Legal
Privacy Policy
We take the protection of your personal data seriously and treat it confidentially, in accordance with the statutory data protection rules (the GDPR and the Austrian Data Protection Act) and with this Privacy Policy.
1. Controller
Grafhaidergut – Andreas & Katrin Havlicek
Diepersdorf 85
4552 Wartberg an der Krems, Austria
Phone: +43 664 2432414
Email: office@grafhaidergut.at
2. Your rights
You have the right at any time to obtain access to your personal data and to request its rectification or erasure, to restrict its processing, to data portability and to object to processing. You may withdraw any consent you have given at any time by informal email; this does not affect the lawfulness of the processing carried out up to that point.
Right to lodge a complaint with the Österreichische Datenschutzbehörde (Austrian Data Protection Authority), Barichgasse 40–42, 1030 Wien, phone: +43 1 52 152-0, email: dsb@dsb.gv.at.
3. Hosting (Netlify)
This website is hosted with Netlify (Netlify, Inc., USA). When the site is accessed, technically necessary server log data is processed (browser type and version, operating system, referrer URL, host name, time, IP address). The legal basis is our legitimate interest in providing the site securely and reliably (Art. 6(1)(f) GDPR). A data processing agreement is in place with Netlify; any transfer of data to the USA takes place on the basis of the EU Standard Contractual Clauses.
4. Cookies & consent
Cookies are small text files that are stored on your device. We distinguish between two types:
- Technically necessary storage: To operate the site, we store your language choice (German/English) and your cookie decision in your browser's local storage (localStorage). This information remains on your device and is not transmitted to us. Legal basis: legitimate interest in a functioning website (Art. 6(1)(f) GDPR).
- Statistics cookies (only with consent): For reach measurement we use Google Analytics (see point 8). These cookies are only set after you have actively clicked "Accept" in the cookie banner (Art. 6(1)(a) GDPR). Without your consent, Google Analytics is not loaded.
Your consent is voluntary and can be withdrawn at any time with effect for the future. You can reopen and change your selection here:
In addition, you can manage or delete cookies at any time in your browser settings; the functionality of the website may then be limited.
5. Getting in touch & contact form
If you contact us by email or via the contact form, we process the details you provide (e.g. name, email address, phone number and your message) in order to handle your enquiry and any follow-up questions (Art. 6(1)(b) GDPR, pre-contractual measures). The data is deleted as soon as it is no longer required; statutory retention periods remain unaffected.
The contact form is handled technically by the "Netlify Forms" service of Netlify, Inc. (USA) and forwarded to the email address given in the imprint. To protect against spam, a hidden field (honeypot) is used; no automated decision-making or profiling takes place. The transfer to the USA takes place on the basis of the EU-US Data Privacy Framework or the EU Standard Contractual Clauses.
6. Online booking (Seekda)
For holiday-apartment bookings, we link to the Seekda booking tool (officialbookings.com). The data you enter there (e.g. name, contact details, travel dates) is processed in order to handle the booking (Art. 6(1)(b) GDPR). The provider's privacy policy also applies: seekda.com/privacy-policy.
7. Embedded content: guest reviews & Instagram (TrustYou & Elfsight)
In the holiday section we embed the review widget from TrustYou (TrustYou GmbH, Germany); in the wedding section and the gallery we use the Elfsight widget (Elfsight LLC) to display our Google reviews and an Instagram feed. These widgets load content from the respective providers' servers – the reviews from TrustYou or Google, the Instagram feed from Instagram/Meta (Meta Platforms Ireland Ltd.). In doing so, your IP address may be transmitted to the respective provider. This embedded content is loaded only after your active consent via the cookie banner (Art. 6(1)(a) GDPR); without consent it is not loaded. Any transfer to the USA takes place on the basis of the EU-US Data Privacy Framework or the EU Standard Contractual Clauses.
8. Web analytics (Google Analytics)
To improve our website, we use Google Analytics (GA4), a web analytics service provided by Google Ireland Ltd. ("Google"), Gordon House, Barrow Street, Dublin 4, Ireland. Google Analytics uses cookies and similar technologies to analyse the use of our website (e.g. pages visited, approximate location, device used, time spent). The information generated is generally transmitted to and stored by Google.
Google Analytics is loaded exclusively after your active consent via the cookie banner (Art. 6(1)(a) GDPR). Without consent, no analysis takes place. Your IP address is truncated (IP anonymisation) so that no direct attribution to your person is possible. Any transfer to the USA takes place on the basis of the EU-US Data Privacy Framework or the EU Standard Contractual Clauses.
Your consent is voluntary and can be withdrawn at any time for the future, via the "Change cookie settings" button (point 4) or by deleting the cookies in your browser. Further information: policies.google.com/privacy.
9. Fonts
For a consistent appearance we use the typefaces "Fraunces" and "Outfit". These are hosted locally on our server (Netlify) and served from there; there is no connection to Google servers or any other third party, and no IP address is transmitted to third parties in the process. The legal basis is our legitimate interest in a consistent, appealing presentation (Art. 6(1)(f) GDPR).
10. Google Maps (link)
Our directions map is only loaded when you actively click on it ("Load map"). Only then is a connection to Google (Google Ireland Ltd. / Google LLC) established and your IP address transmitted to Google; Google's privacy policy then applies.
11. Social media
We link to our profiles on Instagram and Facebook. You are only redirected to these platforms when you click the links, at which point their privacy policies apply.
12. Data security
We take appropriate technical and organisational measures to protect your data against loss, misuse and unauthorised access. Please note that data transmission over the internet (e.g. by email) can have security vulnerabilities; complete protection against access by third parties is not possible.
13. SSL/TLS encryption
For security reasons, this site uses SSL/TLS encryption (recognisable by "https://" and the padlock symbol in the browser bar).
14. Objection to advertising emails
We hereby object to the use of the contact data published in the imprint for the purpose of sending advertising and information materials that have not been expressly requested.
15. Changes to this Privacy Policy
We reserve the right to amend this Privacy Policy so that it always complies with current legal requirements, or to reflect changes to our services or the services we use. The version in force at the time of your next visit will then apply.
Last updated: November 2026. This policy will be updated if the services used change.