Privacy Statement

1. General information

Your data is in safe hands with us at Sonnentherme Lutzmannsburg-Frankenau GmbH (LLC)! We are obliged to protect your personal data ("data") processed as part of our business relationship and we take this duty seriously. Please take the time to read this data privacy information and gain an understanding of why we collect your data and how we will process it.

• Regarding the processing of your data when you visit our website , please see clause 4;

• If you would like to receive our newsletter , you can find more detailed information in clause 5;

• If you would like to receive our online surveys , you can find more detailed information in clause 6 ;

• Further information about the processing of your data if we have a business relationship  with you (customers and suppliers) is available in clause 7;

• If you have registered for the Sunny Bunny Club , you can find information about the processing of your data in clause  8;

• Further information about the processing of your data in the course of an application procedure is available in clause 9.

2. Definitions

Personal data

Personal data refers to any information relating to an identified or identifiable natural person (so-called "data subject").

Examples: name, address, date of birth, e-mail address, IP address, account number, vehicle licence plate number, interests and preferences etc., as well as photos of persons.

The examples mentioned belong to the general category of personal data.

Processing

Processing is any handling of personal data. This can take place both with and without the help of automated processes. Processing procedures are, for example, the collection, recording, storage, amendment, retrieval, erasure or destruction of personal data.

Data processor

A data processor is any natural or legal person, public authority, agency or other body that processes personal data on behalf of the controller. Under current data protection law, these persons are referred to as "service providers".

Controller

The controller is any natural or legal person, public authority, agency or other body that determines the purposes and means of the processing of personal data. Under current data protection law, these persons are referred to as "controller".

3. How do we process your personal data?

Depending on whether you visit our website, subscribe to our newsletter, we are in a business relationship or you apply for a job with us, we process your data in the manner described in the following clauses.

4. Data processing when visiting our website:

when you visit our website, the following data may be collected, stored, analysed or otherwise processed:

• Browser type and version
• Operating system
• Latitude and longitude, continent, country, region, city & language
• Date, time and duration of access
• IP address and pages visited on our website, including entry and exit pages
• Visited pages
• Referrer URL (page from which you were linked to our website)
• Internet Service Provider
• Data that you enter via a contact form

For the operation of our website, it may be necessary in some cases for us to disclose your data to the following recipients. This disclosure may be made by transmission, dissemination or any other form of provision.

[1]    "Third country" comprises all countries other than (1) the Member States of the European Union and (2) the Member States of the European Economic Area, i.e. Iceland, Liechtenstein and Norway in addition to the EU Member States.

2 "EEA" stands for European Economic Area.

Data is also stored in so-called "cookies". Cookies are text files that are stored on your computer or mobile device. They are used to identify the website user and to store temporary information. We only use cookies in principle to the extent necessary to communicate with you via the website.

You can set your browser so that you are informed about the depositing of cookies and only allow cookies in individual cases, exclude the acceptance of cookies in specific cases or in general and activate the automatic deletion of cookies when closing the browser. If cookies are deactivated, the functionality of this website may be restricted.

Transfer to third countries

The data collected in the process can be forwarded to another country. Please note that cookies can also transfer data outside the European Union and the European Economic Area and to a country that does not offer an adequate level of data protection. If the data is transferred to the USA, there is a risk that your data may be processed by US authorities for control and monitoring purposes without your having any legal recourse.

Link to the cookie declaration

Data protection information for the use of Google Analytics

This website uses Google Analytics, a web analysis service provided by Google Ireland Limited ("Google"), Google Ireland Limited Gordon House, Barrow Street Dublin 4 ("Google"). Google Analytics uses so-called "cookies", which are text files placed on your computer, allowing an analysis of your use of the website.  The information generated by the cookie about your use of this website is usually transmitted to a Google server in the USA and stored there. If IP anonymisation is activated on this website, your IP address will be abbreviated by Google within member states of the European Union or in other signatory states to the Agreement on the European Economic Area. Only in exceptional cases will the full IP address be transferred to a Google server in the USA and abbreviated there. On behalf of the operator of this website, Google will use this information to analyse your use of the website, compile reports on website activity and provide other services to the website operator relating to website activity and internet usage. The IP address transmitted by Google Analytics will not be merged with other Google data. You may prevent the use of cookies by selecting the appropriate settings on your browser, however please note that if you do this you may not be able to use the full range of functions of this website. You can prevent Google from collecting the data generated by the cookie regarding your use of the website and from processing this data by downloading and installing the browser plug-in available at the following link (https://tools.google.com/dlpage/gaoptout?hl=de). Further information is available at  www.google.com/analytics/terms or at https://support.google.com/analytics/answer/6004245?hl.

