Updated 12 August 2026

1. Controller

The controller responsible for processing personal data through this website is:

Riederhof OHG der Pircher S. (Appartement Riederhof)
legally represented by Stefania Pircher
Pseirerstraße 27
39010 St. Martin in Passeier (BZ), Italy
Telephone: +39 0473 645 485
Mobile: +39 347 12 40 805
Email: info@riederhof.it
Certified email (PEC): riederhof@pec.it
VAT number: 01182870210
CIN: IT021083B4XYUCLOIM

2. Scope and principles

This policy explains which personal data we process when you visit riederhof.it, submit an enquiry or job application, make an online booking, stay with us or voluntarily use the JAMAL AI chat. Personal data means any information relating to an identified or identifiable person.

We process data only for specified purposes, to the extent necessary and on a valid legal basis. We use appropriate technical and organisational measures to protect the data.

3. Website access and server logs

When you visit the website, your browser sends technically necessary data to the web server. This may include:

  • IP address;
  • date and time of access;
  • requested page or file;
  • amount of data transferred and HTTP status;
  • referring page, where sent by the browser;
  • browser type, operating system and device information.

We process this data to provide the website securely and reliably, detect errors and attacks and demonstrate technical security. The legal basis is Article 6(1)(f) GDPR. Our legitimate interest is the secure and uninterrupted operation of the website.

The website is hosted by ALL-INKL.COM – Neue Medien Münnich, proprietor René Münnich, Hauptstraße 68, 02742 Friedersdorf, Germany. The hosting provider processes data on our behalf as part of the technical provision of the website.

Server logs are retained only for as long as necessary for operation, troubleshooting, abuse prevention and compliance with statutory evidence obligations. They are then erased or anonymised unless a security incident or legal obligation requires longer retention.

4. Contact by email, telephone or certified email

If you contact us by email, telephone or certified email (PEC), we process your contact details, the content of your message and any information you provide voluntarily in order to respond.

Where your message concerns an accommodation enquiry, booking or other pre-contractual step, the legal basis is Article 6(1)(b) GDPR. For general communication, we rely on our legitimate interest in dealing with incoming messages under Article 6(1)(f) GDPR. Processing required by law is based on Article 6(1)(c) GDPR.

Enquiries that do not result in a contract are normally retained until they have been fully handled and for no more than 24 months afterwards, unless earlier erasure is requested and no legal claims or statutory obligations require continued retention. Contract and booking documents are retained for the periods required by civil, tax and commercial law, generally ten years.

5. Enquiry form

You can use our enquiry form to request a non-binding offer or further information. Depending on what you enter, we process:

  • first name and surname;
  • email address and telephone number;
  • requested arrival and departure dates;
  • requested apartment;
  • number of adults and children and the children’s ages;
  • message and other voluntary information;
  • technical information relating to submission and abuse prevention.

Required fields are needed so that we can allocate and respond to your enquiry. Additional information is voluntary. The legal basis is Article 6(1)(b) GDPR, or Article 6(1)(f) GDPR for general requests.

The form is provided on our server using the WordPress plugin Forminator. The information is sent to info@riederhof.it and is also stored in the WordPress database. Stefania Pircher, as the owner, and fahrner web.grafik, as the technical agency, have access to the stored entries only to the extent necessary for handling, maintenance and support. Form entries stored in WordPress are erased automatically after twelve months.

Applications through the Jobs page

Through the form on /jobs/, we process first name, surname, email address, telephone number, selected position, voluntary comments and technical information relating to submission and abuse prevention. No file upload is currently provided. The information is sent to the Riederhof by email and is also stored in the WordPress database.

The purpose is to conduct the recruitment procedure and take pre-contractual steps at your request; the legal basis is Article 6(1)(b) GDPR. Where legal obligations or the defence of specific claims are involved, Article 6(1)(c) or (f) GDPR applies. We include an application in a candidate pool only with separate voluntary consent.

Applications are sent to info@riederhof.it. Stefania Pircher, as the owner, and fahrner web.grafik, as the technical agency, have access to the stored entries only to the extent necessary for selection, handling, maintenance and support. Application data in the WordPress database is erased automatically twelve months after receipt. Email copies are erased once they are no longer necessary for recruitment, evidence or the defence of claims, unless a longer legal obligation or separate consent applies.

Google reCAPTCHA

We use Google reCAPTCHA to protect the enquiry and application forms against automated abuse. It is provided by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. reCAPTCHA may process, in particular, the IP address, browser and device data, interactions, referrer, time and cookies or similar identifiers. Processing by Google LLC and other Google companies in third countries, particularly the United States, is possible.

reCAPTCHA is loaded only if you consent to the “External media” group in the privacy settings. The legal basis for loading the service and writing or reading non-essential information on your device is your consent under Article 6(1)(a) GDPR in conjunction with Article 122 of the Italian Data Protection Code. You can withdraw consent at any time through “Privacy settings”. Without reCAPTCHA consent, the form cannot be submitted through the website; you may contact us by email or telephone instead.

