Legal

Privacy

This statement describes which personal data are processed when you visit this website, for what purpose, on what legal basis and for how long. Content from external providers such as YouTube videos, the Google map or the webcams only loads when you actively click on it. Our visitor statistics and Google Ads only run if you expressly consent in the cookie notice — all at once or individually per category.

Controller

Sport-Center Knitel Walter GmbH
Warth 54 · 6767 Warth · Austria
Phone: +43 5583 3612
Email: [email protected]

All services used at a glance

Here you will find every service that may receive data when you visit this website or use our services — with provider, registered office, purpose, time and the basis for any transfer outside the EU. Services based in the USA are marked “USA”. Details can be found in the relevant sections below.

Links to other websites (such as Instagram, brands in the SPAR supermarket or tourism associations) load nothing until you click them; after that, the privacy policy of the respective website applies.

Transfer to the USA

Several of the providers mentioned above are based in the USA or belong to US groups: Cloudflare, Google (Google Ads, YouTube, Google Maps), WhatsApp, Cisco Meraki and Anthropic, as well as Microsoft as the parent company. On 10 July 2023 the European Commission adopted an adequacy decision for the USA (EU-US Data Privacy Framework, Art. 45 GDPR). It applies to companies that have certified under it; according to the official list (dataprivacyframework.gov, as of September 2026) these are Cloudflare, Google, Microsoft, Cisco and WhatsApp. Anthropic is not certified; for Anthropic we base the transfer on the European Commission’s standard contractual clauses (Art. 46(2)(c) GDPR).

Please note: the adequacy decision is legally contested. An appeal against its confirmation by the General Court of the European Union (judgment of 3 September 2025, T-553/23) is pending before the Court of Justice of the European Union (C-703/25 P). In the USA, authorities may access data under certain conditions, and you do not always have the same legal remedies there as in the EU. The decision is therefore no permanent guarantee: should it be annulled, we will base the transfer on the European Commission’s standard contractual clauses (Art. 46(2)(c) GDPR), where agreed with our providers, or discontinue the service concerned, and update this policy.

That is why data only reaches a US service if this is necessary to operate the website or if you trigger it yourself: Cloudflare, as our hosting provider, is technically necessary and contractually bound by our instructions. Google Ads only runs with your consent to the “Marketing” category — this consent expressly also covers the transfer of your data to the USA (Art. 49(1)(a) GDPR). YouTube, Google Maps and WhatsApp only connect after you click, and the AI search only after you click “Answer from our AI”. You can withdraw your consent at any time via “Cookie settings” at the bottom of every page.

The same applies to the “Ask us” chat assistant: your questions only reach Anthropic (USA) when you send a question there.

Hosting and server log files

This website is hosted by Cloudflare, Inc. (San Francisco, USA). When you visit it, Cloudflare automatically processes technical information transmitted by your browser — such as your IP address, date and time, the page requested, the amount of data transferred and the browser used — in order to deliver the page and protect it against attacks. The legal basis is our legitimate interest in secure and stable operation (Art. 6(1)(f) GDPR). As our processor, Cloudflare is contractually bound by our instructions and is certified under the EU-US Data Privacy Framework.

To protect against attacks and automated access, Cloudflare may additionally run a small check script in your browser (addresses under “/cdn-cgi/challenge-platform/”) that evaluates technical characteristics of the browser in order to tell people apart from automated programs, and may set a technically necessary cookie for this purpose, such as “__cf_bm” (valid for up to 30 minutes) or “cf_clearance” (possible even without a visible check, valid for knitel-arlberg.com and its subdomains, up to one year depending on the Cloudflare setting). Cloudflare may also obscure email addresses on our pages to protect them from being harvested by spam programs (addresses under “/cdn-cgi/l/email-protection”); the address is then only made readable again in your browser, and no additional data about you is collected. Whether and when this happens depends on the security settings at Cloudflare. The legal basis is our legitimate interest in secure operation (Art. 6(1)(f) GDPR); access to your device is strictly necessary for this (§ 165(3) Austrian TKG 2021) and therefore does not require consent.

