Privacy policy
1 Controller
The controller for data processing on this website and in the course of our services under the General Data Protection Regulation (GDPR) is: Alp Ami Hospitality GmbH Finkenstraße 22 82166 Gräfelfing Germany Email: datenschutz@alp-ami.com The controller determines, alone or jointly with others, the purposes and means of processing personal data.
2 Your rights as a data subject
You have the following rights regarding the personal data processed by ALPAMI: – Right of access (Art. 15 GDPR) – Right to rectification (Art. 16 GDPR) – Right to erasure (Art. 17 GDPR) – Right to restriction of processing (Art. 18 GDPR) – Right to data portability (Art. 20 GDPR) – Right to object to processing (Art. 21 GDPR) – Right to withdraw consent (Art. 7(3) GDPR) with effect for the future – Right to lodge a complaint with a supervisory authority (Art. 77 GDPR) An informal message by email to datenschutz@alp-ami.com is sufficient to exercise these rights. The lawfulness of processing carried out on the basis of consent up to the point of withdrawal remains unaffected.
3 Hosting
This website is served by Wix.com Ltd. When you access the site, technically necessary connection data is processed, in particular your IP address. Legal basis: Art. 6(1)(f) GDPR (legitimate interest in the secure operation of the website). For data processing agreements and third-country transfers, see sections 11 and 12.
4 SSL/TLS encryption
For security reasons and to protect the transmission of confidential content, our website uses SSL/TLS encryption. You can recognise an encrypted connection by the "https://" in the address bar and the padlock symbol in your browser.
5 Booking engine (workmatrix)
For most of our houses you book through our booking page booking.alpami.de. It is operated on our behalf by workmatrix GmbH, Jordanstraße 18, 88444 Ummendorf, Germany (product “hotelmatrix”). Our website only provides a search form and loads nothing from that page beforehand. No data is transferred until you click “Check availability”: your chosen house, dates, the number of guests and connection data such as your IP address and browser details are then transmitted to booking.alpami.de. On the booking page you enter the details needed for your booking. workmatrix GmbH processes this data on our behalf under a contract pursuant to Art. 28 GDPR. Legal basis: Art. 6(1)(b) GDPR (pre-contractual measures and performance of the contract). For data processing agreements, see section 11.
6 Payment processing
For payment processing we work with the following payment service providers: Credit card (Visa, MasterCard) – via Adyen PayPal – PayPal (Europe) S.à r.l. et Cie, S.C.A., 22–24 Boulevard Royal, L-2449 Luxembourg Sofortüberweisung (SOFORT) – Klarna Bank AB, Sveavägen 46, 111 34 Stockholm, Sweden These providers process your payment data as independent controllers. Their privacy policies are available on their respective websites. Payment takes place within the booking engine, not on this website. Legal basis: Art. 6(1)(b) GDPR (performance of the contract).
7 Contacting us
If you write to us via the contact form or a cabin's enquiry form, your email programme opens with a prepared message. The data is therefore sent directly by you to us and is neither collected nor cached on this website. We process your details in order to handle your enquiry and any follow-up questions. They are not passed on without your consent. Legal basis: Art. 6(1)(b) GDPR (pre-contractual measures) or Art. 6(1)(a) GDPR (consent). Retention: the data remains stored until you request its deletion, withdraw your consent, or the purpose for storage ceases to apply. Statutory retention obligations remain unaffected.
8 Cookies, Google Analytics and Google Ads
We only use Google Analytics and Google Ads if you consent in the cookie banner. Without consent, this website loads nothing from Google and sets no cookies. We store your choice locally in your browser (localStorage) so the banner does not appear on every visit. You can change or withdraw it at any time via “Cookie settings” at the bottom of every page. Statistics (Google Analytics 4): with your consent, Google Analytics records which pages you visit, where you came from (for example a search engine, an ad, Instagram), device and browser details, a shortened IP address and events such as submitting the booking search (chosen house, dates, number of guests) and clicks on phone, WhatsApp or email. Names, email addresses and payment details are not transmitted. So that a visit can be followed through to a booking on booking.alpami.de, an identifier is added to the address when you move there (cross-domain measurement). Marketing (Google Ads): with your consent, we measure whether a visit from one of our Google ads leads to a booking (conversion tracking). The provider is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. Data may be transferred to Google LLC in the USA; Google is certified under the EU-US Data Privacy Framework (see section 12). Google Analytics data is deleted after 14 months. The legal basis is your consent under Section 25(1) TDDDG and Art. 6(1)(a) GDPR. We use Google Consent Mode: without consent, no cookies are set. The booking page booking.alpami.de (see section 5) may set its own cookies and may ask for your consent itself.
9 Fonts
Our website uses fonts hosted locally on our own servers. When you access our website, no connection is made to external servers (for example Google Fonts), and your IP address and other personal data are not transmitted to third parties.
11 Recipients of data and data processing
We pass on your personal data only where this is legally permissible or necessary to perform the contract. Typical recipients are: – apaleo GmbH (property management system) – workmatrix GmbH, Ummendorf (booking page booking.alpami.de, see section 5) – Payment service providers (see section 6) – Google Ireland Limited (Google Analytics and Google Ads, only with consent, see section 8) – IT service providers and hosting providers, including Wix.com Ltd. (see section 3) – Tax advisors, auditors and lawyers within the legally permissible scope – Registration authorities (under the German Federal Registration Act) – Tax authorities (under the German Fiscal Code) We have concluded data processing agreements pursuant to Art. 28 GDPR.
12 Data transfers to third countries
Where data is transferred to countries outside the EU/EEA (in particular the USA), this takes place only under the following conditions: – An adequacy decision of the EU Commission exists (for example the EU-US Data Privacy Framework), or – EU standard contractual clauses (SCCs) have been concluded, or – Your express consent has been given (Art. 49(1)(a) GDPR).
13 Automated decision-making
ALPAMI does not carry out automated decision-making, including profiling within the meaning of Art. 22 GDPR.
14 Changes to this privacy policy
We reserve the right to amend this privacy policy in order to adapt it to changed legal circumstances or to changes in our services. The current version is available on our website.
10 Pandemic-related information
In the event of a pandemic we may request evidence (vaccination, test or recovery certificates) in accordance with applicable official requirements. This data is processed exclusively to fulfil legal obligations and is deleted promptly once that purpose ceases to apply. Legal basis: Art. 6(1)(c) GDPR in conjunction with Art. 9(2)(i) GDPR (health data on the basis of public health provisions).