Data Protection

1. Controller

UNTERHUBER KG des Martin Unterhuber & Co. – Residence Unterhuber
P.P. Rainer-Str. 3, 39038 San Candido (BZ), Italy
Phone: +39 0474 914030 · Fax: +39 0474 914066
E-Mail: [email protected]
VAT: IT01190390219 · R.E.A. Bolzano 105873

2. Scope

This policy explains how we process personal data when you browse this website or send us a request.

3. Categories & Purposes

• Server & security data (IP address, timestamps, requested resources, referrer, user agent) for technical delivery, stability and security (Art. 6(1)(f) GDPR).
• Form data (name, address, contact details, stay data, message) to answer your request / pre-contractual steps / contract performance (Art. 6(1)(b) GDPR).
• Communication data (e-mail content, metadata) for correspondence & documentation (Art. 6(1)(b)/(f) GDPR).
• Cookie / consent data to store selections & comply with legal obligations (Art. 6(1)(c)/(f) or Art. 6(1)(a) for optional choices).
• Analytics (Google Analytics) only with consent: usage analysis to improve the site (Art. 6(1)(a) GDPR).
• Marketing (Google Ads / remarketing) only with consent (Art. 6(1)(a) GDPR).

4. Legal Bases

Unless otherwise stated: contract / pre-contract (Art. 6(1)(b)), legal obligations (Art. 6(1)(c)), legitimate interest in secure efficient operation (Art. 6(1)(f)), and consent for analytics / marketing (Art. 6(1)(a)).

5. Necessity of Data

Mandatory form fields are required to process your enquiry. Without them we cannot respond adequately.

6. Recipients / Processors

We use hosting & IT providers bound by data processing agreements. Upon consent data may reach Google Ireland Ltd. (Analytics / Ads) with possible transfer to the USA based on EU Standard Contractual Clauses.

7. Third Country Transfers

Occur only with Google services after consent, safeguarded by Standard Contractual Clauses (Art. 46 GDPR).

8. Retention

• Server logs: typically 30 days, longer only for security events.
• Requests / correspondence: for handling plus statutory retention.
• Contract / booking data: per fiscal & commercial law (usually up to 10 years).
• Consent cookies: until withdrawal or expiry (max 6 months).
• Analytics / Ads: according to Google retention settings; IP anonymisation enabled.

9. Cookies & Consent

Essential cookies operate basic features. Analytics / marketing cookies run only after explicit selection. You can change preferences at any time via the footer link.

10. Google Analytics

Loaded only after consent: IP anonymisation, pseudonymous usage profiles. No merging with other Google data by our configuration. Provider: Google Ireland Ltd.

11. Google Ads / Remarketing

Only after consent to measure ad effectiveness & possibly serve personalised ads. You can disable personalised advertising in your Google account.

12. Security

Transport encryption (HTTPS), restricted access, regular updates and role-based permissions reduce risks.

13. Your Rights

Access, rectification, erasure, restriction, portability, objection to processing based on legitimate interests, withdrawal of granted consent, complaint to a supervisory authority.

14. Direct Marketing Objection

If we process data for direct marketing you may object at any time; this applies to related profiling.

15. Updates

We may adjust this notice if services or legal requirements change. The published version applies.

Last updated: 23 Aug 2025