Further information: https://policies.google.com/privacy

6. Online booking through Booking Südtirol

We use the embedded Booking Südtirol system to display availability and to process and manage online bookings. The provider is:

HGV-Service Genossenschaft
Schlachthofstraße 59
I-39100 Bolzano, Italy

When you open the booking page, technically necessary availability and content data are retrieved from widget.bookingsuedtirol.com, api.widgets.bookingsuedtirol.com and, where applicable, cdn.easychannel.it. At least your IP address, browser/device details, time, requested page and search and occupancy parameters are transmitted to the systems involved.

If you continue with the booking, the following data may be processed depending on your choices:

  • travel period, occupancy and selected accommodation or service;
  • optional additional services;
  • title, first name, surname, email address and telephone number;
  • country and any voluntary comments;
  • business-customer or invoice request;
  • payment option and acceptance of contractual terms;
  • technical booking and transaction data.

The purposes are to display bookable services, take pre-contractual steps, conclude and perform the accommodation contract and comply with legal obligations. The legal bases are Article 6(1)(b) and (c) GDPR. Where necessary, we also process data under Article 6(1)(f) GDPR to prevent abuse and establish, exercise or defend legal claims.

Booking Südtirol/HGV-Service processes data to operate the booking platform under its own privacy policy and, where contractually agreed, as a technical service provider for the Riederhof. The respective responsibilities are governed by the applicable contracts and privacy information.

Further information: https://www.bookingsuedtirol.com/en/privacy

Booking and contract data are processed for the performance of the stay and then retained for the statutory periods, generally ten years for tax and accounting documents. Unfinished booking processes are erased when they are no longer necessary for handling, evidence or abuse prevention; the platform provider’s retention periods also apply.

Optional travel insurance

Our website merely contains an external link to Europäische Reiseversicherung AG, Kratochwjlestraße 4, 1220 Vienna, Austria. Merely displaying our website does not transfer booking or contact data to the insurer. Only when you click the link do you leave our website; subsequent processing and any insurance contract are handled under the insurer’s responsibility.

Further information: https://www.europaeische.at/en/legal/privacy

Stay and statutory reporting

In connection with the booking, arrival and stay, we process guest, identity, stay and billing data. The purposes are, in particular, to perform the accommodation contract and comply with reporting, public-security, tax, statistical and local tourist-tax obligations. The legal bases are Article 6(1)(b) and (c) GDPR.

Mandatory reports are submitted through Alloggiati Web to public-security and police authorities, through ASTAT/LTS for tourism statistics and to the competent municipal and tax offices for local tourist tax, billing and tax obligations. Only the prescribed data is transmitted. Data is retained for the period required by law; tax and accounting records are generally retained for ten years.

7. JAMAL AI chat assistant

We provide the optional JAMAL AI chat assistant on our website. JAMAL answers general questions about the Riederhof and helps visitors navigate the website. Its replies are generated automatically by an AI system and may be incomplete or incorrect. JAMAL does not make decisions with legal or contractual effect and does not replace personal information, an offer or a booking confirmation from the Riederhof.

Data processed

When you use JAMAL, we process in particular:

  • the content of your current message, up to 1,000 characters;
  • up to eight previous messages from the current conversation where needed for context;
  • JAMAL’s generated response;
  • the language used;
  • a randomly generated conversation identifier;
  • timestamps and technical status information.

You do not need to enter personal data for general questions. In particular, please do not submit health information, payment details, identity documents, passwords or other confidential or special-category information.

Purpose and legal basis

We process this information to answer the question you voluntarily submit and to provide convenient guest communication. Where your question relates to a booking or another pre-contractual step, the legal basis is Article 6(1)(b) GDPR. For general information, we rely on our legitimate interest in providing efficient and optional guest communication under Article 6(1)(f) GDPR. You may close JAMAL at any time and use email, telephone, the enquiry form or online booking instead.

OpenAI

To generate a reply, our web server transmits the current message and the most recent part of the conversation needed for context to the API of:

OpenAI Ireland Limited
1st Floor, The Liffey Trust Centre
117–126 Sheriff Street Upper
Dublin 1, D01 YC43, Ireland

OpenAI processes this data as the provider of the AI service and, under the applicable Data Processing Addendum, as a processor. Subprocessors and OpenAI companies outside the European Economic Area may be involved.

