Privacy policy

The short version

This website sets no cookies, embeds no third-party services and uses no tools that analyse visitor behaviour. When you open it, you load files from this one server only: the text, the design, the fonts and the images.

That is verifiable. On 31 August 2026 every page of this website was opened in a fresh browser and every network request was recorded. The result: not a single request to a third-party server, no cookie, no entry in the browser’s local storage.

Two pages behave differently and are described separately below: the online booking, which embeds feratel Deskline, and the editing area at /admin/, which the hosts use.

Data does nevertheless arise as soon as anyone opens a website, and there is data you send us yourself when you call or write. That is what follows.

Who is responsible for this website

The controller within the meaning of the General Data Protection Regulation is:

Gorfenspitze
Sven Jörg
Galtür 17a
6563 Galtür
Austria

Phone: +43 5443 8209
Email: info@gorfenspitze.at

Please send all questions about data protection, and all requests concerning the rights set out below, to this address.

No data protection officer has been appointed. In our assessment there is no obligation to do so for a business of this size and activity.

What arises when you open the site

Server log files

This website is hosted by Netlify, Inc. in the United States. Netlify operates a worldwide delivery network for this purpose. As with every web server, a log entry is created when a page is requested. It usually contains:

• the IP address of the requesting device
• the date and time of the request
• the address requested
• the status code returned and the amount of data transferred
• the page visited previously, if the browser sends it
• information about the browser and operating system

This data is technically necessary for the page to be delivered at all. We do not use it to identify individuals and we do not combine it with any other data.

Purpose: delivery of the website, operational security, defence against attacks and troubleshooting.
Legal basis: legitimate interest in secure and stable operation, Art. 6 (1) (f) GDPR.
Recipient: Netlify as a processor for the operation of the website.
Third country: as Netlify is a US company with a worldwide delivery network, processing may also take place outside the European Union. Netlify sets out the details in its own privacy terms, available at www.netlify.com/privacy.
Retention: the logs are deleted by Netlify according to its own periods. We do not keep copies of our own and do not evaluate them.

No cookies and no tracking

This website stores nothing on your device. No cookies are set, and neither the local storage nor the session storage of the browser is written to. That is also why there is no cookie consent window on this website: there is nothing to consent to.

Fonts and images come from this server

The fonts used are held on this server and delivered from there. There is no connection to Google Fonts or any other third-party font service. The same applies to all images and to the few scripts the site uses: they all sit on the same server as the page itself.

When you use the enquiry form

On the page Send an enquiry you can send us a request. We process the details you enter: arrival, departure, number of guests, the type of apartment you would like, first name, last name, email address and, if you wish, your telephone number and your message.

The form runs on Netlify Forms, that is, with the same provider that hosts this website. The submission is stored at Netlify and delivered to us by email. You do not need an account, and none is created.

A single field serves as spam protection: it is invisible to people and is only filled in by automated programs. There is deliberately no CAPTCHA, because it shuts guests out and would be one more third-party service.

Purpose: answering your enquiry and, if it leads to a booking, handling your stay.
Legal basis: steps prior to entering into a contract and performance of the contract, Art. 6 (1) (b) GDPR.
Recipient: Netlify as a processor for receiving and delivering the message.
Retention: for as long as it takes to deal with the matter. If the enquiry leads to a stay, the statutory retention periods apply, in particular those under tax and commercial law.

When you call or write

You can just as well call us or send an email. In that case we process the details you give us yourself. Purpose, legal basis and retention are the same as for the enquiry form. No additional recipient is involved.

The Book online page

On the page Book online the booking system feratel Deskline is embedded, appearing there under the name booking&more. It is the only third-party service on a public page of this website.

As soon as you open that page, your browser loads program files, fonts and data from the servers web5.deskline.net, resc.deskline.net and webapi.deskline.net. Your IP address is transferred to feratel in the process. The booking system also creates several entries in your browser’s local storage, holding the current state of your booking.

