Privacy policy

Here we explain how personal data is processed when you use talheim.at and send enquiries to Talheimer. Last updated: 7 September 2026.

1. Controller and contact details

Hannes Loitfelder — Talheimer “Grias di” & “Hoamat”
Glemmtaler Straße 283
5753 Saalbach Hinterglemm, Austria
Email: info@talheim.at
Telephone: +43 6541 6481

You can use these contact details for questions about data protection or to exercise your rights.

2. Website operation, hosting and security

When you visit the website, the web server processes information including your IP address, date and time, the requested page or file, browser and operating system information, referrer URL and technical status messages. This data is used to deliver the website, analyse errors and protect against misuse. Our hosting provider may process this data as part of its technical operations.

The legal basis is our legitimate interest in providing a secure, functional website under Article 6(1)(f) GDPR. Log data is retained only for as long as necessary to operate the website, investigate errors or examine a security incident. Legal obligations or the protection of legal claims may require longer retention.

The connection to the website is encrypted using HTTPS. Appointed IT service providers may have access to necessary data for maintenance and backups; backup copies may also contain stored enquiries.

3. Contact, holiday enquiries and email

Our enquiry forms are provided through Gravity Forms on our WordPress website. We process your email address and the information you provide, such as surname, preferred room category, travel dates, number of guests and message, to answer your enquiry and prepare an offer. Required fields are marked. Without a way to contact you, we cannot answer your enquiry.

Form submissions are stored in the website database and sent to us by email. Technical information, such as the time received, IP address and the page on which the form was completed, may also be stored. Some forms also contain fields recording the source of an enquiry, such as campaign parameters or an advertising click identifier. Analysis for advertising purposes is separate from handling your enquiry and requires an appropriate legal basis.

Booking enquiries and pre-contractual requests are processed under Article 6(1)(b) GDPR; general correspondence is processed on the basis of our legitimate interest in responding under Article 6(1)(f) GDPR. Microsoft/Outlook is configured via WP Mail SMTP to deliver website emails. Microsoft processes information including recipient and sender details, message contents and delivery information. The provider in Europe is Microsoft Ireland Operations Limited, Ireland. Further information: Microsoft privacy statement.

Enquiries and related correspondence are retained to handle the enquiry, answer necessary follow-up questions and, where applicable, perform the contract. Subsequent retention depends on statutory retention obligations and the need to establish or defend claims. Please do not send payment details or unnecessary sensitive information through the free-text field.

4. Cookies and your choices with CookieYes

We use CookieYes to manage cookie choices. The provider is CookieYes Limited, 3 Warren Yard, Warren Park, Wolverton Mill, Milton Keynes, MK12 5NW, United Kingdom. Your choices, a consent identifier and technical information are processed to save your settings and demonstrate consent. The legal basis is Article 6(1)(c) GDPR in conjunction with consent and record-keeping obligations; technically necessary storage of your choices falls within the exemption for necessary storage under section 165(3) of the Austrian Telecommunications Act 2021 (TKG 2021).

Non-essential cookies and comparable access to your device require prior consent under section 165(3) TKG 2021. The associated processing of personal data is based on Article 6(1)(a) GDPR. You can reject categories and change your decision later using the cookie icon at the bottom left. Withdrawal takes effect for the future and does not affect the lawfulness of earlier processing.

The cookie settings show the configured categories, purposes and durations. Cookie lifetimes must be distinguished from the retention of data already transmitted to the respective provider. Further information: CookieYes privacy policy and CookieYes data processing.

5. Google Analytics 4 and Google Ads

Google Analytics 4 and a Google Ads tag are embedded on the website. Management takes place partly through Google Site Kit. The provider is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. Analytics helps us understand how our website is used; Google Ads is used to attribute advertising interactions and measure advertising results.

Depending on the functions enabled, processing may include pages viewed, interactions, session and cookie identifiers, device and browser information, approximate location data, and campaign and advertising click information. Your consent is the basis for analytics and advertising processing that requires consent. Your choices are passed to the embedded tags through CookieYes and Google’s consent mode. You can reject analytics and advertising in the cookie settings or withdraw your consent.

