Privacy Policy Wellness Journey

Applies to the Wellness Journey on wellnesstrip.com · Deutsche Fassung

Our processing of personal data in the Wellness Journey is limited to data required to provide trip planning, hotel information, availability and price information, the AI travel assistant, and the enquiry and booking function. We process your data on the basis of Austrian and EU law (GDPR, TKG 2021). The privacy policy of wellnesshotel.com applies in addition.

A) Controller

Controller within the meaning of the GDPR:

Best Alpine Wellness Hotels
Brixner Straße 3/4
6020 Innsbruck
Austria

Phone: +43 512 360261
E-mail: info@bestwellnesshotels.at
VAT no.: ATU 4374 3703 · ZVR no.: 028629483

Hereinafter "we". For data protection questions please contact info@bestwellnesshotels.at. Our data protection officer can be reached at the above address, attn. Michaela Thaler, or at thaler@bestwellnesshotels.at.

B) Information on the collection and processing of your data

1. Scope of processing

We use personal data only where necessary for the operation of the Journey and the provision of our content and services, in compliance with the lawfulness requirements of Art. 6 GDPR.

2. Legal basis

We process your data on the basis of your consent (Art. 6(1)(a)), for pre-contractual steps and contract performance (Art. 6(1)(b)) or on the basis of legitimate interests (Art. 6(1)(f) GDPR). You may withdraw consent at any time – via "Cookie settings" in the footer or by contacting the address in A).

3. Storage and deletion

Personal data are kept only as long as necessary for the respective purpose or legal obligations: server logs 14 days · consent cookie 12 months · visitor identifier 30 days · session storage until the tab is closed · AI assistant chat logs 12 months · availability cache max. 48 hours · enquiries 24 months after the last contact · bookings 7 years (§ 132 BAO) · newsletter until withdrawal.

C) Purposes of processing

We collect personal data for the following reasons: operation of the Journey · availability and price information · AI-supported travel advice · processing of enquiries and bookings · newsletter management · tracking (visitor analytics, consent only).

1. Data processed when accessing the Journey

The Journey is hosted on servers of Hostinger International Ltd. Each access processes: IP address, date and time, requested URL, referrer URL, browser type, device category and operating system, data volume and access status. Purpose: delivery, operational security, error analysis, defence against attacks (Art. 6(1)(f) GDPR). Server logs are deleted after 14 days.

Data collected only with your consent (Statistics/Marketing categories): pages visited, clicks, events (e.g. started enquiries), session statistics, approximate location, browser and device information.

2. Cookies and local storage

The Journey uses cookies and browser storage. Strictly necessary entries may be set without consent (§ 165(3) TKG 2021); all others require your permission. On your first visit our cookie banner offers the categories "Necessary", "Statistics" and "Marketing"; Google Tag Manager starts only if both Statistics and Marketing are accepted. You can change or withdraw your choices at any time via "Cookie settings" in the footer.

Necessary

Statistics and marketing (consent only, loaded via Google Tag Manager)

With your consent, IP address, device and browser data, pages visited, interactions and cookie/advertising IDs may be transmitted to the providers and processed into usage and advertising profiles (Art. 6(1)(a) GDPR). For third-country transfers see F).

3. AI travel assistant ("Wilma")

The Journey includes an AI-powered assistant that supports your trip planning by text and, if you wish, by voice.

Data processed: your chat input, the current trip state (region, hotel, dates, number of guests, children's ages, selected rooms/extras/spa treatments), timestamps, the pseudonymous visitor identifier, a hashed value of your IP address (SHA-256 with a secret salt, not reversible) and your user agent.

AI provider: To generate replies, your chat input and trip state are transmitted to Anthropic PBC (San Francisco, USA) via its API (model family "Claude"). Under the provider's terms, content submitted via the API is not used to train the models. Contact details from the enquiry form are not transmitted to the AI provider.

Conversation log: chat histories are stored on our servers to assure the assistant's quality, to detect abuse (rate limits, block lists) and, on your request ("I want to talk to a human"), to enable a conversation with staff. Authorised staff may view logs for these purposes. Retention: 12 months, then automatic deletion.

Please do not enter sensitive data (e.g. health or payment data) in the chat. Availability and prices come from the hotel systems; only the hotel's confirmation is binding. See also our AI Statement. Legal basis: Art. 6(1)(b) GDPR (pre-contractual steps) and Art. 6(1)(f) GDPR (quality assurance, abuse prevention).

