Privacy policy
Last updated: October 2026 · Deutsche Fassung
Protecting your personal data matters to us. We process your data only in line with the EU General Data Protection Regulation (GDPR), the Austrian Data Protection Act (DSG) and the Austrian Telecommunications Act 2021 (TKG 2021). Under Articles 13 and 14 GDPR, this page explains which data we process, why, on what legal basis and for how long. If the German and English versions differ, the German version applies.
- Who is responsible
- Overview of processing
- Visiting this website
- Contacting us by email, phone and WhatsApp
- Booking direct
- Payments
- Online check-in and guest registration
- Bookings through platforms
- Recipients
- Transfers outside the EU
- Providing your data
- Data security
- Your rights
- Changes
1. Who is responsible
[Full name or company name]
Aminato Boutique Apartments
[Business address, if different from] Lastenstraße 6, 8020 Graz, Austria
Email: bookings@aminato-apartments.at
Phone: +43 665 67223008
Our business is not legally required to appoint a data protection officer. For any privacy question, please use the contact details above.
2. Overview of processing
| Purpose | Data | Legal basis | How long we keep it |
|---|---|---|---|
| Running and securing the website | IP address, date and time, page requested, browser and operating system | Art. 6(1)(f) GDPR (legitimate interest in secure operation) | [number] days |
| Answering your enquiries | Name, contact details, travel dates, your message | Art. 6(1)(b) GDPR (steps before a contract), otherwise (f) | 6 months after the enquiry is closed; if you book, as for booking data |
| Handling your booking and stay | Name, address, email, phone, travel dates, number of guests, extras, messages | Art. 6(1)(b) GDPR (performance of contract) | 7 years from the end of the calendar year (§ 132 BAO), where relevant for tax |
| Payments | Amount, payment method, payment status, transaction ID | Art. 6(1)(b) and (c) GDPR | 7 years (§ 132 BAO) |
| Guest register (legal registration duty) | Registration data under § 5 Austrian Registration Act, arrival and departure dates | Art. 6(1)(c) GDPR with § 10 Meldegesetz 1991 | 7 years from entry (§ 10(2) MeldeG) |
| Overnight tax | Number of guests and nights, dates of stay | Art. 6(1)(c) GDPR with regional tax law | As required by tax retention rules |
3. Visiting this website
No cookies, no tracking
Our website sets no cookies and uses no analytics, marketing or social media tools. It embeds no third-party content (such as Google Fonts, Google Maps or YouTube); fonts are loaded from our own server. That is why there is no cookie banner. Your language choice is not stored.
Hosting and server log files
The website is hosted by [name and address of the web host, e.g. easyname GmbH, Austria]. Each visit stores technically necessary access data (IP address, date and time, page requested, amount of data transferred, referrer, browser and operating system) in server log files. This is needed to deliver the website and detect attacks (Art. 6(1)(f) GDPR). Log files are deleted after [number] days. The host is our processor under a contract according to Art. 28 GDPR.
QR code statistics
Links from our business cards and flyers include a source label in the address (for example "utm_source=flyer"). This label contains no personal data and only tells us how often our printed material is used.
4. Contacting us by email, phone and WhatsApp
When you contact us by email, phone or WhatsApp, we process the information you give us to answer your enquiry. The legal basis is Art. 6(1)(b) GDPR where your enquiry concerns a booking, otherwise our legitimate interest in replying (Art. 6(1)(f) GDPR).
WhatsApp is a service of WhatsApp Ireland Limited, Dublin, Ireland, part of the Meta group. The WhatsApp button on our website is a plain link; no data is sent until you tap it. If you message us on WhatsApp, WhatsApp also processes your data (including your phone number and metadata), possibly in the USA. Using WhatsApp is optional. Please send confidential details, such as ID documents, by email or through our online check-in instead. WhatsApp's privacy notice: whatsapp.com/legal/privacy-policy-eea.
