Privacy Policy

1. Data controller

Zahrudin "Sascha" Mešić
Goding 50, 9431 St. Andrä
Email: contact@koralpenhaus.eu

2. Room bookings

When you book a room, we collect your name, email address, phone number (optional), check-in/check-out dates, number of guests, and any notes you provide. This data is stored in our database and used solely to process and manage your reservation, communicate with you about it, and — where legally required — for accounting purposes.

Legal basis: Performance of a contract (Art. 6(1)(b) GDPR).

3. Payment processing via PayPal

The deposit for your booking is processed by PayPal (Europe) S.à r.l. et Cie, S.C.A. When you choose to pay, you are redirected to PayPal, and the payment amount along with a transaction reference is shared between our site and PayPal to confirm your payment. We never see or store your full card or PayPal account details — only a payment confirmation reference. PayPal processes this data under its own privacy policy, available at paypal.com/myaccount/privacy/privacyhub.

Legal basis: Performance of a contract (Art. 6(1)(b) GDPR).

4. Contact form

If you use the contact form, we store your name, email address, and message in our database so we can respond to you. This data is also emailed to us as a notification.

Legal basis: Legitimate interest in responding to inquiries (Art. 6(1)(f) GDPR), or consent by submitting the form.

5. Cookies

This website uses two cookies:

• PHPSESSID — a technical session cookie, deleted when you close your browser. Required for basic site functionality (e.g. security tokens on forms).
• site_lang — remembers your chosen display language for one year, so you don't have to select it again on each visit.

We do not use advertising or third-party tracking/analytics cookies.

6. Automatic language detection

On your first visit, if you haven't yet chosen a language, we send your IP address to a third-party geolocation service (ip-api.com) once, to guess an appropriate language based on your country. The result is then stored in the site_lang cookie described above, and this lookup is not repeated on later visits. This service has its own privacy policy, available at ip-api.com/docs/legal.

Legal basis: Legitimate interest in providing the site in an appropriate language (Art. 6(1)(f) GDPR).

7. Email communication

We send booking confirmation emails and contact-form auto-replies to the email address you provide, containing only the information relevant to your booking or inquiry.

8. How long we keep your data

Booking records are kept for 7 years for tax purposes under § 132 BAO (Austrian Federal Fiscal Code), after which they are deleted. Contact inquiries are deleted once no longer needed to answer them, typically within 12 months.

9. Your rights

Under the GDPR, you have the right to access, correct, or delete your personal data, restrict or object to its processing, and request data portability. To exercise any of these rights, contact us at contact@koralpenhaus.eu.

10. Right to complain

You have the right to lodge a complaint with the Austrian data protection authority: Österreichische Datenschutzbehörde, Barichgasse 40-42, 1030 Vienna, dsb.gv.at.