Privacy Policy

This policy explains which personal data we process when you use suedtirolwellness.com in German, Italian or English, what we use it for, who receives it, how long we store it and what rights you have. Section 11 also applies to our partner portal and to contract management with hotels and day spas.

1. Controller

Online Media des Kousminscki Armin, sole proprietorship (impresa individuale), brand SuedtirolWellness
Gerbergasse 22/A, 39100 Bozen (BZ), Italy
Email: info@suedtirolwellness.com · PEC: kousminscki.armin@pec.it · Phone: +39 327 853 6826
VAT number (P. IVA): IT03199310214

You can reach us at these contact details with any questions about data protection.

2. Visiting the website, hosting and security

When you visit our pages, our server processes the connection data that is technically required for this, in particular your IP address, the date and time, the page requested and information about your browser and device. This is the only way the website can be delivered and protected against misuse.

Hosting: We run the website, content management system, database and media on a server provided by Amazon Web Services EMEA SARL, Luxembourg (“AWS”), in the AWS Frankfurt am Main region. AWS processes the data on our behalf. The data processing terms are part of our contract with AWS. An AWS load balancer in front of our server forwards connections to it. We do not store access logs of this load balancer.

Backups: Once a day, we create an encrypted backup of the database, uploaded files and extensions of our content management system in AWS storage, also in Frankfurt. Each daily backup is marked as deleted after 30 days and permanently removed after another 30 days. AWS carries out these steps with some delay. As long as a backup exists, it may also contain data that we have already deleted in the live system.

Logs: Our application and our content management system write technical logs that may contain such connection data. They are overwritten based on data volume. For each service, no more than three log files of 10 MB each are kept, and older entries are continuously replaced. How long an entry is retained therefore depends on how much is logged.

Protecting the forms against misuse: To prevent our forms from being submitted automatically in bulk, our application counts submission attempts per IP address for 15 minutes in working memory. No more than five attempts are possible per form submission route. These counters are not stored permanently. We also invisibly check an empty control field and the time taken to fill in the form. We do not use an external CAPTCHA service.

Legal basis: Art. 6(1)(f) GDPR, our legitimate interest in secure and stable operation of the website.

For functions that you use yourself or that are necessary for operation, we store a few entries in your browser: one cookie and entries in local storage and session storage. These entries are used neither for advertising nor for audience measurement.

Entry	Type	Purpose	Duration
`lang`	Cookie	the language you selected	365 days from the language change
`cookie_consent`	local storage	your selection in the consent dialog with timestamp and version	until you change your selection or delete your browser data
`persist:mywellness_hotels`	local storage	the properties you selected for an inquiry	until you change your selection or delete your browser data
`persist:mywellness_search`	session storage	travel dates, number of guests, children's ages and message during an inquiry in progress	until the end of the browser session, cleared after a successful inquiry
`persist:mywellness_contact`	session storage	your contact details during an inquiry in progress, so that you do not have to enter them again after an error	until the end of the browser session, cleared after a successful inquiry
`swt_hub_return`, `swt_hub_scroll`, `swt_dayspa_return`, `swt_dayspa_scroll`, `swt_world_return`, `swt_world_scroll`	session storage	returning to the list you last viewed with your filter selection and position	until the end of the browser session
`sw_consent_not_saved`	session storage	a one-time notice if your consent selection could not be saved	removed after it is shown

Some browsers restore sessions after a restart. In that case, session storage is retained as well.

Consent management: On your first visit, all optional categories are declined. We only load optional services if you consent to the “Analytics” or “Marketing” category (Section 4). You can change or withdraw your selection at any time using the “Cookie settings” link in the page footer.

Legal basis: For the technically necessary entries, Art. 6(1)(f) GDPR, our legitimate interest in a functioning website. Under Art. 122 of the Italian Data Protection Code (D.Lgs. 196/2003), no consent is required for these entries. For storing your consent selection, Art. 6(1)(c) in conjunction with Art. 7(1) GDPR, because we must be able to demonstrate that consent was given.

4. Audience measurement and marketing

Google Tag Manager: If you consent to “Analytics” or “Marketing”, our website loads Google Tag Manager. It controls which of the following services are triggered. Which services receive data depends on your selection. When the Tag Manager loads, your IP address is technically transmitted to Google.

Analytics with Google Analytics: With your consent to “Analytics”, we use Google Analytics to measure how our website is used.

