Courtesy translation for our English-speaking guests. The German version is legally binding. — Last updated: 12 September 2026
1. Controller
The controller within the meaning of the General Data Protection Regulation (GDPR) is:
Nina und Matthias Kienzle GesbR, Nesselwängle 124, 6672 Nesselwängle, Austria.
Phone: +43 5675 8383, email: welcome@sunneschloessli.com
2. Principles of processing
We process personal data only to the extent required to provide a functioning website and our content and services, and only on a legal basis under Art. 6 GDPR: consent (lit. a), performance of a contract (lit. b), legal obligation (lit. c) or legitimate interests (lit. f). We do not pass data to third parties for advertising purposes.
Personal data is not transferred to third countries outside the EU or the EEA. Automated decision-making, including profiling (Art. 22 GDPR), does not take place.
3. Provision of the website / server log files
On every visit, our hosting provider automatically records information transmitted by your browser: IP address, date and time of access, name and URL of the retrieved file, referrer URL, browser used and, where applicable, operating system. Legal basis: Art. 6 (1) lit. f GDPR (secure and stable operation of the website). Retention: deletion after 7 days, unless further retention is required for evidentiary purposes.
Hosting provider (processor): Raidboxes GmbH, Hafenstraße 32, 48153 Münster, Germany; a data processing agreement under Art. 28 GDPR is in place. The servers are located in the European Union.
4. Enquiry, voucher and event forms, email
If you use one of our forms (enquiry, voucher, chapel/event enquiry) or contact us by email, we process the data you provide (e.g. title, first and last name, email address, telephone number where given, arrival and departure dates, number of guests, message) exclusively to handle your request. The forms are processed on our own server; no external captcha or spam-protection service is used. Emails, including those generated by the forms, are sent via Microsoft 365 (Microsoft Ireland Operations Ltd., Dublin, Ireland) as a processor under Art. 28 GDPR. Legal basis: Art. 6 (1) lit. b and lit. f GDPR. Retention: deletion after the matter is concluded; statutory retention obligations (as a rule 7 years under Austrian UGB/BAO) remain unaffected.
5. Online booking
Through the booking pages on www.sunneschloessli.com you book suites on a binding basis. We process the data you enter there: title, first and last name, postal address, telephone number, email address, arrival and departure dates, number and ages of fellow travellers, the suite and extras chosen, your expected arrival time and your message to us. Payment details such as card data are not collected in the booking pages; we arrange payment with you after our confirmation. Purpose and legal basis: conclusion and performance of the accommodation contract, Art. 6 (1) lit. b GDPR.
Storage: The booking is stored on our own server with our hosting provider Raidboxes GmbH (see section 3) and deleted there automatically 30 days after your departure. To handle the stay we transfer the booking data to our hotel software (hotelreservation.expert, Mono Solutions ApS, Amagerfælledvej 106, 2300 Copenhagen, Denmark), where it is kept for the duration of the statutory retention periods (as a rule 7 years under Austrian UGB/BAO). Email: The summary of your booking and our confirmation are sent via Microsoft 365 (Microsoft Ireland Operations Ltd., One Microsoft Place, South County Business Park, Leopardstown, Dublin 18, Ireland) as a processor under Art. 28 GDPR. The brief internal notification that a booking has arrived contains no personal data.
6. Cookies and consent
Our website uses only technically necessary cookies and local storage (Art. 6 (1) lit. f GDPR): to store your cookie choice and for the basic functions of the site. For audience measurement we use a cookie-free, self-hosted tool (see section 7); there is no marketing or third-party tracking. Via the cookie notice you can control optional categories (such as the embedded 360-degree tour, see section 11) and revoke any consent given at any time with effect for the future.
7. Audience measurement (Matomo, without cookies)
To understand which pages help our visitors, we use the analytics software Matomo. It runs entirely on our own server; no data is transferred to third parties. Our Matomo is configured without cookies, and IP addresses are shortened (anonymised) before storage, so no conclusions about your person are possible. Only anonymised, aggregated information is recorded, such as pages visited, approximate region of origin and browser type. Legal basis: Art. 6 (1) lit. f GDPR (improving our website); as no cookies are set and no personal reference exists, no consent is required. Retention: the anonymised statistics are not combined with any other data.
What the booking path reports to the statistics: so that we can see where a booking is abandoned, the details of the stay you are looking for (dates, number of nights, number of travellers), the suite chosen and the amounts are included in the statistics. Your name, e-mail address, telephone number, postal address and your message to us are not transmitted. A completed booking carries only a randomly generated reference in the statistics, which cannot be matched to your booking.
How much demand there is for individual nights: When you search for available suites in the booking pages, our own server adds one to a counter for each night searched, notes whether a suite was available and, later, whether a booking was made online. Only these totals per calendar day are stored, without IP address, without any details about you or your device, and without any link to audience measurement. No cookie is set for this. The totals do not show who searched. We use them to plan prices and opening periods better (Art. 6 (1) lit. f GDPR) and delete them after three years. The switch below applies to this as well.
Objection (Art. 21 GDPR): you may object to audience measurement at any time with effect for the future. The switch below takes effect immediately and applies to this browser:
Your decision is stored in a small cookie on this device, so we can honour it on your next visit. If you delete your cookies or use another browser, please set it again here.
8. Fonts and local delivery
Fonts and other design files are delivered exclusively from our own server. No data is transferred to third parties (such as Google Fonts) for this purpose.
9. SSL/TLS encryption
This website uses SSL/TLS encryption to protect the transmission of confidential content. The certificate is provided by Let’s Encrypt.
10. Links to social networks
The link to our Instagram profile is purely static; no data is transmitted to the provider until you actively follow the link. Only on the destination page do that provider’s privacy terms apply.
11. Embedded 360-degree tour (Moving Pictures)
On our gallery page we offer a virtual 360-degree tour of the house and suites. It is loaded in an embedded window (iframe) from the servers of the provider mp moving-pictures gmbh (Am Flughafen 12A, 87766 Memmingerberg, Germany). The tour is not loaded automatically: only when you actively click ”Open the tour” is the content loaded. Your IP address is then transmitted to the provider; this is technically necessary to deliver the content. Before your click, no data is transmitted to the provider. Legal basis: Art. 6 (1) lit. a GDPR (consent by actively clicking). The provider’s privacy terms apply in addition.
12. Your rights
You have the right to access (Art. 15), rectification (Art. 16), erasure (Art. 17), restriction (Art. 18), data portability (Art. 20), objection (Art. 21) and to withdraw consent you have given (Art. 7 (3) GDPR). To exercise these rights, contact welcome@sunneschloessli.com.
13. Right to complain
You have the right to lodge a complaint with the Austrian Data Protection Authority (Datenschutzbehörde, DSB), Barichgasse 40-42, 1030 Vienna, dsb@dsb.gv.at.
14. Changes
The further development of our website or changed legal requirements may make it necessary to amend this privacy policy. The current version is always available on this page; in case of doubt, the German version prevails.