data
protection
Privacy Policy
The protection of your personal data is particularly important to us.
We therefore process your data exclusively on the basis of the legal provisions (GDPR, TKG 2003).
In this data protection information we inform you about the most important aspects of data processing on our website.
Contact us
If you contact us using the form on the website or by email, the data you provide will be stored by us for six months in order to process your request and in case of follow-up questions.
We will not pass on this data without your consent.
Cookies
Our website uses so-called cookies.
These are small text files that are stored on your device using the browser.
They do no harm.
We use cookies to make our offering user-friendly.
Some cookies remain stored on your device until you delete them.
They enable us to recognize your browser the next time you visit.
If you do not wish this, you can set up your browser so that it informs you about the setting of cookies and you only allow this in individual cases.
If cookies are deactivated, the functionality of our website may be restricted.
General information about AI on our website
This website uses artificial intelligence (AI) to keep content up to date, answer questions more quickly and improve usage.
Only tested services are used.
AI helps provide relevant information, increase accessibility and simplify service.
All AI functions used are described transparently and work on the basis of consent in accordance with Article 6 (1) (a) GDPR and Section 165 TKG 2021.
AI Image Caption
An AI module that analyzes the page context is used to automatically create image titles, alt texts and descriptions.
Here too, no personal data is processed or passed on.
The image texts generated serve exclusively to improve accessibility and search engine optimization.
Google Maps
We use the maps from the “Google Maps” service provided by Google LLC, 1600 Amphitheater Parkway, Mountain View, CA 94043, USA.
Data protection declaration: https://www.google.com/policies/privacy/,
Opt-Out: https://adssettings.google.com/authenticated.
Google Fonts
We use fonts (“Google Fonts”) from the provider Google LLC, 1600 Amphitheater Parkway, Mountain View, CA 94043, USA.
Data protection declaration: https://www.google.com/policies/privacy/,
Opt-Out: https://adssettings.google.com/authenticated.
Google ReCaptcha
We use the “ReCaptcha” function to prevent bots from making entries in online forms, for example.
It is offered by Google LLC, 1600 Amphitheater Parkway, Mountain View, CA 94043, USA.
Data protection declaration: https://www.google.com/policies/privacy/,
Opt-Out: https://adssettings.google.com/authenticated.
Web Analysis
Our website uses functions of the web analysis service Google Analytics.
The provider is Google Inc., based at 1600 Amphitheater Parkway Mountain View, CA 94043, USA.
Cookies are used for this purpose, which enable an analysis of the use of the website by its users.
The information generated in this way is transferred to Google’s server in the USA and stored there.
You can prevent this by setting your browser so that no cookies are stored.
We have concluded a corresponding contract for data processing with the provider.
Our concern within the meaning of the GDPR (legitimate interest) is to improve our offering and our website.
Since the privacy of our users is important to us, the user data is pseudonymized.
Your IP address is recorded but immediately pseudonymized (e.g. by deleting the last 8 bits).
This means that only a rough localization is possible.
Data processing is carried out on the basis of the legal provisions of Section 96 Paragraph 3 TKG and Article 6 Paragraph 1 lit a (consent) and/or f (legitimate interest) of the GDPR.
In addition, Google is certified under the Privacy Shield Agreement and therefore offers a guarantee that it will comply with European data protection law (https://www.privacyshield.gov/participant?id=a2zt000000001L5AAI&status=Active).
The user data is stored for a period of 14 months.
You can find detailed information about Google’s use of data, your options for settings and objection on the following Google websites: https://www.google.com/intl/de/policies/privacy/partners (“Use of data by Google when you use our partners’ websites or apps”),
http://www.google.com/policies/technologies/ads (“Use of data for advertising purposes”), http://www.google.de/settings/ads “Manage information that Google uses to show you advertising”).
Adobe Typekit Web Fonts
We use fonts (“Adobe Typekit Web Fonts”) from the provider Adobe Systems Software Ireland Limited (Adobe Ireland).