General note: To check your privacy settings on Google, please go to https://myaccount.google.com/

Google also processes your data in the USA, among other places. We would like to point out that according to the European Court of Justice, there is currently no adequate level of protection for data transfers to the USA. This may pose various risks for the lawfulness and security of data processing.

Hotjar

This website uses Hotjar. The provider is Hotjar Ltd., Level 2, St Julians Business Centre, 3, Elia Zammit Street, St Julians STJ 1000, Malta, Europe (Website: https://www.hotjar.com). Hotjar is a tool for analysing your user behaviour on our website. With Hotjar, we can record for example your mouse and scroll movements and clicks. Hotjar can also determine how long you have been hovering over a certain area with the mouse cursor. Hotjar uses this information to create so-called heat maps, which can be used to determine which website areas are favoured by website visitors. Hotjar can also be used to obtain direct feedback from website visitors. This function serves to improve the website operator's online offers. The use of Hotjar and the placement of Hotjar cookies is based on Art. 6 par. 1 lit. f GDPR. The website operator has a legitimate interest in analysing user behaviour in order to optimise both their website and their advertising.

Deactivating Hotjar

If you wish to deactivate data collection by Hotjar, click on the following link and follow the instructions there: https://www.hotjar.com/opt-out Please note that Hotjar must be deactivated separately for each browser or end device. For further information about Hotjar and the data collected, please refer to Hotjar's privacy policy at the following link: https://www.hotjar.com/privacy

Integration of third-party services and content

It may happen that third-party content, such as the booking system from Kognitiv (formerly seekda), online games from artworks, videos from YouTube, maps from Google Maps, RSS feeds or graphics from other websites is integrated into this online offer. This always assumes that the provider of these contents (hereinafter "third-party provider") can detect a user's IP address. For without that IP address, the contents cannot be sent to that user's browser. So the IP address is necessary to display these contents. We try to use only contents whose provider uses IP addresses exclusively to deliver those contents. However, we have no influence on whether the third-party providers store the IP address, e.g. for statistical purposes. If we know whether this is the case, we will inform our visitors accordingly.

Booking system for  Sonnentherme,  Sonnenpark,  Thermen Chalets,  Pension Sonnengarten and partners

We use "Kognitiv" from Seekda, Neubaugasse 10, 1070 Vienna as the booking system on our website. If you use our booking system, their data privacy regulations apply.

Google Adwords Conversion Tracking

This website also uses Google Conversion Tracking. This means that Google AdWords will place a cookie on the visitor's computer if this is demanded via a Google ad on our website. Such cookies will become invalid after thirty days, and do not identify anyone personally. If the user visits certain pages from the website of an AdWords customer before the cookie has expired, Google and the customer can see that the user has clicked on the ad and was directed to this page. Every AdWords customer is given another cookie. Therefore, cookies cannot be tracked via the websites of AdWords customers. The information obtained through the conversion cookies helps create conversion statistics for AdWords customers who have chosen conversion tracking. The AdWords customers learn the total number of users who have clicked on their ads and been directed to a page which has been given a conversion tracking tag. However, they receive no information which could identify the user personally. For the tracking procedure to work, cookies must be placed. But visitors wishing not to participate in the tracking procedure can change their browser settings to deactivate the placement of cookies in general. Visitors can also deactivate cookies for conversion tracking by setting the browser to block cookies from the domain "www.googleadservices.com". Google's privacy policy on conversion tracking can be found here.

Google also processes your data in the USA, among other places. We would like to point out that according to the European Court of Justice, there is currently no adequate level of protection for data transfers to the USA. This may pose various risks for the lawfulness and security of data processing.

