Sporthotel Zoll OHG d. Messner H., located at Brennerstraße 48/a, IT-39049 Sterzing, is committed to protecting the online privacy of its users. This document has been prepared in accordance with Article 13 of EU Regulation 2016/679 (hereinafter referred to as the “Regulation”) to familiarize you with our privacy policy and understand how your personal information is treated when using our website and to give your explicit and informed consent to the processing of your personal data (valid only for individuals aged 16 years or older). The information and data provided by you or otherwise acquired by us during the use of our services on the website (hereinafter referred to as “Services”) will be processed in accordance with the provisions of the Regulation and the confidentiality obligations that affect the activities of the data controller.

According to the provisions of the Regulation, the processing carried out by Sporthotel Zoll is based on the principles of lawfulness, fairness, transparency, purpose limitation, data minimization, accuracy, integrity, and confidentiality.

INDEX

DATA CONTROLLER PERSONAL DATA SUBJECT TO PROCESSING Navigation data Special categories of personal data Data voluntarily provided by the data subject Cookies Purposes of personal data processing and legal basis for processing RECIPIENTS OF PERSONAL DATA DISCLOSURE OF PERSONAL DATA RETENTION OF PERSONAL DATA Rights of the data subject ONLINE BOOKINGS AND RESERVATION INQUIRIES NEWSLETTER CONSENT CHARACTERISTICS PLUGINS USED GETAVO GIFT VOUCHER TOOL OBJECTION TO PROMOTIONAL EMAILS CHANGES

1. DATA CONTROLLER

The data controller for the processing carried out on the website is Sporthotel Zoll OHG d. Messner H., as determined above. For information about the processing of personal data by the data controller, including the list of data processors appointed to process the data, please write to the following address: info@sporthotel-zoll.com.

2. PERSONAL DATA SUBJECT TO PROCESSING

We inform you that, due to your navigation on the website, the data controller will process personal data that may consist of an identifier such as your name, an identification number, an online identifier, a postal address, an email address, a telephone number (landline and/or mobile), or one or more elements of your physical, physiological, mental, economic, cultural, or social identity, in order to identify or make the data subject identifiable (hereinafter referred to as “personal data”).

The personal data processed through the website are as follows:

a. Navigation data

The computer systems and software procedures used for the operation of the website collect some personal data as part of their normal operation, the transmission of which is implicit in the communication protocols of the Internet. These pieces of information are not collected to be associated with identified individuals, but due to their nature, through processing and linking with third-party data, they may allow the identification of users. This category of data includes IP addresses or domain names of computers used by users who connect to the website, the URI (Uniform Resource Identifier) addresses of the requested resources, the timing of the request, the method used to submit the request to the server, the size of the file received in response, the numerical code indicating the status of the server’s response (successful, error, etc.), and other parameters related to the operating system and computer environment. This data is used solely to obtain anonymous statistical information about the use of the website and to ensure its proper functioning, detect anomalies and/or misuse, and is deleted immediately after processing. The data may be used to ascertain liability in case of hypothetical computer crimes against the website or third parties. Apart from this possibility, the data collected on the website is deleted after a short period of time.

b. Special categories of personal data

If you use our website for an application (or send it via email), there may be a transmission of your personal data that falls under the special categories of personal data according to Article 9 of the regulation, namely “personal data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, or trade union membership, and the processing of genetic data, biometric data for the purpose of uniquely identifying a natural person, data concerning health or data concerning a natural person’s sex life or sexual orientation.” Please do not publish this data unless it is absolutely necessary. We explicitly inform you that the data controller cannot be held responsible for the transmission of special categories of personal data without explicit consent for processing such data (except for sending a resume), nor can they be subjected to any reproach since in this case, the processing is allowed as the data relates to personal data that has been manifestly made public by the data subject, in accordance with Article 9(1)(e) of the regulation. However, we emphasize that it is important, as mentioned above, to provide explicit consent for the processing of special categories of personal data if you decide to transmit such information.

