PRIVACY INFORMATION for Guests
We take our responsibility for the processing of your personal data very seriously. We process your personal data exclusively in compliance with the applicable legal provisions, in particular the General Data Protection Regulation (GDPR) and Austrian data protection law. We take the necessary technical and organisational measures to protect your data against unauthorised access, loss, misuse or any other unlawful processing.
This Privacy Information explains how we process your personal data.
The controller responsible for the processing described herein is:
we gmbh
Flugplatzstraße 52
5700 Zell am See
legal@we.rent
+43 505383800
1. Where does the personal data we process come from?
We process data that you provide to us in connection with a booking enquiry, reservation or accommodation.
Data may also originate from:
-
persons travelling with you or the person making the booking;
-
tour operators;
-
booking platforms;
-
the property owner;
-
payment service providers;
-
service providers involved in the management or servicing of the property;
-
persons reporting damage, complaints or other incidents.
2. Which categories of personal data do we process?
Depending on the specific booking and its processing, the following data may be processed:
-
name;
-
contact details;
-
billing and payment data;
-
booking, arrival and departure data;
-
number of guests;
-
information about the booked property;
-
communication data;
-
information regarding special requests and additional services;
-
information regarding damage, complaints and claims;
-
deposit and reimbursement data;
-
legally required registration data;
-
data concerning consent and withdrawal of consent;
-
technical data when using online portals or digital check-in procedures.
3. For which purposes and on which legal bases is processing carried out?
We process your personal data only where a legal basis exists. Processing is carried out in particular for the following purposes:
Booking enquiry and conclusion of contract
We process your data in order to handle your enquiry and reservation and to conclude and perform the brokerage and accommodation agreement.
This includes in particular:
-
processing the booking enquiry;
-
confirming the reservation;
-
processing payments;
-
communicating before, during and after the stay;
-
organising check-in and check-out;
-
processing cancellations and changes;
-
organising cleaning and property management;
-
handling deposits;
-
processing complaints and damage claims.
The legal basis is Article 6(1)(b) GDPR, insofar as the processing is necessary for the performance of a contract or for taking steps prior to entering into a contract.
Legal obligations
We process your data insofar as this is necessary to comply with legal obligations, in particular for:
-
accounting and financial reporting;
-
tax purposes;
-
statutory retention requirements;
-
reports and information provided to public authorities;
-
legally required documentation and record-keeping obligations.
The legal basis is Article 6(1)(c) GDPR.
Legitimate interests
We also process your data insofar as this is necessary for the purposes of legitimate interests, in particular for:
-
IT and data security;
-
prevention of misuse;
-
documentation of damage;
-
handling complaints;
-
preservation of evidence;
-
enforcement or defence of legal claims;
-
quality control and improvement of processes.
The legal basis is Article 6(1)(f) GDPR.
Marketing
For our own marketing activities, we process your data only where an appropriate legal basis exists. Depending on the communication channel, separate consent may be required.
If you have expressly subscribed to our newsletter or electronic advertising, processing is based on your consent pursuant to Article 6(1)(a) GDPR.
Where permitted by law, we may inform existing customers about our own similar services on the basis of our legitimate interest in direct marketing pursuant to Article 6(1)(f) GDPR.
You may object to the processing of your data for direct marketing purposes at any time. If you object, your personal data will no longer be processed for direct marketing purposes.
Franchise system, quality assurance and system administration
We operate our business as part of a franchise system. The franchisor is:
we gmbh
Flugplatzstraße 52
5700 Zell am See
legal@we.rent
+43 505383800
As the franchisee, we generally process guest data for our own contractual and organisational purposes.
The franchisor processes data for its own purposes, in particular for:
-
administration of the franchise system;
-
management of the franchise agreement;
-
central quality assurance and billing processes;
-
IT and system security;
-
compliance with its own legal obligations;
-
its own marketing activities, insofar as a legal basis exists.
