We are pleased that you are visiting our website. Protecting your personal data is important to us. Below, we inform you in accordance with the GDPR and the Austrian Data Protection Act (DSG) about which data we process, for what purpose, and on which legal basis. Last updated: June 2026.
The controller within the meaning of the GDPR is:
Roland Kurz e.U. (Hotel Castel)
St. Antoniusweg 18, A-6561 Ischgl, Austria
Phone: +43 5444 5746 · Email: office@castel.cc
Website: www.castel-ischgl.at
For questions regarding data protection and to exercise your rights, you can reach us using the contact details above. A data protection officer is not required by law and has not been appointed.
This website is operated and maintained by an external technical service provider acting on our behalf as a processor pursuant to Art. 28 GDPR:
The server infrastructure is located in Austria (EU). The purpose is the secure and stable delivery of the (statically generated) website as well as the operation of the server-side script for the inquiry form. The legal basis is our legitimate interest in proper, secure operation (Art. 6 (1) (f) GDPR). The agreements required under Art. 28 GDPR are in place with the (sub-)processors.
Each time the website is accessed, the hosting provider automatically records access data in server log files:
This data is technically necessary and serves system security and stability (Art. 6 (1) (f) GDPR). It is stored for the period required and then deleted. It is not combined with other data sources to identify individuals.
You can use the inquiry form to send us a room or contact inquiry. The following data is processed: salutation, first and last name, address, phone number, email, desired arrival/departure dates, number of adults/children/nights, desired room type, and your comment.
We use this data exclusively to process your inquiry and to initiate a possible accommodation contract (Art. 6 (1) (b) GDPR). The data is not passed on to third parties; the email is delivered to office@castel.cc and sent via the mail server of our technical service provider (sender noreply@web-werk.at; mail infrastructure: World4You Internet Services GmbH, Austria).
Spam and abuse protection: The form uses a hidden honeypot field, a server-side signed time token (HMAC), an origin/referer check, and a per-IP limit (rate limit). For this purpose, your IP address is processed exclusively in hashed and truncated form (HMAC-SHA256); the raw IP address is not stored. No cookies are set and no third-party providers (no captcha) are embedded. The legal basis is our legitimate interest in preventing spam and abuse (Art. 6 (1) (f) GDPR).
Our website only uses technically necessary local storage techniques as well as – exclusively with your consent – services that require consent. Our granular consent management implements the GDPR and § 165 of the Austrian Telecommunications Act (TKG 2021):
castel_consent, including timestamp and version) – no transfer to us or third parties, no tracking.The legal basis for necessary storage techniques is Art. 6 (1) (f) GDPR and § 165 (3) TKG 2021; for all other services, Art. 6 (1) (a) GDPR (consent).
To improve our services, we plan to use the open-source analytics tool Matomo. If activated, Matomo runs on the instance of our technical service provider (analytics.web-werk.at, processor, server location Austria) with a site ID used exclusively for this website, works without cookies, truncates/anonymizes the IP address, and passes no data on to third parties.
Current status: Matomo is currently not active. No Matomo code is delivered and no statistical data processing takes place. As soon as Matomo goes live, it will be loaded only after your consent (category "Statistics", Art. 6 (1) (a) GDPR); this policy will then be updated accordingly. Any retention of anonymous statistical data is limited to a maximum of 26 months.
On the "Contact and directions" and "Surroundings and activities" pages, we embed interactive maps. These are only loaded after you have consented to the category "External media & services" or clicked "Load content" (§ 165 TKG 2021, Art. 6 (1) (a) GDPR). Until then, only a placeholder is displayed.
When a map is loaded, your IP address, among other data, is transferred to the respective provider, which thereby becomes an independent controller. With Google Maps, a transfer to the USA is possible; this takes place on the basis of your explicit consent (Art. 49 (1) (a) GDPR) and the safeguards used by Google (EU standard contractual clauses, EU-US Data Privacy Framework).
For direct bookings, we embed the online booking system (IBE widget) of Casablanca hotelsoftware GmbH, A-6020 Innsbruck, on the booking page and the room pages (frontend.casablanca.at). The scripts are only loaded after you have consented to "External media & services" or clicked "Load content" (§ 165 TKG 2021, Art. 6 (1) (a) GDPR).
When the widget is loaded, your IP address, among other data, is transferred to Casablanca. If you complete the booking process, Casablanca processes the booking and stay data you enter in order to initiate/perform the accommodation contract (Art. 6 (1) (b) GDPR). The servers are located in Austria. Privacy policy: casablanca.at/datenschutz.
For table reservations at Restaurant Castello and for online pizza orders, we link to the external services aleno (mytools.aleno.me, aleno AG, Zurich, Switzerland – adequacy decision for Switzerland) and Foodbooking (foodbooking.com). These services are not embedded in our website: no data is transferred to them when you merely visit our pages. Only when you actively click one of the links does the respective service open in a new window; from that point on, its own privacy policy applies and the provider is an independent controller for the reservation or order data entered there.
The guest reviews displayed on our website (homepage, restaurant) are embedded locally/statically from public sources (including Google, Booking.com, Tripadvisor). No third-party review widget is embedded and therefore no data is transferred to any such provider. Only when you actively click a platform link are you redirected to the respective platform, whose own privacy policy then applies.
Data is only disclosed where this is necessary to fulfill the purpose or where you have given your consent. Recipients are in particular our technical service provider and the hosting provider as (sub-)processors as well as – after your consent – the providers of embedded third-party content (Paznaun-Ischgl, Google Maps, Casablanca). Beyond that, we only disclose data where we are legally or officially obliged to do so (e.g. registration law, tax law). We do not sell your data.
Once these periods have expired, the data is deleted or anonymized.
Under the GDPR, you have the following rights: access (Art. 15), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20), and objection to processing based on Art. 6 (1) (f) GDPR (Art. 21). To exercise these rights, simply contact us using the contact details given in the "Controller" section.
Right to lodge a complaint: You have the right to lodge a complaint with a supervisory authority. The competent authority is the Austrian Data Protection Authority (Datenschutzbehörde, DSB), Barichgasse 40–42, 1030 Vienna · dsb@dsb.gv.at · dsb.gv.at.
Where processing is based on your consent (in particular statistics/Matomo and external media such as maps and the booking system), you can withdraw your consent at any time with effect for the future; the lawfulness of the processing carried out up to that point remains unaffected. The easiest way to withdraw your consent is via the "Cookie settings" link in the page footer; in addition, you can delete the locally stored entry castel_consent via your browser settings.
We reserve the right to amend this privacy policy in order to reflect changes in the legal situation or changes to our services. The version published on this page applies.
Choose which categories you want to allow. Necessary cookies are required for the operation of the website and are always active. You can find details in our Cookie Policy.
Required for basic functions and for saving your cookie selection (locally in your browser). No tracking takes place.
Anonymous audience measurement with our self-hosted Matomo (no cookies, IP address shortened). Helps us improve the website. No data is passed on to third parties.
Third-party content: interactive maps (Paznaun-Ischgl, Google Maps) and the booking system (Casablanca). When these load, data (e.g. your IP address) is transmitted to the providers.