Privacy Policy

We process personal data only to the extent necessary and solely for the purposes specified in this Privacy Policy.
Personal data is any information relating to an identified or identifiable natural person. This includes, for example:
• Name
• Address
• Email address
• Phone number
• IP address
• Order and billing information
• Payment information
• Booking details
• Communication data
Processing is carried out exclusively on a legal basis in accordance with Article 6 of the GDPR.

We process your personal data, in particular, for the following purposes:

• Providing access to our website
• Processing inquiries
• Fulfilling orders
• Processing payments
• Shipping goods
• Booking accommodations at Schlafgut am Johanneshof
• Registration for events
• Sending our newsletter
• Customer service
• Compliance with legal obligations
• Improving our website
• Marketing and audience measurement (subject to appropriate consent)

Depending on the type of processing, this is based on

• your consent pursuant to Art. 6(1)(a) of the GDPR,
• to fulfill a contract pursuant to Article 6(1)(b) of the GDPR,
• to comply with legal obligations pursuant to Article 6(1)(c) of the GDPR, or
• on the basis of our legitimate interest pursuant to Article 6(1)(f) of the GDPR.

We store personal data only for as long as is necessary for the respective purposes or as required by statutory retention obligations.

In particular, statutory retention periods are set forth in the Austrian Commercial Code (UGB), the Federal Tax Code (BAO), and other tax and corporate law regulations.

Once the relevant purpose of processing no longer applies or the statutory retention periods have expired, personal data will be deleted, provided that no other legal obligations or legitimate interests preclude such deletion.

We use the WooCommerce shopping cart system to operate our online store.

When you place an order, we process the personal data necessary to fulfill and process your order. This includes, in particular:

• First and last name
• Billing and shipping addresses
• Email address
• Phone number
• Products ordered
• Order history
• Payment information
• Billing information
• Shipping information

This data is processed exclusively for the purpose of fulfilling the contract concluded with you and for carrying out pre-contractual measures in accordance with Article 6(1)(b) of the GDPR.

To the extent that statutory retention obligations apply, your data will be stored in accordance with legal requirements.

You have the option to voluntarily create a customer account.

The personal information you provide will be stored so that future orders can be processed more easily.

You can have your customer account deleted at any time. This does not affect any legal retention requirements.

We work with external payment service providers to process your payment.

Depending on the payment method you select, the data required for payment processing will be transmitted to the respective payment service provider.

This processing is carried out exclusively for the purpose of fulfilling the contract in accordance with Article 6(1)(b) of the GDPR.

Hobex

We use the payment service provider hobex AG to process credit card payments as well as Apple Pay and Google Pay.
Payment data is transmitted exclusively and directly to Hobex or the relevant payment networks.
Familie Reinisch GmbH does not store any complete credit card information.
For more information, please see Hobex’s Privacy Policy.

PayPal

When you select PayPal as your payment method, the personal data required for payment processing is transmitted to PayPal.
This may include, in particular:

• Name
• Billing address
• Shipping address
• Email address
• Payment amount
• Order number

Data processing is carried out solely for the purpose of processing the payment.

For more information, please see PayPal’s Privacy Policy.

EPS and Sofortüberweisung

When you select EPS or Sofortüberweisung, the necessary payment data is transmitted to the respective payment service provider and to the participating financial institution.
Processing is carried out exclusively for the purpose of executing the payment in accordance with Article 6(1)(b) of the GDPR.

To deliver your order, we will provide the necessary personal data to the shipping provider we have contracted for this purpose.
This includes, in particular:

• Name
• Shipping address
• Phone number (if necessary)
• Email address (for shipping information)

The data is processed solely for the purpose of delivery.

We use HUGO Hotel Software to process reservations for the Schlafgut at Johanneshof.
The following data, in particular, is processed as part of a reservation:

• Name
• Address
• Email address
• Phone number
• Stay details
• Booking information
• Payment information

Data is processed solely for the purpose of processing your reservation, fulfilling legal obligations (e.g., registration requirements), and communicating with you regarding your stay.
The privacy policy of the booking system used also applies.

When purchasing or redeeming gift certificates, we process the personal data necessary to fulfill the purchase agreement.
This includes, in particular:

• Name
• Billing information
• Gift card number
• Order information
• Payment information

Processing is carried out on the basis of Article 6(1)(b) of the GDPR.

To comply with legal obligations, personal data may be disclosed to our tax advisor and to other entities required by law to receive such information.

This is done exclusively in accordance with legal provisions.

The legal basis for this is Article 6(1)(c) of the GDPR.

We use carefully selected data processors to provide our services.

These may include, in particular:

• Hosting providers
• IT service providers
• Payment service providers
• Shipping service providers
• Newsletter service providers
• Hotel software
• Tax consulting

Agreements in accordance with Article 28 of the GDPR have been concluded with all data processors, to the extent required by law.

Our website is hosted by Hetzner Online GmbH, Industriestraße 25, 91710 Gunzenhausen, Germany.

For the purpose of providing and securing the website, so-called server log files are automatically processed when you visit the site. In particular, the following data may be collected:

• IP address
• Date and time of access
• Page accessed
• Amount of data transferred
• Browser type and version
• Operating system
• Referrer URL
• HTTP status code

Processing is based on our legitimate interest pursuant to Article 6(1)(f) of the GDPR in ensuring the secure and stable operation of our website.

Our website uses cookies.

Cookies are small text files that are stored on your device and contain certain information.

