hotelsINshape Privacy Policy
The protection of your personal data is important to us. Below, we explain what data we process in connection with our website, our newsletter and our competitions, for what purposes and on what legal basis this is done, to whom we disclose data, and what rights you have.
1. Data controller
Hotels IN Shape GmbH
Almerstraße 2
5760 Saalfelden am Steinernen Meer
Austria
Company registration number: FN 624509 x
Company Register Court: Zell am See District Court
VAT number: ATU80502314
Represented by the managing directors Andreas Thurner and Kurt Tropper
Email: fit@hotelsinshape.com
Telephone: +43 6582 716910
Website: www.hotelsinshape.com
Under the brand name “hotelsINshape — best fitness hotels”, we operate a curated platform for hotels specialising in fitness, yoga, outdoor sports, recovery and longevity. Our corporate purpose is the operation of online platforms for hotels. We have not appointed a data protection officer, as the legal requirements for doing so are not met. If you have any questions regarding data protection, please contact us using the contact details provided above.
2. Accessing our website and hosting
When you visit our website, your browser transmits technically necessary data to our server, which is stored in what are known as server log files. This includes the page accessed, the date and time of access, the amount of data transferred, the browser used (including its version), the operating system, the previously visited page and the IP address.
| Purpose | Hosting and delivering the website, ensuring stability and security, and detecting and defending against attacks. |
|---|---|
| Legal basis | Article 6(1)(f) of the GDPR. Our legitimate interest lies in ensuring the technically fault-free and secure operation of the website. |
| Retention period | The log files are automatically deleted after [enter time period; 7 to 30 days is standard], unless they are required to investigate a specific security incident. |
| Recipient | MICADO Digital Solutions GmbH, Hammerschmiedstraße 5, 6370 Kitzbühel, Austria, which operates the website and servers on our behalf in accordance with Article 28 of the GDPR. |
3. Cookies and similar technologies
Our website uses cookies and similar technologies, such as local storage. This involves storing or retrieving small amounts of data on your device.
- Technically necessary cookies enable the website to function, for example, page navigation, security features and the storage of your cookie preferences. They are set without your consent.
- Optional cookies are used for audience measurement, marketing purposes or to embed external content. They are only set once you have given your consent via our consent banner.
| Purpose: | Provision of basic functions and — subject to consent — audience measurement and the integration of external content. |
|---|---|
| Legal basis: | For essential cookies: Section 165(3) of the Telecommunications Act 2021 (TKG 2021) (Austria) in conjunction with Article 6(1)(f) of the GDPR. For all other cookies: your consent in accordance with Article 6(1)(a) of the GDPR. |
| Retention period: | Depending on the type of cookie: session cookies are deleted when the browser is closed; persistent cookies are deleted once their expiry date has passed or when they are manually deleted. |
| Cancellation: | You can change or withdraw your consent at any time, with effect for the future, via the cookie settings on our website. You can also delete or block cookies via your browser settings; however, this may mean that certain features of the website are no longer available. |
We use the Micado Web consent management tool to manage your consent. Your choice is stored so that we can take it into account the next time you visit and provide evidence of it in the event of a dispute.
4. Making contact
If you contact us via a contact form, by email or by telephone, we will process the data you provide us with — usually your name, your email address, your telephone number (if applicable) and the content of your enquiry.
| Purpose | Processing and responding to your enquiry, as well as any related correspondence. |
|---|---|
| Legal basis | Article 6(1)(b) of the GDPR, if your enquiry is for the purpose of entering into or performing a contract; otherwise, Article 6(1)(f) of the GDPR on the basis of our legitimate interest in responding to enquiries. |
| Retention period | Until your matter has been fully resolved. Beyond that, only to the extent that statutory retention obligations apply or the data is required to assert or defend legal claims. |
| Recipient | Within our organisation, only those persons entrusted with processing the data are granted access. External IT and hosting service providers process the data exclusively on our behalf in accordance with Article 28 of the GDPR. |
5. Prize draws
We regularly organise competitions in which a partner hotel provides the prize and, often, another partner promotes the campaign through its own channels. Entries are made via a form on our website.
What data we collect
To take part, we need your first name, surname and email address. In addition, we store the time of your registration, the campaign page you visited and the boxes you ticked. After submitting the form, you will receive an email with a confirmation link; your entry is only valid once you have clicked on this link. We also store the time of this confirmation.
