Privacy policy
1 Controller
The controller for data processing on this website and in the course of our services under the General Data Protection Regulation (GDPR) is: Alp Ami Hospitality GmbH Finkenstraße 22 82166 Gräfelfing Germany Email: datenschutz@alp-ami.com The controller determines, alone or jointly with others, the purposes and means of processing personal data.
2 Your rights as a data subject
You have the following rights regarding the personal data processed by ALPAMI: – Right of access (Art. 15 GDPR) – Right to rectification (Art. 16 GDPR) – Right to erasure (Art. 17 GDPR) – Right to restriction of processing (Art. 18 GDPR) – Right to data portability (Art. 20 GDPR) – Right to object to processing (Art. 21 GDPR) – Right to withdraw consent (Art. 7(3) GDPR) with effect for the future – Right to lodge a complaint with a supervisory authority (Art. 77 GDPR) An informal message by email to datenschutz@alp-ami.com is sufficient to exercise these rights. The lawfulness of processing carried out on the basis of consent up to the point of withdrawal remains unaffected.
3 Hosting
This website is served by Wix.com Ltd. When you access the site, technically necessary connection data is processed, in particular your IP address. Legal basis: Art. 6(1)(f) GDPR (legitimate interest in the secure operation of the website). For data processing agreements and third-country transfers, see sections 11 and 12.
4 SSL/TLS encryption
For security reasons and to protect the transmission of confidential content, our website uses SSL/TLS encryption. You can recognise an encrypted connection by the "https://" in the address bar and the padlock symbol in your browser.
5 Booking engine (Simultem)
Availability, prices and bookings are handled through an embedded booking engine provided by Simultem Oy, Finland. The booking engine is only loaded once you explicitly open it. Before that, no data whatsoever is transmitted to Simultem or any other third party. Once opened, your entries and connection data such as your IP address and browser details are transmitted to Simultem and the servers the engine uses. Legal basis: Art. 6(1)(a) GDPR (consent given by opening the engine) and Art. 6(1)(b) GDPR (pre-contractual measures and performance of the contract). For data processing agreements and third-country transfers, see sections 11 and 12.
6 Payment processing
For payment processing we work with the following payment service providers: Credit card (Visa, MasterCard) – via Adyen PayPal – PayPal (Europe) S.à r.l. et Cie, S.C.A., 22–24 Boulevard Royal, L-2449 Luxembourg Sofortüberweisung (SOFORT) – Klarna Bank AB, Sveavägen 46, 111 34 Stockholm, Sweden These providers process your payment data as independent controllers. Their privacy policies are available on their respective websites. Payment takes place within the booking engine, not on this website. Legal basis: Art. 6(1)(b) GDPR (performance of the contract).
7 Contacting us
If you write to us via the contact form or a cabin's enquiry form, your email programme opens with a prepared message. The data is therefore sent directly by you to us and is neither collected nor cached on this website. We process your details in order to handle your enquiry and any follow-up questions. They are not passed on without your consent. Legal basis: Art. 6(1)(b) GDPR (pre-contractual measures) or Art. 6(1)(a) GDPR (consent). Retention: the data remains stored until you request its deletion, withdraw your consent, or the purpose for storage ceases to apply. Statutory retention obligations remain unaffected.
8 Cookies
This website sets no cookies and uses no analytics or marketing technologies. There is no tracking, and no consent banner is required. The booking engine (see section 5) may set its own cookies once you open it. Until then, nothing is transmitted from this website to third parties.
9 Fonts
Our website uses fonts hosted locally on our own servers. When you access our website, no connection is made to external servers (for example Google Fonts), and your IP address and other personal data are not transmitted to third parties.
11 Recipients of data and data processing
We pass on your personal data only where this is legally permissible or necessary to perform the contract. Typical recipients are: – apaleo GmbH (property management system) – Simultem Oy, Finland (booking engine, see section 5) – Payment service providers (see section 6) – IT service providers and hosting providers, including Wix.com Ltd. (see section 3) – Tax advisors, auditors and lawyers within the legally permissible scope – Registration authorities (under the German Federal Registration Act) – Tax authorities (under the German Fiscal Code) We have concluded data processing agreements pursuant to Art. 28 GDPR.
12 Data transfers to third countries
Where data is transferred to countries outside the EU/EEA (in particular the USA), this takes place only under the following conditions: – An adequacy decision of the EU Commission exists (for example the EU-US Data Privacy Framework), or – EU standard contractual clauses (SCCs) have been concluded, or – Your express consent has been given (Art. 49(1)(a) GDPR).
13 Automated decision-making
ALPAMI does not carry out automated decision-making, including profiling within the meaning of Art. 22 GDPR.
14 Changes to this privacy policy
We reserve the right to amend this privacy policy in order to adapt it to changed legal circumstances or to changes in our services. The current version is available on our website.
10 Pandemic-related information
In the event of a pandemic we may request evidence (vaccination, test or recovery certificates) in accordance with applicable official requirements. This data is processed exclusively to fulfil legal obligations and is deleted promptly once that purpose ceases to apply. Legal basis: Art. 6(1)(c) GDPR in conjunction with Art. 9(2)(i) GDPR (health data on the basis of public health provisions).