Facebook Remarketing, Retargeting and Pixel

The Facebook app is a product of Meta Platforms (Meta Platforms Ireland Ltd., 4 Grand Canal Square, Grand Canal Harbour, Dublin 2 Ireland). The other products are now also operated by Meta Platforms.

Meta also processes your data in the USA, among other places. We would like to point out that according to the European Court of Justice, there is currently no adequate level of protection for data transfers to the USA. This may pose various risks for the lawfulness and security of data processing.

When you visit our pages, a direct connection is established between the browser and the Facebook server via the remarketing tags after you have given your consent. This informs Facebook that you have visited our site with your IP address. This allows Facebook to allocate a user's visit to our site to their user account. We can use the information obtained in this way to show Facebook ads. Please be aware that as site provider we have no knowledge about the contents of transmitted data or their use by Facebook.

Since the renaming of Facebook Ireland Limited to Meta Platforms Ireland Limited has been valid since 4 January 2022, this is also stated in the currently valid privacy policy: www.facebook.com/privacy/policy

The Trade Desk website pixel:

This website uses technology from The Trade Desk (The Trade Desk Ltd, 1 Bartholomew Close, London EC1A 7BL, United Kingdom,  https://www.thetradedesk.com/) to collect and store data for marketing and optimisation purposes. Pseudonymised user profiles, for example, can be created from this data. Browser cookies can be used for this purpose. The data collected using The Trade Desk technology is not used by The Trade Desk to personally identify visitors to this website. The collection and storage of data can be refused here  at any time with effect for the future. Further information about data protection at The Trade Desk is available here.

Messenger, WhatsApp, Instagram

We use the communication tools Messenger, WhatsApp and Instagram on our website, which are provided by Meta Platforms Ireland Limited (Meta Platforms Ireland Ltd, 4 Grand Canal Square, Grand Canal Harbour, Dublin 2 Ireland).

Meta also processes your data in the USA, among other places. We would like to point out that according to the European Court of Justice, there is currently no adequate level of protection for data transfers to the USA. This may pose various risks for the lawfulness and security of data processing.

As the renaming of Facebook Ireland Limited to Meta Platforms Ireland Limited has been effective since 4 January 2022, this is also stated in the respective privacy policies of Facebook Messenger and Instagram:
Facebook Messenger  www.facebook.com/help/messenger-app/1064701417063145
Instagram https://help.instagram.com/519522125107875
WhatsApp's privacy policy can be found here: www.whatsapp.com/legal/privacy-policy-eea

We carry out the processing of your data when contacting or interacting with our site or its content on the basis of Art. 6 par. 1 line 1 lit. f GDPR. Our legitimate interest lies in responding to your request. If your contact has the purpose of concluding a contract, the additional legal basis for the processing is Art. 6 par. 1 line 1 lit. b GDPR.

Server log files

When you use our website, certain data transmitted by your browser is automatically stored. The log files created from this contain data such as your IP address, the URL, the time, type and number of requests, the amount of data transferred, the date, time and duration of individual accesses, your browser type and any other similar information. The collection and use of the information stored in the log files is used solely for anonymised evaluation for statistical purposes (e.g. to analyse user behaviour), to improve our services and to comply with our security guidelines.

5. Data processing when ordering our newsletter

Subject to your consent (in line with Art. 6 par. 1 lit. a GDPR), we process your data in order to inform you at regular intervals by means of a newsletter - in accordance with your interests - about activities and promotions of Sonnentherme, Sonnenpark, of  Thermen Chalets, of Pension Sonnengarten and/or our Sunny Bunny Club. Consent regarding this is given when registering for the newsletter.

In the course of sending the newsletter, the following data of yours is processed:

• E-mail address
• First name and surname
• Time of registration for the newsletter
• Device types used, e-mail programmes
• IP address and therefore the location of access (based on the IP address)
• Preferences when reading the newsletter (click behaviour)
• Deliverability of the e-mail and, if applicable, whether the recipient's mailbox is full
• Time of each opening of the newsletter, duration of reading
• Consent to data processing, if given

If you do not wish to provide this information, please do not subscribe to the newsletter. ‑You can unsubscribe from the newsletter at any time by sending an e-mail to mailings@sonnentherme.at or mailings(at)sonnenpark.at with the subject "Unsubscribe Newsletter" and by clicking on the link provided in each newsletter sent out.

