Privacy policy

1. Controller

IMG City GmbH
Hyrtlstraße 1, 4050 Traun
FN 485383 z · ATU 72948858
Telefon: +43 681 20 66 93 90
E-Mail: Show email address

Please use the contact details above for privacy enquiries. No separate data protection officer is designated on this website.

2. Categories of personal data

Depending on your use, the following data may be processed:

• Name, first name, company and contact person
• Addresses, telephone number and email address
• Enquiry, reservation, stay and order data
• VAT and company register numbers for business guests
• Payment method, payment status and billing information
• Technical access data such as IP address, time, page accessed, browser and operating system

Registration data for accommodation

Where required by registration, tourism or residence law, the following may additionally be processed:

• Date of birth, profession and purpose of stay
• Type, number, issuing authority and validity of a travel document
• visa and nationality information where applicable

3. Purposes and legal bases

Data required for enquiries, bookings and statutory registration obligations must be provided. Without such data, an enquiry may not be completed or an accommodation contract may not be performed.

4. Website, hosting and server logs

The website is provided through the following hosting and domain provider:

When the website is accessed, technically necessary server log data is processed. This may include the IP address, date and time, requested file, data volume, referrer, browser and operating system. Processing serves secure website delivery, error analysis, system security and prevention of misuse.

Retention period: Server log files are generally retained for 30 days and then deleted, unless longer retention is required to investigate a specific security incident.

Server location according to the provider: Lumen Technologies, Wamslerstraße 8, 81829 München, Deutschland

5. Contact, enquiries, bookings, PMS and payment

Contact form and email

When you contact us, the information entered is processed to handle your enquiry, prepare an offer and communicate with you. The form is transmitted through the website server. A technically necessary in-house honeypot mechanism is used for spam prevention without an external CAPTCHA.

Direct bookings and Booking.com

Depending on the arrival date, short-notice booking requests are redirected to Booking.com. Booking parameters contained in the redirect URL—particularly the accommodation, check-in, check-out and the number of adults and children—may be transmitted to Booking.com. A booking made through Booking.com is additionally subject to its privacy policy and contractual terms.

PMS and guest management

PMS means “Property Management System”. A PMS is software used to manage accommodation units, reservations, guests, stays, availability, correspondence and billing-related processes. KWHotel, provided by Kajware, is used for reservation management and guest service. The data is processed in a MySQL database.

Payment processing

For direct bookings, payment is made either through myPOS or by bank transfer. For bookings made through Booking.com, payment is processed through Booking.com where provided for by the relevant booking model. For bank transfers, the banks involved also process the data necessary to complete the payment.

6. Recipients and processors

Personal data is disclosed only where necessary for enquiries, bookings, stays, payments, legal obligations, debt management, legal defence or secure technical operation.

For bookings made through online travel portals, their privacy policies also apply. Where a booking originated through a portal, booking-related changes, payment status and other information required for contract processing may be transmitted to that portal.

7. International data transfers

When international service providers such as Google or Booking.com are used, processing outside the European Union or European Economic Area cannot be entirely excluded. Transfers take place only on a lawful GDPR basis, such as an adequacy decision, appropriate safeguards or where necessary for contract performance.

8. Cookies, local storage and external content

Technically necessary functions

Technically necessary functions may be used without separate consent where required for a service explicitly requested by the user or for secure operation.

Storage of privacy preferences

The selected privacy preference is currently stored in the browser’s local storage. It is not transmitted to an external provider. It can be reset or changed through the “Privacy settings” link in the footer.

Google Maps

Google Maps is loaded only after you consent to the “External content” category. Only then can a connection to Google be established. This may transmit IP address, device and browser information and usage data to Google.

Statistics and marketing

No consent-based statistics or marketing services are currently active on this website. These categories are shown transparently in the settings and remain disabled.

9. Retention periods

Enquiries are retained only for as long as necessary to handle them, take pre-contractual steps, perform a contract and comply with legal obligations.

Billing and booking records are generally retained until the end of the eighth following calendar year after the latest relevant correspondence, payment or invoice, unless a longer statutory or legal period applies.

Data may be retained longer where required to establish, exercise or defend legal claims or where a legal obligation requires it. Once the purpose no longer applies and relevant periods have expired, data is deleted or anonymised.

10. Your rights

Subject to the statutory requirements, you have the following rights in particular:

• access to personal data processed
• rectification of inaccurate or incomplete data
• erasure where no retention duty or other legal basis applies
• restriction of processing
• data portability where legally applicable
• objection to processing based on legitimate interests
• withdrawal of consent with effect for the future

To exercise your rights, send a message to Show email address. Where there are reasonable doubts about your identity, additional information necessary to confirm identity may be requested. An original signature or comparison document is not required as a general rule.

Right to lodge a complaint

If you believe that processing infringes data protection law, you may contact the Austrian Data Protection Authority: Barichgasse 40–42, 1030 Vienna, email: dsb@dsb.gv.at.

11. Automated decisions and changes

No solely automated decision-making, including profiling, that produces legal effects or similarly significantly affects you currently takes place through this website. Occupancy and revenue data may be evaluated for statistical and business purposes without producing such a decision concerning individual guests.

This privacy policy will be updated when the website, services used, legal requirements or actual processing activities change.