5. Booking direct
For direct bookings we use the booking and property management system of Smoobu GmbH, Pappelallee 78/79, 10437 Berlin, Germany. Smoobu processes your booking data (name, address, contact details, travel dates, number of guests, extras, messages) only on our behalf, under a data processing agreement according to Art. 28 GDPR. The legal basis is the performance of your accommodation contract (Art. 6(1)(b) GDPR).
The booking form is loaded from Smoobu's servers, which receive your IP address when it loads. [Check after embedding which cookies the form sets and add them here; only strictly necessary cookies are allowed without consent under § 165(3) TKG 2021.] Smoobu's privacy notice: smoobu.com/en/privacy-policy.
We use your email address and phone number to send you information about your stay (for example arrival details and your door code). We do not send you advertising.
6. Payments
Online payments are handled by Stripe (Stripe Payments Europe, Limited, Ireland)[ and, if enabled, PayPal (Europe) S.à r.l. et Cie, S.C.A., 22–24 Boulevard Royal, 2449 Luxembourg]. You enter your payment details (such as card data) directly with the payment provider; we never receive your full card details, only the payment status, amount and transaction ID. The payment provider processes data partly on our behalf and partly as an independent controller, for example to prevent fraud and meet its obligations as a payment institution. The legal basis is Art. 6(1)(b) and (c) GDPR. Stripe's privacy notice: stripe.com/privacy.
7. Online check-in and guest registration
As an accommodation provider, Austrian law (Meldegesetz 1991) requires us to keep a guest register. Before your arrival, our online check-in collects the legally required data of every guest, in particular name, date of birth, sex, nationality, home address and, for guests from abroad, the type, number and issuing authority of their travel document, as well as arrival and departure dates. The legal basis is Art. 6(1)(c) GDPR with § 10 of the Registration Act. We keep this data for seven years from the date of entry (§ 10(2) MeldeG) and pass it to authorities only where the law requires. Data for the overnight tax is reported to the competent tax authority.
8. Bookings through platforms
If you book through a platform such as Booking.com or Airbnb, the platform sends us the data we need for your stay. The platform's own privacy policy applies to its processing. We handle the data we receive in the same way as data from a direct booking.
9. Recipients
Your data is shared only where needed for the purpose in question, with:
- our processors: web host, Smoobu GmbH (booking system), Stripe (payments)[, tax adviser, cleaning service (name and dates of stay only)];
- authorities, where the law requires it (for example the registration and tax authorities);
- banks and payment providers, to process payments.
We never sell your data or share it for advertising.
10. Transfers outside the EU
We do not transfer your data outside the EU or EEA ourselves. Stripe (for payments) and WhatsApp (if you use it) may transfer data to the USA. Such transfers rely on the European Commission's adequacy decision for the EU-US Data Privacy Framework (Art. 45 GDPR) or on standard contractual clauses (Art. 46(2)(c) GDPR).
11. Providing your data
The details in the booking form are needed to conclude and perform your accommodation contract, and the registration data is required by law. Without them we cannot accept your booking or accommodate you. Everything else is voluntary. We do not use automated decision-making or profiling (Art. 22 GDPR).
12. Data security
The website is protected by TLS encryption (HTTPS). Only people who need it to handle your stay can access guest and booking data. Our service providers are contractually bound to appropriate technical and organisational measures (Art. 32 GDPR).
13. Your rights
You have the right at any time to:
- access the data we hold about you (Art. 15 GDPR),
- rectify inaccurate data (Art. 16 GDPR),
- erase your data, unless we are legally required to keep it (Art. 17 GDPR),
- restrict processing (Art. 18 GDPR),
- data portability (Art. 20 GDPR),
- object to processing based on legitimate interests (Art. 21 GDPR),
- withdraw any consent you have given, with effect for the future (Art. 7(3) GDPR).
An email to bookings@aminato-apartments.at is enough. We reply within one month and may ask you to confirm your identity to protect your data.
If you believe we process your data unlawfully, you can complain to the supervisory authority: Austrian Data Protection Authority (Datenschutzbehörde), Barichgasse 40–42, 1030 Vienna, www.dsb.gv.at.
14. Changes
We update this privacy policy when our website, our service providers or the law change. The version published here applies.