Data protection declaration: https://www.adobe.com/privacy/policy.html,
Opt-Out: https://www.adobe.com/privacy/opt-out.html.
Mouse Tracking
Our concern within the meaning of the GDPR (legitimate interest) is to improve our offering and our website.
We therefore use Hotjar to better understand the needs of our users and to optimize what we offer on this website.
Using Hotjar’s technology, we get a better understanding of our users’ experiences (e.g. how much time users spend on which pages, which links they click, what they like and dislike, etc.) and this helps us to align our offerings with our users’ feedback.
Hotjar works with cookies (see above) and other technologies to collect information about the behavior of our users and their devices (in particular the IP address of the device (is only recorded and stored in anonymized form), screen size, device type (unique device identifiers), information about the browser used, location (country only), preferred language for displaying our website).
Hotjar stores this information in a pseudonymized user profile.
The Information is neither used by Hotjar nor us to identify individual users or combined with other data about individual users.
For more information, please see Hotjar’s privacy policy: https://www.hotjar.com/legal/policies/privacy.
You can object to the storage of a user profile and information about your visit to our website by Hotjar as well as the setting of Hotjar tracking cookies on other websites by clicking on this Opt-Out Link.
Data storage via our webshop
For the purpose of contract processing, we store the following data: salutation, first and last name, address, email address and optionally entered data of the user (company name, address details, telephone number).
The data you provide is necessary to fulfill the contract or to carry out pre-contractual measures.
Without this data we cannot conclude the contract with you.
Data will not be transferred to third parties, with the exception of the transfer of credit card details to the processing bank institutions/payment service providers for the purpose of debiting the purchase price, to the transport company/shipping company commissioned by us to deliver the goods and to our tax advisor to fulfill our tax obligations.
After the shopping process is canceled, the data we have stored will be deleted.
If a contract is concluded, all data from the contractual relationship will be stored until the tax retention period (7 years) has expired.
The data name, address, purchased goods and date of purchase will also be stored until the end of product liability (10 years).
Data processing is carried out on the basis of the legal provisions of Section 96 Paragraph 3 TKG and Article 6 Paragraph 1 lit a (consent) and/or lit b (necessary for contract fulfillment) of the GDPR.
Registration and user account
Users of our web shop can optionally create a user account.
As part of the registration process, we provide users with the required information (mandatory fields and optional information).
We use the data entered during registration for the purpose of using our offer.
Users can be informed about information relevant to the offer or registration, such as changes to the scope of the offer or technical updates, by email.
In the event that users terminate their user account, their data will be deleted from this account;
An exception is data whose storage is necessary for commercial or tax reasons in accordance with Article 6 Paragraph 1 Letter c GDPR.
The users are responsible for any backup of the data in the event of termination before the end of the contract.
We are entitled to irretrievably delete all user data stored during the term of the contract.
Based on both our legitimate interests and the user’s interests in protecting against misuse and other unauthorized use, we store the IP address and the time of the respective action by the user when a user uses our registration and login function in connection with their user account.
The IP addresses are anonymized or deleted after 7 days at the latest.
As a general rule, we do not pass on the data to third parties;
An exception are situations in which we have to pursue our claims or in which we have to comply with a legal obligation in accordance with Article 6 (1) (c) GDPR.
Newsletter
You have the option of subscribing to our newsletter via our website.
In order to provide you with targeted information, we may also collect and process additional information that users provide voluntarily.
To send our newsletter we need your email address and your declaration that you agree to receive the newsletter.
As soon as you have registered for the newsletter, we will send you a confirmation email with a link to confirm your registration.
You can cancel your newsletter subscription at any time.
Please send your cancellation to the following email address: arthotel@blauegans.at.
We will then immediately delete your data in connection with sending the newsletter.
Google Re/Marketing Services
Our concern within the meaning of the GDPR (legitimate interest) is to improve our offering and our website.