According to the provider’s current information, API inputs and outputs are not used to train OpenAI models by default unless the customer expressly opts in to sharing data for that purpose. Content and related metadata may generally be retained for up to 30 days in abuse-monitoring logs; exceptions required by law or necessary for security may apply.

Further information:

  • https://openai.com/policies/data-processing-addendum/
  • https://openai.com/policies/sub-processor-list/
  • https://developers.openai.com/api/docs/guides/your-data
  • https://openai.com/enterprise-privacy/

Storage by the Riederhof and in your browser

Messages and replies stored on our server are automatically erased 30 days after the most recent message unless a legal obligation or the protection of specific legal claims requires longer retention. Access to stored conversations is limited to authorised persons and technically necessary service providers.

Your browser also stores a random conversation identifier and a limited recent history locally on your device so that you can continue the conversation when moving between pages. This local storage is technically limited to no more than 30 days. You can erase the local data at any time by removing the website data for riederhof.it in your browser.

8. Cookies, Local Storage and consent management

We use cookies and similar storage technologies. Cookies are small files stored in your browser. Local Storage permits local browser storage without an automatic expiry date.

Borlabs Cookie

We use Borlabs Cookie to manage your choices. The essential cookies borlabs-cookie and borlabs-cookie-gcs are stored to record which groups and services you accepted or rejected. The legal basis is Article 6(1)(f) GDPR; this storage is technically necessary to apply your privacy choice. The choice is currently retained in the browser for up to six months.

You can change your selection at any time through the “Privacy settings” link in the footer. Withdrawal takes effect for the future. Third-party cookies that have already been set may remain in the browser until they expire; you can also delete them through your browser settings.

Language cookie

WPML uses wp-wpml_current_language to store the selected website language. This cookie is necessary to display the site in your chosen language. The legal basis is Article 6(1)(f) GDPR; device access is technically necessary.

Cookie overview

Service Typical cookies/storage Purpose Duration
Borlabs Cookie borlabs-cookie, borlabs-cookie-gcs storing consent choices up to 6 months
WPML wp-wpml_current_language selected language usually session to 1 day
Google reCAPTCHA e.g. _GRECAPTCHA, CONSENT bot and abuse protection according to Google, up to 6 months/2 years
Google Analytics 4 _ga, _ga_*, _gid, _gat* reach and usage analysis about 1 minute to 2 years
Meta Pixel _fbp, possibly _fbc measurement and attribution of visits up to 90 days
Bunny Fonts no cookies observed by us loading the Roboto font on the Jobs page duration of the technical request
JAMAL localStorage: conversation ID and history continuing the optional chat no more than 30 days

The cookies actually stored may vary depending on your browser, provider changes and your choices. Non-essential services are loaded only after you consent.

9. Google Analytics 4

With your consent, we use Google Analytics 4, a web analytics service provided by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. It helps us understand how the website is used and which content should be improved.

The following may be processed in particular:

  • an abbreviated or otherwise processed IP address;
  • device, browser, language and approximate location details;
  • pages viewed, referrer, interactions and times;
  • random online identifiers stored in cookies;
  • technical information about consent.

Google may also process the data through Google LLC and other recipients in the United States or other third countries. The legal basis for using Google Analytics is solely your consent under Article 6(1)(a) GDPR in conjunction with Article 122 of the Italian Data Protection Code. You can withdraw it at any time through “Privacy settings”.

Analytics cookies may be retained for up to two years, depending on the cookie. User and event data in Google Analytics are erased according to the retention period configured for the property. Aggregated reports without a direct personal reference may be kept for longer.

Further information:

  • https://policies.google.com/privacy
  • https://support.google.com/analytics/answer/11397207
  • https://support.google.com/analytics/answer/7667196

10. Meta Pixel

With your consent, we use the Meta Pixel provided by Meta Platforms Ireland Limited, Merrion Road, Dublin 4, D04 X2K5, Ireland. The pixel helps us measure visits and interactions, create audiences for advertising and assess the effectiveness of advertisements on Facebook and Instagram.

Meta receives, in particular, information about the page view, browser/device data, IP address, time, referrer, pixel ID and cookie and event identifiers. If you are logged in to a Meta service, Meta may be able to associate the information with your account. Meta may also process data in the United States and other third countries.

Under Meta’s contractual terms, Meta and we are joint controllers under Article 26 GDPR for certain collection and transmission of event data. Meta’s subsequent processing is carried out under Meta’s own responsibility and privacy policy.

The legal basis for using the Meta Pixel is your consent under Article 6(1)(a) GDPR in conjunction with Article 122 of the Italian Data Protection Code. You can withdraw it at any time through “Privacy settings”. Meta cookies such as _fbp and _fbc may be retained for up to 90 days.