Our own measurement events record page views and clicks on links to hotel websites. We transmit the address of the page visited, the page you came from, the page title, the language and the page type and, for clicks on hotel websites, also the hotel's identifier and the click location. We transmit the address of the page visited without query parameters. Exceptions are the identifier of an ad click and campaign details such as the source, medium and name of a campaign, so that we can tell which ad or campaign brought you to us. We transmit the page you came from without query parameters. We do not transmit names, email addresses, phone numbers or the content of your inquiries with these events.
Inquiries: If you send an inquiry to hotels and our email service has accepted it for at least one hotel, our server reports this to Google Analytics as an inquiry event, linked to the identifier that Google Analytics has assigned to your browser. This report does not contain names, contact details or message texts. We also tell Google whether you have additionally consented to “Marketing”. Without this consent, use of the report for advertising purposes is restricted. Google Analytics is linked to our Google Ads account, where such a report may be counted as a success of our ads. So that a later withdrawal of your consent can also be taken into account for these reports, our website stores random identifiers and the times of your inquiries in your browser's local storage for this purpose (sw_measurement_revoke_keys, sw_measurement_revoke_pending), no more than 20 entries for no more than 14 days.
Automatically collected events: In addition, Google Analytics itself records further interactions (scrolling, clicks on external links, site search, form interactions, video engagement and file downloads) as well as information about your device and browser. These events may also contain the address of the page and of the previously visited page, including their parameters.
Redaction: Google Analytics is set to redact email addresses and the values of certain parameters in page addresses, for example for names, phone numbers and messages.
Retention period: Google Analytics retains event and user data for us for 14 months. If you use our website again, the period for your browser's identifier and the associated user-level data may be extended. This does not restart the period for individual events already recorded. Most aggregated standard reports are not affected by this setting.

Marketing with Google and Meta: With your consent to “Marketing”

we allow Google to also use the data collected through Google Analytics for advertising purposes, for example to personalize ads and measure their success, provided that you have also consented to “Analytics”, and
we use the Meta Pixel to notify Meta when you view a page, click a link to a hotel website or send an inquiry that our system has accepted. Meta also receives technical information such as your IP address, information about your browser and device, the page address and identifiers from cookies. Meta uses this data to measure the effectiveness of our ads and to select and deliver ads on Facebook and Instagram.

Providers and roles:

Google Tag Manager and Google Analytics: Google Ireland Limited, Dublin, Ireland. For measurement with Google Analytics, Google processes the data on our behalf. Where Google uses the data for advertising purposes with your consent to “Marketing”, Google acts on our behalf or as an independent controller, depending on the service.
Meta Pixel: Meta Platforms Ireland Limited, Dublin, Ireland. For measuring the effectiveness of our ads, Meta processes the data on our behalf. Where the data is used to select and deliver ads, we and Meta are joint controllers for its collection on our website and its transmission to Meta (Art. 26 GDPR). Meta is the sole controller for the subsequent processing.

Joint controllership with Meta, the key points: The Meta Controller Addendum applies to the joint controllership. Under it, we inform you about this processing, and Meta enables you to exercise the rights under Arts. 15 to 20 GDPR for the data stored by Meta after transmission. You can exercise your rights both against us (Section 1) and against Meta. Meta explains how it processes data and how you can contact Meta in its Privacy Policy.

Transfers to third countries: Google and Meta may also process data in the USA. Depending on the processing, the basis is the European Commission's adequacy decision on the EU-U.S. Data Privacy Framework (Art. 45 GDPR) or standard contractual clauses (Art. 46 GDPR).

Cookies of these services: Google Analytics sets the cookies _ga and _ga_<ID>, which are valid for two years under Google's default setting. We have not changed this setting, and your browser may shorten their lifetime. With your consent to “Marketing”, Google and Meta may set further cookies. The providers determine which cookies these are and how long they remain valid. Meta describes this in its Cookies Policy.

Legal basis: your consent, Art. 6(1)(a) GDPR and Art. 122 D.Lgs. 196/2003. You can withdraw it at any time via “Cookie settings” with effect for the future. After that, these services are no longer triggered.

5. Inquiries to one or more hotels

Using our inquiry forms, you can send a non-binding inquiry about a stay to one or more properties.