Visitor statistics (only with your consent)

Only if you allow the "Statistics" category in the cookie notice (individually in the settings or with "Accept all") do we count your page views on our own server. We store the time, the page visited, the name of the website you came from (without path or search terms), a shortened IP address (the last part is removed before saving), country and region, a rough device and browser category (e.g. "mobile, iOS, Safari") and your preferred browser language. Cloudflare roughly derives country and region from the IP address. To be able to count the number of visitors per day, we also compute, from the IP address and browser identifier, a checksum whose key changes daily and is deleted after two days; it does not allow us to recognise you across several days. We also record, roughly, whether the visit obviously comes from an automated program (such as a search engine, testing tool or data centre); we derive this at the moment of the visit from the browser identifier, the network provider and Cloudflare's bot assessment and store only this flag. We do not store the full IP address, your town or the browser identifier string, and we do not set any cookies for this. The purpose is to see which pages are used and how. The legal basis is your consent (Art. 6(1)(a) GDPR, § 165(3) Austrian TKG 2021). The entries are deleted automatically after 30 days. Access is restricted to specifically authorised staff via a password-protected internal area; the data are not passed on to third parties and are not combined with other data.

We store the entries with our hosting provider Cloudflare, Inc. (USA), which as a processor is bound by our instructions. Your consent to the “Statistics” category expressly also covers this storage in the USA (Art. 49(1)(a) GDPR); see “Transfer to the USA” for more.

In addition, with the same consent we use Cloudflare Web Analytics. A small script from Cloudflare, Inc. (USA) reports which page was viewed (without search parameters), which website you came from, country, device type, browser, operating system and the page loading times; your IP address is processed for the transmission. Cloudflare sets no cookies for this and stores nothing in your browser; we only see aggregated figures. The purpose is to make the website faster and better. The legal basis is your consent (Art. 6(1)(a) GDPR, § 165(3) TKG 2021), which expressly also covers the transfer to the USA (Art. 49(1)(a) GDPR); Cloudflare is certified under the EU-US Data Privacy Framework and acts as our processor. Without your consent the script is not loaded; if you withdraw it, the page is reloaded and the script removed.

Guest Wi-Fi registration

To give you access to our free guest Wi-Fi at the Hotel Garni, we record your room number, your name if you wish, and the time of sign-in. The purpose is to link Wi-Fi access to your stay and to be able to follow up in the event of misuse. The legal basis is our legitimate interest (Art. 6(1)(f) GDPR). The Wi-Fi cannot be used without a room number; giving your name is optional. We do not record your e-mail address, phone number or IP address. The entries are deleted automatically after 60 days. Only specifically authorised staff have access, via a password-protected internal area; the data is not passed on to third parties.

The guest Wi-Fi itself runs on network technology from Cisco Meraki (Cisco Systems, Inc.), which is managed via the provider’s cloud service. When you connect and are granted access, this system processes technical connection data of your device, such as the device identifier (MAC address), the assigned IP address and the time, in order to provide access (Art. 6(1)(f) GDPR). Cisco acts as our processor; data may be transferred to the USA.

Cisco Meraki stores these connection logs in its cloud service; how long depends on the settings of our Meraki account.

Google Ads (only with your consent)

Only if you allow the "Marketing" category in the cookie notice (individually in the settings or with "Accept all") do we load the Google Ads Google tag. It measures how many booking requests, phone calls or WhatsApp contacts result from a Google ad (conversion measurement). Personalised advertising and remarketing are switched off: we explicitly signal to the Google tag not to use your data for personalised advertising. The legal basis is exclusively your consent (Art. 6(1)(a) GDPR, § 165(3) Austrian TKG 2021); without consent, the Google tag is not loaded. There is no device fingerprinting and no location request on this website.

