Record of Processing Activities

under Art. 30 GDPR · As of October 2026

This record describes which personal data Sporthotel Ideal KG processes for which purpose, to whom it is disclosed and when it is deleted. The retention periods are set in our hotel software CASA One, which deletes or anonymises the data automatically in daily runs once a period has expired. Invoices, bookings and cash register data are excluded: they are kept for at least 12 years (statutory minimum 7 years) and remain linked to the guest file as revenue history for as long as the guest relationship exists. The German version is authoritative.

ControllerSporthotel Ideal KG
Hochgurglerstraße 2
6456 Hochgurgl, Austria

ManagementEvi Riml
Hochgurglerstraße 2
6456 Hochgurgl

Data protection officerArmin Riml
Hochgurglerstraße 2
6456 Hochgurgl

Data protection contacthotel@sporthotelideal.at
Phone +43 5256 6290

1. Processing activities

No.	Activity and purpose	Data subjects and data categories	Legal basis	Recipients	Retention periods
1	Enquiries and offersAnswering enquiries (phone, e-mail, website, price calculator, WhatsApp), preparing and sending offers, sending brochures.	Prospective guests, guests: name, address, e-mail, phone, travel dates, number of persons, requests, message content; IP address and browser identifier when an offer is opened.	Art. 6(1)(b) GDPR (pre-contractual measures)	CASA One (hotel software and online guest area); Futureweb GmbH (e-mail); WhatsApp Ireland Ltd. if the guest chooses WhatsApp.	Enquiries from the website form: 1 year after completion Offer in the online guest area: anonymised 300 days after departure, the guest link expires IP address and browser identifier: deleted from the day of departure (without travel dates, 90 days after opening) Chat about an offer: 1 year after the last message Offer in CASA One: like reservations (no. 2)
2	Booking and reservationProcessing bookings (direct, online, via booking portals), room planning, booking confirmation, managing the stay.	Guests, fellow travellers: name, address, contact details, date of birth, travel dates, room and service requests, payment method (card masked only).	Art. 6(1)(b) GDPR (accommodation contract); Art. 6(1)(c) (retention obligations)	CASA One; booking channels feratel and Seekda where a booking is made through them; Futureweb GmbH (e-mail delivery of the confirmation).	Reservations, account entries and room plan: at least 12 years (statutory 7 years, § 132 Austrian Federal Fiscal Code, BAO); while the guest relationship exists they remain in the guest file as history of stays and revenue; no automatic deletion Raw data of online bookings including the masked card number: 180 days Booking message from booking channels: 400 days after departure Items on the server not collected by the hotel: 200 days
3	Payment processingDeposit, guarantee and payment by credit card or PayPal; one-click follow-up booking with a stored card.	Guests: name, e-mail, phone, amount, booking number, masked card (brand, last four digits, expiry), payment history, PayPal e-mail. The guest enters the card number and security code directly with the payment provider; the hotel does not store them.	Art. 6(1)(b) GDPR; Art. 6(1)(c) (proof of payment)	Hobex AG (card payment) and PayPal (Europe) S.à r.l. et Cie, S.C.A., each as an independent controller.	Payment log: 180 days Stored card: name, phone and e-mail deleted from the month after the card expires Stored PayPal account: deleted at PayPal 400 days after the last departure Security codes of the one-click booking: 30 days after expiry Proof of payment (masked card, amount): like invoices (no. 13)
4	Online check-in and guest registrationStatutory guest registration (registration form), visitor's tax, online check-in before arrival, signature on the guest pad.	Guests, fellow travellers: name, date of birth, sex, nationality, address, type and number of ID document, vehicle registration, arrival and departure, signature.	Art. 6(1)(c) GDPR (Austrian Registration Act 1991, Tyrolean Visitor's Tax Act); online check-in also Art. 6(1)(b)	Registration authority (municipality of Sölden) and Ötztal Tourismus via the registration system of feratel media technologies AG; CASA One.	Registration form and registration data: 8 years (statutory minimum 7 years) Online check-in on the server: IP address only as a pseudonym, deleted after 30 days ID document, nationality, address, e-mail and vehicle registration on the server: 45 days after the hotel has taken over the check-in, at the latest after 13 months Entire online check-in on the server: 300 days after departure Log of deviating entries during the takeover: 180 days
5	Guest file and guest servicesKeeping the guest file (master data, stays, preferences), looking after guests during their stay, regular-guest care, garage spaces, returning forgotten items.	Guests: master and contact data, date of birth, stays, requests and notes, bank details (if provided), vehicle registration.	Art. 6(1)(b) GDPR; Art. 6(1)(f) (caring for our regular guests)	CASA One; SendHomeService (returns, only at the guest's request).	Guest file: as long as the guest relationship exists; on request immediately (Art. 17 GDPR) unless a retention obligation applies Deleted guest file: all personal data anonymised automatically after 3 years Garage plan (name, vehicle registration): 1 year after the end of the stay
