Information on data protection

The protection of your personal data is of particular concern to me. I therefore process your personal data exclusively on the basis of the statutory provisions (GDPR, TKG 2003). Below I will give you an overview of the processing of your data as well as your rights in data protection and their enforcement.
Joerg Schober Hotelberatung processes the following personal data:
Master and contact data, e.g. name, academic degree, address, date of birth, telephone number, e-mail addresses, copies of ID cards, etc.
Contract data, e.g. business data such as capacity utilization and sales data, statistics, balance lists and KERF, balance sheets, consulting protocols, etc.
Image data: If you have given the necessary consent for processing.
Processing and order results for the fulfilment of contracts and consents
Data for the fulfilment of legal obligations and regulatory requirements
This list does not contain an exhaustive list of the data processed. I do not have all of the above-mentioned data for all data subjects. The scope of the data processing results from the contractual relationship or the consents given. You have the right to information! You can request a list of your data stored by me at js@hotel-kompetenz.at.
I receive the majority of your personal data through your intervention at the beginning of the contractual relationship by transmitting it on request, purely for the fulfilment of the contractually agreed consulting object.
Purpose and legal basis of personal data processing
Processing for the fulfilment of the contract:
Depending on the type of contract I conclude with you, I may provide certain services for you. These may include, for example, advice on sales and marketing, support in hotel controlling or the creation of text and other content material. To do this, I must process your data. You will find the scope of data processing in the contract documents.
Processing based on a legitimate interest:
This includes data processing in the context of legal prosecution and the processing of personal data for the purpose of direct advertising.
Processing on the basis of consent
If there is neither a contract nor a legitimate interest, data processing may still be lawful if you have given me your consent to do so. The scope and content of this data processing is always determined by the individual declaration of consent. It is important to note that you can withdraw your consent at any time. For example, you can revoke your consent at any time by post or e-mail.
However, the withdrawal of consent shall not affect the lawfulness of processing based on consent before its withdrawal.
Is there an obligation to disclose my data?
In order to fulfil our business relationship, I am dependent on many of your personal data. Without personal data such as your name, telephone number or e-mail address, it is not possible for me to contact you, which would significantly hinder the contractual relationship. In order to fulfil an order received from you, I need personal data, as otherwise I have no basis for my consulting activities.
I must therefore process your personal data if it is necessary for the business relationship on the basis of a contract or a legal provision. If you do not provide me with this data, it will often not be possible for me to offer you my services. If I am only allowed to process your data on the basis of your consent, you are not obliged to give this consent and provide the data.
The data is transmitted to the following recipients:
Third parties commissioned by me, e.g. IT service providers, photographers, printers, print agencies, graphic designers, etc., are contractually obliged to treat your data as strictly confidential. Third parties are contractually obliged to treat your data as strictly confidential and to process it only for the purpose of providing the service.

Disclosure to third parties may also take place if you have consented to the disclosure
Your data will not be transferred to any third country!
Obligation to retain personal data:
Personal data will be stored by me for the duration required to fulfil the individual purpose. This applies for the duration of the contractual relationship or your declaration of consent as well as for the statutory retention periods in accordance with Section 132 of the German Federal Fiscal Code and Section 1489 of the German Civil Code. After the end of the respective purpose, data is stored, for example, for the assertion of claims or due to accounting obligations. You have the right to information about all your personal data stored by me.
Security measures for personal data processing
Data protection and data security are important to me. I have therefore taken all technical and organizational measures to secure data processing. Your personal data is in good hands with me. I protect the data against unlawful processing and unintentional loss or damage. The protection of your data is ensured, for example, by up-to-date hardware and software, external and internal encryption, physical access controls and multiple backups.