If you enter a booking, feratel processes the details required for it. The terms of feratel apply to that processing.

Purpose: displaying availability and receiving bookings.
Legal basis: steps prior to entering into a contract and performance of the contract, Art. 6 (1) (b) GDPR.
Recipient: feratel as the operator of the booking system.

If you would rather avoid this, simply do not open that page. Booking works just as well through the enquiry form, by telephone or by email. Those ways are set out next to the booking system on the page itself.

Links that lead away from this website

The imprint and this privacy policy contain links to third-party sites: to our host’s privacy policy, to the Austrian data protection authority, to the European Commission’s online dispute resolution platform and to the general terms and conditions of the Austrian Economic Chamber. As soon as you click one of them, you leave this website. The privacy policy of that site applies to the processing of your data there, not this one. We have no influence over it.

There are no outbound links on any of the other pages of this website. This was counted for the state of 31 August 2026, not assumed.

The editing area at /admin/

The address /admin/ is where the hosts maintain prices and texts. It is of no relevance to guests and is mentioned here for completeness.

This area behaves differently from the rest of the website. It loads the editing software and its fonts from the delivery networks unpkg.com and cdn.jsdelivr.net and queries the operating status of GitHub at githubstatus.com. The IP address is transferred to those providers in the process. It also creates two entries in the browser’s local storage holding the language setting and display preferences.

Access requires a sign-in through GitHub. Search engines are excluded from this area.

What does not happen on this website

Because an earlier version of this policy claimed the opposite, explicitly: none of the following exists on this website.

• no reach or behaviour analysis, in particular no Google Analytics, no etracker, no Matomo or Piwik, no Hotjar, no Siteimprove
• no advertising networks, no Google Ads, no Google AdSense, no remarketing, no Facebook Custom Audiences, no nugg.ad
• no analytics or advertising services from Bing, Seznam or Yandex
• no social media plugins from Facebook, Instagram, X or other networks
• no newsletter, no prize draws, no surveys
• no registration and no user account for guests
• no passing on of data for advertising purposes
• no automated decision-making and no profiling within the meaning of Art. 22 GDPR

Your rights

You have the following rights in relation to us. To exercise any of them an informal message to info@gorfenspitze.at is enough.

Access

You have the right to find out whether and to what extent we process data about you, and to receive a copy of that data.

Rectification

If we process incomplete or incorrect data about you, you can ask at any time for it to be corrected or completed.

Erasure

You can ask for your data to be deleted. There may be statutory retention obligations that prevent immediate deletion, for example in the case of invoices. If so, we will tell you which ones.

Restriction of processing

You can ask us to store your data only, and not to use it further, for example while we check whether it is correct.

Data portability

You have the right to receive the data you have given us in a common, machine-readable format, in so far as the processing is based on consent or on a contract.

Objection

In so far as we process data on the basis of a legitimate interest, you can object to that processing on grounds relating to your particular situation.

Withdrawal of consent

In so far as processing is based on your consent, you can withdraw it at any time with effect for the future. The lawfulness of the processing carried out up to that point is unaffected.

Complaint to the supervisory authority

If you believe that the processing of your data infringes data protection law, please speak to us so that we can clear the matter up. Regardless of that, you have the right to lodge a complaint with a supervisory authority. The competent authority is the Austrian Data Protection Authority, dsb@dsb.gv.at, www.dsb.gv.at. You may also contact any other supervisory authority within the European Union.

Proof of identity

To protect your data we may, in case of doubt, ask for proof of your identity before we deal with a request.

Manifestly unfounded or excessive requests

In the case of manifestly unfounded or excessive requests, in particular where they are repeated frequently, we may charge a reasonable fee or refuse to act on the request, in accordance with Art. 12 (5) GDPR.

Changes to this policy

If the website changes technically, this policy changes with it. The version available here is always the one that applies.