According to Google, Analytics does not log or store individual IP addresses for visits from the EU; the IP address is initially processed technically, including to derive an approximate location. This does not mean that all analytics data is anonymous. Information about data processing and your options can be found in Google’s privacy policy and the Google Analytics privacy information for Europe.

6. Videos, maps, reviews and social media content

Some pages contain embedded external content. When this content loads, the provider receives at least your IP address and connection information for technical reasons; other data may include the page visited, browser details, cookie identifiers and interactions. If you are signed in to the provider’s service, it may be able to associate the visit with your user account.

  • YouTube and Google Maps: Videos and maps provided by Google Ireland Limited. Information: Google privacy policy.
  • Instagram: Embedded posts provided by Meta Platforms Ireland Limited, Ireland. Information: Instagram privacy policy.
  • HolidayCheck: Review content from HolidayCheck AG, Bahnweg 8, 8598 Bottighofen, Switzerland. Information: HolidayCheck privacy policy.
  • Tripadvisor: Review content from the Tripadvisor service. Information about the responsible companies and processing: Tripadvisor privacy statement.

Your consent governs non-essential cookies and processing by these services that requires consent. Please note: with the current technical integration, some external content, particularly review widgets, may establish connections to the provider as soon as the relevant page is opened. Your cookie choices do not automatically block every external connection.

7. Fonts, weather images and webcams

The fonts used in the website layout, including navigation, are hosted locally on our webspace. Your browser does not connect to Google Fonts for these font files. Requests generate the technical connection data on our web server described under “Website operation, hosting and security”. Embedded external content may load its providers’ own resources; the information under “Videos, maps, reviews and social media content” applies to these.

The weather page also retrieves images from external servers, including ZAMG/GeoSphere Austria, uwz.at, saalbach.com, berghotel.at, bergbahnen-fieberbrunn.at and live-panorama.com. These providers receive the connection data required to deliver the images. The purpose is to provide the displayed weather and webcam information. Where no additional functions requiring consent are used, this provision is based on our legitimate interest in informing our guests under Article 6(1)(f) GDPR.

Ordinary external links must be distinguished from embedded content: when you open a link to a booking portal, weather website or social network, you leave our website. The respective provider’s privacy information applies to processing there.

8. Guestbook

The Talheimer guestbook is operated under talheim.at and embedded on some pages. If you voluntarily publish an entry there, the name you enter and your contribution may be publicly visible. Please do not provide confidential information or other people’s personal data without their authorisation. For questions about an existing entry or a deletion request, contact us at info@talheim.at. Technical access data may be processed to operate the service and protect against misuse, on the basis of Article 6(1)(f) GDPR. Voluntary publication is based on your consent under Article 6(1)(a) GDPR.

9. Recipients, transfers and retention periods

Recipients may include our hosting, IT and email service providers, as well as the providers named for the relevant functions. International providers may process data outside the European Economic Area, particularly in the United States, the United Kingdom or Switzerland. The requirements of Articles 44 et seq. GDPR must be met, for example through an applicable adequacy decision or appropriate safeguards such as standard contractual clauses. The relevant service’s contractual and privacy information identifies the applicable arrangement; you may ask us for information about the safeguards used for our processing.

Personal data must not be retained longer than required for its respective purpose, a legal obligation or the necessary protection of legal claims. Provider cookies have the lifetimes stated in the cookie settings; deletion periods for forms, email, backups and analytics events must be considered separately.

10. Your rights

Subject to the GDPR, you have the rights of access, rectification, erasure, restriction of processing and data portability. You may object to processing based on legitimate interests for reasons relating to your particular situation; you may object to direct marketing at any time. You may withdraw consent with effect for the future.

You may lodge a complaint with a data protection supervisory authority. In Austria: Austrian Data Protection Authority, Barichgasse 40–42, 1030 Vienna, email: dsb@dsb.gv.at, website: dsb.gv.at.