Privacy Policy

As of 16.10.2025

1. Introduction and Scope
This Privacy Policy explains how we process personal data when you visit the website mywellness-suedtirol.com or use the features provided there. Personal data means any information relating to an identified or identifiable natural person (e.g., name, e-mail address, IP address).

We process your data in accordance with the General Data Protection Regulation (GDPR), applicable Italian data protection laws, and other relevant regulations. The following information explains the type, scope, purposes, legal bases, storage periods, and your rights.

2. Controller
Online Media
Gerbergasse 22/A, 39100 Bolzano (BZ), Italy
E-Mail: info@mywellness-suedtirol.com • Tel.: +39 327 853 6826
PEC: kousminscki.armin@pec.it • VAT No.: IT03199310214 • REA: BZ-240361 • CF: KSMRMN93L25A952E. Details according to the trade register.

3. Data Processing when Visiting the Website (Server Logs)
When you access our website, the web server automatically processes the following data: IP address, date and time, requested URL, referrer URL, browser used, operating system, HTTP status code.
Purpose: operation, security of infrastructure, error analysis.
Legal basis: Art. 6 (1) lit. f GDPR (legitimate interest).
Storage period: usually 7–14 days; in case of security incidents, until clarification is completed.

4. Consent Management (Cookies/Tracking)
We use a Consent Management Platform (CMP) that stores and manages your choices regarding cookies or similar technologies. Non-essential cookies and similar technologies are only activated after your explicit consent. You may change or withdraw your consent at any time with effect for the future via the CMP settings.
Legal bases: Art. 6 (1) lit. c GDPR (compliance with ePrivacy obligations, proof of consent) and Art. 6 (1) lit. f GDPR (documentation/evidence purposes).

5. Web Analytics with Google Analytics 4
We use Google Analytics 4 (GA4) by Google Ireland Limited for statistical analysis of website usage. IP anonymization is enabled. Processing occurs only if you have given consent through the CMP. GA4 may transfer data to third countries (particularly the USA). Google LLC is certified under the EU-US Data Privacy Framework; additionally, Standard Contractual Clauses and technical/organizational safeguards may apply.
Purpose: statistics/performance analysis, improvement of our services.
Legal basis: Art. 6 (1) lit. a GDPR (consent).
Retention at Google Analytics: e.g., 14 months (unless configured otherwise in the account).
You may withdraw consent at any time via CMP. Alternatively, deactivation via browser add-ons is possible.

6. Marketing with Meta Pixel (Facebook/Instagram)
If you consent via CMP, we use the Meta Pixel by Meta Platforms Ireland Ltd. to measure visitor actions and deliver interest-based ads on Facebook/Instagram (remarketing/conversion tracking). Pseudonymous usage data may be processed and transferred to the USA (EU-US DPF/SCC).
Purpose: marketing/remarketing, campaign optimization.
Legal basis: Art. 6 (1) lit. a GDPR (consent).
You may withdraw consent anytime in CMP.

7. Embedded Content: Google Maps
On hotel detail pages, we embed Google Maps so you can view locations. For privacy reasons, we use a 2-click solution: a connection to Google is established only when you actively load the map. Afterward, Google may process usage data (including IP address); this may involve transfer to third countries (EU-US DPF/SCC).
Legal basis: Art. 6 (1) lit. a GDPR (consent after click).
If you do not consent, the map will not be loaded.

8. Contact and Inquiry Forms (Forwarding to Hotels)
Through our forms, you can directly send inquiries to a selected hotel.
Data processed: first and last name, e-mail address, number of adults/children, planned check-in/check-out, free text message.
Purpose: handling your inquiry and forwarding to the chosen hotel; the hotel then processes your data under its own responsibility.
Legal basis: Art. 6 (1) lit. b GDPR (pre-contractual measures upon your request).
Storage with us: we do not permanently store inquiry content on the web server. If protocol data/backups are generated for technical reasons, these are only used to ensure delivery and IT security and deleted after a reasonable period.
Note: The respective hotel is an independent controller and may provide further information on its data processing.

9. Recipients and Processors
We use AWS for hosting and Mailchimp for e-mail delivery, both acting on our behalf (Art. 28 GDPR). Data Processing Agreements are in place. Additionally, Google (Analytics) and Meta (Pixel) receive data if you have consented. If data is processed outside the EEA, this is based on an adequacy decision (EU-US DPF) or appropriate safeguards, especially Standard Contractual Clauses, complemented by additional measures.

10. Retention Periods
We process personal data only as long as necessary for the respective purposes. Applicable statutory retention periods (e.g., commercial/tax law) and limitation periods for claims apply. Afterward, data is deleted or anonymized.

11. Your Rights
You have the right – within the legal framework – to access, rectification, erasure, restriction of processing, data portability, and the right to object to processing based on Art. 6 (1) lit. f GDPR. Consent given can be withdrawn at any time with future effect (e.g., via CMP).

12. Data Security
We protect your data through TLS encryption, role-based access controls, logging, backups, and organizational measures according to Art. 32 GDPR to ensure a level of security appropriate to the risk.

13. Changes to this Policy
We will update this Privacy Policy if technical processes, services, or legal situations change. The current version published on the website always applies.