6	E-mail communication and guest informationHandling the e-mail inbox, sending confirmations and automatic information before and after the stay, proof of dispatch.	Guests, prospective guests, business partners: e-mail address, name, content and attachments, delivery status.	Art. 6(1)(b) GDPR; Art. 6(1)(f) (proof of dispatch)	Futureweb GmbH (e-mail server, Austria); CASA One.	Inbox (closed conversations): attachments after 1 year, message text after 2 years, messages after 3 years, conversation after 4 years; for offers and bookings only sender, subject and time remain E-mail log: message text after 90 days, entry (recipient, subject, status) after 2 years Outbox: 90 days after sending Log of automatic e-mails: 2 years after arrival
7	WhatsApp, Facebook and InstagramCommunicating with guests and prospective guests who choose this channel; replying to messages and comments. No advertising via WhatsApp.	Guests, prospective guests: phone number, profile name, message content, timestamps.	Art. 6(1)(b) GDPR; Art. 6(1)(f) (replying via the chosen channel)	WhatsApp Ireland Ltd. (processor); Meta Platforms Ireland Ltd. (Facebook, Instagram; joint controller for page insights, Art. 26 GDPR).	WhatsApp messages in CASA One: 1 year Facebook and Instagram messages: inbox periods (no. 6) On the server: as soon as CASA One has collected the message
8	AI assistantAnswering guest questions in the chat on the website and booking page; internally summaries and reply suggestions for incoming enquiries. A member of staff always reviews suggested replies before they are sent.	Website visitors, guests: chat entries, time, language, page visited; internally: content of incoming enquiries.	Art. 6(1)(f) GDPR (round-the-clock guest service); Art. 6(1)(b) if an enquiry or booking results	Anthropic PBC, USA (processor); content is not used for training.	Conversation transcripts: 90 days Evaluation only in aggregated form without personal reference (statistics 24 months) Internal reply suggestions: not stored Chat history in the guest's browser: 30 days after the last message
9	Newsletter and postal mailingsInformation about offers, price lists and news by e-mail newsletter or post; birthday greetings.	Subscribers, guests: name, address, e-mail, language, time and text of consent, unsubscribe status.	E-mail: Art. 6(1)(a) GDPR, § 174 Austrian Telecommunications Act 2021 (double opt-in); post to guests: Art. 6(1)(f) (direct marketing)	Futureweb GmbH (e-mail dispatch); CASA One.	Until consent is withdrawn (unsubscribe link in every mailing or informally); the address is then blocked for mailings Unconfirmed sign-ups: 48 hours
10	Website and web analyticsProviding and securing the website and booking page; audience measurement only with consent.	Website visitors: IP address, browser and device data, pages visited; with consent, usage data (Google Analytics 4).	Provision and security: Art. 6(1)(f) GDPR; analytics: Art. 6(1)(a), § 165(3) Austrian Telecommunications Act 2021	Futureweb GmbH (hosting, Austria); Google Ireland Ltd. (Google Analytics 4, only after consent).	Google Analytics: 14 months Consent: stored in the browser until withdrawn ("Cookie settings") Session cookie of the booking page: when the browser is closed
11	Video surveillanceProtecting guests, staff and property in the ski room, hotel lobby, reception, bar and dining room (signposted at the entrance). Guest rooms are not monitored.	Guests, visitors, staff: video images.	Art. 6(1)(f) GDPR (protection of persons and property)	None; if an incident occurs, security authorities and insurers.	Automatically after 15 days; longer only while a specific incident is being cleared up
12	Applications and personnel administrationRecruitment, payroll, registration with social insurance, registration of staff, working time records.	Applicants, staff: master and contact data, date of birth, CV and references, ID and social insurance data, bank details, working hours.	Art. 6(1)(b) GDPR (employment contract and its initiation); Art. 6(1)(c) (Austrian social insurance, income tax, fiscal, registration and working time laws)	Austrian Health Insurance Fund (ÖGK), tax office, municipality; tax advisor (payroll).	Applications without employment: 7 months after rejection (periods of the Equal Treatment Act) Personnel and payroll records: 7 years after the end of the calendar year (§ 132 BAO)
13	Accounting and cash registerInvoicing, cash register, bookkeeping, vouchers.	Guests, corporate customers: name, address, VAT number (companies), services, amounts, payment method.	Art. 6(1)(b) and (c) GDPR (Austrian fiscal, VAT, cash register and commercial law)	Tax office; tax advisor.	At least 12 years (statutory 7 years after the end of the calendar year, § 132 BAO); invoices remain linked to the guest file and retrievable while the guest relationship exists; no automatic deletion Archived PDF file of the invoice: deleted after 12 years at the earliest; the invoice remains retrievable from the stored data (duplicate)
14	Travel insuranceArranging travel insurance in the booking process if the guest wishes.	Guests, fellow travellers: name, address, phone, e-mail; date of birth of insured persons.	Art. 6(1)(b) GDPR	Europäische Reiseversicherung AG, Vienna (independent controller).	On the server: as soon as CASA One has collected the application At the hotel with the booking (no. 2)
15	IT operations, security and backupOperating the hotel software CASA One, access protection, logging, backup, error analysis.	Staff: user accounts (name encrypted, password only as a hash), login attempts, event log. Guests: backup copies of the data above.	Art. 6(1)(c) GDPR in conjunction with Art. 32 GDPR (security of processing); Art. 6(1)(f)	CASA One (software provider, maintenance); Futureweb GmbH (servers in Austria).	Backups at the hotel: 60 days (rolling) Backup of the online server at the host: 365 days Login attempts: 1 day Login log of remote access: 1 year Backup run log: 1 year Event log without invoice reference: 3 years Screenshots from improvement suggestions: 14 days after completion

