Privacy policy of the website

1. Who is responsible

When it comes to your data, we are your contact:

Just write to us if you want to know something. A real person answers – Pauline, Julia or Daniel.

2. Your enquiry and booking

This is the reason we have any data from you at all.

We arrange the booking. For that we need your contact details and the details of your stay – travel period, number of people and what you tell us about the booking. The legal basis is Art. 6 (1) (b) GDPR: we need them to fulfil our contract with you.

What your host receives

You conclude the rental contract directly with the hut owner. We inform them only as far as necessary for your stay. They are responsible for their own processing.

What we do not do:

• We do not pass your data on for advertising – neither to the host nor to anyone else.
• We do not sell data.
• Other hosts, booking portals, review platforms and advertising networks learn nothing about your enquiry or booking.

Payment

You pay by bank transfer or, if agreed in advance, in cash on site. We do not offer card payment – so your card details never reach us. With a bank transfer we see what every bank sends along: name, IBAN, amount, reference. We need that to match your payment and book it.

3. When you write to us or call

Your message and your contact details stay with us until your request is dealt with – and a little beyond, in case you get back to us about it. None of it is passed on. The legal basis is Art. 6 (1) (b) GDPR when it concerns a booking, otherwise Art. 6 (1) (f) GDPR.

Via WhatsApp. If you write to us via WhatsApp, we process your phone number and the content of your message in order to answer your request. The provider is WhatsApp Ireland Limited, Merrion Road, Dublin 4, Ireland; data may be transferred to the USA in the process. Meta is certified under the EU-US Data Privacy Framework. You can just as easily reach us by e-mail or phone – choose whatever you prefer.

4. For our hosts

From our hosts we process the contract and contact data required for our cooperation and for settlement (Art. 6 (1) (b) GDPR). They stay with us for as long as the cooperation lasts, plus the statutory retention period.

5. When you are just browsing

Even then our server stores a few technical details: which browser and operating system you use, which page you came from, when you were here and your IP address. That is not tracking – without these details we could neither find faults nor fend off attacks. The legal basis is Art. 6 (1) (f) GDPR. We do not combine this with other data.

The connection to our site is encrypted. You can tell by the “https://” and the padlock symbol in your browser’s address bar.

Cookie-free reach measurement. We count for ourselves which pages are visited how often – with our own tool on our server. No cookies are set, no IP addresses stored and no profiles built; we only see anonymous figures. The data stays on our server and is deleted after 120 days. The legal basis is Art. 6 (1) (f) GDPR.

Technology. Our website and our booking system run on servers in Europe. For hosting and technical support we work with service providers who are contractually bound to our instructions (Art. 28 GDPR). They keep the technology running; your data is not their business.

6. Cookies – and what you say about them

A few cookies are technically necessary, otherwise the site does not work. We set those without asking (Art. 6 (1) (f) GDPR).

Everything else – statistics, maps, videos, advertising – stays off until you say yes. The legal basis is then your consent under Art. 6 (1) (a) GDPR and Section 165 (3) of the Austrian Telecommunications Act (TKG 2021).

For this choice we use an open-source consent tool on our own server. It loads nothing from third-party servers. Your choice and the time of your choice stay in your browser’s local storage – they are not transmitted to us.

Changed your mind? Via the small symbol at the bottom right of every page you can change your decision at any time. In your browser you can also restrict or delete cookies in general – but then not everything on our site may work.

7. What only runs if you say yes

These services stay blocked until you agree in the selection dialog. You can withdraw at any time – the legal basis is always Art. 6 (1) (a) GDPR and Section 165 (3) TKG 2021.

• Google Analytics 4 (Google Ireland Ltd., Dublin) – shows us which huts and pages are popular. Your IP address is shortened in the process.
• Google Tag Manager, Google Ads with remarketing and conversion tracking (Google Ireland Ltd.) – this is how we run our ads and measure whether they work.
• Google Maps (Google Ireland Ltd.) – the maps on our hut pages.
• YouTube in privacy-enhanced mode (Google Ireland Ltd.) – for embedded videos.
• Instagram (Meta Platforms Ireland Ltd., Dublin) – for content from our profile.

Data to the USA. With Google and Meta your data may be transferred to the USA. Both companies are certified under the EU-US Data Privacy Framework; in addition, the EU Commission’s standard contractual clauses apply. For embedding Instagram we are jointly responsible with Meta (Art. 26 GDPR); you can find the agreement at facebook.com/legal/controller_addendum.

Fonts. Our fonts are hosted on our own server. No connection to Google is made when the page loads.

8. Wishlist

If you save huts to your wishlist, that stays in your browser. Nothing is transmitted to us.

9. How long we keep your data

• Bookings and invoices: 7 years. Tax law requires this of us (Section 132 of the Austrian Federal Fiscal Code, BAO). After that we delete or anonymise them.
• Enquiries without a booking: until your request is dealt with.
• Server log files: only briefly, for operation and security.
• Your cookie decision: until you change or withdraw it.

10. Your rights

It is your data – you decide about it. At any time you can:

• ask which data we hold about you
• have it corrected if something is wrong
• have it deleted
• have the processing restricted
• take your data with you in a common format
• withdraw a consent – this applies from that moment on; everything before remains lawful

Right to object

An e-mail to info@urlaubshuetten.com is enough. You do not need a form, and there are no fees.

There is no automated decision-making about you or profiling within the meaning of Art. 22 GDPR.

11. If something is not right

Please tell us first – most things are sorted out with a phone call. But you can also complain directly to the supervisory authority at any time:

12. Advertising e-mails to us

Our contact details are in the legal notice because the law requires it – not so that anyone can send us unsolicited advertising. We expressly object to this use and reserve the right to take legal action.

13. The Hugomaschine - our in-house tool

The Hugomaschine is our in-house tool for marketing and analysis. It runs on a computer belonging to Sprenger Touristik KG and works exclusively with our own accounts. The controller is Sprenger Touristik KG; the postal address and contact details are given in section 1. This section describes what the tool does through the Google and YouTube interfaces - as Google requires of every application that uses them.

What the Hugomaschine does with YouTube

It uploads our own videos - hut tours, seasonal clips - to our YouTube channel, after someone on our team has approved them. And it reads the statistics of that channel so we can see which videos work well. It uses YouTube API Services to do so.

Only data from our own channel is processed: video titles, descriptions, publication dates and figures such as views, watch time and interactions. The Hugomaschine does not retrieve or store data about viewers or other YouTube users.

What it does with Google Analytics, Search Console and Gmail

It reads the statistics of our website from Google Analytics and Google Search Console - the same figures we see in the browser. From our mailbox it reads only the automatic system messages of our booking system, in order to count enquiries and bookings per hut. It does not send any e-mail from that mailbox, deletes nothing and changes nothing.

Where the data stays

All data is stored on a computer belonging to Sprenger Touristik KG, solely for our internal analysis, and deleted after 24 months. It is not passed on to third parties. The Hugomaschine has no external users; the only connected Google account is our company account.

Google and YouTube

The services used are subject to the Google Privacy Policy and the YouTube Terms of Service. Access by the Hugomaschine to a Google account can be revoked at any time at security.google.com/settings/security/permissions.

Questions

An e-mail to info@urlaubshuetten.com is enough. A real person will answer - Pauline, Julia or Daniel.

Version: 16.09.2026