Further information:

  • https://www.facebook.com/privacy/policy/
  • https://www.facebook.com/legal/controller_addendum/

11. Fonts and Bunny Fonts

Most fonts on our website are loaded from our own server. The Jobs page currently also loads the Roboto font through Bunny Fonts, a service provided by BunnyWay d.o.o., Dunajska cesta 165, 1000 Ljubljana, Slovenia. This technically transmits, in particular, your IP address and browser, device, referrer and time information to BunnyWay. According to the provider, API requests to Bunny Fonts are not logged or tracked.

The purpose is to provide a consistent display of the Jobs page. The legal basis is our legitimate interest in a readable and consistent presentation under Article 6(1)(f) GDPR. Further information: https://bunny.net/privacy/

12. External links, Google Maps and social networks

Our website contains links to external services, in particular Google Maps, Facebook, Instagram, YouTube and the travel insurer. Merely displaying our page does not transmit data to these destinations through the links. Only when you click a link do you leave our website; the destination provider then processes, under its own responsibility, the IP address, browser data, time and, where applicable, account data.

Please consult the privacy information of the relevant provider. We have no control over its subsequent processing.

13. Recipients and processors

Data is disclosed only to parties that need it for the relevant purposes. These may include:

  • authorised Riederhof personnel;
  • hosting, IT, maintenance, email and website service providers;
  • HGV-Service/Booking Südtirol and technical platform partners;
  • BunnyWay for the font request on the Jobs page until it is hosted locally;
  • Google for reCAPTCHA and, after consent, Google Analytics;
  • Meta, after consent, for the Meta Pixel;
  • OpenAI and its subprocessors when JAMAL is used voluntarily;
  • payment and insurance providers and legal advisers;
  • public-security, police, tax and municipal authorities and statistical and tourism bodies where required for the contract or by law.

Where a recipient processes data solely on our behalf, we enter into an agreement under Article 28 GDPR. Recipients acting under a legal obligation or in their own responsibility process the data on their respective legal basis.

14. Transfers outside the EEA

Google, Meta, OpenAI and their subcontractors may process data outside the European Economic Area. For such transfers, the providers involved and we rely, depending on the recipient, on an adequacy decision under Article 45 GDPR, including the EU-US Data Privacy Framework for duly certified US companies, or on appropriate safeguards under Article 46 GDPR, in particular the European Commission’s Standard Contractual Clauses. If adequate safeguards are not available for an optional service, the transfer takes place only with your explicit consent under Article 49(1)(a) GDPR after you have been informed of the possible risks.

You may request information about the safeguards specifically used, or a copy of the relevant provisions, at info@riederhof.it.

15. Requirement to provide data

You are generally not required to provide personal data. However, required fields in enquiry, application and booking forms are necessary to handle your request, conduct the recruitment process or conclude the contract. Without those details, we cannot process the requested enquiry or booking. Analytics, the Meta Pixel and JAMAL are optional and are not a condition for normal use of the website or direct contact with us.

16. No solely automated decision-making

We do not make decisions based solely on automated processing that produce legal or similarly significant effects within the meaning of Article 22 GDPR. This also applies to job applications. JAMAL provides non-binding information generated automatically. Prices, availability and bookings become binding only in accordance with the rules and confirmations specified in the booking process.

17. Your rights

Subject to the statutory conditions, you have in particular the following rights:

  • access to the data processed about you (Article 15 GDPR);
  • rectification of inaccurate data (Article 16 GDPR);
  • erasure (Article 17 GDPR);
  • restriction of processing (Article 18 GDPR);
  • data portability (Article 20 GDPR);
  • objection to processing based on Article 6(1)(e) or (f) GDPR (Article 21 GDPR);
  • withdrawal of consent with effect for the future (Article 7(3) GDPR);
  • the right to lodge a complaint with a supervisory authority (Article 77 GDPR).

To exercise your rights, write to info@riederhof.it or to the address given in section 1. We may ask for appropriate proof of identity to ensure that data is not disclosed to an unauthorised person.

18. Right to object

Where we process data on the basis of legitimate interests under Article 6(1)(f) GDPR, you may object at any time on grounds relating to your particular situation. We will then cease processing unless we demonstrate compelling legitimate grounds or the processing is necessary for the establishment, exercise or defence of legal claims.

19. Right to lodge a complaint

You may contact the Italian supervisory authority in particular:

Garante per la protezione dei dati personali
Piazza Venezia 11
00187 Rome, Italy
https://www.garanteprivacy.it

You may also contact another supervisory authority competent under Article 77 GDPR.

20. Security and updates

We use an encrypted HTTPS connection and appropriate technical and organisational security measures. However, no method can guarantee absolute security.

We update this privacy policy when functions, providers or legal requirements change. The current version is always available on this website.