What information: first and last name, email address, travel dates, number of adults and children as well as children's ages. Optionally, country, message and phone number. The phone number is required if you would like to be contacted by phone. In addition, your confirmation that you are of legal age, the language, the selected properties and technical delivery information: delivery status, email delivery identifiers, error and retry data and a key that prevents duplicate submissions.

What happens to the inquiry: Each property you select receives your inquiry in a separate message, and you receive a confirmation at your email address. Other properties do not receive your inquiry. The hotels' email addresses come from our directory, not from your browser. If a hotel replies using the reply function of its email program, the reply goes directly to your email address.

Who receives the data: The selected hotels process your inquiry as independent controllers. Each hotel decides how long it keeps your inquiry. Please contact the property in question directly about this. We use an email service provider for sending (Section 8).

How long we store the data: We store your inquiry with the associated recipient and delivery data in our inquiry system and delete it there automatically 14 days after receipt. Deletion runs every hour, so an entry may still exist for up to one hour after the period has expired. We do not additionally store the content of your inquiry in the change logs of our content management system. This deletion does not cover copies outside the inquiry system:

the messages in the hotels' mailboxes, which each hotel decides on, and in your own mailbox,
the data held by our email service provider (Section 8),
our daily backups until they are deleted (Section 2).

This rule applies to inquiries received on or after the date on which this version takes effect.

Legal basis: Art. 6(1)(b) GDPR. We process your inquiry at your request, as a step prior to entering into a possible contract with the hotel.

6. Contact form

If you write to us using the contact form, we process your name, your email address, your message and the language and, if transmitted, the page from which you wrote to us. We store your message in our content management system and forward it by email to our team so that it can be dealt with. We reply to the email address you provided.

How long we store the data: We keep your message and the associated email copies of our team until we have finished dealing with it. We delete completed inquiries as part of a monthly deletion round. We do not additionally store the content of your message in the change logs of our content management system. Section 8 applies to the data held by our email service provider and Section 2 to our daily backups. If a contract results from your inquiry, we keep the documents required for it separately as part of the contractual relationship.

Legal basis: Art. 6(1)(f) GDPR, our legitimate interest in answering your message. If your message is aimed at a contract, Art. 6(1)(b) GDPR.

7. Inquiries from hotels and day spas

Businesses that would like to be listed on SuedtirolWellness or have questions about a partnership can write to us using the “List your hotel” and “Contact for hotels” forms. The inquiry is non-binding and does not create a contract.

What information: name of the business, name of the contact person, email address and message. For “List your hotel”, optionally website and phone number. For “Contact for hotels”, also a subject. In addition, the language.

What happens to the inquiry: We store the inquiry in our content management system and forward it by email to our team so that it can be dealt with and answered personally. Other businesses do not receive the inquiry.

How long we store the data: We keep the inquiry and the associated email copies of our team until we have finished dealing with it. We delete completed inquiries as part of a monthly deletion round. We do not additionally store the content of the inquiry in the change logs of our content management system. Section 8 applies to the data held by our email service provider and Section 2 to our daily backups. If a contract results from the inquiry, we keep the documents required for it separately as part of the contractual relationship (Section 11).

Legal basis: Art. 6(1)(b) GDPR, insofar as the inquiry is aimed at a contract with you or your business. Otherwise, Art. 6(1)(f) GDPR, our legitimate interest in handling business inquiries.

8. Email delivery

We send the messages from our forms, to the hotels, to you and to our team, via the Mailchimp Transactional (Mandrill) service of The Rocket Science Group LLC d/b/a Mailchimp, USA, an Intuit company. Our server hands the messages over to this service in encrypted form (TLS). Mailchimp processes the messages on our behalf under its data processing terms, including in the USA (Section 10).

Mailchimp stores the content of sent messages for 30 days. Mailchimp keeps delivery information, for example whether a message arrived or was rejected, for longer under its terms. Messages to our team go to our team's email mailboxes.

9. Content, maps and external links

Fonts are part of our website and are delivered with it from our server. No connection to Google Fonts is made to display them.
Images are delivered from our own server. Videos or maps from other providers are not embedded on our pages.
Google Maps: On the hotel pages, a link leads to a map search on Google Maps. Google Maps opens only when you click it, and Google's privacy terms then apply.
External links: Links to websites, booking pages or social networks of hotels and other providers are simple references. Such a link connects to the provider in question only when clicked. The provider is responsible for the processing there.

We do not currently offer a newsletter.