If the franchise agreement ends and the franchisor continues the business relationship with you, the provisions of this Privacy Information shall otherwise continue to apply to the franchisor.
Depending on the processing activity, the legal basis is Article 6(1)(b) GDPR, insofar as processing is necessary for the performance of a contract; Article 6(1)(f) GDPR, insofar as legitimate interests exist in maintaining a consistent, secure and efficient franchise system; or Article 6(1)(a) GDPR, insofar as consent is required.
4. What are the consequences if we are unable to process your data?
Within the framework of an existing or prospective contractual relationship, certain personal data must be processed so that we can fulfil our contractual obligations and provide our services to you. Otherwise, the contract cannot be performed.
The provision of data for newsletters, electronic advertising or certain voluntary additional services is voluntary. If you do not provide such data or withdraw your consent, we will no longer be able to provide you with these voluntary information services or additional services.
5. How long will your data be processed?
We store personal data only for as long as necessary for the respective purposes or for as long as statutory retention obligations, limitation periods, evidentiary interests or ongoing proceedings require longer storage.
As a general rule, the following retention periods apply:
| Type of data | Retention period |
| Contract and booking data |
For the duration of the contract and thereafter until the expiry of statutory retention, warranty, limitation or evidentiary periods |
| Invoice, payment and accounting data |
In accordance with statutory retention obligations |
| Marketing data |
Two years after the most recent customer contact, unless an objection or withdrawal of consent occurs earlier |
| Objections to advertising |
For as long as necessary to ensure that the objection is permanently respected |
In addition, data may be processed until the conclusion of any legal disputes if it is required as evidence.
6. Will your data be disclosed to third parties?
We disclose personal data only where there is a legal basis for doing so and where the disclosure is necessary for the respective purposes.
Recipients of personal data may include in particular:
-
the franchisor and entities connected with the franchise system, insofar as this is necessary for system operation, quality assurance, administration or contractual purposes;
-
IT service providers, software providers, hosting providers and app or booking system providers;
-
payment service providers, banks and debt collection service providers, insofar as necessary for payment processing or debt recovery;
-
tax advisers, auditors and accounting service providers;
-
lawyers, courts, authorities and other public bodies;
-
insurance companies, insofar as necessary for the handling of claims;
-
trainers, freelance staff or other persons engaged in the performance of services, insofar as necessary for service provision;
-
marketing and communications service providers, insofar as necessary for permitted advertising or newsletter distribution;
-
maintenance and security service providers, insofar as necessary for rental operations, access systems or security measures.
Personal data is not transferred outside the European Union or the European Economic Area.
7. Consent, right of withdrawal and age restriction
Consent and withdrawal
Where the processing of personal data is based on your consent, you may withdraw that consent at any time with effect for the future.
Consent may in particular be withdrawn:
-
by email to: legal@we.rent
-
in writing to: Flugplatzstraße 52, 5700 Zell am See
-
via an unsubscribe link in a newsletter, where available;
-
via the relevant functions provided in an app or customer portal, where available.
The withdrawal of consent does not affect the lawfulness of processing carried out on the basis of consent prior to its withdrawal.
Following withdrawal, the data concerned will be deleted or anonymised unless another legal basis exists for further processing, in particular statutory retention obligations or legitimate interests relating to evidence and legal defence.
8. What rights do you have?
Subject to the statutory requirements, you have the following rights:
-
right of access pursuant to Article 15 GDPR;
-
right to rectification pursuant to Article 16 GDPR;
-
right to erasure pursuant to Article 17 GDPR;
-
right to restriction of processing pursuant to Article 18 GDPR;
-
right to data portability pursuant to Article 20 GDPR;
-
right to object pursuant to Article 21 GDPR;
-
right not to be subject to a decision based solely on automated processing, insofar as the statutory requirements are met.