2. Processors, other recipients and third countries

Recipient	Service	Role	Location and third country
CASA One, Mag. (FH) Armin Riml, MBA, Hochgurgl	Hotel software, online guest area, booking page, maintenance	Processor	Austria; servers at Futureweb GmbH in Austria
Futureweb GmbH, St. Johann in Tirol	Hosting of website, mailboxes and online server	Processor	Austria
WhatsApp Ireland Ltd., Dublin	WhatsApp Business Platform	Processor	Ireland; USA (Meta Platforms, Inc.): EU-US Data Privacy Framework, standard contractual clauses
Anthropic PBC, San Francisco	AI assistant	Processor	USA: standard contractual clauses
Google Ireland Ltd., Dublin	Google Analytics 4, only after consent	Processor	Ireland; USA (Google LLC): EU-US Data Privacy Framework, standard contractual clauses
feratel media technologies AG, Innsbruck	Registration system, booking channel	Processor	Austria
Seekda GmbH	Channel manager for booking portals	Processor	Austria
SendHomeService, Hochgurgl	Returning forgotten items, only at the guest's request	Processor	Austria
Meta Platforms Ireland Ltd., Dublin	Facebook and Instagram pages	Independent controller; joint controller for page insights (Art. 26 GDPR)	Ireland; USA: EU-US Data Privacy Framework, standard contractual clauses
Hobex AG, Salzburg	Card payment	Independent controller (payment service provider)	Austria
PayPal (Europe) S.à r.l. et Cie, S.C.A.	Payment with PayPal	Independent controller (payment service provider)	Luxembourg
Europäische Reiseversicherung AG, Vienna	Travel insurance	Independent controller	Austria
Authorities: municipality of Sölden, Ötztal Tourismus, Austrian Health Insurance Fund, tax office	Statutory registrations and levies	Independent controllers	Austria

3. Technical and organisational measures (Art. 32 GDPR)

Encryption: All connections are encrypted (TLS). CASA One stores names, bank, vehicle and note fields as well as online check-in data in encrypted form (AES-256-GCM).
Access control: Personal user accounts with roles; passwords only as a hash; lockout after repeated failed attempts; remote sessions with limited duration.
Data minimisation: Card data masked only; daily automatic deletion runs according to the periods in section 1.
Logging and access requests: Event and login logs; access requests under Art. 15 GDPR directly from the guest file.
Availability: Daily backups at the hotel and at the host; servers in Austria.
Physical protection: Locked office and archive rooms; video surveillance of public areas.

Sporthotel Ideal KG · Hochgurglerstraße 2 · 6456 Hochgurgl · As of October 2026 Back to the privacy policy