top of page
hofburg bäume Kopie 2.jpeg

DATA PROTECTION

Protecting your personal data is important to us. This privacy policy explains which personal data are processed when you visit our website, contact us or make an online booking, the purposes of that processing and your rights.

We process personal data exclusively on the basis of the applicable legal provisions, in particular the General Data Protection Regulation (GDPR), the Austrian Data Protection Act (DSG) and the Telecommunications Act 2021 (TKG 2021).

1. Controller

The controller responsible for processing personal data in connection with this website is:

VOTIV Liegenschaftsverwertungs GmbH
Roosevelt Stadthaus
Frankgasse 1
1090 Vienna
Austria

Commercial register number: FN 203940 m
Commercial register court: Commercial Court of Vienna
VAT identification number: ATU51828508

Email: home@roosevelt-vienna.com
Telephone: +43 677 614 69 952

2. General information on data processing

Personal data are information relating to an identified or identifiable natural person. Examples include names, addresses, email addresses, telephone numbers, IP addresses, booking details and payment information.

We process personal data only to the extent that this is necessary to provide and securely operate our website, to handle enquiries, to process a booking or perform an accommodation contract, to comply with legal obligations, on the basis of a legitimate interest, or on the basis of your consent.

3. Provision of the website and server log files

When you access our website, your device's browser automatically transmits technical information to the server. In particular, the following data may be processed:

  • IP address;

  • date and time of access;

  • page or file accessed;

  • volume of data transferred;

  • previously visited website or referrer URL;

  • browser type and version;

  • operating system;

  • language settings;

  • internet service provider;

  • information about the device used; and

  • technical error and security information.

These data are processed to provide the website technically, ensure its stability and security, identify attacks and misuse, and analyse technical errors.

The legal basis is our legitimate interest in a secure and functional website under Article 6(1)(f) GDPR.

Server log files are generally stored only for as long as necessary for these purposes. They may be retained for longer where necessary to investigate specific security incidents or to establish, exercise or defend legal claims.

4. Hosting and the Wix website platform

Our website is operated using the Wix website platform.

The provider is, in particular:
Wix Online Platforms Limited
1 Grant’s Row
Dublin 2 D02HX96
Ireland

In hosting and technically operating the website, Wix may process website visitors' personal data. These include, in particular, IP addresses, technical usage data, device and browser information, security data and information entered into forms on the website.

Processing serves to provide, display, secure and technically administer our website.

The legal basis is Article 6(1)(f) GDPR. Our legitimate interest is the secure, reliable and economical operation of our website.

Where Wix processes personal data on our behalf, this takes place under a data processing agreement pursuant to Article 28 GDPR.

Data may also be processed outside the European Economic Area in the course of providing these services. Where data are transferred to countries without an adequacy decision by the European Commission, the transfer is based on appropriate safeguards under Article 44 et seq. GDPR, in particular the European Commission's Standard Contractual Clauses.

Further information on data processing by Wix is available in Wix's privacy policy.

5. Contacting us

If you contact us by email, telephone, a contact form or otherwise, we process the data you provide. These may include, in particular:

  • name;

  • email address;

  • telephone number;

  • the content of your message;

  • your preferred dates of stay;

  • number of guests;

  • room preferences or booking requests; and

  • other information provided voluntarily.

The data are processed to handle your enquiry, communicate with you and take steps prior to entering into a contract.

The legal basis is Article 6(1)(b) GDPR where your enquiry concerns a potential or existing booking. For other enquiries, processing is based on our legitimate interest in providing an appropriate response under Article 6(1)(f) GDPR.

The data are stored for as long as necessary to handle your enquiry and possible follow-up questions. Data may also be retained to comply with statutory retention obligations or to establish, exercise or defend legal claims.

6. Online bookings through OnePageBooking

Our website links to the OnePageBooking booking platform for direct online bookings.

The provider is:
HotelNetSolutions GmbH
Genthiner Straße 8
10785 Berlin
Germany

When you access and use the booking platform, the following data are processed in particular:

  • title, first name and surname;

  • address;

  • email address;

  • telephone number;

  • arrival and departure dates;

  • selected room or apartment;

  • number and, where applicable, ages of accompanying guests;

  • booking and rate details;

  • special requests or messages;

  • IP address and technical connection data;

  • company and billing details, where applicable;

  • selected payment method; and

  • data required for payment or a card guarantee, where applicable.

Processing serves to handle your booking enquiry, take steps prior to entering into a contract, conclude and perform the accommodation contract, and process payment or the booking guarantee.

