LEGAL INFORMATION
Privacy policy
This notice explains how we process personal data when you visit our website or send enquiries to Alpspitzherzl. Last updated: 8 October 2026.
1. Data controller and contact details
Brigitte Scheck · Alpspitzherzl holiday apartment
Zugspitzstraße 33
82467 Garmisch-Partenkirchen · Germany
Telephone: +49 8821 74418
Email: info@alpspitzherzl.de
2. Hosting and technical access data
Our website and email account are hosted by STRATO GmbH, Otto-Ostrowski-Straße 7, 10249 Berlin, Germany. The hosting provider processes technical data sent by your browser when you access the website. This includes, in particular, your IP address, date and time, the page or file requested, response status, browser and operating system and, where applicable, the previously visited page (referrer).
This processing is necessary to deliver the website, maintain technical stability and detect and prevent misuse. The legal basis is Article 6(1)(f) GDPR; our legitimate interest is the secure and reliable operation of our website. STRATO receives the data as our technical service provider. Further information: STRATO privacy information.
3. Enquiries by form, email or telephone
When you contact us, we process the information you provide to answer your enquiry and, where applicable, prepare for your stay. The enquiry form collects your name, email address, preferred arrival and departure dates, number of adults and, where applicable, children, enquiry type and, optionally, telephone number and message. Your details are sent to us by email. Please provide only information needed for your enquiry.
For enquiries about a stay, the legal basis is Article 6(1)(b) GDPR (steps prior to entering into a contract or performance of a contract). For other matters, we process data under Article 6(1)(f) GDPR; our legitimate interest is responding to your message. Where processing is based on consent, Article 6(1)(a) GDPR applies. You may withdraw consent at any time with future effect, for example by email. Withdrawal does not affect the lawfulness of prior processing.
We need the information marked as required to handle your enquiry meaningfully. The form cannot be submitted without it. You may alternatively contact us by telephone or email. Your enquiry does not lead to an automated booking decision; we respond personally.
4. Local protection of the contact form
Our contact form uses Contact Form 7 with a local honeypot and timing check to prevent automated spam enquiries. An invisible form field and the time between loading and submitting the form are checked. This takes place on our web server without calling an external CAPTCHA service. Google reCAPTCHA is not used in the contact form. The legal basis for spam prevention is Article 6(1)(f) GDPR; our legitimate interest is protecting the form against misuse.
5. Cookies and similar functions
Technically necessary functions may store information in your browser or access it, for example when authorised users sign in to administer the website. Where strictly necessary for a service you have expressly requested, this is based on section 25(2)(2) TDDDG. Any associated processing of personal data is based in particular on our legitimate interest in secure website operation under Article 6(1)(f) GDPR. You may manage or delete cookies in your browser settings; this may limit some functions.
6. Links to other websites
Our website links to external services, including the FeWo-direkt booking platform, Google Maps for route planning and local attractions. Google Maps is opened only when you click a directions link; a map is not automatically embedded. Clicking an external link takes you away from our website. The respective provider is responsible for subsequent data processing. Please read its privacy information.
7. Guest registration on the “Ga-Pa Card” page
The “Ga-Pa Card” page embeds an external guest registration form from meldeclient.feratel.at. When you open that page, your browser requests the form from the external provider. If the connection succeeds, technical data, particularly your IP address and browser information, is transmitted to that provider’s server. Details entered in this guest registration form are processed through the external service and are not sent via our contact form. The integration provides guest registration; our legitimate interest in this function is the basis for the technical integration under Article 6(1)(f) GDPR. Article 6(1)(b) GDPR applies to details needed to prepare and carry out your stay. You may alternatively contact us directly by email or telephone.
8. Recipients and retention periods
Your data is accessible to the people responsible for handling your enquiry and the technical service providers involved, particularly STRATO for hosting and email. Further disclosure takes place only where necessary to perform a contract, required by law or authorised by your consent.
We retain personal data for as long as necessary for its purpose. Enquiry data is deleted once the matter is concluded and no further retention is required. If you book a stay, statutory retention requirements, particularly for tax-related documents, may require longer storage. Limited retention may also be necessary to establish or defend legal claims. The content of the records, applicable legal obligations and relevant limitation periods determine the retention period.
9. Your rights
Subject to the applicable legal requirements, you have rights of access to your personal data (Article 15 GDPR), rectification (Article 16), erasure (Article 17), restriction of processing (Article 18) and data portability (Article 20). You may withdraw consent at any time with future effect. To exercise these rights, contact us using the details above.
Right to object: Where we process data under Article 6(1)(f) GDPR, you may object under Article 21 GDPR on grounds relating to your particular situation. We will then stop processing the data unless we have compelling legitimate grounds overriding your interests, rights and freedoms, or the processing serves to establish, exercise or defend legal claims. You may object to processing for direct marketing at any time.
You also have the right to complain to a data protection supervisory authority under Article 77 GDPR. For private businesses in Bavaria, the relevant authority is in particular the Bavarian State Office for Data Protection Supervision (BayLDA), Promenade 18, 91522 Ansbach, Germany.