Privacy Policy
This privacy policy explains which personal data we process on this website, for what purpose and on what legal basis. We process data in line with the General Data Protection Regulation (GDPR) and limit ourselves to what is necessary.
1. Controller
Annabelle Fischer
mei chalet - DAS BARBARA
Gasse 176a
6105 Leutasch
Austria
Email: info@meichalet-dasbarbara.at
Phone: +43 699 10939808
2. Which data we process and why
Contact form, email and phone
When you contact us via the contact form, by email or by phone, we process the data you provide in order to handle and answer your enquiry. For the contact form this is your name, email address, subject and message as well as your IP address. Providing the data is voluntary; we need your name, email address and message to answer your enquiry. Messages from the contact form are delivered to us as email by our hosting provider. The legal basis is the performance of pre-contractual measures (Art. 6(1)(b) GDPR) where your enquiry concerns a contract, and otherwise our legitimate interest in answering enquiries (Art. 6(1)(f) GDPR). We keep this data for as long as it is needed to handle your enquiry and delete it afterwards, unless statutory retention obligations apply.
Spam protection (Cloudflare Turnstile)
To protect our contact form against abuse by automated programs we use the Turnstile service provided by Cloudflare, Inc., 101 Townsend St., San Francisco, CA 94107, USA. The Turnstile script loads when you open the contact page. Turnstile uses technical signals (including IP address, browser and device information, and interaction patterns) to determine whether input comes from a human. The following data is transferred to Cloudflare servers, including in the USA: your IP address, technical browser and device information (including user agent, browser properties, screen and language settings), interaction patterns within the Turnstile widget (such as mouse movements and timing), and the verification result in the form of a token. The contents of your form entries (name, email address, message) are not transferred to Cloudflare. Cloudflare is certified under the EU-US Data Privacy Framework (Art. 45 GDPR). In the standard configuration we use (without so-called pre-clearance), Turnstile does not set any cookies and does not build user profiles. Within its frame, Turnstile creates the entry “cf.turnstile.u” in your browser's local storage. The legal basis is our legitimate interest in protecting the website against abusive automated use (Art. 6(1)(f) GDPR). Cloudflare is engaged by our hosting provider as a further processor. For more information, see the Cloudflare Turnstile privacy policy: cloudflare.com/en-gb/turnstile-privacy-policy
Server log data
When the website is accessed, the server processes technically necessary data (including IP address, date and time, the page requested and browser type) in order to deliver the pages. No access log containing this data is stored. When the contact form is submitted, the server stores a truncated IP address in the system log; the system log is deleted after 30 days. The legal basis is our legitimate interest in the secure and stable operation of the website (Art. 6(1)(f) GDPR).
Cookies and consent
This website sets only technically necessary entries. Details are in our Cookie Policy.
Web analytics (Google Analytics 4)
This website uses the web-analytics service Google Analytics 4 only after your explicit consent given via the cookie banner (Art. 6(1)(a) GDPR). The provider is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. Google Analytics processes pseudonymous usage data (including pages viewed, time spent, approximate location, and browser and device information) and sets _ga cookies (details and withdrawal in our Cookie Policy). According to Google, Google Analytics 4 does not log or store IP addresses; the IP address is processed only briefly during collection to derive coarse location data and is then discarded. Event data stored on Google servers is deleted automatically after the retention period configured in the Analytics property (2 or 14 months). Data may be transferred to Google LLC in the USA; Google is certified under the EU-US Data Privacy Framework, and standard contractual clauses pursuant to Art. 46 GDPR are in place as an additional safeguard. Google processes this data on our behalf under a data processing agreement pursuant to Art. 28 GDPR. You can withdraw a given consent at any time with effect for the future via the cookie settings.
Booking and enquiry system (CASABLANCA)
Our booking page embeds the booking and enquiry system of CASABLANCA hotelsoftware GmbH, Öde 32, 6491 Schönwies, Austria. It shows the availability of our chalet and receives your enquiry. When you open that page, the system is loaded from CASABLANCA's servers; for technical reasons your IP address is transmitted to CASABLANCA in the process. If you submit an enquiry, we and CASABLANCA process the details you enter (such as name, contact details, travel dates and number of guests) in order to quote for and handle your booking. The legal basis is the performance of a contract and pre-contractual measures (Art. 6(1)(b) GDPR). CASABLANCA processes this data as our processor under an agreement pursuant to Art. 28 GDPR and, according to its own information, stores it in data centres within the European Union. Details are set out in CASABLANCA's privacy policy: casablanca.at/legal/datenschutzerklaerung.
3. Recipients and processors
To provide the website, deliver contact enquiries and handle booking enquiries, we use carefully selected service providers (hosting, email delivery and the CASABLANCA booking system). They process data only on our behalf and on the basis of data-processing agreements under Art. 28 GDPR. Any disclosure beyond this to third parties takes place only where we are legally required to do so.
4. Storage period
We store personal data only for as long as it is necessary for the purposes stated above or as required by statutory retention periods. After that, the data is deleted.
5. Security
We take appropriate technical and organisational measures to protect your data, including encrypted transmission (TLS/HTTPS).
6. External links
This privacy policy does not apply to third-party websites we link to. The respective providers are responsible for their content and data protection.
7. Your rights
Under the GDPR you have the following rights:
- access to the data processed about you (Art. 15 GDPR),
- rectification of inaccurate data (Art. 16 GDPR),
- erasure (Art. 17 GDPR) and restriction of processing (Art. 18 GDPR),
- data portability (Art. 20 GDPR),
- objection to processing (Art. 21 GDPR),
- withdrawal of a given consent with effect for the future (Art. 7(3) GDPR).
Right to object: Where we process data on the basis of our legitimate interest (Art. 6(1)(f) GDPR), you may object to this processing at any time on grounds relating to your particular situation (Art. 21 GDPR).
To exercise your rights, a message to info@meichalet-dasbarbara.at is enough.
8. Right to lodge a complaint
You have the right to lodge a complaint with a supervisory authority. In Austria this is the Austrian Data Protection Authority (Österreichische Datenschutzbehörde),Barichgasse 40-42, 1030 Wien (dsb.gv.at).
9. Changes to this privacy policy
We update this privacy policy when our processing or the legal situation changes. The version published on this page at the time applies.
Last updated: 17 September 2026