We store your data in connection with the newsletter mailing until cancellation, which is possible at any time.

In the course of the newsletter mailing, we may disclose your data to the following recipients (through transmission, distribution or another form of provision):

6. Data processing in connection with online surveys

We conduct online surveys to further improve our services. We use the third-party provider "SurveyMonkey" (SurveyMonkey Europe UC, 2^nd Floor, 2 Shelbourne Buildings, Shelbourne Road, Dublin, Ireland). Participation in the survey is voluntary and the provision of personal data is generally not required for the result; nor do we share customer data with SurveyMonkey and as a rule receive non-personal information from SurveyMonkey. Identification cannot be completely excluded on the basis of the individual information provided by the participants (e.g.: in the case of an entry in a free text field such as "The employees responded in an exemplary and extremely empathetic manner when one of my two daughters suffered a circulatory collapse due to her agitation on 25. 5.", we can of course remember the respective persons and assign this entry, but will of course never disclose this).

7. Data processing in connection with the wheel of fortune competition

As part of our prize draw contract with participants, we collect personal data in accordance with Art. 6 par. 1(b) (first and last name, e-mail address, mobile phone number, postcode, country, time of participation in the prize draw) to organise the wheel of fortune competition and send advertising by newsletter. The participants digitally agree to the contract, winners will be notified and their names published on the website. The data collected will not be passed on to third parties. False information such as fake e-mails or false names are not permitted. The sending of the newsletter can be cancelled at any time (see 5. Data processing when ordering our newsletter).

8. Data processing as part of our business relationship (customers and suppliers)

As part of our business relationship with customers or suppliers, we process your data on the basis of contractual (initiation, maintenance and processing of a business relationship) and legal obligations (e.g. statutory retention obligation in line with § 132 BAO) (Art. 6 par. 1 lit b and c GDPR) and on the basis of our legitimate interests or the legitimate interests of third parties (Art. 6 par. 1 lit f GDPR), namely:

• For the purpose of internal administration and management of your business case (e.g.: swimming courses or season tickets) to the extent required (e.g.: processing your business case, forwarding your business case to various departments, archiving purposes, correspondence with you);
• For the purpose of direct advertising (e.g.: post mailing, e-‑mail dispatch, satisfaction surveys, congratulatory letters, statistical analyses). We would like to expressly inform you that you can object to the processing of your data for the purpose of direct advertising by sending an e-‑mail to info@sonnentherme.at or by post to Sonnentherme Lutzmannsburg Frankenau GmbH, Thermengelände 1, 7361 Lutzmannsburg (for the revocation of consent to the newsletter mailing see clause 5);
• Assertion and defence of any legal claims;

these are lawfully processed to the extent necessary in each case.

Please understand that we are generally unable to process business transactions if the necessary personal data is not available to us.

We will only store your data for as long as is necessary for the purposes for which we have collected your data. In relation to this, statutory retention obligations must be taken into account (for example, for tax law reasons, contracts and other documents pertaining to our contractual relationship must be kept for a period of seven years in accordance with § 132 BAO). In justified individual cases, for example for the assertion and defence of legal claims, we may also store your data for up to 30 years after termination of the business relationship.

In order to achieve the intended purposes, it may be necessary for us to disclose your data to the following recipients (by transmission, distribution or other form of provision) on a case-by-case basis:

9. Sunny Bunny Club

If you have registered your child (under the age of 9 ) for the Sunny Bunny Club, we will use the information provided for the following purposes

• Sending electronic direct advertising (see 5)
• Sending direct advertising by post
• Setting up access (login) to our offer at www.sunnybunny.at

The information collected as part of the Sunny Bunny Club will be erased after the end of the 9th year of age of the child for whom you have set up the access.

10. Data processing as part of the application procedure

If you apply to us, we will process your data to carry out pre-contractual measures (conclusion of a service contract, Art. 6 par. 1 lit b GDPR).

Please understand that we will not be able to process your application if you do not provide us with your applicant data. We would like to expressly point out that, as a rule, there is no need to provide us with particularly sensitive data (e.g.: religious confession).