4. Voice function (dictation and read-aloud)

If you use the microphone icon, your speech is transmitted to ElevenLabs Inc. (New York, USA) and converted to text; if you have replies read aloud, the reply text is converted to speech there. The connection is established only on your action; audio is not stored by us. Legal basis: Art. 6(1)(a) GDPR (consent by starting the function).

5. Distance calculation

If you ask the assistant about distances, the place you name is sent to Nominatim (OpenStreetMap Foundation, UK) and OSRM (Project OSRM) to determine coordinates and route. The request is made from our server; your IP address is not transmitted (Art. 6(1)(b) GDPR).

6. Availability and price information

When you select dates, number of guests and children's ages, these details (without contact data) are transmitted to the hotel systems of the listed properties to determine availability and prices. Systems used: seekda, ASA Hotel, Elite Front Office and Oracle OPERA Cloud. The respective hotel is responsible for processing in these systems. Retrieved data are cached briefly on our side (max. 48 hours). Legal basis: Art. 6(1)(b) GDPR.

7. Reviews and third-party content

For hotels we display rating figures from Google, HolidayCheck and TrustYou. These values are loaded by our server; no data about you are transmitted to these providers.

D) Contact, enquiries and bookings

Via the enquiry/booking form we process: salutation, first and last name, e-mail address, phone number, address, travel dates (arrival/departure or day visit), number of guests and children's ages, selected hotel, room, board, offer, extras, spa treatments with preferred times, your message, the total price, and the time and origin of the enquiry.

• Forwarding to the selected hotel for processing – by transfer into the hotel system (see C.6) and/or by e-mail. The hotel processes your data as an independent controller under its own privacy policy.
• Confirmation e-mail to you and administration of the enquiry in our booking portal (Best Alpine Wellness Hotels as intermediary).
• E-mail dispatch via Microsoft 365 / Exchange Online (Microsoft Ireland Operations Ltd.; sender booking@bestwellnesshotels.at).

Legal basis: Art. 6(1)(b) GDPR. Retention: enquiries 24 months after the last contact; bookings 7 years under § 132 BAO. A booking becomes binding only upon confirmation by the hotel.

1. Newsletter

If you tick the newsletter of Best Alpine Wellness Hotels and/or the hotel in the form, we process your e-mail address and name for dispatch. The Best Alpine Wellness Hotels newsletter is governed by the wellnesshotel.com privacy policy (double opt-in, CleverReach GmbH & Co. KG). Withdraw at any time via the unsubscribe link or by e-mail to info@bestwellnesshotels.at. Legal basis: Art. 6(1)(a) GDPR; § 174 TKG 2021.

E) Data security

All transfers in the Journey are TLS-encrypted (visible by the lock symbol in the address bar). Access to enquiry, booking and conversation data is restricted to authorised staff; IP addresses in chat logs are stored only as hashes. We also apply appropriate technical and organisational measures to protect your data against manipulation, loss, destruction or unauthorised access.

F) Recipients and transfers to third countries

1. Recipients

We do not sell, trade or transfer personal data to uninvolved third parties. We pass on data only where necessary to perform a contract (forwarding your enquiry to the selected hotel), for the technical operation of the Journey or on another legal basis. Service providers supporting us are contractually bound to confidentiality (Art. 28 GDPR). List of service providers:

Data may also be disclosed in the context of official requests, judicial orders and legal proceedings where necessary to safeguard or enforce rights. We aim to limit any such disclosure to what is legally required.

2. Transfers to third countries

We use providers that are partly based outside the EU/EEA or process data there (in particular the USA: Anthropic, ElevenLabs and the parent companies of Google, Meta, Microsoft, Pinterest, LinkedIn, Spotify). For the USA an adequacy decision (EU-US Data Privacy Framework) exists for certified companies; where it does not apply, we rely on the EU standard contractual clauses (Art. 46(2)(c) GDPR) with supplementary measures. Without an adequacy decision or suitable safeguards there is a risk that local authorities access data and that enforcing your rights is more difficult.

G) Your rights

You have the right to obtain information about the personal data we process (purposes, categories, recipients, planned retention, origin, automated decision-making), and the rights to rectification, erasure, restriction of processing, data portability and objection (Art. 15–21 GDPR). You may withdraw consent at any time with effect for the future. You can exercise your rights at any time via the contact address in A). If you believe our processing violates applicable data protection law, you may lodge a complaint with the Austrian Data Protection Authority (Barichgasse 40–42, 1030 Vienna, dsb@dsb.gv.at).

The Journey is intended for persons aged 18 and over. We update this policy when services or the legal situation change; the version published here applies.