We also inform you that, for the purpose of applicant selection, the data controller may analyze publicly accessible social profiles (e.g., LinkedIn) for professional purposes.

c. Data voluntarily provided by the data subject

If you use certain services on the website (e.g., the inquiry, contact, or reservation form), we may process personal data from third parties that you send to the data controller. In these cases, you are the data controller assuming all legal obligations and liabilities. In this regard, you indemnify us to the maximum extent with regard to any claims, demands, compensation claims arising from the processing, etc., which the data controller may receive from third parties whose personal data has been processed by using the functions of the website in violation of the applicable regulations for the protection of personal data. If you provide or otherwise process personal data of third parties in the course of using the website, you guarantee in any case that this specific processing is based on an appropriate legal basis in accordance with Article 6 of the regulation, which legitimizes the processing of the relevant information.

d. Cookies

General information about cookies

Cookies are small text files that are deposited by a website on the hard drive of a client computer through the browser to store small amounts of information from the website for a certain period of time. In general, there are various types of cookies. Some are essential for the functioning of the website, such as navigation or shopping cart cookies. Furthermore, there are analytics cookies that collect information, such as the number of website visitors and their path on the website. Functionality cookies allow the website to remember your choices (e.g., selected filter settings or automatic language preference).

Additionally, there are cookies known as profiling cookies that capture user preferences and actions. Based on this information, a user profile is created. This is done to combine advertising messages with the users’ interests, enabling more targeted advertising. Often, third-party cookies are used by website operators for personalized advertising.

Consent requirement for cookies

Website visitors must actively consent to the use of cookies that are not essential for the functionality of the website, and they also have the right to withdraw their consent at any time.

This website uses a technology called CMP (Content Management Platform) to manage this right. When accessing the website, a banner appears that informs the website user about the use of cookies, provides various consent options (consent to all cookies, individual categories of cookies, or each cookie separately), and provides detailed information about the different cookies. The CMP remembers the user’s selected settings and applies them during the next website visit. Here, website visitors can exercise their right to withdraw consent or adjust the settings.

Blocking cookies through browser settings

Firefox:

1. Click on the menu and select Preferences.
2. Go to the Privacy & Security tab.
3. Under the “History” section, choose “Use custom settings for history.”
4. In the options that appear, uncheck “Accept cookies.”
5. Click the “OK” button.

For more detailed information, visit: https://support.mozilla.org/en-US/kb/block-websites-storing-cookies-site-data-firefox

Google Chrome:

1. Click on the menu and select Settings.
2. Scroll down and click on “Advanced” to expand the settings.
3. Under the “Privacy and security” section, click on “Content settings.”
4. In the Cookies section, select “Block third-party cookies.”
5. Click the “Done” button.

For more detailed information, visit: https://support.google.com/chrome/answer/95647?hl=en

Internet Explorer:

1. Open the “Tools” menu and select “Internet Options,” or if the menu bar is not visible, click on the menu icon and select “Internet Options.”
2. Click on the “Privacy” tab.
3. Using the slider, choose the desired level of cookie processing. Moving the slider to the top will block all cookies, and moving it to the bottom will allow all cookies.
4. Click the “OK” button.

For more detailed information, visit: https://support.microsoft.com/en-us/windows/delete-and-manage-cookies-168dab11-0753-043d-7c16-ede5947fc64d

Safari:

1. Click on “Preferences” in the Settings.
2. Go to the “Privacy” tab.
3. In the “Cookies and website data” section, you can specify if and when Safari should store cookies from websites. For more information, click the Help button (indicated by a question mark).

For more detailed information, visit: https://support.apple.com/en-us/HT201265

Detailed information on the use and settings of cookies can be found here.