We will delete your application seven months after the end of the application process, unless you wish to be kept on record for longer. On our application website, we give you the opportunity to provide us with your consent (Art. 6 par. 1 lit a GDPR) so that we can keep you on record as an applicant. Our internal data protection information for employees, which can be requested during the application process, applies to "recruited persons".

11. Automation-supported decision-making

We would like to inform you that no data processing as defined by Art. 22 GDPR takes place. That means: we will not make any decision based solely on automated processing (including profiling) that has legal effects concerning you or similarly significantly affects you; any decision with a relevant effect will be made by a natural person.

12. Collection of data from other sources (information pursuant to Art. 14 GDPR)

It is possible that we do not obtain data directly from you, but from the following sources:

13. What are your rights with regard to data processing?

We would like to inform you that you have the right to

• request information at any time about which of your data we process. The right of access also includes the right to receive a copy of the data, provided that this does not adversely affect the rights and freedoms of other persons (see in detail Art. 15 GDPR);
• to request the rectification or completion of inaccurate or incomplete data concerning you (see in detail Art. 16 GDPR);
• to request the erasure of your data (see in detail Art. 17 GDPR). However, there is no right to erasure, for example, if the processing is necessary to fulfil a legal or contractual obligation;
• to request the restriction of the processing of your data if certain conditions are met (see in detail Art. 18 GDPR);
• to object to the processing of your data which is necessary to protect our legitimate interests or those of a third party. In the event of an objection, we will no longer process your data unless the processing serves the establishment, assertion or defence of legal claims or we can demonstrate compelling legitimate grounds for the processing which override your interests. If you object to processing for direct marketing purposes, we will no longer process your personal data for these purposes (see in detail Art. 21 GDPR);
• to receive the transfer of the data provided by you in a structured, commonly used and machine-readable format. However, there is only a right to data portability if the processing is based on your consent or on a contract (see in detail Art. 20 GDPR).

14. AI support

Sonnentherme Lutzmannsburg-Frankenau GmbH uses various AI products to support its operations. Texts and images may therefore originate in part or in full from such programmes but are always checked and approved manually before publication. Within the company, the use of AI support is regulated in Directive No. 23 of Landesholding Burgenland. This paragraph is intended as a general notification / labelling that such products are in use and therefore replaces any local labelling.

To assert one of the above-mentioned rights, please send an e-mail to info@sonnentherme.at or a letter to Sonnentherme Lutzmannsburg Frankenau GmbH, Thermengelände 1, 7361 Lutzmannsburg.

If we process your data on the basis of your consent, you have the right to revoke this consent at any time by e-mail to info@sonnentherme.at or by post to Sonnentherme Lutzmannsburg Frankenau GmbH, Thermengelände 1, 7361 Lutzmannsburg. This does not affect the lawfulness of the data processing carried out up to this point in time (Art. 7 par. 3 GDPR).

If, despite our obligation to process your data lawfully, there is a breach of your right to lawful processing of your data, please contact us by post or email (see contact details below) so that we can learn of your concerns and address them. However, you also have the right to lodge a complaint with the Austrian data protection authority or with another data protection supervisory authority in the EU, in particular at your place of residence or work.

We hope that this information has provided you with clarity as to how and for what purposes we process your data. If you still have questions about the processing of your personal data, you are welcome to contact us by e-mail at info@sonnentherme.at or by post at Sonnentherme Lutzmannsburg Frankenau GmbH, Thermengelände 1, 7361 Lutzmannsburg.

Name and address of the controller
 Sonnentherme Lutzmannsburg-Frankenau GmbH
 Address:                                  A-7361 Lutzmannsburg, Thermengelände 1
 Telephone number:            +43 2615 87171
 Fax number:                          +43 2615 87171-20
 E-mail address:                    info@sonnentherme.at
 Internet address:                 www.sonnentherme.at

 Company register number:      FN 109948p
 Company register court:  Oberpullendorf
 UID:                                           ATU 38285404
 Memberships:                      Burgenland Chamber of Commerce
 Professional group:            Tourism

 Applicable legislation: Trade regulations, www.ris.bka.gv.at

 Contact Group Data Protection Officer:
 Horst Lesacher, LL.M. (WU) LL.B. (WU)
 Tel: +43 5 9010 8018
 E-Mail: datenschutz(at)landesholding-burgenland.at

Last updated on 27.01.2025