Privacy policy

This is a translation for your convenience. The German version is the legally binding one.

Controller

Mag. Andreas Mössner
ROCKS Schladming — apartment house
Bergwerkstraße 327, 8970 Schladming, Austria
Email: andreas_moessner@yahoo.com

Processing of enquiries & bookings

When you send us an enquiry, we process the data you provide (name, email address, requested dates, apartment, number of guests, your message) solely in order to handle your enquiry and process your booking. Depending on the payment method chosen, invoicing and payment take place by bank transfer, on site, or via a payment service provider (see the section “Payment processing”). The legal basis is Art. 6(1)(b) GDPR (performance of a contract), and for the retention of invoices Art. 6(1)(c) GDPR (statutory retention obligations).

Availability calendar and booking engine (Smoobu)

For availability, prices and bookings we use the service Smoobu (Smoobu GmbH, Germany).

Calendar: On the apartment pages we display free dates and the price per night. Our server retrieves the pricing data from Smoobu and serves it to your browser — your IP address is not transmitted to Smoobu in the process. If this display cannot be loaded, we embed Smoobu's own calendar instead; in that case a connection to Smoobu is established and your IP address is transmitted there. The legal basis is Art. 6(1)(f) GDPR (legitimate interest in displaying current availability and prices).

Booking engine: Smoobu's booking system is embedded as an iframe on the homepage and the apartment pages. When it loads, a connection to Smoobu is established and your IP address is transmitted. If you book there, you enter your data directly with Smoobu — this includes name, email address, phone number, address, travel dates and number of guests. Smoobu processes this data as our processor in order to perform the accommodation contract; the legal basis is Art. 6(1)(b) GDPR. Depending on the payment method chosen, payment is processed via a payment service provider (see the next section). Retention follows the statutory periods (§ 132 of the Austrian Federal Fiscal Code: seven years for invoice records).

Details: Smoobu's privacy policy.

Payment processing

When booking through our booking engine you can choose between several payment methods: credit card, Klarna, instant bank transfer, invoice (bank transfer) or payment on arrival.

If you choose invoice or payment on arrival, no data is transmitted to a payment service provider — you transfer the amount directly to us or pay on site.

If you choose credit card, Klarna or instant bank transfer, the payment is processed by an external payment service provider. The data required for the payment (including name, email address, billing address, amount, booking reference and the payment details you enter) is transmitted directly to that provider. We never receive your full credit card details — they are entered and processed exclusively at the payment service provider.

Providers used:

Stripe (Stripe Payments Europe Ltd., Ireland) for card payments. Details: Stripe's privacy policy.
Klarna (Klarna Bank AB, Sweden) for Klarna and instant bank transfer. Details: Klarna's privacy policy.

The payment service providers are independently responsible for processing your payment data and may carry out their own checks for fraud prevention and creditworthiness. The legal basis for the transfer is Art. 6(1)(b) GDPR (performance of a contract); where a credit check takes place, this is based on Art. 6(1)(f) GDPR (legitimate interest in protection against payment defaults). Insofar as data is transferred to a third country, the providers base this on the European Commission's standard contractual clauses.

Hosting & form submission

This website is hosted by Netlify (Netlify Inc., USA). Technically necessary data (e.g. IP address, browser type, time of access) is processed in order to deliver the page. The legal basis is Art. 6(1)(f) GDPR (legitimate interest in secure and fast delivery).

When you submit the enquiry form, the data you enter is transmitted to us via Netlify (Netlify Forms) and cached there for delivery. The transmission is encrypted. As Netlify is based in the USA, data may be transferred to a third country; Netlify bases such transfers on the European Commission's standard contractual clauses. The legal basis is Art. 6(1)(b) GDPR (steps prior to entering into a contract). Details: Netlify's privacy policy.

Following an enquiry, we automatically send an acknowledgement to the email address you provided. For this we use the service Resend as a processor; your email address and the details you entered in the form are transmitted. Sending takes place via servers within the European Union (Ireland region). The provider is Resend Inc., based in the USA; insofar as access from the USA is possible, the transfer is based on the European Commission's standard contractual clauses. The legal basis is Art. 6(1)(b) GDPR (steps prior to entering into a contract). Details: Resend's privacy policy.

The data we collect in the enquiry form: apartment, travel dates, number and ages of guests, first and last name, email address, phone number, country and — where you provide them voluntarily — billing address, expected arrival time, breakfast preference and your message. We need this data to check availability, to calculate the price and the local tourist tax, and for invoicing. We store it for as long as is necessary to process your stay, and beyond that within the statutory retention periods (§ 132 of the Austrian Federal Fiscal Code: seven years for invoice records).

Web analytics (Plausible)

To analyse how the site is used we use Plausible Analytics — a privacy-friendly alternative to Google Analytics. Plausible sets no cookies, creates no cross-device profiles and stores no personal data. Only anonymous aggregate figures are recorded (e.g. page views, country of origin, referring website, device type). Individual visitors cannot be identified and IP addresses are not stored. The data is processed on servers within the EU. The legal basis is Art. 6(1)(f) GDPR (legitimate interest in statistical analysis to improve what we offer). Details: Plausible's privacy policy.

Maps & external content

An embedded map (OpenStreetMap) is used to show our location. Your IP address is transmitted to the respective provider in the process.

Your rights

You have the right of access, rectification, erasure, restriction of processing, data portability and objection. You may also lodge a complaint with the Austrian Data Protection Authority.

← Back to the homepage