Privacy Policy
Version 1.1 · Last updated: 20 September 2026
1. Introduction
This privacy notice informs you, pursuant to Regulation (EU) 2016/679 (GDPR) and the Italian Personal Data Protection Code (Legislative Decree 196/2003 as amended by Legislative Decree 101/2018), about the nature, scope and purposes of the processing of personal data on this website.
2. Data controller (Titolare del trattamento)
Oberwidner – Sole proprietorship
Owner: Anna Lena Lobis
Innerpens 3, 39058 Sarntal (BZ), Italy
P. IVA / C.F.: 03308120215
Phone: +39 340 250 5809
Email: info@oberwidner.com
3. Data processed and purposes
a) Enquiries and bookings: when you use the enquiry form or the booking widget, or contact us by email, telephone or WhatsApp, we process in particular your name, contact details, travel dates, requested chalet, number of guests and your message in order to handle the enquiry and carry out the booking (Art. 6(1)(b) GDPR). For the receipt of enquiries and bookings and for the management of reservations we use the booking and management system by Out Of The Box Media GmbH, Flahwiesenweg 11, 39040 Vahrn (BZ), Italien, P.IVA IT03338000213. The provider processes the data exclusively on our behalf and according to our instructions (Art. 28 GDPR); processing takes place within the European Union.
b) Payment: for direct bookings, payment is processed via Stripe. The provider is Stripe Payments Europe Limited, 1 Grand Canal Street Lower, Grand Canal Dock, Dublin, Ireland. Stripe processes the payment and transaction data required for the payment process (Art. 6(1)(b) and (c) GDPR). Card data are processed exclusively by Stripe and are never stored in our booking system.
c) Email delivery: confirmations, offers and notifications are sent using the email service Brevo (Sendinblue SAS, France). The email address, name and the booking details required for the message are processed for this purpose (Art. 6(1)(b) GDPR).
d) Hosting and server logs: the website is provided through Lovable or Lovable Cloud. On access, technical data such as IP address, date and time, requested page and user agent are processed to provide, stabilise and secure the website (Art. 6(1)(f) GDPR).
e) Statutory reporting obligations: as an accommodation establishment we are legally obliged to transmit the data of all guests to the authorities. This includes:
– registration with the Questura via the Alloggiati Web portal of the Polizia di Stato (Art. 109 TULPS, R.D. 773/1931) with name, date and place of birth, nationality, type of identity document, document number and place of issue as well as the period of stay;
– the statistical overnight-stay report and the settlement of the tourist tax with the provincial administration or the South Tyrol association of tourism organisations (LTS/ASTAT).
The legal basis is Art. 6(1)(c) GDPR (compliance with a legal obligation). Without this information, accommodation is not legally permitted. The transmission takes place via our booking and management system. The authorities are recipients by virtue of law and are not processors. Identity document data are collected exclusively for this registration and deleted after expiry of the statutory retention periods.
4. Cookies and tracking
This website uses necessary storage technologies for its operation and to save your consent decision. With your consent, we also use Google Analytics 4 and Google Tag Manager (Google Ireland Limited), Meta Pixel (Meta Platforms Ireland Limited) and Microsoft Clarity (Microsoft Ireland Operations Limited). These services may process usage, device, browser and event data to measure reach, website use and advertising effectiveness. Processing takes place only with your consent under Art. 6(1)(a) GDPR; you may reject non-essential cookies through the cookie banner and change your decision at any time via the cookie banner. Your choice is stored locally under “oberwidner-cookie-consent”.
5. Recipients and processors
Data are disclosed only to the providers required for the respective purpose:
– Out Of The Box Media GmbH, Flahwiesenweg 11, 39040 Vahrn (BZ), Italien, P.IVA IT03338000213 — operation of the booking and management system (reservations, enquiries, guest communication, statutory reports). Sub-processors used: Supabase (database, processing in Ireland), Vercel (operation of the application), Brevo/Sendinblue SAS, France (email delivery).
– Stripe Payments Europe Limited, Ireland — payment processing.
– Lovable — website hosting and cloud functions.
– With your consent: Google Ireland Limited (Google Analytics 4, Google Tag Manager), Meta Platforms Ireland Limited (Meta Pixel), Microsoft Ireland Operations Limited (Microsoft Clarity).
All processors are contractually bound under Art. 28 GDPR. The authorities named in Section 3(e) are not processors but recipients by virtue of law. Data are otherwise disclosed only where permitted or required by law.
6. Storage period
Personal data are stored only for as long as necessary for the stated purposes or to comply with legal retention obligations (in particular tax and accounting rules, generally 10 years). Server logs are anonymised or deleted after a short period.
7. Transfers outside the EU
When the listed providers are used, processing outside the EEA, particularly in the United States, cannot be excluded. Any such transfer takes place only on the basis of an adequacy decision, the EU-US Data Privacy Framework or appropriate safeguards such as the Standard Contractual Clauses under Articles 44 et seq. GDPR.
8. Your rights
You have the right at any time to access (Art. 15), rectify (Art. 16), erase (Art. 17), restrict processing (Art. 18), receive your data in a portable format (Art. 20) and object to processing (Art. 21 GDPR). To exercise your rights, contact info@oberwidner.com. You also have the right to lodge a complaint with the Italian Data Protection Authority (Garante per la protezione dei dati personali, Piazza Venezia 11, 00187 Rome, www.garanteprivacy.it).
9. Privacy contact
For any request regarding data protection, please contact us at info@oberwidner.com.