Courtesy translation for our English-speaking guests. The German version is legally binding. — Last updated: 31 October 2026
1. Controller
The controller within the meaning of the General Data Protection Regulation (GDPR) is:
Nina und Matthias Kienzle GesbR, Nesselwängle 124, 6672 Nesselwängle, Austria.
Phone: +43 5675 8383, email: welcome@sunneschloessli.com
2. Principles of processing
We process personal data only to the extent required to provide a functioning website and our content and services, and only on a legal basis under Art. 6 GDPR: consent (lit. a), performance of a contract (lit. b), legal obligation (lit. c) or legitimate interests (lit. f). We do not pass data to third parties for advertising purposes.
Personal data is not transferred to third countries outside the EU or the EEA. Automated decision-making, including profiling (Art. 22 GDPR), does not take place.
3. Provision of the website / server log files
On every visit, our hosting provider automatically records information transmitted by your browser: IP address, date and time of access, name and URL of the retrieved file, referrer URL, browser used and, where applicable, operating system. Legal basis: Art. 6 (1) lit. f GDPR (secure and stable operation of the website). Retention: deletion after 7 days, unless further retention is required for evidentiary purposes.
Hosting provider (processor): Raidboxes GmbH, Hafenstraße 32, 48153 Münster, Germany; a data processing agreement under Art. 28 GDPR is in place. The servers are located in the European Union.
4. Enquiry, voucher and event forms, email
If you use one of our forms (enquiry, voucher, chapel/event enquiry) or contact us by email, we process the data you provide (e.g. title, first and last name, email address, telephone number where given, arrival and departure dates, number of guests, message) exclusively to handle your request. The forms are processed on our own server; no external captcha or spam-protection service is used. Emails, including those generated by the forms, are sent via Microsoft 365 (Microsoft Ireland Operations Ltd., Dublin, Ireland) as a processor under Art. 28 GDPR. Legal basis: Art. 6 (1) lit. b and lit. f GDPR. Retention: deletion after the matter is concluded; statutory retention obligations (as a rule 7 years under Austrian UGB/BAO) remain unaffected.
Communication by WhatsApp: If you wish, we also write to you about your enquiry and your stay by WhatsApp. We use the WhatsApp Business app on a phone belonging to the house, number +43 5675 8383. The provider is WhatsApp Ireland Limited, Merrion Road, Dublin 4, D04 X2K5, Ireland. We only message you by WhatsApp if you have agreed to it (in the enquiry form, when accepting an offer, in the online booking or before your arrival) or if you write to us by WhatsApp yourself. This is voluntary; without your consent we reach you by email, and we always send confirmations by email. We process your phone number, your profile name and the content of our messages; according to WhatsApp, the content is end-to-end encrypted. WhatsApp and Meta process connection and usage data under their own responsibility, also in the USA. For this, WhatsApp LLC and Meta Platforms, Inc. are certified under the EU-U.S. Data Privacy Framework, and WhatsApp also uses the European Commission’s standard contractual clauses. On our phone, WhatsApp has no access to the address book. Legal basis: your consent, Art. 6(1)(a) GDPR, and for a booking also Art. 6(1)(b) GDPR. You can withdraw your consent at any time with a short message by WhatsApp or to welcome@sunneschloessli.com; it has no effect on your booking. Storage period: We keep the note of your answer (yes or no, the date and where you told us) with your enquiry or booking on our server and delete it there 30 days after your departure. Only the answer and its date remain in our guest records at Microsoft 365 (see above), so that we do not ask you again on a future stay. We delete chats no later than 12 months after your departure. You can follow our WhatsApp channel ”Schlössli-Postille”; we cannot see who follows it.
5. Online booking
Through the booking pages on www.sunneschloessli.com you book suites on a binding basis. We process the data you enter there: title, first and last name, postal address, telephone number, email address, arrival and departure dates, number and ages of fellow travellers, the suite and extras chosen, your expected arrival time and your message to us. Payment details such as card data are not collected in the booking pages; we arrange payment with you after our confirmation. Purpose and legal basis: conclusion and performance of the accommodation contract, Art. 6 (1) lit. b GDPR.
Storage: The booking is stored on our own server with our hosting provider Raidboxes GmbH (see section 3) and deleted there automatically 30 days after your departure. To handle the stay we transfer the booking data to our hotel software (hotelreservation.expert, Mono Solutions ApS, Amagerfælledvej 106, 2300 Copenhagen, Denmark), where it is kept for the duration of the statutory retention periods (as a rule 7 years under Austrian UGB/BAO). Email: The summary of your booking and our confirmation are sent via Microsoft 365 (Microsoft Ireland Operations Ltd., One Microsoft Place, South County Business Park, Leopardstown, Dublin 18, Ireland) as a processor under Art. 28 GDPR. The brief internal notification that a booking has arrived contains no personal data.