The legal basis is Article 6(1)(b) GDPR. Where statutory retention or reporting obligations apply, processing is also based on Article 6(1)(c) GDPR.

HotelNetSolutions processes data on our behalf or as part of the technical provision of the booking platform. Further processing on that platform is additionally governed by the privacy information provided there.

7. Processing booking and guest data

In connection with a reservation or stay, we process the personal data required to arrange, perform and invoice the accommodation contract.

These may include, in particular:

  • name and contact details;

  • address and country of origin;

  • date of birth;

  • details of accompanying guests;

  • arrival and departure dates;

  • services booked;

  • correspondence and special requests;

  • billing and payment data;

  • information about cancellations or changes; and

  • legally required guest registration data.

Processing serves, in particular, to administer reservations, perform the accommodation contract, communicate with guests, issue invoices and process payments, comply with guest registration, tax and commercial law obligations, and handle complaints and legal claims.

The legal bases are Article 6(1)(b) GDPR for contractual performance and Article 6(1)(c) GDPR for compliance with legal obligations.

Where processing is necessary to prevent payment defaults, enforce legal rights or properly organise hotel operations, it may also be based on our legitimate interest under Article 6(1)(f) GDPR.

8. Hotel and reservation systems

We use specialised hotel software and technical service providers to manage reservations, room availability, guest data, prices and distribution channels. These include, in particular, systems for reservation and guest management, property management, channel management, direct bookings, price and availability management, and payment processing.

The data required to process a booking may be transmitted to the service providers involved and processed by them on our behalf.

These include, in particular:

  • HotelNetSolutions GmbH / OnePageBooking;

  • SiteMinder Limited or its European group companies;

  • Little Hotelier as part of the SiteMinder platform; and

  • where applicable, other providers expressly identified in the relevant booking or payment process.

Processing serves to perform the accommodation contract under Article 6(1)(b) GDPR and, where necessary, to comply with legal obligations under Article 6(1)(c) GDPR.

Where these service providers process data on our behalf, appropriate agreements under Article 28 GDPR are in place.

9. Payment processing and credit card guarantees

Depending on the selected rate, a credit card guarantee, pre-authorisation or advance payment may be required.

The data required for payment processing may be processed directly by the payment service provider involved. These may include, in particular:

  • cardholder's name;

  • credit or debit card details;

  • expiry date;

  • card verification code;

  • billing address;

  • payment amount;

  • currency;

  • booking number;

  • IP address; and

  • payment status information.

As a rule, we do not receive all complete card details, but only the information required to manage the booking and the payment status.

Processing serves to perform the accommodation contract and process payments under Article 6(1)(b) GDPR. Where necessary to prevent payment defaults or fraud, processing may also be based on Article 6(1)(f) GDPR.

The relevant payment service provider's privacy information also applies to its processing.

10. Bookings through external booking portals

If you book through an external booking portal such as Booking.com or Expedia, we receive the personal data required to handle your reservation from that portal.

The booking portals initially process data as independent controllers. Their respective privacy policies apply to data collection and processing on their platforms.

Once the data have been transmitted to us, we process them to perform the accommodation contract, communicate with you, process payments and comply with legal obligations.

The legal bases are Article 6(1)(b) and (c) GDPR.

11. Cookies and similar technologies

Our website uses cookies and similar technologies. Cookies are small files or pieces of information that can be stored on or read from your device.

Cookies may serve, in particular, to provide basic website functions, save language preferences or other choices, document consent status, statistically analyse website use, measure advertising effectiveness or provide external content.

Technically necessary cookies

Technically necessary cookies are required to provide the website and functions expressly requested by you properly.

These cookies are used without separate consent on the basis of section 165(3) TKG 2021. Where personal data are processed, this is based on our legitimate interest in a secure and functional website under Article 6(1)(f) GDPR.

Statistics, marketing and external media cookies

Cookies and similar technologies that are not technically necessary are used only if you have given prior consent through our consent management system.

This applies, in particular, to cookies or technologies for audience measurement and statistics, conversion measurement, personalised or non-personalised advertising, remarketing, external maps, embedded media or social media functions.

The legal basis is your consent under Article 6(1)(a) GDPR in conjunction with section 165(3) TKG 2021.

You may withdraw or change your consent at any time with effect for the future through our website's cookie settings.

The specific cookies used, their providers, purposes and storage periods are displayed in the website's cookie settings.

12. Consent management

We use a consent management solution to manage your cookie and privacy preferences.

In particular, the following information is processed: your consent decision, the time of that decision, the selected cookie categories, a pseudonymous identifier where applicable, technical browser and device information, and the version of the consent information displayed.