We therefore use the marketing and remarketing services (“Google Marketing Services” for short) from Google LLC, 1600 Amphitheater Parkway, Mountain View, CA 94043, USA, (“Google”).
Google is certified under the Privacy Shield Agreement and thereby offers a guarantee that it will comply with European data protection law (https://www.privacyshield.gov/participant?id=a2zt000000001L5AAI&status=Active).
With the help of Google marketing services, we can display advertisements for and on our website in a targeted manner in order to only show users those advertisements that potentially reflect their interests.
To do this, Google executes a code and uses so-called (re-)marketing tags, with the help of which an individual cookie is stored in the user’s browser.
For the use of cookies see above.
Google may also combine the information collected with such information from other sources.
When the user then visits other websites, ads tailored to their interests can be shown to them.
In addition, the user’s IP address is recorded via Google Analytics, but is immediately pseudonymized (e.g. by deleting the last 8 bits).
This means that only rough localization is possible; the advertisements are not managed and displayed for a specific person, but for the cookie holder, regardless of who the cookie holder is.
Of course, this does not apply if a user has expressly allowed Google to process the data without this pseudonymization.
The information collected about users by Google marketing services is transmitted to Google and stored on Google’s servers in the USA.
The user’s IP address will not be merged with the user’s data within other Google offerings.
We use, among other things, cookies from the Google marketing service “Google AdWords”;
We may display third-party advertisements based on the Google marketing service “AdSense” and its cookies. Others Information about Google’s use of data for marketing purposes can be found at https://policies.google.com/technologies/ads, Google’s data protection declaration is available at https://www.google.com/policies/privacy.
We also use the “Google Tag Manager” to integrate the analysis and marketing services offered by Google into our website and to manage them centrally.
Online presence in social media
We operate online presences within social networks and platforms in order to be able to communicate with users, interested parties and customers who are active there.
When accessing these networks and platforms, the terms and conditions and data processing guidelines of the respective operators apply.
Unless otherwise stated in our privacy policy, we process users’ data when they communicate with us on social networks and platforms.
Use of Facebook social plugins
Our concern within the meaning of the GDPR (legitimate interest) is the improvement of our offering as well as the analysis, optimization and economical operation of our website.
We therefore use social plugins (“plugins”) from the social network facebook.com, which are operated by Facebook Ireland Ltd., 4 Grand Canal Square, Grand Canal Harbour, Dublin 2, Ireland (“Facebook”).
The plugins can display content such as graphics, text articles or videos or elements for interaction on the website.
You can recognize them by one of the Facebook logos (“f” on a corresponding background, the “thumbs up” sign or the terms “Like” or “Like”) or the label with the addition “Facebook Social Plugin”.
You can see the list and appearance of the Facebook social plugins here: https://developers.facebook.com/docs/plugins/.
Facebook is certified under the Privacy Shield Agreement and therefore offers a guarantee of compliance with European data protection law (https://www.privacyshield.gov/participant?id=a2zt0000000GnywAAC&status=Active).
Further information regarding data collection by Facebook, the further processing and use of the data as well as user rights and setting options to protect privacy can be found in Facebook’s data protection information: https://www.facebook.com/about/privacy/.
Content and functions of the Twitter service may be integrated into our online offering.
They are offered by Twitter Inc., 1355 Market Street, Suite 900, San Francisco, CA 94103, USA.
This can include, for example, content such as images, videos or texts and buttons with which users can react to the content.
If the users are members of Twitter, Twitter can assign access to the content and functions to the users’ respective profiles.
Twitter privacy policy: https://twitter.com/de/privacy.
Twitter is certified under the Privacy Shield Agreement and therefore offers a guarantee of compliance with European data protection law (https://www.privacyshield.gov/participant?id=a2zt0000000TORzAAO&status=Active).
Content and functions of the Instagram service may be integrated into our online offering.
They are served by Instagram Inc., 1601 Willow Road, Menlo Park, CA, 94025, USA offered.
