Privacy policy

1. Controller

HappyStay GmbH, Alliiertenstraße 1/28, 1020 Wien, Austria

Email: hello@chat.happystay.at · Phone and WhatsApp: +43 670 3086377

For all data protection questions and to exercise your rights (section 10), please use these contact details.

2. The essentials

• We do not use advertising tools. Google Analytics for our visitor statistics only runs if you agree in the cookie notice. Without your consent, we only set cookies that are technically necessary.
• We use the data you enter when booking for your booking and to meet legal obligations.
• Some service providers are based outside the EU. We name them below together with the legal basis for the transfer.

3. Visiting the website

When you open a page, our web server processes technically necessary data: your IP address, date and time, the address requested and information about your browser. This data is written to an access log. We also count page views; for this we store only the address requested and the time, without the IP address.

Purpose: to deliver the website, protect it against attacks, find errors and determine the number of visits. The legal basis is our legitimate interest in secure and reliable operation (Art. 6(1)(f) GDPR).

The website and our booking system run on servers of Hetzner Online GmbH, Industriestraße 25, 91710 Gunzenhausen, Germany, in a data centre in Nuremberg. Hetzner processes the data on our behalf.

Retention: we delete the access logs after 14 days.

4. Cookies and browser storage

Technically necessary: we store your answer to the cookie notice in your browser’s local storage so that the notice does not appear on every visit. If you switch the language, the site remembers your choice in a language cookie. Both are technically necessary for the site to work the way you set it up (Section 165(3) Austrian Telecommunications Act 2021).

Only with your consent: the Google Analytics cookies for our visitor statistics (section 5). If you do not agree, the site does not load Google Analytics at all.

You can change or withdraw your choice at any time using the “Change cookie settings” button at the end of this page. It is as easy as giving consent. If you withdraw, the statistics stop immediately and the site deletes the Google Analytics cookies in your browser.

In the payment step the site loads Stripe’s payment form (section 7). Stripe may use its own cookies or similar technologies to prevent fraud.

5. Visitor statistics with Google Analytics

If you agree in the cookie notice, we use Google Analytics 4. The provider is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. Without your consent, the site loads nothing from Google.

Purpose: we want to understand how our site is used, for example how many people visit it, which pages they open and which site brought them to us. This shows us what works well and what we should improve. For this, Google Analytics records, among other things, the pages viewed with date and time, the page you came from, information about your device and browser, and your approximate location (country, region, city).

The legal basis is your consent (Art. 6(1)(a) GDPR), for the cookies in conjunction with Section 165(3) Austrian Telecommunications Act 2021. Consent is voluntary. You can withdraw it at any time (section 4); the withdrawal applies from that moment on.

Cookies: Google Analytics stores in your browser the cookie “_ga” and a cookie whose name starts with “_ga_” and ends with the ID of our statistics. This lets Google recognise whether you have visited the site before. Both cookies expire at the latest two years after your last visit.

We have switched off the link to Google accounts (Google Signals) and personalised advertising. The site does not set advertising cookies. According to Google, Google Analytics 4 does not store IP addresses.

Google may transfer data to Google LLC in the USA. This is based on the European Commission’s adequacy decision for the EU-US Data Privacy Framework (Art. 45 GDPR), under which Google LLC is certified.

Retention: how long Google keeps the data on individual visits is set in our Google Analytics settings. Google then deletes it automatically.

6. Map

On apartment and city pages we show a map from OpenStreetMap. Your browser loads the map images directly from servers of the OpenStreetMap Foundation, St John’s Innovation Centre, Cowley Road, Cambridge, CB4 0WS, United Kingdom, which thereby learns your IP address. The purpose is to show you where the apartments are. The legal basis is our legitimate interest in doing so (Art. 6(1)(f) GDPR).

The European Commission has adopted an adequacy decision for the United Kingdom (Art. 45 GDPR).

7. Booking and payment

When you book, we ask for your first name, last name, email address and phone number, and optionally a company name and comments, together with your travel dates, number of guests and chosen extras. We need your first name, last name and email address to complete the booking; without them no booking is possible.

The purpose is to perform your booking: reserving the apartment, processing payment and looking after you before and during your stay. The legal basis is the performance of the contract (Art. 6(1)(b) GDPR).

For this we pass data to the following service providers:

• Smoobu GmbH, Berlin, Germany (reservation and calendar system): name, email address, travel dates and price.
• Stripe Payments Europe Limited, Dublin, Ireland (payment processing): you enter your payment details directly into Stripe’s form. We see neither your full card number nor your login details, only the payment status. Stripe may transfer data to Stripe, Inc. in the USA on the basis of the European Commission’s adequacy decision for the EU-US Data Privacy Framework (Art. 45 GDPR).

Legal obligations: the Austrian Registration Act requires us to keep a guest register with the details listed there (Sections 5 and 10 Meldegesetz 1991). We also have to account for city tax and keep invoices. The legal basis is Art. 6(1)(c) GDPR.

Retention: we keep invoices and accounting records for seven years (Section 132 Austrian Federal Fiscal Code), the guest register for seven years from the entry (Section 10(2) Meldegesetz 1991). We delete other booking data once we no longer need it for the contract and any claims arising from it, usually three years after your departure.

8. When you write to us

If you write to us by email, on WhatsApp or, after booking, through the booking messages, we process your message and contact details to reply to you. The legal basis is the performance or preparation of the contract (Art. 6(1)(b) GDPR), and for general enquiries our legitimate interest in answering them (Art. 6(1)(f) GDPR).

We use the following service providers for this:

• WhatsApp Ireland Limited, Dublin, Ireland, a Meta company, if you write to us on WhatsApp. Data may also be transferred to Meta Platforms, Inc. in the USA. The transfer is based on the adequacy decision for the EU-US Data Privacy Framework (Art. 45 GDPR).
• HighLevel LLC and LeadConnector LLC, Dallas, USA: we receive and answer emails and WhatsApp messages through this system. The transfer is based on the adequacy decision for the EU-US Data Privacy Framework (Art. 45 GDPR).
• Smoobu GmbH, Berlin, Germany: messages about an existing booking.
• Anthropic PBC, USA: we use AI to prepare replies to guest messages. For this we transmit the message, the previous conversation and the booking details. The transfer is based on the European Commission’s standard contractual clauses (Art. 46(2)(c) GDPR).

We delete messages once the enquiry has been dealt with and no retention obligation applies. Messages about a booking are kept as long as the other booking data (section 7).

9. No automated decisions

We do not make decisions about you based solely on automated processing. Nor do we use your data to assess you personally or to show you targeted advertising.

10. Your rights

You have the right of access to your data, to rectification, erasure and restriction of processing, to data portability and to object to processing based on our legitimate interest (Art. 15 to 18, 20 and 21 GDPR). Simply write to us at the address in section 1.

You can also lodge a complaint with the Austrian Data Protection Authority: Barichgasse 40–42, 1030 Vienna, www.dsb.gv.at.