3. Purposes of processing personal data and legal basis for processing

The provided data is processed for the following purposes:

• Compliance with legal obligations
• Handling pre-contractual and contractual measures regarding the stay (reservation, check-in, check-out, etc.)
• Forwarding messages and phone calls addressed to the guest
• Storing data for facilitating future bookings and inquiries
• Sending information, offers, and news from the hotel and partner businesses and associates via email, mail, and other means of telecommunication about the hotel, the surrounding area, local events, etc.
• Video surveillance
• Operation of wellness and fitness facilities

The legal basis for processing your data includes:

• Legal or regulatory obligations
• Performance of pre-contractual and contractual measures and obligations
• Consent obtained from you
• Legitimate interests (e.g., improving our customer service and proximity, including direct marketing, and video surveillance to protect individuals and property from possible attacks, theft, robbery, damage, vandalism, fire prevention, and workplace safety)

4. Recipients of personal data

Your personal data may be disclosed for the purposes mentioned in Section 3 to:

• Entities typically acting as data processors, i.e., (i) individuals, companies, or professional firms providing assistance and advice to the data controller regarding accounting, administrative, legal, tax, financial, collection, marketing, and communication matters related to service provision; (ii) entities with whom cooperation is necessary for the provision of services (e.g., hosting providers); (iii) subjects entrusted with carrying out technical maintenance activities (including maintenance of network equipment and electronic communication networks) (collectively referred to as “Recipients”);
• Subjects, entities, or authorities to whom your personal data must be communicated due to legal obligations or regulatory provisions;
• Persons authorized by the data controller to process personal data necessary for carrying out activities related to service provision or other purposes mentioned in Section 3, who have committed to confidentiality or are subject to an appropriate legal obligation of confidentiality (e.g., employees of the data controller).
  
  

5. Transfer of personal data

Some of your personal data may be transferred to recipients located outside the European Economic Area. The data controller ensures that the processing of your personal data by these recipients is carried out in accordance with the regulations. In fact, transfers may be based on an adequacy decision, the standard contractual clauses approved by the European Commission, or another appropriate legal basis. For more information, you can contact the data controller at the following address: info@sporthotel-zoll.com.

6. Retention of personal data

Personal data processed for the purposes mentioned in Section 3 will be retained for as long as strictly necessary to achieve these purposes. Since data processing is carried out to provide services, the data controller will process personal data in any case until the time provided by Italian legislation for the protection of interests (Art. 2946 ff. Civil Code). Regarding the resumes submitted through the website or by email, personal data will be retained for a period deemed appropriate for the purpose for which the data was collected. This applies regardless of the data controller’s possibility to contact the applicant shortly before the expiry of the indicated deadline to request an extension of this retention period.

The personal data processed for the purposes mentioned in Section 3 will be stored until the specific obligation or applicable law provides for a certain timeframe.

On the other hand, personal data processed for the purposes mentioned in Section 3 will be kept until the consent is revoked by the data subject or, if such revocation does not occur, for a specific maximum period deemed appropriate.

For further information regarding the retention period of the data and the criteria used to determine this timeframe, please contact the data controller at the following address: info@sporthotel-zoll.com.

7. Rights of the data subject

Right to information: According to Art. 15 GDPR, you have the right to obtain information about the personal data being processed, its origin, the types of data being processed, whether it is being disclosed to third parties, and what is being done with the data.

Right to rectification and erasure: According to Art. 16 GDPR, you have the right to request the correction or completion of your personal data. Similarly, under Art. 17 GDPR, you have the right to erasure. In particular, if the data has been published, you also have the “right to be forgotten,” which means that necessary steps will be taken to delete all links, copies, replications, or similar.

Right to object: You can exercise your right to object under Art. 21 GDPR and modify or completely revoke your consent declaration for the future.

Right to restriction of processing: Under Art. 18 GDPR, you can also request the restriction of the processing of your personal data. The collected data may then only be processed with individual consent or the processing must be specifically restricted.

Right to data portability: According to Art. 20 GDPR, you have the right to receive the personal data provided in a structured, commonly used, machine-readable format and to request the transfer of your personal data to another controller.

