Data protection

1. basics
With this data protection information, we inform you about the type, scope and purpose of the collection and processing of your personal data by our company.

The controller responsible for data processing is
Imagine Immobilien GmbH
Straßganger Straße 117
office@lavilo.at

2. purposes of data processing
This data protection information relates to all processing operations that are essential for you as an interested party, customer, website visitor, newsletter subscriber, client or supplier.

The purposes for which we process your personal data can be summarized as follows:

– our business activities (aparthotel)
– marketing (and information by e-mail, including text messages)
– newsletter
– contact form on the website and other inquiries (e.g. by e-mail)
– cookies and website tracking

3. business activity (Aparthotel)
We process your personal data in connection with your interest in or use of our services, namely

– Your master data (e.g. surname, first name, home address, e-mail address, telephone number, date of birth, gender, country of origin)
– Data from submitted travel documents, e.g. passport, identity card or driver’s license (e.g. type of document, document number, date of issue, issuing authority, duration, nationality, other passport data),
– Data on the payment method and other data associated with the payment (e.g. payment method, payment amount, card number, cardholder),
– Data relating to your booking or requested service (e.g. date of booked or requested arrival and departure, your booked or requested rooms, your language, your vehicle registration number (to determine parking authorization), number of persons),
– other data provided or requested by you in connection with your booking or requested service (e.g. data of fellow travelers (if you provide us with such data), data on destinations, contact persons, conditions, special services, frequent flyer number, personal preferences, tourist guides, gastronomy, rental vehicles, transfers, registration processing, insurance, events, tours, accreditations, vouchers, billing and its verification (B2B, B2C, FIT), ticket booking,

We do not engage in profiling or automated decision-making that produces legal effects concerning you or otherwise significantly affects you.

We may also receive personal data from sources other than directly from the data subject. This is the case, for example, if a person making a booking, a travel agency or a booking platform provides us with this data. In this case, we assume that the person for whom the booking was made already has the information about the data processing in our company (due to the forwarding of the information by the person making the booking) or that the cost of providing the information separately is disproportionately high.

We base the processing of the above-mentioned data on the following legal bases:

– the necessity of the respective processing for the fulfillment of the contract or for the implementation of pre-contractual measures (Art 6 para 1 lit b GDPR),
– your consent, if you have given us such consent (Art 6 para 1 lit a GDPR),
– the fulfillment of legal obligations (e.g. according to accounting, tax and customs law, contracts, reporting, etc.) to which we are subject (Art 6 para 1 lit c GDPR),
– the protection of our overriding legitimate interests within the meaning of Art 6 para 1 lit f GDPR (e.g. the improvement of our customer service or the protection of our own legal interests, etc.).
The following applies to the storage period of your data:

If there are statutory retention obligations or other legal obligations to retain data, we will store your data in accordance with these obligations. We store accounting data (“books and records” and associated documents as defined in Section 132 of the Federal Fiscal Code) or data that must be included in the guest register (Section 10 of the Registration Act) for a period of approximately 7 years.

If processing is based on your consent, we will store the data in accordance with the consent given, but for no longer than 3 years after the last contact with you.

We store data from interested parties or inquiring persons (e.g. by e-mail or via our contact form) that do not lead to bookings for a maximum period of 3 years after the last contact.

All other data will be deleted by us after 3 years at the latest.

If, after expiry of these periods, further storage is necessary for the assertion, exercise or defense of legal claims (e.g. in the context of legal proceedings), we will continue to store the data until the legally binding conclusion.

4. marketing (and information by electronic mail including SMS)
We use marketing to inform you and the public about our services.

Your personal data may be processed in the course of our marketing activities (e.g. name, residential or e-mail address, date of birth, details of your last booking/enquiry).

We base the processing of this data on the following legal bases:

– the pursuit of our overriding, legitimate interests within the meaning of Art. 6 para. 1 lit. f GDPR (e.g. in the case of postal mailings or electronic marketing to existing customers)
– your separate consent within the meaning of Art. 6 para. 1 lit. a GDPR, provided that you have given us such consent (e.g. for other direct advertising e.g. by email, messenger etc…)
If the processing is based on our overriding, legitimate interests, these interests consist of presenting our services or our offer to you and thus increasing our sales (marketing). This applies to postal marketing and our marketing to existing customers.

In the case of electronic marketing, we distinguish between electronic marketing to existing customers and other direct advertising.

In the case of electronic marketing to existing customers, we process your data exclusively in accordance with the relevant statutory provisions. Your data is processed for this purpose on the basis of our overriding, legitimate interests (“marketing”), but only if you have given us your contact information in the course of a purchase or when using a service and we advertise our own, similar products or services with this electronic mailing. When collecting the contact data, we point out this type of data processing and the sending and give you the opportunity to refuse this type of marketing when collecting the data and sending it.

