Privacy Policy

1. Who we are — the data controller

The controller responsible for personal data processed through this website is:

Wonderbench Hospitality Media GmbH
Kärntner Ring 14/3, 1010 Vienna, Austria
Company registration number: FN 486213b (Vienna Commercial Court)
VAT identification number: ATU72658109
Email: [email protected]

We are an independent editorial publisher. We do not sell travel, take commission from hotels, or operate a booking engine. This significantly limits the categories of personal data we need, and this policy reflects that limited scope.

2. What personal data we collect

2.1 Data you give us voluntarily

When you complete the enquiry form on our contact page, or write to any of our published email addresses, we receive and store the information you choose to provide. This typically includes your name, email address, an optional telephone number, the type of enquiry, your hotel of interest, approximate travel dates, and the free-text content of your message. If you volunteer additional details — accessibility requirements, dietary preferences, the names of fellow travellers — we process those too, solely to answer you.

2.2 Data collected automatically

Our hosting infrastructure records standard server log data for every request: the truncated IP address of the requesting device, the date and time of the request, the resource requested, the HTTP status code, the volume of data transferred, the referring URL where supplied, and the user-agent string identifying browser and operating system. These logs exist for security, fraud prevention, capacity planning and diagnosing faults.

2.3 Data collected through cookies and similar technologies

We set a strictly necessary local-storage entry recording your cookie consent decision, so that the consent banner does not reappear on every page. Optional analytics and functional technologies are only activated where you have given consent through the banner. Full detail is provided in our Cookie Policy.

2.4 Data we do not collect

We do not collect payment card data, passport or identity document data, health data, biometric data, or data revealing racial or ethnic origin, political opinions, religious belief, trade union membership, sexual orientation or criminal convictions. Please do not send such information to us. If you do, we will delete it unless retention is legally required.

3. Legal bases for processing

• Consent (Art. 6(1)(a) GDPR) — optional analytics and functional cookies; any optional marketing communications you expressly request.
• Pre-contractual and contractual steps (Art. 6(1)(b) GDPR) — responding to editorial or partnership enquiries where a contractual relationship may follow.
• Legitimate interests (Art. 6(1)(f) GDPR) — maintaining website security and availability, preventing abuse of our forms, responding to general correspondence, and defending legal claims. We have assessed these interests against your rights and consider them proportionate given the minimal data involved.
• Legal obligation (Art. 6(1)(c) GDPR) — retention of commercial correspondence and accounting records where Austrian tax and commercial law requires it.

4. Purposes of processing

We process personal data only for the following purposes: answering enquiries and providing written editorial recommendations; investigating and correcting factual errors reported to us; operating, securing and improving the website; producing aggregate, non-identifying statistics about which articles are read; complying with statutory record-keeping duties; and establishing, exercising or defending legal claims. We do not engage in automated decision-making or profiling that produces legal or similarly significant effects.

5. Cookies and tracking technologies

Cookies are small files placed on your device; local storage performs a comparable function. We classify the technologies we use into three groups — strictly necessary, analytics, and functional — and only the first group operates without your prior consent. You can withdraw or change your consent at any time by clearing your browser's site data for this domain, which causes the consent banner to reappear on your next visit. A complete table of cookie names, purposes, providers and durations is published in the Cookie Policy.

6. Third-party processors and recipients

We keep our processor list deliberately short. The categories of recipient are:

• Hosting and content delivery provider — stores website files, serves pages and maintains server logs. Data is processed within the European Economic Area.
• Email service provider — transmits and stores correspondence sent to our published addresses.
• Web font provider — typefaces are requested from Google Fonts when you load a page. Your browser transmits an IP address to that service in order to fetch the font files. If you prefer to avoid this, most browsers permit blocking of third-party font requests.
• Map tile provider — our contact page embeds a map frame served by OpenStreetMap. The frame loads only when the page is rendered and transmits your IP address to that provider.
• Privacy-conscious analytics provider — used only after consent, configured without cross-site tracking and with IP truncation enabled.
• Professional advisers — accountants and legal counsel bound by professional confidentiality, where strictly necessary.

Each processor operates under a written data processing agreement meeting Art. 28 GDPR requirements. We do not sell, rent or trade personal data, and we do not share enquiry content with hotels unless you explicitly instruct us to do so.

7. International transfers

Our primary infrastructure is located within the European Economic Area. Where a processor transfers data outside the EEA, that transfer takes place on the basis of an adequacy decision of the European Commission or, failing that, the European Commission's Standard Contractual Clauses supplemented by technical measures such as encryption in transit and at rest. You may request a copy of the relevant transfer mechanism by writing to our privacy address.

8. Retention periods

• Enquiry correspondence — retained for 24 months from the last substantive exchange, then deleted, unless an ongoing matter requires otherwise.
• Server access logs — retained for 30 days, then automatically overwritten.
• Consent records — retained for the life of the consent plus 12 months, as evidence of lawful processing.
• Aggregated analytics — retained in non-identifying form for up to 26 months.
• Accounting and commercial records — retained for seven years in accordance with Austrian statutory requirements.

9. Your rights under the GDPR

Subject to the conditions in the Regulation, you have the right to: access the personal data we hold about you and receive a copy; rectification of inaccurate or incomplete data; erasure ("the right to be forgotten"); restriction of processing in defined circumstances; data portability, receiving data you provided in a structured, machine-readable format; objection to processing based on legitimate interests, including direct marketing at any time; and withdrawal of consent at any time without affecting the lawfulness of processing carried out before withdrawal.

To exercise any right, email [email protected]. We respond within one month; complex requests may be extended by a further two months, and we will tell you if that applies. We may ask for proportionate information to verify your identity before acting.

10. Your rights under the CCPA / CPRA

If you are a California resident, you additionally have the right to know the categories and specific pieces of personal information collected, the sources, the business purposes and the categories of third parties involved; the right to request deletion; the right to correct inaccurate information; the right to opt out of the sale or sharing of personal information; and the right not to be discriminated against for exercising these rights. We do not sell or share personal information as those terms are defined under California law. Requests may be submitted to the same privacy address and will be handled within 45 days, extendable once by a further 45 days with notice.

11. Security measures

We apply technical and organisational measures appropriate to the risk, including TLS encryption for all site traffic, access control on administrative systems, multi-factor authentication for staff accounts, the principle of least privilege, regular patching of software dependencies, and periodic review of processor arrangements. No internet transmission is entirely secure; we therefore ask that you avoid sending sensitive information through open channels.

12. Children

This website addresses an adult travel audience and is not directed at children. We do not knowingly collect personal data from anyone under 16. If you believe a child has provided us with personal data, contact us and we will delete it promptly.

13. Data protection contact and supervisory authority

Our data protection contact point is reachable at [email protected] or by post at Wonderbench Hospitality Media GmbH, Data Protection, Kärntner Ring 14/3, 1010 Vienna, Austria.

If you believe our processing infringes data protection law, you may lodge a complaint with the Austrian Data Protection Authority (Österreichische Datenschutzbehörde), Barichgasse 40–42, 1030 Vienna, Austria — or with the supervisory authority of your EU member state of residence or workplace. We would, however, appreciate the opportunity to address your concern first.

14. Changes to this policy

We review this policy at least annually and whenever our processing changes materially. The version date appears at the top of this page. Where a change materially affects your rights, we will highlight it on the site for a reasonable period. Continued use of the website after a change indicates acceptance of the revised policy.