You also have the right to lodge a complaint with the supervisory authority according to Art. 77 GDPR.

8. ONLINE BOOKINGS AND BOOKING INQUIRIES

Our website uses the booking technology XENUS Hotelsoftware provided by PCS GmbH, Bahnhofstraße 10, 39046 St. Ulrich (BZ) Italy.

When you make an online booking or a booking inquiry through our website, we require your email address, travel dates, booked product, salutation, first name, and last name for processing purposes. In some cases, we may also request your telephone number to quickly contact you, particularly regarding unforeseen circumstances that may affect your booking.

To calculate the valid travel price for your individual travel parameters, we also need the number of accompanying persons and whether the accompanying persons are adults or children. If you are traveling with children, we also request the age of the children for the correct calculation of the travel price. Furthermore, we ask for the desired payment method for the trip. If a prepayment applies to your travel parameters, you will be redirected to a payment service provider for the secure processing of the prepayment.

Additional information in the form is provided on a voluntary basis.

The processing of your data for online bookings and booking inquiries is based on Art. 6(1)(b) GDPR and serves the fulfillment of a contract or the implementation of pre-contractual measures.

For more information on the handling of personal data, please refer to https://www.xenus.it/Privacy.html.

9. NEWSLETTER

If you would like to subscribe to the newsletter offered on the website, we require your email address and information that allows us to verify that you are the owner of the specified email address and that you agree to receive the newsletter. No further data is collected or only collected on a voluntary basis. The sending of the newsletter is based on your consent pursuant to Art. 6(1)(a) GDPR.

You can revoke your consent to the storage of data, email address, and their use for newsletter dispatch at any time, for example, by using the “unsubscribe” link in the newsletter. The legality of data processing that occurred prior to the revocation remains unaffected.

The newsletter is sent using the service of Sporthotel Zoll OHG by the newsletter software Newstroll: NEWSTROLL – email marketing software in Maustäle 18, D 72793 Pfullingen (DE). The registration for our newsletter follows a double opt-in process. After registration, you will receive an email asking you to confirm your subscription. This confirmation is necessary to identify you as the owner of the email address. Newsletter registrations are logged to meet legal requirements. The logging of the registration process is based on a legal obligation according to § 76 BDSG, Art. 6 (1) sentence 1 lit. c GDPR. This includes the storage of the registration and confirmation timestamps, IP address, and registration data.

You can revoke your consent to the storage of the email address for its use in newsletter dispatch at any time with effect for the future. The revocation can be made using a link in the newsletters themselves. When unsubscribing from the newsletter, your data will be moved to an “exclude list” to ensure that you no longer receive the newsletter in the future. If you wish to have all data completely deleted, please contact info@sporthotel-zoll.com.

10. CONSENT CHARACTERISTICS

The processing of your data is based on contractual or legal grounds and complies with the requirements of EU Regulation No. 679/2016 (GDPR).

Consent for the processing of additional special categories of data is voluntary. Without consent, specific precautions regarding further bookings cannot be considered.

Consent for data processing related to the sending of information, offers, and news from the hotel is voluntary. By not providing personal data, no offers and news will be transmitted.

11. USED PLUGINS

We use various plugins for different purposes. The plugins used are listed below:

• Google Analytics
• Google Ads & Google Conversion Tracking
• Google Tag Manager
• Google Maps
• Facebook Pixel Tracking
• YouTube
• Getavo Voucher Tool

GOOGLE ANALYTICS

This website uses features of the web analytics service Google Analytics. The provider is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland.

Google Analytics uses “cookies,” which are text files placed on your computer, to help analyze how users use the website. The information generated by the cookie about your use of the website will generally be transmitted to and stored by Google on servers in the United States.

The storage of Google Analytics cookies is based on Art. 6(1)(f) of the GDPR. The website operator has a legitimate interest in analyzing user behavior to optimize both its website and advertising.

