Privacy Policy

Who is responsible for your data

The controller is Rittisbergblick Hotel GmbH, operating as Rittis Alpin Chalets Dachstein, Vorberg 613–618, 8972 Ramsau am Dachstein, Austria. For questions about personal data or to exercise your rights, contact [email protected] or +43 3687 21705-0. Further company information is available in our legal notice.

Enquiries, reservations and your stay

When you contact us, we process the information you provide, such as your name, contact details, language, travel dates, accommodation preference, number of guests, children’s ages and message. We use it to respond, prepare an offer and arrange the services you request. Information needed to take steps at your request before a contract or to perform a contract is processed under Article 6(1)(b) GDPR. Guest registration, accounting and other statutory duties may require processing under Article 6(1)(c). Please provide only information relevant to your request; do not send payment-card details through an ordinary enquiry or chat.

Online booking, payments and external services

Online booking may take you to our booking service at booking.rittis.com. Payments, vouchers, restaurant reservations and other linked services may be handled by separate providers. The information entered there is processed under the notices and contractual conditions shown by that service. We receive the booking and transaction information needed to organise your stay, provide the purchased service and meet legal obligations. An enquiry on this website does not itself authorise a payment.

Guest accounts and sign-in

A guest account stores your verified email address, the name you provide, language and the preferences needed for the features you use. A sign-in link is valid for 15 minutes; a session can last up to 30 days. Where you choose a supported identity provider, we use the identity information needed to verify and manage your sign-in. Access is limited to the relevant account; a guest account does not grant administration access. Account sign-in does not by itself subscribe you to marketing. To request account deletion, contact the hotel. Information subject to statutory retention or needed to resolve a dispute may have to be retained.

Email subscriptions and push notifications

Subscriptions are optional and require the relevant consent under Article 6(1)(a) GDPR. Email subscriptions use your confirmed email, consent record, language, topics, frequency and time zone. Each campaign email includes a way to change preferences or unsubscribe. An address used for an enquiry is not automatically subscribed. Push subscriptions store the browser’s technical delivery address and associated public keys, language and delivery preferences. We may also record browser, platform, device category, installation status, approximate country where available, and delivery, opening, clicking or dismissal signals. Such signals do not prove that a person read a message. You can manage preferences through the notification settings and withdraw consent at any time. Technical push records, inactive subscription records and completed campaign delivery logs are deleted no later than 90 days under the relevant retention rules. Pending subscription confirmation requests expire after 48 hours.

Cookies, consent and website operation

We use technical functions needed for security, language selection, sessions, consent choices and features you request. The accommodation calculator stores your selection locally in your browser so it can be restored after reloading; expired travel dates are replaced with future dates. You can remove this information in your browser settings. Optional analytics and advertising technologies are controlled through the consent interface. You can refuse optional categories or change your choice later. The lawful basis depends on the function: consent for optional technologies and, where appropriate, contract performance or our legitimate interest in providing and securing the website for necessary functions.

Traffic analysis and advertising measurement

Where activated with the appropriate consent, Google Analytics and Google Ads help us understand visits and the outcome of advertising. Depending on the feature, this may involve page and interaction events, technical browser information, approximate location and advertising identifiers. An advertising conversion is a measurement event and does not necessarily represent a different person or a confirmed booking. We also operate first-party statistics and technical monitoring to understand use, detect errors and protect the website. These are assessed separately from optional advertising technologies; where based on legitimate interests under Article 6(1)(f) GDPR, those interests are reliable operation, security and service improvement. The available data and attribution depend on your choices, browser restrictions and the systems involved.

Google API connections and Google account data

Authorised hotel staff can connect Google services to view and manage the hotel’s advertising and to analyse authorised Google Ads, Analytics and Search Console reports. Where Google sign-in is offered, the account information requested is used for authentication and the features described at sign-in. Google data is used only to provide the requested connection and related reporting or administration. We do not sell Google user data, use it for unrelated advertising, or use it to train general-purpose artificial-intelligence models. Access is restricted to authorised personnel and service providers needed to deliver those functions. Our use and transfer of information received from Google APIs follows the Google API Services User Data Policy, including its Limited Use requirements. You can withdraw a connection through your Google account’s permissions where applicable, or contact us to remove stored connection data, subject to retention obligations.

Hosting, security, messages and service providers

The website relies on hosting, network delivery, security, email, booking and, where enabled, chat and translation providers. Relevant services may include Cloudflare for delivery or protection, consent management, Google services, and SendPulse for chat or notifications. Service availability depends on the feature used. Technical requests may include an IP address, request time, browser information and the requested address. Enquiry and chat contents may be processed by providers needed for delivery, support or translation. We restrict access according to the task and use appropriate contractual safeguards where required. We disclose information to authorities or professional advisers only where there is an applicable legal basis.

International transfers

Some providers may process data outside the European Economic Area. Where the GDPR requires a transfer safeguard, the applicable basis may be an adequacy decision or appropriate safeguards such as European Commission standard contractual clauses, together with additional measures where needed. A provider’s location does not by itself mean that all data stays within one country. You can ask us for information about safeguards relevant to the service you use.

How long information is kept

Retention depends on the purpose, the feature and applicable duties. We keep enquiry and contract information for the period needed to handle your request, perform the contract and meet registration, accounting, tax or other legal obligations. Security and diagnostic records are limited according to their operational purpose; they are not kept simply because storage is available. Subscription and sign-in time limits are described above. Consent records and information needed to establish or defend legal claims may need to be kept after a subscription or account ends. When the purpose and any applicable retention requirement expire, information is deleted or anonymised.

Your choices and rights

Subject to the applicable conditions, you may request access, correction, deletion, restriction of processing and data portability. You may object to processing based on legitimate interests and object to direct marketing at any time. You may withdraw consent without affecting the lawfulness of processing before withdrawal. To make a request, contact [email protected]; we may need proportionate information to verify your identity. You also have the right to lodge a complaint with a supervisory authority, including the Austrian Data Protection Authority. Refusing optional marketing or advertising consent does not prevent an ordinary hotel enquiry.

Required information and automated decisions

Fields marked as required are needed to respond to the relevant request or provide the requested feature; without them we may be unable to do so. Other information is optional unless a legal duty applies. We do not use website interactions alone to make solely automated decisions producing legal or similarly significant effects about a guest. Advertising measurement or automated bidding is distinct from deciding whether a particular guest may book a stay.

Changes and related documents

This page describes the website and connected services as of the date below. We update it when relevant processing or services change. The existing detailed hotel data-protection information and consent documents remain available in the data-protection section. Those documents do not mean that optional consent is granted simply by visiting this page. For questions about which notice applies to a particular service, contact the hotel.