal address or email address are transmitted to this service. However, the online identifiers, IP addresses, device information and usage data transmitted may constitute personal data within the meaning of the GDPR.

This data is transferred to Meta’s servers in the USA. Meta Platforms, Inc. is certified under the EU-US Data Privacy Framework (DPF). This means that there are adequate safeguards in place for data transfers to the USA within the meaning of Article 45 of the GDPR.

Meta stores cookies in your web browser for a period of one year from your last visit. These cookies contain a randomly generated user ID, which can be used to recognise you on future visits. If you are logged in to Meta services such as Facebook or Instagram, Meta may also link your visit to your account.

The legal basis for this processing is your consent in accordance with Article 6(1)(a) of the GDPR. You can withdraw your consent at any time via our cookie settings dialogue.

DialogShift

Our website uses the chat application provided by DialogShift GmbH, Torstr. 201, 10115 Berlin, Germany. This application processes and stores data for the purposes of web analytics, operating the chat application and responding to enquiries. To operate the chat function, chat texts are stored and a cookie with a unique ID is set – this serves to recognise you as a customer. A cookie is a small text file that is stored locally in the cache on your device. With the help of this cookie, our application recognises the device and can retrieve past chat logs.

This cookie is stored for 90 days from the date of last use. You can disable the storage of cookies in your browser settings. However, the chat function cannot be used without cookies. The possible disclosure of, for example,

Name, email address or telephone number

is provided voluntarily and with your consent to the temporary use and storage of this data for the purpose of establishing contact until the end of that contact. This personal data will be deleted after 90 days.

The legal basis for data processing is your consent in accordance with Article 6(1)(a) of the GDPR. DialogShift provides further information on the collection and use of data, as well as your rights and options for protecting your privacy, at https://www.dialogshift.com/datenschutz.

8.  SuitePad (digital guest information pack)

In the hotel rooms at Rainers Hotel Vienna, we use the ‘SuitePad’ digital guest information pack provided by SuitePad GmbH, Berlin. Guests can use the tablet to access information about the hotel and make use of various services such as room service, feedback forms, telephone calls or booking enquiries. In doing so, personal data may be processed to the extent that it is entered by the guest or generated in the course of using the service.

This processing is carried out to provide our hotel services and to improve the guest experience on the basis of Article 6(1)(b) of the GDPR (performance of a contract) and Article 6(1)(f) of the GDPR (legitimate interest in efficient guest care).

Where SuitePad GmbH processes personal data on our behalf, a data processing agreement is in place in accordance with Article 28 of the GDPR. Further information on data protection at SuitePad can be found at: https://www.suitepad.de/de/datenschutz.

9.   Ariane Self Check-in

At Hotel Rainers21, we use the services of Ariane Systems SAS, France, to carry out self-check-in processes.

In the course of using this service, personal data may be processed that is necessary for carrying out the check-in, fulfilling statutory registration obligations and providing the booked hotel services. This includes, in particular, master data, contact details, booking details, arrival information and, where applicable, payment details.

Processing is carried out on the basis of Article 6(1)(b) of the GDPR (performance of a contract) and Article 6(1)(c) of the GDPR (compliance with legal obligations, in particular reporting obligations).

Where Ariane Systems processes personal data on our behalf, this is done on the basis of a data processing agreement in accordance with Article 28 of the GDPR. The data is processed exclusively for the purpose of carrying out the check-in and check-out process and the associated hotel services. [ariane.com]

Further information on data protection at Ariane Systems can be found at: https://www.ariane.com/privacy.

10. Job applications

We process the personal data you provide as part of your job application (e.g. personal details, CV, references and correspondence) for the purpose of conducting the recruitment process. The legal basis for this is Article 6(1)(b) of the GDPR. If no employment relationship is established, the application documents will be deleted after 12 months at the latest, provided there is no statutory obligation to retain them or a legitimate interest in storing them for a longer period.

11. Voucher management

When you purchase a voucher via our online shop, your personal data is processed directly by our service provider, E-Guma. A separate privacy policy applies to the use of this online shop, which is available here: https://shop.e-guma.ch/rainer-hotels/de/privacypolicy

12. Categories of recipients / Transfer to third countries

We transfer your personal data to the following recipients or categories of recipients:

• Hotel and booking systems (PMS, CRS, channel managers)
• Online booking platforms and travel distribution partners
• Payment service providers
• IT and hosting service providers
• Newsletter and marketing platforms
• Web analytics and tracking service providers
• Providers of digital guest services and check-in systems
• Tax advisers, auditors and legal advisers
• Companies within the Rainer Group
• Business transfer: Should we negotiate or complete a transaction affecting all or part of our business (for example, a reorganisation, merger, sale or acquisition), data may be disclosed to third parties involved in that transaction to the extent permitted by law.

Some of the service providers we use are based outside the European Economic Area or process data on servers outside the EEA, in particular in the USA. Where this is the case, we ensure that appropriate safeguards are in place in accordance with Article 44 et seq. of the GDPR. This is achieved, in particular, through an adequacy decision by the European Commission (e.g. the EU-US Data Privacy Framework) or by entering into standard contractual clauses.

An up-to-date list of the specific service providers we use can be requested at any time at hello(at)rainer-hotels.at.

13. Data subjects’ rights / Objection / Contact

As a data subject within the meaning of the GDPR, you are generally entitled to the right of access, rectification, erasure, restriction of processing and data portability, in each case subject to the statutory provisions.

If you have given us your consent to process your data, you have the right to withdraw this consent at any time. This does not affect the lawfulness of the data processing carried out prior to the withdrawal. Withdrawal of consent means that, from that point onwards, we will no longer process your data for the purposes mentioned above or for the purposes specified in the consent.

Where the processing of your data is based on our legitimate interests, you have the right to object to such processing. If you have grounds relating to your particular situation which prevent such processing, we will no longer process your data unless we have compelling legitimate grounds for the processing which override your interests, rights and freedoms, or the processing is necessary for the establishment, exercise or defence of legal claims. Where your data is processed for direct marketing purposes, it will no longer be processed for these purposes once you have lodged an objection.

To exercise your rights, please contact:

Werner Magedler at werner.magedler@rainer-hotels.at or by post to Rainers Hotel Management Ges.m.b.H., Wiedner Gürtel 3a, 1040 Vienna, Austria.

With regard to the processing of your data by us, you may also lodge a complaint with a supervisory authority at any time. In Austria, this is the Austrian Data Protection Authority (www.dsb.gv.at)