10. Recipients, access and transfers to third countries

Within SuedtirolWellness, only the responsible staff and administrators have access to your information, as well as narrowly authorized technical services of our application, for example for sending messages and automatic deletion.

Other recipients are the hotels you select (Section 5) and our service providers acting on our behalf: AWS for hosting and backups (Section 2), Mailchimp for email delivery (Section 8), the provider of our email mailboxes and Supabase for the partner portal (Section 11). With your consent, Google and Meta also receive data (Section 4).

Transfers to third countries:

Mailchimp processes data in the USA. The basis is the European Commission's adequacy decision on the EU-U.S. Data Privacy Framework (Art. 45 GDPR), supplemented by standard contractual clauses (Art. 46 GDPR) under Mailchimp's data processing terms.
Google and Meta: Section 4.
AWS and Supabase store our data in data centers in the EU (Frankfurt and Ireland, respectively). For access from third countries, for example by support staff or sub-processors, their data processing terms provide for standard contractual clauses (Art. 46 GDPR).

The providers publish the terms containing these safeguards on their websites. On request, we will tell you where to find them.

11. Partner portal and contract management with partner businesses

Hotels and day spas with which we are negotiating or concluding a contract receive a personal link by email to our partner portal. There we process information about the business and the contact person, contract data such as the scope of services, price and term as well as the processing status of the profile and of any day spa profile booked.

When you sign a document in the portal, we process the drawn signature, your confirmation of the Terms for Hotel Partners and the Privacy Policy, the time of signing, the IP address, the reference to the contract template used and checksums that can be used to prove the content of the document. This creates a signed contract document as a PDF that can be retrieved via a link with limited validity. The portal also records the signing process with a checksum and IP address. The same purpose applies to orders placed via our order form.

Service providers: The portal application runs on our server at AWS (Section 2). Supabase Pte. Ltd., Singapore, operates the database and the storage of contract documents on our behalf. The storage location is the Ireland region (EU). Supabase backs up the database daily under the standard features of our plan. These backups can be retrieved for seven days. For access from third countries, see Section 10.

How long we store the data:

Contract documents, invoices and business correspondence are kept for ten years from the date of the last accounting entry relevant to the business transaction concerned (Art. 2220 of the Italian Civil Code). Ongoing contracts, including their addenda, are also kept beyond that period for as long as they are needed for the performance or administration of the contract. If the documents are needed for a tax audit that has already started and is not yet completed, we keep them until it is completed (Art. 22 DPR 600/1973).
Proof of signature, meaning the version and checksums of the document, time of signing, IP address and drawn signature, is part of the respective contract file. We keep it together with that file insofar as it is required to prove that the contract was concluded.
Other portal data, for example processing statuses and activity notes, is kept for as long as it is needed for contract management or for resolving a specific dispute. The ten-year period does not apply to this data.

Legal basis: Art. 6(1)(b) GDPR for concluding and performing the contract. For data of contact persons who are not themselves a party to the contract, Art. 6(1)(f) GDPR, our legitimate interest in managing the contract with the business. For statutory retention obligations, Art. 6(1)(c) GDPR. For keeping proof of signature, Art. 6(1)(f) GDPR, our legitimate interest in being able to prove that the contract was concluded and to assert or defend legal claims.

12. Obligation to provide data, profiling and automated decisions

You are not obliged by law or by contract to provide us with data through the forms. Without the information marked as required fields, however, we cannot process or forward your inquiry.

We do not make decisions based solely on automated processing that produce legal effects concerning you or similarly significantly affect you (Art. 22 GDPR). This is different from creating usage profiles: if you consent to “Marketing”, Google and Meta may also use data about your use of our website to show you advertising (Section 4).

13. Your rights

You have the right of access (Art. 15 GDPR), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18) and data portability (Art. 20). Where we process data on the basis of our legitimate interest, you can object on grounds relating to your particular situation (Art. 21). You can withdraw consent you have given at any time with effect for the future (Art. 7(3)). Processing carried out until then remains lawful.

A message to the contact details given in Section 1 is enough for any of your requests.

You can also lodge a complaint with a data protection supervisory authority (Art. 77 GDPR), in particular in the Member State of your habitual residence, your place of work or the place of the alleged infringement. The authority responsible for us is the Garante per la protezione dei dati personali, Piazza Venezia 11, 00187 Rome, www.garanteprivacy.it.

14. Changes

We update this policy when our website or our processing changes. The version published here at any given time applies.