Personal offer: In reply to your enquiry we can send you a personal offer by email. It leads to a page of its own on www.sunneschloessli.com that can only be reached through the link in that email. There you accept the offer and enter: first and last names of the travellers, email address, telephone number, if you wish your postal address and country, the extras you would like and a message to us. For guests who have stayed with us before we may fill in names, telephone number and address on that page in advance; you can change them there. We store these details with the offer on our server at Raidboxes and delete them there automatically 30 days after your departure, as we do for an offer that is declined or withdrawn. For the booking we transfer the data to our hotel software (see above), where the statutory retention periods apply. The offer, our confirmation and, if you would like to pay by credit card, a payment link are sent via Microsoft 365 (see above). You enter your card details only on the payment provider’s page that the payment link opens, never with us. Legal basis: Art. 6 (1) lit. b GDPR.
Before your arrival, online check-in: A few days before you arrive we send you an email via Microsoft 365 (see above) with the link to our online check-in, a page of its own on www.sunneschloessli.com that can only be reached through that link. Its first step takes you to the online registration form of our hotel software. Below it you may tell us, voluntarily, roughly when you will arrive, what you are looking forward to and whether there is an occasion, send us a message and ask us to email you the guest card in advance; you can change the details later and send them again. If you are coming back to us, we pre-fill the registration form with the details we already have from you, and you only check it. Information about allergies and intolerances is health data. We store it only if you give your separate consent right next to the field, and we use it only for preparing your breakfast and your stay; without your consent we discard it, and the rest of your details still reaches us. We store all details on our server at Raidboxes, transfer them to our hotel software for your stay and delete them from the server automatically 30 days after your departure. Legal basis: Art. 6 (1) lit. b GDPR; for allergies and intolerances your consent under Art. 9 (2) lit. a GDPR, which you may withdraw at any time.
6. Cookies and consent
Our website uses only technically necessary cookies and local storage (Art. 6 (1) lit. f GDPR): to store your cookie choice and for the basic functions of the site. For audience measurement we use a cookie-free, self-hosted tool (see section 7); there is no marketing or third-party tracking. Via the cookie notice you can control optional categories (such as the embedded 360-degree tour, see section 11) and revoke any consent given at any time with effect for the future.
7. Audience measurement (Matomo, without cookies)
To understand which pages help our visitors, we use the analytics software Matomo. It runs entirely on our own server; no data is transferred to third parties. Our Matomo is configured without cookies, and IP addresses are shortened (anonymised) before storage, so no conclusions about your person are possible. Only anonymised, aggregated information is recorded, such as pages visited, approximate region of origin and browser type. Legal basis: Art. 6 (1) lit. f GDPR (improving our website); as no cookies are set and no personal reference exists, no consent is required. Retention: the anonymised statistics are not combined with any other data.
What the booking path reports to the statistics: so that we can see where a booking is abandoned, the details of the stay you are looking for (dates, number of nights, number of travellers), the suite chosen and the amounts are included in the statistics. Your name, e-mail address, telephone number, postal address and your message to us are not transmitted. A completed booking carries only a randomly generated reference in the statistics, which cannot be matched to your booking.
How much demand there is for individual nights: When you search for available suites in the booking pages, our own server adds one to a counter for each night searched, notes whether a suite was available and, later, whether a booking was made online. Only these totals per calendar day are stored, without IP address, without any details about you or your device, and without any link to audience measurement. No cookie is set for this. The totals do not show who searched. We use them to plan prices and opening periods better (Art. 6 (1) lit. f GDPR) and delete them after three years. The switch below applies to this as well.
Objection (Art. 21 GDPR): you may object to audience measurement at any time with effect for the future. The switch below takes effect immediately and applies to this browser:
Your decision is stored in a small cookie on this device, so we can honour it on your next visit. If you delete your cookies or use another browser, please set it again here.
8. Fonts and local delivery
Fonts and other design files are delivered exclusively from our own server. No data is transferred to third parties (such as Google Fonts) for this purpose.
9. SSL/TLS encryption
This website uses SSL/TLS encryption to protect the transmission of confidential content. The certificate is provided by Let’s Encrypt.
10. Links to social networks
The link to our Instagram profile is purely static; no data is transmitted to the provider until you actively follow the link. Only on the destination page do that provider’s privacy terms apply.
11. Embedded 360-degree tour (Moving Pictures)
On our gallery page we offer a virtual 360-degree tour of the house and suites. It is loaded in an embedded window (iframe) from the servers of the provider mp moving-pictures gmbh (Am Flughafen 12A, 87766 Memmingerberg, Germany). The tour is not loaded automatically: only when you actively click ”Open the tour” is the content loaded. Your IP address is then transmitted to the provider; this is technically necessary to deliver the content. Before your click, no data is transmitted to the provider. Legal basis: Art. 6 (1) lit. a GDPR (consent by actively clicking). The provider’s privacy terms apply in addition.
12. Your rights
You have the right to access (Art. 15), rectification (Art. 16), erasure (Art. 17), restriction (Art. 18), data portability (Art. 20), objection (Art. 21) and to withdraw consent you have given (Art. 7 (3) GDPR). To exercise these rights, contact welcome@sunneschloessli.com.
13. Right to complain
You have the right to lodge a complaint with the Austrian Data Protection Authority (Datenschutzbehörde, DSB), Barichgasse 40-42, 1030 Vienna, dsb@dsb.gv.at.
14. Changes
The further development of our website or changed legal requirements may make it necessary to amend this privacy policy. The current version is always available on this page; in case of doubt, the German version prevails.