This can include, for example, content such as images, videos or texts and buttons with which users can react to the content.
If the users are members of Instagram, Instagram can assign access to the content and functions to the users’ respective profiles.
Instagram privacy policy: http://instagram.com/about/legal/privacy/.
Content and functions of the Pinterest service may be integrated into our online offering.
They are offered by Pinterest Inc., 635 High Street, Palo Alto, CA, 94301, USA.
This can include, for example, content such as images, videos or texts and buttons with which users can react to the content.
If the users are members of Pinterest, Pinterest can assign access to the content and functions to the users’ respective profiles.
Pinterest privacy policy: https://about.pinterest.com/de/privacy-policy.
Contents and functions of the Xing service may be integrated into our online offering.
They are offered by XING AG, Dammtorstraße 29-32, 20354 Hamburg, Germany.
This can include, for example, content such as images, videos or texts and buttons with which users can react to the content.
If the users are members of Xing, Xing can assign access to the content and functions to the users’ respective profiles.
Xing’s privacy policy: https://www.xing.com/app/share?op=data_protection.
Content and functions of the LinkedIn service may be integrated into our online offering.
They are offered by LinkedIn Ireland Unlimited Company, Wilton Plaza, Wilton Place, Dublin 2, Ireland.
This can include, for example, content such as images, videos or texts and buttons with which users can react to the content.
If the users are members of LinkedIn, LinkedIn can assign access to the content and functions to the users’ respective profiles.
LinkedIn privacy policy: https://www.linkedin.com/legal/privacy-policy.
LinkedIn is certified under the Privacy Shield Agreement and thereby offers a guarantee of compliance with European data protection law (https://www.privacyshield.gov/participant?id=a2zt0000000L0UZAA0&status=Active).
Vimeo
Videos from the “Vimeo” platform may also be integrated into our website.
They are offered by Vimeo Inc., Attention: Legal Department, 555 West 18th Street New York, New York 10011, USA.
Privacy policy: https://vimeo.com/privacy.
YouTube
Videos from the “YouTube” platform may also be integrated into our website.
They are offered by Google LLC, 1600 Amphitheater Parkway, Mountain View, CA 94043, USA.
Data protection declaration: https://www.google.com/policies/privacy/,
Opt-Out: https://adssettings.google.com/authenticated.
Zenchef
Contents from the “Zenchef” and “Zencall” platforms may also be integrated into our website.
They are offered by Zenchef SAS, 63 avenue de Villiers, 75017 Paris, France.
Zenchef is responsible for data processing SAS.
Further information can be found in the data protection declaration:
https://www.zenchef.com/de/privacy-policy
Soundcloud
Content from the “Soundcloud” platform may also be integrated into our website.
They are offered by SoundCloud Global Limited & Co. KG, SoundCloud Inc. and Repost Network Inc.
Data protection declaration: https://soundcloud.com/pages/privacy,
Opt-Out: https://soundcloud.com/signin?redirect_url=/settings/privacy.
Websline voucher shop
1.
Description and scope of data processing
You can buy vouchers on our website.
If a user takes advantage of this option, the data entered in the input mask will be transmitted to us and stored.
This data is: salutation, first name, last name, address, email address, telephone, voucher value, personalization of the voucher, shipping options/alternative delivery address, payment method.
If you make a voucher value from our website, this is done through the online ordering platform of websLINE Internet-& Marketing GmbH, Sägewerkstrasse 24, 83395 Freilassing, Germany.
All order data you enter is transmitted encrypted.
websLINE is committed to handling your transmitted data in accordance with data protection regulations.
websLINE takes all organizational and technical measures to protect your data.
In this context, the data will not be passed on to third parties.
The data is used exclusively for processing the booking and for communication.
2.
Legal basis for data processing
The legal basis for processing the data is the conclusion of a purchase contract with the user.
3.