What we use the data for
| Purpose | Conducting the prize draw, selecting and notifying the winner, and arranging the prize. |
|---|---|
| Legal basis | Article 6(1)(b) of the GDPR. By taking part, a legal relationship is established between you and us in accordance with the terms and conditions of participation. |
| Retention period | We will delete the data of participants who have not won and who have not given their consent to marketing communications once the competition has ended. We will retain the data of the winner for as long as is necessary to process the prize and to fulfil any requirements under tax or commercial law. |
Passing on details to the partner hotel
If you win, we will pass on your name and contact details to the hotel providing the prize. Without this transfer, the prize cannot be claimed. The hotel is solely responsible for the further processing of this data; this does not constitute processing on behalf of a third party. The legal basis is Article 6(1)(b) of the GDPR. The relevant partner hotel is named on the promotion page.
Apart from in the event of a win, we will only pass on your data to a partner hotel if you have given your express consent to this — see the following section.
Voluntary consent to marketing
On the registration form, you can choose separately whether you wish to receive our newsletter and whether the relevant partner hotel may send you offers by email. Both options are voluntary. Participation in the prize draw is not dependent on this, and your chances of winning remain the same even if you do not give your consent.
| Purpose | The sending of promotional emails by us or by the partner hotel you have selected. |
|---|---|
| Legal basis | Article 6(1)(a) of the GDPR (your consent) in conjunction with Section 7(2) of the Unfair Commercial Practices Act (UWG) or Section 174 of the Telecommunications Act 2021 (TKG 2021). |
| Withdrawal | You may withdraw any of these consents at any time with future effect — by using the unsubscribe link in any email or by sending a message to fit@hotelsinshape.com, or by contacting a partner hotel directly. The lawfulness of any processing carried out prior to the withdrawal remains unaffected. |
6. Newsletter
When you subscribe to our newsletter, we process your email address and, as a rule, your first name and surname. We only process further details if you provide them voluntarily. The email addresses used for our newsletter are obtained from the registration process on our website and from competitions in which you have expressly selected the newsletter option.
Confirmation procedure
Registration takes place via the double opt-in procedure. After you have registered, we will send you an email containing a confirmation link. We will only add you to the mailing list once you have clicked on this link. If you do not confirm within 48 hours, your email address will be automatically removed. As proof of your consent, we store the time of your registration, the time of your confirmation and the wording of the consent statement that was displayed to you at the time.
Performance measurement
Our newsletters may contain tracking pixels and personalised links, which we use to collect statistical data on whether an email has been opened and which links have been clicked. We analyse this information to improve content and sending times. If you do not wish this to happen, you can unsubscribe from the newsletter or disable the loading of images in your email programme.
| Sending hotel recommendations, offers and news, as well as statistical analysis of usage. | |
|---|---|
| Legal basis | Article 6(1)(a) of the GDPR (your consent). |
| Retention period | Until you withdraw your consent. We will also retain evidence of your consent for as long as claims relating to the sending of the newsletter may be brought. |
| Recipient | The data is transmitted via the system operated by MICADO Digital Solutions GmbH, Hammerschmiedstraße 5, 6370 Kitzbühel, Austria, which processes the data exclusively on our behalf in accordance with Article 28 of the GDPR. |
Block list
If you unsubscribe or object to receiving marketing communications, we will add your email address to a block list. This list serves solely to ensure that you no longer receive any marketing communications from us in future — even if your address is re-entered into our systems by other means. The legal basis is Article 6(1)(f) of the GDPR; it is in both our legitimate interest and yours to respect your objection on a permanent basis. For this reason, a block list entry will be retained even if you request erasure (Article 17(3)(e) of the GDPR).
7. Protecting our forms from misuse
Our forms are protected against automated submissions. This is achieved using [insert name of the method — our own coding method or an external service]. Technical data relating to your access is processed in this process. The legal basis is Article 6(1)(f) of the GDPR; our legitimate interest lies in protecting our forms from misuse and spam.