In the case of other electronic direct advertising, you give us your consent in advance, which you can revoke at any time.

You have the right to object to processing based on legitimate interest at any time or to withdraw your consent (see section “Rights of data subjects”). In this case, we will no longer contact you for marketing purposes. Revocation (consent) or objection (legitimate interests) does not affect the lawfulness of the processing carried out up to that point. The processing (further storage) of customer data, e.g. to fulfill the obligations of accounting regulations, remains in place.

We store marketing data that is processed on the basis of your consent until you withdraw your consent or all marketing data is deleted no later than 3 years after the last contact.

5. newsletter
You have the option of subscribing to our newsletter. To subscribe to the newsletter, you must provide us with your e-mail address.

The electronic registration for the newsletter only becomes effective when you confirm a registration link that you receive by e-mail. This serves to verify that you have completed the registration. Data processing in connection with our newsletter is carried out exclusively on the basis of your consent (Art. 6 para. 1 lit. a GDPR).

You have the option to revoke this consent at any time (see section “Data subject rights”). You will also find all the information you need to simply unsubscribe from the newsletter in each individual newsletter that you receive from us. The lawfulness of the processing of the data up to the time of revocation or unsubscription is not affected by a revocation.

We generally store data in connection with our newsletter until consent is withdrawn or this data is deleted at the latest 3 years after the last contact.

6. contact form on the website and other inquiries (e.g. by email)
You can send us inquiries about our services or general inquiries via the contact form on our website or by email. Such inquiries may also be sent to us by third parties (e.g. from a booking platform).

We will process the contact details and other data provided by you in order to process your request. The legal basis for this processing is either Article 6(1)(b) GDPR (contract initiation, contract fulfillment) or Article 6(1)(f) GDPR (our overriding legitimate interests in smooth communication and documentation for general inquiries).

We store this data for a maximum period of 3 years after the last contact, although the storage period may be longer if the question leads to the conclusion of a contract (see section: “Business activities (hotel operations)”).

7. cookies and website tracking
When you visit our website, you will be asked whether you allow the use of cookies. Cookies are small text elements that are used to store information in web browsers. We use cookies to ensure the functionality of our website, to make it user-friendly and to improve IT security.

You can prevent the storage of cookies by selecting the appropriate settings in your browser or subsequently delete cookies via your browser if they have already been set. However, we would like to point out that actively deactivating such cookies may impair the functionality of our website and it may not be possible to use all the functions of our website (e.g. recognition of data entered in the event of a crash, pre-filled forms stored in your browser, calling up images or videos).

We have to use technically necessary or functional cookies to make our website usable for you. The legal basis for the setting of technically necessary cookies is our legitimate interests within the meaning of Art. 6 para. 1 lit. f GDPR, namely to ensure the operability of our website and IT security.

We only use cookies that are not technically necessary if you have given us your prior consent (Art. 6 (1) (a) GDPR). These are, for example, cookies that recognize you the next time you visit our website and are stored on your end device. The information recognized and stored by cookies is also used to analyze your usage behavior. They help us to improve our website and determine which areas of our website are visited by which users and receive the most attention. This enables us to improve our website and present content that is of maximum interest to our target groups.

The following applies to the storage duration of the cookies we use:
[Specify the storage duration of the individual cookies, in particular any tracking data, whereby this should be kept as short as possible]

8. categories of recipients / transfer to third countries
Your personal data will be transferred by us to the following recipients or categories of recipients:

– Processors engaged by us: CONCRETE RECIPIENTS OR CATEGORIES SUPPLEMENT,
– IF REQUIRED Recipients within our Group: CONCRETE SUPPLEMENT taking into account the permitted purposes of use,
– IF REQUIRED SUPPLEMENT

9. rights of data subjects / objection / contact
As a data subject within the meaning of the GDPR, you have the right to information, correction, deletion, restriction and data portability, in each case within the framework of the statutory provisions.

If you have given us your consent to process your data, you have the right to withdraw this consent at any time. This does not affect the lawfulness of the processing of the data up to the point of withdrawal. If you withdraw your consent, we will no longer process your data for the purposes stated above or for the purposes stated in the consent.

If the processing of your data is based on our legitimate interests, you have the right to object to the processing. If you have reasons arising from your particular situation that speak against this processing, we will no longer process your data unless we have compelling legitimate grounds for processing that outweigh your interests, rights and freedom, or the processing serves to assert, exercise or defend legal claims. If your data is processed for direct marketing purposes, this data will no longer be processed for these purposes once you have objected.

To exercise your rights, please contact:
info@lavilo.at or
Imagine Immobilien GmbH, Straßganger Straße 117, 8052 Graz

With regard to the processing of your data by us, you can also lodge a complaint with a supervisory authority at any time. In Austria, this is the Austrian Data Protection Authority (www.dsb.gv.at).