Privacy Policy

Last updated: September 2026
The protection of your personal data matters to us. We process your data exclusively in accordance with the applicable legal provisions, in particular the General Data Protection Regulation (GDPR), the Austrian Data Protection Act (DSG) and the Austrian Telecommunications Act (TKG 2021).

With this Privacy Policy we inform you, in accordance with Art. 13 and 14 GDPR, about the processing of your personal data on our website and in connection with booking apartments in the Wachau.

1. Controller

The controller responsible for data processing is:
Anne Ristorcelli
Danube Atelier
Rossatz 12
3602 Rossatz, Austria
Phone: +43 699 17050606
Email: welcome@danube-atelier.com

2. What data we process and why

a) Visiting the website (server logs)
When you visit our website, our web server automatically records the following data:

  • IP address (anonymised where possible)
  • Date and time of the request
  • Page or file requested
  • Browser type and version
  • Operating system
  • Referrer URL (the page visited before)

This data is processed to ensure the security, stability and functionality of the website and to prevent misuse.
Legal basis: Art. 6(1)(f) GDPR (legitimate interest).
The data is deleted after a few days unless longer retention is required for security reasons.

b) Bookings made through the website
When you book an apartment through our website, we process the following personal data:

  • First and last name
  • Address (street, postcode, town, country)
  • Email address
  • Telephone number
  • Booking details (dates requested, number of guests, apartment chosen)
  • Payment information (depending on the payment method – we do not store full card details ourselves; processing is handled by secure payment providers)
  • Any special requests or notes

Purposes of processing:

  • Handling your booking (entering into and performing the contract)
  • Booking confirmations, invoices and payment processing
  • Meeting statutory registration obligations (Austrian Meldegesetz, guest registration)
  • Communicating with you, for example about changes or questions
  • Meeting tax retention obligations

Legal bases: Art. 6(1)(b) GDPR (performance of a contract), Art. 6(1)(c) GDPR (legal obligation, such as registration and tax law), Art. 6(1)(f) GDPR (legitimate interest, such as guest service).

c) Contact form and enquiries
When you use our contact form or write to us by email, we process the data you provide (name, email address, message) solely in order to deal with your enquiry.
Legal basis: Art. 6(1)(f) GDPR (legitimate interest) or Art. 6(1)(b) GDPR for pre-contractual measures.

d) Newsletter, if offered
If you subscribe to our newsletter, we process your email address in order to send it. You may withdraw your consent at any time.
Legal basis: Art. 6(1)(a) GDPR (consent).

3. Disclosure of data to third parties

We share your data only where this is necessary for the purposes described above:

  • with processors, such as our web host, booking software, payment service providers and email service providers – all contractually bound to comply with the GDPR
  • with public authorities, such as registration authorities under the Meldegesetz and the tax office
  • with external bookkeeping or tax advisers, where required

Transfers to third countries outside the EU or EEA take place only where appropriate safeguards are in place, such as Standard Contractual Clauses, or where an exception under the GDPR applies.

4. Retention periods

We keep your data only for as long as necessary for the purposes described or for statutory retention obligations:

  • Booking and contract data: generally 7 years (tax retention obligations)
  • Registration data: as required by the Meldegesetz
  • Server logs: a few days up to a maximum of 6 months

After these periods the data is deleted or anonymised.

5. Your rights

Under the GDPR you have the following rights:

  • Right of access to the data stored about you (Art. 15)
  • Right to rectification of inaccurate data (Art. 16)
  • Right to erasure (Art. 17)
  • Right to restriction of processing (Art. 18)
  • Right to data portability (Art. 20)
  • Right to object to processing (Art. 21)
  • Right to withdraw consent at any time (Art. 7) – this does not affect the lawfulness of processing carried out before the withdrawal

To exercise your rights, please write to the email address given above.

If you wish to make a complaint, you may contact the Austrian supervisory authority:
Austrian Data Protection Authority
Barichgasse 40–42, 1030 Vienna
Phone: +43 1 52 152-0
Email: dsb@dsb.gv.at
Website: www.dsb.gv.at

6. Cookies and similar technologies

Our website uses cookies, small text files stored on your device.

  • Technically necessary cookies: required for the website to work, for example the booking function. Legal basis: Art. 6(1)(f) GDPR or § 165 TKG.
  • Analytics and marketing cookies, where used: only with your consent, Art. 6(1)(a) GDPR.

You can delete cookies in your browser at any time or refuse their use. Please note that this may limit the functionality of the website.

7. Data security

We take appropriate technical and organisational measures to protect your data, such as SSL encryption during transmission, secure servers and access restrictions.

8. Changes to this Privacy Policy

We may update this Privacy Policy where necessary, for example because of legal changes or new features. The current version is always available on this website.