Cookies, Google Analytics and social networks
My website uses cookies. Cookies make websites more user-friendly and efficient for the user and also serve to anonymously analyse the use of the website, to simplify the design of interactions with the website or to ensure an error-free application. Cookies are small text files that recognize you when you use the website again. Some cookies remain stored on your end device until you delete them. Cookies make it possible to recognize your browser on your next visit. However, no personal details, such as your name or address, are stored. This means that you cannot be identified by this information. If you do not want this, you can set up your browser so that it informs you about the setting of cookies and you only allow this in individual cases. Please note, however, that deactivating cookies may restrict the functionality of this website and you will therefore not be able to use all the functions of the website to their full extent. Cookies already stored on your computer can be deleted by you at any time. Please refer to the browser instructions under “Help” in the browser menu.
This website also uses Google Analytics, a web analysis service of Google Inc. 1600 Amphitheatre Parkway, Mountain View, CA 94043 USA (“Google”). Google Analytics uses cookies, which are stored on your computer and enable your use of the website to be analysed. The information generated in this way is transferred to the Google server and stored there. Our website uses the IP anonymization option offered by Google Analytics. Your IP address will therefore be shortened and further anonymized by Google within the member states of the European Union or in other contracting states of the Agreement on the European Economic Area. Google will use the information to evaluate the use of the website, to compile reports on website activity and to provide other services relating to website activity and internet usage. Google may also transfer this information to third parties where required to do so by law, or where such third parties process the information on Google’s behalf. Google has undertaken not to associate your IP address with any other data held by Google. You can also prevent the transmission and storage of your information in this context by setting up your browser so that no cookies are stored. You can also prevent Google from collecting your data in connection with Google Analytics by downloading and installing the browser plug-in available at the following link: http://tools.google.com/dlpage/gaoptout?hl=de . Google is headquartered outside the EU. According to the decision of the EU Commission of July 12, 2016, the requirements of the “Privacy Shield” applicable in the USA correspond to the level of data protection in the EU.”
I work together with various social networks such as Facebook. When you use these social networks, your browser is automatically connected to the relevant network. Your IP address and other information will be transmitted if you have previously visited the platform in question. The data is only transmitted after you have interacted with it. By clicking on the relevant icon, you indicate that you agree to communicate with the selected platform and that information about you will be transmitted to this social network. In these cases, please note that you are then subject to the terms of use of the social media providers or the partners of the group of companies and that I have no influence over these.
Your rights
The GDPR grants you the following rights to your personal data:
Right of access (Article 15 GDPR)
Right to rectification (Article 16 GDPR)
Right to erasure (Article 17 GDPR)
Right to restriction of processing (Article 18 GDPR)
Right to data portability (Article 20 GDPR)
Right to object (Article 21 GDPR)
The right to information
The right of access gives you the opportunity to obtain confirmation from me as to whether I am processing your personal data. If I do so, you also have the right of access to all your processed personal data and to the following information:
Purposes of the processing
Categories of personal data processed
Categories of recipients to whom your personal data is transferred
The duration for which the personal data will be stored or, if this is not possible, the criteria for determining this duration
Legal information about your rights to rectification, erasure, restriction or objection
Right to lodge a complaint with the supervisory authority
All available information about the origin of the personal data if it is not collected from you (the data subject)
whether automated decision-making including profiling exists (Article 22 (1) and (4) GDPR)
Automated decision-making, including profiling, is not carried out at Jörg Schober Hotelberatung!
The right to rectification
Your data should always be processed correctly and completely. If incorrect or incomplete processing is suspected, you can request that the data be corrected or completed.
The right to erasure
Data processing is only carried out for specified, clear and legitimate purposes. Data is only collected and stored if it is absolutely necessary to fulfill the individual purpose. If the storage purpose no longer applies, the data is deleted in accordance with the deletion periods. The principles of appropriateness and proportionality in data processing are observed. The principle of data minimization applies. If you nevertheless suspect that this is not the case, you can request the deletion of your personal data for the following reasons:
The personal data are no longer necessary for the purposes for which they were collected or otherwise processed
If you withdraw your consent, which was the legal basis for the processing (Article 6(1)(a) GDPR), if there is no other legal basis for the processing.
You object to the processing (Article 21 (1) GDPR) and there are no overriding legitimate grounds for the processing.
The personal data were processed unlawfully (without cause).