Processing is necessary to store and demonstrate your choice and to take it into account on subsequent visits.

The legal bases are Article 6(1)(c) GDPR where we are required to document consent, and Article 6(1)(f) GDPR. Our legitimate interest is the legally compliant and user-friendly management of consent.

13. Google Analytics

Where you have consented through our cookie settings, our website may use Google Analytics, a web analytics service provided by:

Google Ireland Limited
Gordon House
Barrow Street
Dublin 4
Ireland

Google Analytics enables us to statistically analyse the use of our website. In particular, the following data may be processed:

  • truncated or complete IP address;

  • device and browser information;

  • operating system;

  • approximate location;

  • pages visited;

  • time and duration of the visit;

  • source of the visit;

  • interactions with the website;

  • pseudonymous online identifiers; and

  • information about booking or conversion events.

These data help us analyse website use, make technical and content improvements, and assess the success of our offerings.

Google Analytics is activated only after you have given consent. The legal basis is Article 6(1)(a) GDPR in conjunction with section 165(3) TKG 2021.

You may withdraw your consent at any time through the cookie settings with effect for the future.

Google may also process data on servers outside the European Economic Area. Where data are transferred to the USA, the transfer may be based on the EU-US Data Privacy Framework if the recipient is appropriately certified. The European Commission's Standard Contractual Clauses may also be used.

14. Google Ads and conversion tracking

We use Google Ads to draw attention to our offerings and measure the effectiveness of our advertising.

The provider is:
Google Ireland Limited
Gordon House
Barrow Street
Dublin 4
Ireland

If you reach our website through a Google advertisement and have consented to the relevant processing, a conversion cookie may be set or a comparable online identifier processed.

In particular, the following data may be processed:

  • IP address;

  • device and browser information;

  • pages accessed;

  • time of access;

  • advertisement clicked;

  • search and campaign information;

  • pseudonymous cookie or user identifiers; and

  • information about whether an enquiry or booking was made.

Processing serves to measure the success of our advertisements, attribute bookings or enquiries to campaigns, and optimise our advertising.

Processing takes place only with your consent under Article 6(1)(a) GDPR in conjunction with section 165(3) TKG 2021.

You may withdraw your consent at any time through the cookie settings.

Data transfers to the USA may be based on the EU-US Data Privacy Framework if the recipient is appropriately certified. Standard Contractual Clauses may also be used.

15. Google Tag Manager and Consent Mode

Where implemented on our website, we use Google Tag Manager for the technical management of website tags.

The provider is Google Ireland Limited.

Google Tag Manager is used to control analytics, marketing and other services technically. As a rule, Tag Manager does not create its own usage profiles. However, accessing it may transmit technical data, in particular the IP address, to Google.

Where Google Tag Manager or the services integrated through it are not technically necessary, they are activated only after your consent under Article 6(1)(a) GDPR in conjunction with section 165(3) TKG 2021.

We may also use Google Consent Mode to communicate your consent decision to Google services and adjust their behaviour according to your choices.

16. Google Maps

Our website may embed maps from Google Maps.

The provider is:
Google Ireland Limited
Gordon House
Barrow Street
Dublin 4
Ireland

When a Google map loads, your IP address, device and browser information, location data and information about your use of the map may be transmitted to Google.

Google Maps is loaded only if you have consented to the relevant category through our cookie settings or expressly activated the map.

The legal basis is your consent under Article 6(1)(a) GDPR in conjunction with section 165(3) TKG 2021.

You may withdraw consent at any time through the cookie settings.

Google may also process data outside the European Economic Area. Transfers to the USA may be based on the EU-US Data Privacy Framework or Standard Contractual Clauses.

17. Google Fonts

Our website may use fonts from Google Fonts.

Where the fonts are stored locally on our web server or within the website platform and loaded from there, accessing the fonts does not establish a direct connection to Google.

If fonts are loaded directly from Google's servers, your IP address in particular may be transmitted to Google. Such external integration occurs only where technically necessary or where you have given prior consent.

Depending on the technical implementation, the legal basis is Article 6(1)(f) GDPR or your consent under Article 6(1)(a) GDPR in conjunction with section 165(3) TKG 2021.

18. Links to Instagram, Facebook and WhatsApp

Our website contains links to our Instagram and Facebook pages and, where applicable, a link to contact us through WhatsApp.

As a rule, these are simple links. Merely visiting our website does not transmit personal data to these platforms, provided that no additional social media plugins or embedded content are loaded.

Only when you click a link do you leave our website and establish a direct connection to the provider. As a rule, that provider is responsible for subsequent data processing.