We use cookies to

• ensure the technical functionality of our website,
• provide the shopping cart,
• save your settings,
• analyze website usage statistically,
• enable marketing activities.

To do this, we use technically necessary cookies as well as—with your consent—statistical and marketing cookies.

The legal basis for this is Article 6(1)(a) of the GDPR (consent) or Article 6(1)(f) of the GDPR (legitimate interest for technically necessary cookies).

We use Borlabs Cookie to manage your cookie consent settings.

Borlabs Cookie stores your selected privacy settings so that they can be applied the next time you visit the website.

No personal data is transmitted to the provider of Borlabs Cookie in this process.

The legal basis for this use is Article 6(1)(c) of the GDPR (compliance with legal obligations) and Article 6(1)(f) of the GDPR (legitimate interest in managing consent in compliance with the law).

You can change or withdraw your consent at any time via the website’s cookie settings.

Our website uses Google Tag Manager, provided by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland.

Google Tag Manager is used exclusively to manage and integrate additional services on our website.

Google Tag Manager itself does not create user profiles or store cookies.

If additional services are loaded via Google Tag Manager (e.g., Google Analytics or Meta Pixel), this is done only with your consent via our cookie management system.

For more information, please visit:

https://support.google.com/tagmanager

Our website uses Google Analytics 4, a web analytics service provided by Google Ireland Limited.

Google Analytics allows us to analyze the usage of our website statistically.

The following information, among other things, may be processed in this context:

• truncated IP address
• Device Information
• Browser Information
• Usage Patterns
• Pages Visited
• Duration of stay
• Visitors’ Countries of Origin
• Interactions on the Website

Google uses this information on our behalf to generate reports on the use of our website.

Google Analytics is activated only after you have given your consent via our cookie banner.

The legal basis for this is Article 6(1)(a) of the GDPR.

The retention period depends on the settings configured in Google Analytics.

For more information, visit:

https://policies.google.com/privacy

Our website uses the Meta Pixel from Meta Platforms Ireland Limited, Dublin, Ireland.

With the help of the Meta Pixel, we can analyze the success of our ads and target visitors to our website.

In particular, the following data may be processed:

• pages viewed
• Device Information
• Browser Information
• Referrer
• Interactions on Our Website

The Meta Pixel is activated only after you have given your express consent.

The legal basis is Article 6(1)(a) of the GDPR.

For more information, visit:

https://www.facebook.com/privacy/policy

Our website uses Google Maps to display interactive maps.

The provider is Google Ireland Limited.

When you visit a page that includes an embedded Google Maps map, personal data—in particular, your IP address—may be transmitted to Google.

Google Maps is loaded only after you have given your consent through our cookie management system.

The legal basis for this is Article 6(1)(a) of the GDPR.

For more information, visit:

https://policies.google.com/privacy

Videos from YouTube may be embedded on our website.

The provider is Google Ireland Limited.

When playing a video, personal data may be transmitted to Google.

To the extent technically possible, we use YouTube’s enhanced privacy mode.

YouTube videos are loaded only with your consent.

The legal basis for this is Article 6(1)(a) of the GDPR.

For more information, visit:

https://policies.google.com/privacy

Our website contains links to our profiles on social media platforms, specifically:

• Facebook
• Instagram

Simply visiting our website does not result in any personal data being transferred to these providers.

A connection to the respective provider is established only when you actively click on a link.

The privacy policy of the respective platform operator applies.

When using certain services (e.g., Google, Meta, or YouTube), the transfer of personal data to countries outside the European Union or the European Economic Area—in particular to the United States—cannot be ruled out.

To the extent that data is transferred to third countries, this is done exclusively in accordance with the legal provisions of the GDPR. Where necessary, appropriate safeguards are implemented in accordance with Art. 44 et seq. of the GDPR, in particular the Standard Contractual Clauses approved by the European Commission or an adequacy decision.

For more information on data processing by the respective providers, please refer to their privacy policies.

Under applicable law, you have the right at any time to:

• Information about the personal data we process (Art. 15 of the GDPR),
• Correction of inaccurate or incomplete data (Art. 16 of the GDPR),
• Erasure of your personal data (“right to be forgotten”), provided that no statutory retention requirements preclude this (Art. 17 GDPR),
• Restriction of processing (Art. 18 GDPR),
• Data Portability (Art. 20 of the GDPR),
• Objection to the processing of your personal data, provided that such processing is based on legitimate interests (Art. 21 GDPR),
• Withdrawal of consent that has already been given, effective for the future (Art. 7(3) of the GDPR).

To exercise your rights, simply send an informal notice to:

Reinisch Family, LLC

Email: office@j-r.at

You have the right at any time, in accordance with applicable legal provisions, to If you believe that the processing of your personal data violates data protection laws, you have the right to file a complaint with the competent supervisory authority.

The competent supervisory authority in Austria is:

Austrian Data Protection Authority

40–42 Barichgasse

1030 Vienna

Austria

Phone: +43 1 52 152-0

Email: dsb@dsb.gv.at

Website: https://www.dsb.gv.at

Familie Reinisch GmbH implements appropriate technical and organizational security measures to protect personal data from loss, misuse, unauthorized access, unauthorized alteration, or disclosure.

Our security measures are continuously adapted and improved in line with technological developments.

Access to personal data is restricted to those individuals who need this data to perform their respective duties.

We reserve the right to update this Privacy Policy in response to changes in the legal landscape, technical developments, or changes to our services.

The current version published on our website is always the one that applies.

As of July 2026