IP Anonymization We have enabled the IP anonymization feature on this website. This means that within member states of the European Union or other states party to the Agreement on the European Economic Area, your IP address will be shortened by Google before being transmitted to the US. Only in exceptional cases will the full IP address be transmitted to a Google server in the US and shortened there. On behalf of the website operator, Google will use this information to evaluate your use of the website, compile reports on website activity, and provide other services relating to website activity and internet usage to the website operator. The IP address transmitted by your browser as part of Google Analytics will not be merged with any other data held by Google.

Browser Plugin You can prevent the storage of cookies by adjusting your browser software accordingly; however, please note that if you do this, you may not be able to use all the features of this website to their full extent. You can also prevent the collection of data generated by the cookie and related to your use of the website (including your IP address) by Google and the processing of this data by Google by downloading and installing the browser plugin available at the following link: https://tools.google.com/dlpage/gaoptout?hl=en.

Objection to Data Collection You can prevent Google Analytics from collecting your data by clicking on the following link. An opt-out cookie will be set to prevent the collection of your information on future visits to this site: Disable Google Analytics.

For more information on how Google Analytics handles user data, please refer to Google’s privacy policy: https://support.google.com/analytics/answer/6004245?hl=en.

Data Processing Agreement We have concluded a data processing agreement with Google and fully implement the strict requirements of the German data protection authorities when using Google Analytics.

Demographic Features in Google Analytics This website uses the “demographic features” function of Google Analytics. This allows reports to be generated containing information about the age, gender, and interests of site visitors. This data comes from interest-based advertising by Google and visitor data from third-party providers. This data cannot be attributed to any specific individual. You can disable this feature at any time by adjusting the ads settings in your Google account or by generally prohibiting the collection of your data by Google Analytics as explained in the “Objection to Data Collection” section.

GOOGLE ADS AND GOOGLE CONVERSION TRACKING This website uses Google Ads, which is an online advertising program provided by Google Ireland Limited, located at Gordon House, Barrow Street, Dublin 4, Ireland.

As part of Google Ads, we utilize a feature called Conversion Tracking. When you click on an advertisement served by Google, a conversion tracking cookie is set. This cookie expires after 30 days and is not used for personal identification of users.

If you visit specific pages on this website and the cookie has not expired, Google and we can recognize that you clicked on the ad and were redirected to this page.

Each Google Ads customer receives a different cookie, and these cookies cannot be tracked across the websites of Google Ads customers. The information obtained through the use of conversion cookies is used to create conversion statistics for Google Ads customers who have opted for conversion tracking. Customers can learn the total number of users who clicked on their ad and were redirected to a page with a conversion tracking tag. However, they do not receive any information that personally identifies users.

If you do not wish to participate in tracking, you can opt out by disabling the Google Conversion Tracking cookie through your internet browser’s user settings. By doing so, you will not be included in the conversion tracking statistics.

The storage of conversion cookies and the use of this tracking tool are based on Art. 6(1)(a) of the General Data Protection Regulation (GDPR), and your consent can be revoked at any time.

For more information about Google Ads and Google Conversion Tracking, please refer to Google’s privacy policy: https://policies.google.com/privacy?hl=en.

You can configure your browser to notify you when cookies are being set, allow cookies on a case-by-case basis, block cookies for specific cases, or automatically delete cookies when you close your browser. Disabling cookies may limit the functionality of this website.

Data Processing Agreement: We have entered into a data processing agreement with Google and fully implement the strict requirements of the German data protection authorities when using Google Analytics.

Demographic features in Google Analytics: Our website uses the “demographic features” of Google Analytics, which allows for the creation of reports that contain information about the age, gender, and interests of website visitors. This data is derived from Google’s interest-based advertising and visitor data from third-party providers. This data cannot be attributed to any specific individual. You can disable this feature at any time through the ad settings in your Google account or by opting out of data collection by Google Analytics as described in the “Objection to Data Collection” section.

You can prevent the collection of your data by Google Analytics by clicking on the following link: https://tools.google.com/dlpage/gaoptout. This will set an opt-out cookie that prevents the collection of your data on future visits to this website.

