Legal

Privacy policy

Transparent, clear and without tracking.

Protecting your personal data matters to us. In this privacy policy we inform you, in accordance with Art. 13 and 14 GDPR, the Austrian Data Protection Act (DSG) and the Austrian Telecommunications Act 2021 (TKG 2021), which data we process, for what purpose and on what legal basis.

1. Controller

Name / company
Torggelgasse 16, 6971 Hard, Austria
Email: office@blauelagune-fms.com
Phone: +43 …

A data protection officer is not required by law and has not been appointed. Please send any data protection questions to the email address above.

2. Principles & legal bases

Contract and pre-contractual measures (Art. 6(1)(b) GDPR) – e.g. answering your request, handling your booking
Legal obligation (Art. 6(1)(c) GDPR) – e.g. guest registration, visitor tax, tax retention duties
Legitimate interest (Art. 6(1)(f) GDPR) – e.g. secure operation of this website, preventing abuse, asserting claims
Consent (Art. 6(1)(a) GDPR, § 165(3) TKG 2021) – e.g. loading Google Maps or the 360° tour. You can withdraw consent at any time with effect for the future.

This website does not use analytics, tracking or advertising cookies. We do not sell data and do not make automated decisions including profiling within the meaning of Art. 22 GDPR.

3. Hosting & server log files

This website is hosted by hosting provider, address, country. When you visit, your browser automatically transmits technical data that is stored in server log files: IP address, date and time, page or file requested and amount of data, referrer URL, browser type, operating system and device type. This is necessary to deliver the website, ensure system security and analyse errors, based on our legitimate interest (Art. 6(1)(f) GDPR). Log files are deleted after 14 days unless needed longer to investigate a security incident. A data processing agreement pursuant to Art. 28 GDPR is in place with the hosting provider.

4. Contact by email & phone

If you contact us by email or phone, we process your details (e.g. name, email, phone number, message) to handle your enquiry – on the basis of Art. 6(1)(b) GDPR if your enquiry relates to a contract, otherwise our legitimate interest in replying (Art. 6(1)(f) GDPR).

5. Request form

Via the request form you can send us a non-binding request. We process: required – first name, last name, email, arrival and departure date; optional – phone, preferred apartment, number of guests, message; technical – time of submission, a simple arithmetic check and a hidden spam-protection field.

Purpose: checking availability, answering your request and preparing an offer. Legal basis: pre-contractual measures at your request (Art. 6(1)(b) GDPR). Without the required details we cannot process your request. Your details are sent by email to office@blauelagune-fms.com and are not passed on to third parties. If no booking results, we delete the request no later than 6 months after our last communication; if you book, the periods in section 6 apply.

6. Booking & stay

Contract performance (Art. 6(1)(b) GDPR): offer, booking confirmation, check-in, invoicing, communication during your stay.
Guest register (Art. 6(1)(c) GDPR in conjunction with the Austrian Registration Act 1991): as an accommodation provider we must keep a guest register including name, date of birth, sex, nationality, country of origin and home address, and for foreign guests the type, number, date of issue and issuing authority of the travel document. This data is kept for seven years and may be passed to the competent authorities on request.
Visitor tax (Art. 6(1)(c) GDPR in conjunction with the Vorarlberg Tourism Act): overnight stays are reported to the municipality or the competent tourism organisation.
Accounting & tax (Art. 6(1)(c) GDPR in conjunction with § 132 BAO and § 212 UGB): invoices and booking records are kept for seven years.
Payments: payment data is passed to the respective bank or payment service provider (e.g. bank, card terminal provider).

7. Booking platforms

If you book via a booking platform (e.g. Booking.com, Airbnb), we receive the data required to handle the booking from that platform. The platform operator is responsible for processing on the platform itself; its privacy policy applies. Occupancy periods (without guest data) may be synchronised between platforms and our calendar to avoid double bookings.

8. Availability search

The search for available apartments runs entirely in your browser. The dates and number of guests you enter are not sent to us unless you then submit the request form.

9. Cookies & local storage

This website itself does not set cookies. To remember your consent choice, we store it in your browser’s local storage under the key bl-consent-v1 (value “all” or “necessary”). This is strictly necessary to respect your decision (§ 165(3) TKG 2021) and remains until you delete it in your browser.

By clicking “Accept cookies” you allow external content (Google Maps, 360° tour) to load, which may use cookies or similar technologies of the respective provider. With “Necessary only” this content is not loaded automatically; you can load it individually by clicking. You can change your choice at any time via “Cookie settings” in the footer of every page.

10. Google Maps

The home page can display a Google Maps map provided by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. The map is only loaded if you have consented or clicked “Load Google Maps”. Only then is a connection made to Google servers, transmitting in particular your IP address, browser and device information and the page visited; Google may set cookies. Legal basis: your consent (Art. 6(1)(a) GDPR, § 165(3) TKG 2021). More: Google privacy policy.

11. 360° tour

For the virtual tour we embed a 360° tour from provider, address, country. It is only loaded if you have consented or clicked “Start 360° tour”. Your IP address and technical browser/device information are then transmitted to the provider, which may set cookies. Legal basis: your consent (Art. 6(1)(a) GDPR, § 165(3) TKG 2021). The provider’s privacy policy applies: link.

We link to our Instagram and Facebook profiles (Meta Platforms Ireland Ltd., Merrion Road, Dublin 4, D04 X2K5, Ireland) with simple links only. No plugins are embedded and no data is sent to Meta when you visit our website. Only when you click a link are you taken to the platform, where Meta’s privacy policy applies.

13. Fonts & icons

Fonts (Inter, Lora) and icons are served from our own server. No connection to Google Fonts or other third parties is made.

14. Recipients & processors

Hosting and email provider (name) as processor under Art. 28 GDPR
Tax advisor / accounting (name – if applicable)
Banks and payment service providers
Municipality of Hard or the competent tourism organisation (visitor tax) and authorities where legally required
Booking platforms, if you booked via them
IT service provider for website maintenance, only as far as necessary

15. Transfers to third countries

As a rule, no data is transferred outside the EU/EEA. Exceptions only apply if you consent to external content (Google Maps, possibly the 360° tour), in which case data may also be transferred to the USA. Google LLC is certified under the EU-US Data Privacy Framework, for which an adequacy decision of the European Commission exists (Art. 45 GDPR).

16. Retention overview

Server log files: 14 days
Requests without booking: no later than 6 months after last contact
Guest register: 7 years (Registration Act)
Invoices & booking records: 7 years (§ 132 BAO, § 212 UGB)
Cookie choice: until deleted in your browser

17. Data security

This website and your form entries are transmitted encrypted via HTTPS (TLS). We take appropriate technical and organisational measures to protect your data against loss, manipulation and unauthorised access. Please note that unencrypted emails are not fully protected in transit.

18. Your rights

You have the right of access (Art. 15), rectification (Art. 16), erasure (Art. 17, unless statutory retention applies), restriction (Art. 18), data portability (Art. 20), objection to processing based on legitimate interests (Art. 21) and to withdraw consent at any time (Art. 7(3) GDPR). Simply contact office@blauelagune-fms.com. You may also lodge a complaint with the Austrian Data Protection Authority, Barichgasse 40–42, 1030 Vienna, dsb@dsb.gv.at, www.dsb.gv.at.

19. Changes

We update this privacy policy when the website, our processes or the law change. The version published here applies.

Last updated: October 2026