8. Web analytics with Google Analytics 4
Provided you have given your consent, we use Google Analytics 4. The provider is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. This may involve the processing of the pages you visit and your interactions with the site, technical details about your device, approximate location information and your truncated IP address. We use Google Analytics with IP anonymisation enabled; this means that your IP address is truncated before further processing.
| Purpose | Measuring reach, analysing usage, and optimising the content and structure of our website. |
|---|---|
| Legal basis | Article 6(1)(a) of the GDPR (your consent via our consent banner). |
| Retention period | In accordance with the settings configured in Google Analytics 4, event data is automatically deleted once the specified retention period has expired. |
| third countries | Data may be transferred to the USA; see Section 11. |
| Withdrawal | Via the cookie settings on our website. You can also prevent data collection using Google’s browser add-on: tools.google.com/dlpage/gaoptout |
9. Embedded third-party services
We only integrate the following services once you have given your consent via our consent banner. The legal basis in each case is Article 6(1)(a) of the GDPR. When a service is accessed, the provider may process your IP address, device and browser information, and the page you have accessed. Processing may take place in third countries.
Google Maps
For displaying maps and locations. The provider is Google Ireland Limited, address as above. Privacy policy: policies.google.com/privacy
YouTube
For embedding video content. The provider is Google. If you are logged into your Google account, YouTube may associate your use of the service with your profile; you can prevent this by logging out. Privacy policy: policies.google.com/privacy
Meta plugins (Facebook, Instagram)
For linking to our social media channels. The provider within the EU is Meta Platforms Ireland Limited, Merrion Road, Dublin 4, Ireland. If you are logged into Facebook or Instagram, Meta may associate your visit with your account. Privacy policy: de-de.facebook.com/policy.php
Note regarding adoption: Delete any services not integrated into the website without replacement. A privacy policy that describes processing activities that do not actually take place is just as flawed as one that omits information.
10. Our social media presence
We operate accounts on Instagram and Facebook. When you interact with these accounts, the respective provider processes your data in accordance with its own terms and conditions; we have no control over this. Where we decide jointly with the provider on the purposes and means of processing — for example, in relation to page statistics — we share joint responsibility in accordance with Article 26 of the GDPR. You may exercise your data subject rights both with us and with the relevant provider. The legal basis is Article 6(1)(f) of the GDPR; our legitimate interest lies in our public image and in communicating with interested parties.
11. Data transfers to third countries
Some of the services mentioned above may process data outside the European Union, in particular in the United States. The European Commission has adopted an adequacy decision for the US under the EU-US Data Privacy Framework; transfers to certified organisations are permitted on this basis. Where a recipient is not certified, we base the transfer on the European Commission’s Standard Contractual Clauses pursuant to Article 46(2)(c) of the GDPR or on your explicit consent pursuant to Article 49(1)(a) of the GDPR. Please note that third countries may not have a level of data protection comparable to that of the EU, and that public authorities may, under certain circumstances, gain access to data.
12. Recipients of your data
Within our organisation, only those individuals who require your data for the purposes stated are granted access to it. In addition, we pass on data to:
- IT service providers for hosting, website operation and newsletter distribution — exclusively as data processors in accordance with Article 28 of the GDPR.
- Partner hotels — in the event of a prize being won, for the purpose of processing the prize, and otherwise only with your express consent. The hotels are independently responsible in this regard.
- Providers of the integrated services, provided you have consented to this.
- Public authorities and courts, to the extent that we are legally obliged to do so.
We do not pass on data to any other third parties, in particular we do not sell address data.
13. Your rights
Under the GDPR, you have the following rights:
- Access to the personal data processed about you (Art. 15 GDPR)
- Rectification of inaccurate data (Art. 16 GDPR)
- Erasure (Art. 17 GDPR)
- Restriction of processing (Art. 18 GDPR)
- Data portability (Art. 20 GDPR)
- Objection to processing based on a legitimate interest (Art. 21 GDPR)
- Withdrawal of consent with effect for the future (Art. 7(3) GDPR)
You may object to receiving marketing communications at any time without giving reasons. Simply send an informal message to fit@hotelsinshape.com or click on the unsubscribe link in any of our emails.
If you believe that the processing of your data breaches data protection law, you may lodge a complaint with a supervisory authority. The supervisory authority responsible for us is the Austrian Data Protection Authority, Barichgasse 40–42, 1030 Vienna, dsb.gv.at. You may also contact the supervisory authority in your country of residence.
14. Changes to this Privacy Policy
We will update this privacy policy if our services or the legal requirements change. The version published on our website is the one that applies at any given time.