For more information on how Google Analytics handles user data, please refer to Google’s privacy policy: https://support.google.com/analytics/answer/6004245?hl=en.

CONVERSION TRACKING AND CUSTOM AUDIENCE WITH FACEBOOK PIXEL Our website uses the Facebook pixel for conversion tracking. This service is provided by Facebook Ireland Limited, located at 4 Grand Canal Square, Dublin 2, Ireland. According to Facebook, the data collected is also transferred to the United States and other third countries.

The Facebook pixel is a JavaScript code that allows tracking of conversions, optimization, and capturing of remarketing audiences (Custom Audience). The pixel tracks the user’s actions on the website through a specific tracking code personalized with conversion indicators.

Custom Audience is an audience targeting option that allows the website provider to reach people on Facebook who have visited their website. These individuals can be automatically grouped based on specific actions taken on the website. This information is transmitted to Facebook via the tracking code.

The Facebook ID is also captured in this process. We would like to inform you that the personal data of individual users is anonymous to us and is encrypted locally on the system. The data is securely transmitted to Facebook, where it is stored and processed. However, Facebook can associate this data with your Facebook account and use it for its own advertising purposes in accordance with Facebook’s data usage policy. You can find information about Facebook’s data usage policy at: https://www.facebook.com/about/privacy/.

The encrypted data is used only for the matching process, not shared with third parties or other advertisers, and is promptly deleted after the matching process is completed. You can opt out of the use of the Facebook pixel on the following page: https://www.youronlinechoices.eu.

YOUTUBE WITH ENHANCED PRIVACY This website embeds videos from YouTube. The operator of YouTube is Google Ireland Limited (“Google”), located at Gordon House, Barrow Street, Dublin 4, Ireland.

We use YouTube in the enhanced privacy mode, which, according to YouTube, means that YouTube does not store information about visitors to this website unless they watch the video. However, the enhanced privacy mode does not necessarily exclude the sharing of data with YouTube partners. Regardless of whether you watch a video, YouTube establishes a connection to the Google DoubleClick network.

When you start a YouTube video on this website, a connection to YouTube’s servers is established. This informs the YouTube server about the pages you have visited on our website. If you are logged into your YouTube account, you allow YouTube to associate your browsing behavior directly with your personal profile. You can prevent this by logging out of your YouTube account.

Furthermore, after starting a video, YouTube may store various cookies on your device or use comparable recognition technologies (e.g., device fingerprinting). This allows YouTube to obtain information about visitors to this website. This information is used, among other things, to capture video statistics, improve user-friendliness, and prevent fraud attempts.

Additional data processing operations may be triggered after starting a YouTube video, over which we have no control.

The use of YouTube is in the interest of presenting our online content in an appealing manner. This constitutes a legitimate interest under Art. 6(1)(f) of the General Data Protection Regulation (GDPR). If consent has been requested, processing will be based on Art. 6(1)(a) of the GDPR, and consent can be revoked at any time.

For more information about data protection at YouTube, please refer to their privacy policy: https://policies.google.com/privacy?hl=en.

12. OBJECTION TO PROMOTIONAL EMAILS The use of contact information published within the scope of the imprint obligation for sending unsolicited advertising and information materials is hereby objected to. The website operators expressly reserve the right to take legal action in the event of unsolicited promotional information, such as spam emails.

13. CHANGES This privacy policy is effective from 01/01/21. The controller reserves the right to change or update the content in whole or in part, including due to changes in applicable legislation. Therefore, the controller encourages you to regularly visit this section to stay informed about the latest and most up-to-date version of this privacy policy.

14. Data Controller Helmut Messner Sporthotel Zoll OHG d. Messner H. Brennerstraße 48/a 39049 Sterzing Province of Bolzano / South Tyrol Italy Tel.: +39 0472 76 56 51 Tax Number and VAT ID: IT 01374210217