Privacy policy

The controller responsible for the data processing on this website is FMW Eventgastronomie e.U. (Brauhaus zu Murau), owner Fritz Wassermann.

Raffaltplatz 17, 8850 Murau, Styria

Phone: +43 3532 2437

Email: hotel@brauhaus-murau.com

The website is operated by Vercel Inc. (USA). Server functions run in the region fra1 (Frankfurt am Main); static pages and files are delivered via Vercel’s worldwide content delivery network (CDN), that is, from locations in various countries.

When the website is accessed, the hosting provider processes technical data in server logs: IP address, time, the address requested (path) and browser data. The legal basis is the legitimate interest in the secure and stable operation of the website (Art. 6(1)(f) GDPR).

Vercel Inc. is certified under the EU-US Data Privacy Framework. The transfer of data to the USA is based on this.

The website writes its own concise log lines. They contain no IP address and no directly personal information.

Error messages from the browser (for example when an animation or a booking widget fails to load) are reported through a dedicated interface. Only the source, the event and a brief technical note without an email address are logged. The legal basis is the legitimate interest in diagnosing errors (Art. 6(1)(f) GDPR).

Consent decisions are logged as proof: event (decision, grant or withdrawal), version, place of the decision (banner, footer or placeholder), selection per category and service, and the server time. No IP address is written to this log line either.

If an address is requested that does not exist (404) or no longer exists (410), only the requested address (path) is logged.

All fonts are delivered by this website itself. There is no connection to Google Fonts or other font providers; no data is transmitted to third parties for this purpose.

The website uses its own consent manager (no third-party provider). Services that are not necessary are loaded only after consent. The categories are: Necessary (always active), Statistics, Marketing and External content (Teburio, Google Maps, YouTube).

The legal basis for non-necessary cookies and comparable storage is consent (Art. 6(1)(a) GDPR in conjunction with section 165(3) of the Telecommunications Act 2021 (TKG 2021)).

The decision can be changed or withdrawn at any time via ‘Cookie settings’ in the footer.

An asterisk (*) in the table stands for the variable remainder of the cookie name.

If consent is withdrawn, the website deletes the associated cookies from Google or Meta respectively and reloads the page.

Google Analytics 4 measures how the website is used. The service is loaded only after consent to the category ‘Statistics’; without consent, no Google script is loaded. Google Consent Mode v2 is integrated.

The provider is Google Ireland Limited; its parent company is Google LLC (USA). Google LLC is certified under the EU-US Data Privacy Framework.

The legal basis is consent (Art. 6(1)(a) GDPR in conjunction with section 165(3) TKG 2021).

The Meta Pixel helps to measure the effect of ads on Facebook and Instagram. It is loaded only after consent to the category ‘Marketing’.

For users in the EU, the controller is Meta Platforms Ireland Limited; data is transferred to Meta Platforms, Inc. (USA). Meta Platforms, Inc. is certified under the EU-US Data Privacy Framework.

The legal basis is consent (Art. 6(1)(a) GDPR in conjunction with section 165(3) TKG 2021).

For table reservations, reference is made to Teburio. The provider is Teburio GmbH, Alan-Brooke-Weg 6, 33102 Paderborn, Germany.

The direct link opens the Teburio page; from then on its privacy policy applies. An embedded reservation widget is loaded only after a click or after consent to the category ‘External content’.

The legal basis is taking steps prior to entering into a contract for the reservation (Art. 6(1)(b) GDPR) or, for the embedded widget, consent (Art. 6(1)(a) GDPR).

The map showing the location of the restaurant is loaded from www.google.com only after consent to the category ‘External content’. Until then there is no connection to Google.

The provider is Google Ireland Limited; its parent company is Google LLC (USA), certified under the EU-US Data Privacy Framework. The legal basis is consent (Art. 6(1)(a) GDPR).

The embedded video is loaded via the domain www.youtube-nocookie.com only after consent to the category ‘External content’. This domain reduces data processing but does not replace the legal basis.

The provider is Google Ireland Limited; its parent company is Google LLC (USA), certified under the EU-US Data Privacy Framework. The legal basis is consent (Art. 6(1)(a) GDPR).

The following topics can be submitted through the request form: Room request, Group request, Seminar, Celebration, Wedding, Gift voucher, General question.

The details entered in the form fields are processed: Name, Email, Phone, Address as well as, depending on the topic, dates, number of people, special requests and comments.

The purpose is to handle and answer the request. The legal basis is taking steps prior to entering into a contract (Art. 6(1)(b) GDPR).

The request is delivered by email to reception via the Resend service (Resend, Inc., USA): Reception email. Resend is certified under the EU-US Data Privacy Framework; Resend offers a data processing agreement with EU standard contractual clauses. According to the provider, the data stored at Resend is located in the USA.

In addition, every request (topic, details from the form fields, time and language) is stored in a database at Supabase (Supabase, Inc.; server location in the EU). The purpose is handling the request by the team in an internal inbox; only signed-in team members of the hotel have access.

The stored request is deleted automatically 180 days after it was received. The hotel can delete it earlier; on request it is deleted immediately (right to erasure, Art. 17 GDPR).

Supabase processes the data as a processor on behalf of the hotel and is to that extent a recipient of the data.

Under Articles 15 to 21 GDPR, data subjects have the following rights:

Consent that has been given can be withdrawn at any time with effect for the future (withdrawal, Art. 7(3) GDPR), for example via ‘Cookie settings’ in the footer.

Data subjects can lodge a complaint with the supervisory authority. In Austria this is the Austrian supervisory authority (Österreichische Datenschutzbehörde, DSB): Barichgasse 40–42, 1030 Vienna, phone +43 1 52 152-0, email dsb@dsb.gv.at, dsb.gv.at.