The deletion of personal data is subject to a legal obligation under EU law or the law of the Member States of the data controller.
The personal data was collected in relation to information society services offered (Article 8 (1) GDPR) (minor regulation).
The right to “be forgotten”
With the right to “be forgotten”, the legislator has published personal data in mind. If a person deletes data that they have already published, they must inform all recipients who have received the data as a result of the publication of the deletion. The GDPR refers here primarily to internet search engines.
The right to restriction of processing
This right allows you to prohibit the use of your data in the event of unlawful data processing. This means that the data will not be deleted immediately, but it may no longer be used by the controller. If it appears that your data is being processed unlawfully, you can request that the processing of your personal data be restricted.
However, this only applies for the following justified reasons:
You dispute the accuracy of your personal data. For the duration of the verification by the controller, you may request that the processing be restricted.
The processing of personal data is unlawful. Instead of deletion, however, you “only” wish to restrict the use of the personal data.
The controller no longer needs your personal data for processing purposes. However, you need the data to assert, exercise or defend legal claims.
You have objected to the processing (Article 21 (1) GDPR). Until it is clear whether the legitimate reasons of the controller outweigh your interests, you can request the restriction of processing.
The right to data portability
As your data is your property, you can request to receive it in a structured, commonly used and machine-readable format. This applies to all data that I process automatically on the basis of our contractual relationship or your consent. You can also instruct me to transfer your data directly to another controller. Please bear in mind that a direct transfer to a third party will make all transferred data known to the third party. The protection of your data is a valuable asset, so please consider carefully who you wish to grant access to. Your processed data may also contain personal data of other persons. For example, if other persons appear in shareholdings. These persons also have rights and freedoms.
It will only be forwarded to third parties,
if you expressly instruct me to do so,
if the recipient is a government agency, law firm, notary’s office or tax consultant.
The right to object
In addition to the legal basis of legal obligation, contractual relationship and consent, data may also be processed on the basis of a legitimate interest. You must be informed of this. If you assume that the legitimate interest does not exist, you can object to this. This primarily concerns the legitimate interest of direct advertising. If the controller is unable to demonstrate legitimate grounds for further processing, it may no longer process the personal data after the objection.
Processing your applications
You can send your requests to me either by post (Joerg Schober Hotelberatung, Bei der Saeule 12, A-6060 Hall in Tirol) or by e-mail ( js@hotel-kompetenz.at). Please make your request as specific as possible so that I can process it as quickly as possible.
However, before I can process your application, I must check your identity so that your data is not transmitted to an unauthorized person. In case of doubt, I will carry out a more detailed identity check. This is primarily to protect your personal data.
In principle, I will endeavor to examine your application without delay. However, I will inform you of the appropriate measures within one month of receiving your application. This period may be extended by 2 months if your application is very complex or there are a large number of applications. However, you will be informed of any extension of the deadline within one month of receipt of your application.
You can submit your applications free of charge. You will not incur any costs other than the postage costs or the transmission costs according to the existing basic tariffs. There is one exception to this: In the case of manifestly unfounded or excessive applications, I am entitled to charge you a reasonable fee. This takes into account the administrative costs for the notification, refusal or implementation of the requested measure.
Possibility of complaint
If you have any questions, suggestions or complaints about data protection, you can contact me at any time (js@hotel-kompetenz.at). In the event of suspected data protection violations, you can also lodge a complaint with the Austrian Data Protection Authority.
Competent supervisory authority:
Austrian Data Protection Authority
Barichgasse 40-42
1030 Vienna
Austria
Phone: +43 1 52 152-0
E-mail: dsb@dsb.gv.at
https://www.dsb.gv.at/

If you have suffered material or non-material damage as a result of a breach of the GDPR or Sections 1 or 2 of the first main section of the FADP 2018, you are entitled to claim compensation from the controller or the processor (Article 82 GDPR). The provisions of civil law apply. The regional court in your district has jurisdiction. However, you can also file applications and lawsuits with the regional court in whose district the defendant has their habitual residence, registered office or place of business.