Privacy policy

01Controller

The controllers for data processing on this website are:

If you have any questions about data protection, you can reach us at any time using these contact details.

02Your rights

Under the General Data Protection Regulation you have the following rights:

• Access to information about which data we hold about you
• Rectification of inaccurate data
• Erasure of your data
• Restriction of processing
• Data portability in a commonly used format
• Objection to processing
• Withdrawal of consent you have given, at any time and with effect for the future

A short message to info@gafalhof.com is enough. We reply within one month.

Right to lodge a complaint

If you believe that we are not processing your data lawfully, you can lodge a complaint with the supervisory authority:

03Hosting and server log files

Our website is hosted by ALL-INKL.COM – Neue Medien Münnich, Hauptstraße 68, 02742 Friedersdorf, Germany.

When you visit our pages, the server automatically records data transmitted by your browser:

• IP address
• date and time of access
• page accessed
• browser and operating system used
• previously visited page

This data is technically necessary in order to deliver the website and keep it running reliably. We do not combine it with other data and cannot identify any individual from it.

We have a data processing agreement with our host in accordance with Art. 28 GDPR.

Legal basis

Art. 6(1)(f) GDPR — legitimate interest in a secure, functioning web presence

Retention period

7 days, then deleted automatically.

04Cookies and consent

Cookies are small text files stored on your device. We distinguish between two types.

Technically necessary cookies

They make sure the site works — for example, that your cookie choice stays saved. They are set without consent, because the site would otherwise not be usable.

All other cookies

In particular those arising from embedded third-party services, we set only once you have agreed.

On your first visit a banner appears in which you can select what you allow. You can change your decision at any time via the link in the footer of the page.

Legal basis

Art. 6(1)(a) GDPR in conjunction with § 165(3) of the Austrian Telecommunications Act (TKG 2021)

05Contacting us

If you write us an email or call us, we process your details in order to answer your enquiry.

We keep correspondence for as long as it is needed to deal with the matter, and beyond that where statutory retention obligations require us to.

Legal basis

Art. 6(1)(b) GDPR where a stay is being arranged, otherwise Art. 6(1)(f) GDPR

06Gift voucher orders

On the Gift vouchers page you can order a voucher. In doing so we collect:

• voucher value and quantity
• your name and email address
• your preferred delivery method
• optionally the name of the person receiving the gift and a personal message

We need these details in order to issue the voucher and get back to you. The order is sent to us by email and additionally stored in our website’s database so that no order is lost.

The data stays on our server and is not passed on to third parties.

Legal basis

Art. 6(1)(b) GDPR — performance of a contract or pre-contractual measures

Retention period

We delete the order data from the website database once the order has been completed and no queries remain open, at the latest after twelve months. Invoices and accounting records are kept for seven years in accordance with § 132 of the Austrian Federal Fiscal Code (BAO).

07Booking enquiries via easybooking

On the Enquiry page an enquiry form from our booking system is embedded. The provider is

If you fill in this form, your details — travel dates, number of guests, contact details — are transmitted to easybooking and processed there on our behalf. The form is displayed in an embedded frame; in doing so your browser establishes a connection to easybooking’s servers.

The privacy policy of easybooking also applies.

Legal basis

Art. 6(1)(b) GDPR — pre-contractual measures at your request

08Google Maps

On individual pages we embed map material from Google Maps. The provider is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland.

When the map is loaded, Google receives your IP address and information about the page accessed. Transfer to the USA cannot be ruled out. Google is certified under the EU-US Data Privacy Framework.

We only load the map once you have given your consent. You can find further information in Google’s privacy policy.

Legal basis

Art. 6(1)(a) GDPR — your consent

09Google Analytics

We use Google Analytics 4, a web analytics service provided by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland.

Google Analytics helps us understand which content interests our guests and how they use our website. We use this to improve the site. Among other things, the following are recorded:

• pages accessed and time spent
• approximate location based on the shortened IP address
• device, browser and screen resolution used
• the source through which you found us

Your IP address is shortened before it is stored. We cannot link it to you personally. Transfer to the USA cannot be ruled out; Google is certified under the EU-US Data Privacy Framework.

We only load Google Analytics once you have given your consent. Without your agreement no analysis takes place. You can withdraw your consent at any time via the cookie settings in the footer.

More on this in Google’s privacy policy.

Legal basis

Art. 6(1)(a) GDPR — your consent

Retention period

14 months, after which the data is deleted automatically

10Fonts

We use our own fonts on this website, loaded from our own server. No connection to third-party servers is established and no information about you is passed on.

11Virtual tour

For the 360-degree tour of our houses we embed an external service. The tour is only loaded once you actively start it and have agreed to the embedding. In doing so your browser establishes a connection to the provider’s server and transmits your IP address.

Legal basis

Art. 6(1)(a) GDPR — your consent

12Social media

In the footer we link to our profiles on Facebook and Instagram. These are plain links — no content from these services is loaded and no data is transmitted unless you click on them yourself.

If you follow one of these links, the privacy terms of the respective provider apply.

13Disclosure and automated decision-making

We do not pass your data on to third parties unless it is necessary for the performance of a contract, you have consented, or we are legally obliged to do so.

No automated decision-making or profiling takes place.

14Changes to this policy

We update this policy when our website or the legal requirements change. The current version can always be found on this page.

Last updated: 10 August 2026