Possible providers include:
Meta Platforms Ireland Limited
Merrion Road
Dublin 4
D04 X2K5
Ireland
for Facebook, Instagram and WhatsApp.

Please note that these providers may also process data outside the European Union or the European Economic Area.

The relevant platform's privacy information also applies.

19. Email communication

Email communication regularly involves the processing of technical connection data and metadata in addition to the content you provide. These include, in particular, sender and recipient addresses, date and time, subject line and information about the mail servers involved.

Please note that unencrypted emails are generally not fully protected against access by third parties. Please therefore send particularly sensitive information only after making prior arrangements with us.

20. Recipients of personal data

Where necessary for the purposes described, personal data may be transmitted in particular to the following categories of recipients:

  • hosting and website providers;

  • IT and maintenance service providers;

  • providers of hotel, booking and reservation systems;

  • online booking portals;

  • payment service providers and credit card companies;

  • banks;

  • tax advisers and bookkeeping services;

  • legal advisers;

  • advertising and analytics service providers;

  • public authorities and courts; and

  • other recipients where disclosure is required by law or necessary to perform a contract.

Service providers receive only the data they need for their respective services. Where they act on our behalf, they are contractually required to comply with data protection provisions.

21. Data transfers to third countries

Some of our service providers may process personal data outside the European Union or the European Economic Area.

A transfer to a third country takes place only where the requirements of Article 44 et seq. GDPR are met.

In particular, this may be based on an adequacy decision by the European Commission, the EU-US Data Privacy Framework for appropriately certified US companies, the European Commission's Standard Contractual Clauses, or express consent where no other transfer basis exists.

Despite appropriate safeguards, it cannot be entirely ruled out in certain third countries that public authorities may access data and that individuals may not have the same legal remedies as within the European Union.

22. Retention periods

As a rule, we store personal data only for as long as necessary for the relevant processing purpose.

Data are retained for longer, in particular, where statutory retention obligations apply, the data are required to perform a contract, outstanding claims exist, legal claims may be asserted, or the data are required to defend or enforce claims.

Booking, invoicing and business records are generally retained for seven years in accordance with statutory commercial and tax law retention obligations. Longer retention may be necessary where records are relevant to pending proceedings.

Data from general enquiries are deleted once the enquiry has been fully dealt with and there are no statutory or legitimate grounds for continued retention.

23. Data security

We implement appropriate technical and organisational measures to protect personal data against loss, manipulation, unauthorised access and other risks.

Our website uses an encrypted HTTPS connection. This protects data transmitted between your browser and our website against unauthorised access.

However, complete protection of data transmitted over the internet cannot be guaranteed.

24. No automated decision-making

As a rule, we do not carry out solely automated decision-making, including profiling, that produces legal effects concerning you or similarly significantly affects you.

Where automated price or availability management is used, it relates to room prices and booking availability, not to a legally significant assessment of you as an individual.

25. Your rights

Subject to the applicable legal requirements, you have in particular the following rights:

  • the right of access to your personal data under Article 15 GDPR;

  • the right to rectification of inaccurate or incomplete data under Article 16 GDPR;

  • the right to erasure of your data under Article 17 GDPR;

  • the right to restriction of processing under Article 18 GDPR;

  • the right to data portability under Article 20 GDPR;

  • the right to object to certain processing under Article 21 GDPR; and

  • the right to withdraw consent under Article 7(3) GDPR.

Withdrawal of consent does not affect the lawfulness of processing carried out before its withdrawal.

To exercise your rights, you may contact:
VOTIV Liegenschaftsverwertungs GmbH
Frankgasse 1
1090 Vienna
Austria

Email: home@roosevelt-vienna.com

To prevent unauthorised disclosure of personal data, we may request appropriate proof of your identity.

26. Objection to processing based on legitimate interests

Where we process your personal data on the basis of Article 6(1)(f) GDPR, you have the right to object at any time on grounds relating to your particular situation.

We will then no longer process the data unless we can demonstrate compelling legitimate grounds that override your interests, rights and freedoms, or the processing serves to establish, exercise or defend legal claims.

27. Right to lodge a complaint

If you believe that the processing of your personal data infringes data protection law, you have the right to lodge a complaint with a data protection supervisory authority.

The competent Austrian supervisory authority is:
Österreichische Datenschutzbehörde
Barichgasse 40–42
1030 Vienna
Austria

Telephone: +43 1 52 152-0
Email: dsb@dsb.gv.at

28. Changes to this privacy policy

We reserve the right to amend this privacy policy if legal requirements, our website, the services used or our data processing activities change.

The current version published on this website applies.

bottom of page