In particular, you have the right to object at any time to the processing of personal data concerning you where the processing is based on Article 6(1)(f) GDPR. Where your data is processed for direct marketing purposes, you have the right to object in any event. If you object to direct marketing, your personal data will no longer be processed for direct marketing purposes.
To exercise your rights, you may contact us at:
we gmbh
Flugplatzstraße 52
5700 Zell am See
legal@we.rent
+43505383800
9. Right to lodge a complaint with the data protection authority
If you believe that the processing of your personal data infringes data protection legislation or that your rights under data protection law have been violated, you have the right to lodge a complaint with the competent supervisory authority.
Austrian Data Protection Authority
Barichgasse 40–42
1030 Vienna
Email: dsb@dsb.gv.at
Website: https://www.dsb.gv.at/
10. Automated decision-making and profiling
As a general rule, we do not use decisions based solely on automated processing that produce legal effects concerning you or similarly significantly affect you.
Where analyses are carried out using digital systems, apps, customer portals, training software or marketing tools, these generally serve the administration, improvement, personalisation or promotion of our services. Such processing does not result in an automated individual decision with significant legal effects unless we inform you separately.
11. Data security
We take appropriate technical and organisational security measures to protect personal data against loss, misuse, unauthorised access, unauthorised disclosure, alteration or destruction.
Depending on the processing activity, these measures include in particular:
-
access restrictions and authorisation concepts;
-
password and authentication measures;
-
encryption or secure transmission, where appropriate;
-
logging of security-relevant activities;
-
staff training and confidentiality obligations;
-
careful selection and monitoring of service providers;
-
safeguarding of IT systems and data;
-
regular review of the measures implemented.
12. Changes to this Privacy Information
We reserve the right to amend this Privacy Information where this becomes necessary due to legal, technical or organisational changes.
13. Website Use, Online Portals and AI Chatbot
In addition, we process personal data when you use our website, online portals or other digital services.
This includes, in particular, technical data generated during use (e.g. IP address, date and time of access, pages accessed, browser type and version, device data, cookies and comparable tracking technologies), as well as data that you enter via online forms, owner portals or other digital functions.
These data are processed for the following purposes:
-
provision and display of the website and online portals;
-
ensuring IT and data security, in particular to prevent misuse and safeguard systems;
-
statistical analysis for the purpose of improving our services;
-
processing enquiries submitted via contact forms or digital communication channels;
-
organisation and administration of bookings, payouts and other services for property owners via digital systems.
Depending on the processing activity, the legal basis is Article 6(1)(b) GDPR, insofar as the processing is necessary for the performance of a contract with you or in order to take steps at your request prior to entering into a contract, as well as Article 6(1)(f) GDPR, insofar as legitimate interests exist in the secure, efficient and user-friendly provision of our digital services. Where consent is required for individual analytics or marketing functions, processing is based on Article 6(1)(a) GDPR.
AI-Powered Chatbot
An AI-powered chatbot may be made available on our website for the purpose of providing general information, assistance and communication with users. The chatbot processes the content you enter in an automated manner in order to respond to enquiries and evaluate the information provided in its relevant context.
In particular, the chatbot is intended to answer general questions about our services, properties and processes, provide assistance with bookings and reservations, and receive requests and reports. The chatbot does not provide individual legal, tax or other professional advice in specific cases.
Please note that you should not enter sensitive personal data into the chatbot, in particular health data, data relating to criminal convictions, or bank or credit card details, unless this is expressly provided for.
The legal basis for the processing of personal data in connection with the chatbot is Article 6(1)(b) GDPR, insofar as the communication serves the preparation or performance of a contract (e.g. clarification of questions relating to a property owner agreement), as well as Article 6(1)(f) GDPR, insofar as we have a legitimate interest in efficient and modern communication with property owners and prospective customers. Where consent is required, we base the processing on Article 6(1)(a) GDPR.
Chatbot enquiries may be analysed in anonymised or pseudonymised form for analytics and improvement purposes in order to continuously improve the quality of responses and the user-friendliness of the system.