Purpose of data processing
We process the personal data from the input mask solely to process the voucher purchase and to process payment transactions.
4.
Duration of storage
The data will be deleted as soon as it is no longer necessary to achieve the purpose for which it was collected.
In the case of a contractual relationship, we will delete the data received as soon as national, commercial law, statutory or contractual retention requirements have been met.
5.
Possibility of objection and removal
The user has the opportunity to object to the processing of their personal data at any time.
Data protection information for the use of our telephone assistant Assistant.ai
With this notice we inform you about what data we collect from you when you use our telephone assistant, how we use this data and how you can object to the use of data.
WHO IS RESPONSIBLE FOR DATA COLLECTION AND PROCESSING?
G&G GFRERER U. GFRERER HOTEL- UND RESTAURANT BETRIEBSGMBH collects and processes your data as the responsible body.
The appointed data protection officer is Matthias Baumgartner.
If you have any questions or suggestions about data protection, please contact us please: arthotel@blauegans.at.
WHAT DATA DO WE COLLECT, FOR WHAT PURPOSE AND FOR HOW DURATION?
By using the digital telephone assistant, we process your spoken word (audio) by using speech recognition to create a text.
This text is used to process and respond to your request.
The audio data will be
irrevocably deleted immediately after transcription.
The transcript will be retained to ensure that your request can be traced.
To check and accept reservations, the service collects the following data: telephone number, date, time, number of people, first and last name.
The storage period is 12 months.
LEGAL BASIS OF DATA PROCESSING:
The collection of your data by our telephone assistant constitutes processing of personal data within the meaning of the GDPR. This use is based on a free contractual relationship between you and the responsible body (Art. 6 Para. 1 lit. b GDPR).
The contractual relationship consists of the provision of information about our restaurants and the offer to accept reservations, which you request from us by using our telephone assistant.
We also rely on an overriding legitimate interest in accordance with Article 6 (1) (f) GDPR.
We justify this interest with our desire to provide gastronomic services.
WILL DATA BE SHARED?
The responsible body works with a processor to carry out data processing.
In doing so, we adhere to the applicable European data protection regulations.
We also ensure compliance with these provisions through separate agreements with our processor.
WHAT RIGHTS DO USERS HAVE?
You can request information about what data has been stored about you.
You can request correction, deletion and restriction of processing (blocking) of your personal data as long as this is permitted by law and it is possible to assign your data to you personally.
To exercise your rights, please contact the contact point mentioned above.
You have the right to lodge a complaint with a supervisory authority.
In Austria this is the Austrian Data Protection Authority, Barichgasse 40-42, 1030 Vienna Telephone: +43 1 52 152-0, Email: dsb@dsb.gv.at.
PRIVACY NOTICE UPDATE
We adapt the data protection notice to changes in functionality or changes in the legal situation.
We therefore recommend that you read the data protection notice at regular intervals.
If your consent is required or parts of the data protection notice contain regulations of the contractual relationship with you, the changes will only be made with your consent.
As of: March 16, 2026
Your rights
In principle, you have the rights to information, correction, deletion, restriction, data portability, revocation and objection.
If you believe that the processing of your data violates data protection law or otherwise violates your data protection rights If you have been violated in any way, you can lodge a complaint with the supervisory authority.
In Austria this is the data protection authority.
You can reach us using the following contact details:
G&G GFRERER U. GFRERER HOTEL- UND RESTAURANT BETRIEBSGMBH
Herbert von Karajanplatz 3
5020 Salzburg
t +43 (0)662 8424910
f +43 662 84 24 91 – 9
Telephone: +43 (0)662 8424910
Email: arthotel@blauegans.at
Source: The WKO model data protection declaration was used as the basis for this data protection declaration
As of:
AI Image Caption
An AI module that analyzes the page context is used to automatically create image titles, alt texts and descriptions. Here too, no personal data is processed or passed on. The image texts generated serve exclusively to improve accessibility and search engine optimization.