When it loads, the Google tag transmits technical information to Google, in particular your IP address, the page visited, details of your browser and device, and identifiers from Google cookies. After a booking request has been successfully submitted, or after a click on our phone number or the WhatsApp button, the fact of this action is added — no names, email addresses, phone numbers or other form content. Provider: Google Ireland Limited, privacy policy: policies.google.com/privacy.

Google processes this data as an independent controller and sets its own cookies (including the cookie “_gcl_au”, stored for up to 90 days, and the entry “_gcl_ls” in your browser’s local storage). A transfer to Google LLC in the USA is possible; Google LLC is certified under the EU-US Data Privacy Framework (adequacy decision, Art. 45 GDPR). If you withdraw your consent, we delete the Google cookies on our domain and no longer load the Google tag.

Your consent to the “Marketing” category expressly also covers this transfer to the USA (Art. 49(1)(a) GDPR). In the USA, authorities may under certain circumstances access data, and you do not always have the same legal remedies there as in the EU; see “Transfer to the USA” for more.

You can change your selection or withdraw your consent at any time with effect for the future — here or via "Cookie settings" at the bottom of every page:

Withdraw consent

Proof of your cookie decision

We are legally required to be able to demonstrate that you have given consent and what you were informed about (Art. 7(1) GDPR). We therefore log every decision made in the cookie notice — “Accept all”, “Necessary only” or your own selection per category — as well as every withdrawal. The only things stored are: the time, your decision including the categories allowed, which button you chose, how the notice was opened and whether it was your first decision on this device, the version of the notice text shown to you together with a checksum of that text, the language and a randomly generated proof reference. We do not store your IP address or the page visited for this. Every entry is electronically signed so that later changes can be detected; we keep the exact wording of every version of the notice in an archive.

This reference contains no information about you and is used solely for this proof — not to recognise you, and not for advertising. It is also stored in your browser’s local storage so that a later withdrawal can be matched to the same decision. Without this reference we cannot link an entry to any person; if you would like to know what is stored about you, please give us your reference. The legal basis is the fulfilment of the above documentation obligation (Art. 6(1)(c) or (f) GDPR); this logging therefore runs regardless of how you decide. Your choice is valid for twelve months; after that we ask you again. We keep the entries for three years, because complaints and claims arising from them are possible for that long (§ 24(4) Austrian Data Protection Act, DSG); if you consented, the three years run from the end of these twelve months, i.e. four years in total. If you later change or withdraw your choice, we keep that entry at least as long as the consent it relates to, so that the record stays complete. After that they are deleted automatically. If you ask us to delete your entry earlier, we only record that and when we deleted it, together with a non-reversible short value of your reference so that we can prove the deletion if you quote the reference again — we do not keep your reference itself. This record is deleted after three years.

Cookies and Local Storage

We ourselves do not set any cookies for advertising or analytics purposes; only if you consent to the “Marketing” category does Google Ads set its own cookies (see above). For some functions we use your browser’s local storage (localStorage or sessionStorage), namely for:

The cookie notice remembers that you have already seen it, your choice per category (statistics, marketing) for twelve months and the corresponding proof reference (see “Proof of your cookie decision” above).
The window announcing special offers remembers for the duration of your visit that it has already been shown, and the notice bar at the top of the page that you have closed it.

This information remains exclusively on your device and is not transmitted to us or third parties — with one exception: your cookie decision together with its proof reference (see above). You can delete it at any time via your browser settings.

This storage is technically necessary for the website to provide the functions you use and is therefore permitted without consent (§ 165(3) Austrian TKG 2021). The legal basis for the associated processing is our legitimate interest in a functional and fast website (Art. 6(1)(f) GDPR).

Embedded Third-Party Content

Some pages embed content from external providers. As a rule, this does not load automatically but only once you click the relevant preview tile — only then can that provider process your IP address and set its own cookies.

YouTube videos (video library on “Warth am Arlberg”): the provider is Google Ireland Limited. Clicking a video establishes a connection to YouTube. Privacy policy: policies.google.com/privacy.

Google Maps (directions map): also Google Ireland Limited, loads only after you click “Load map”. Privacy policy: policies.google.com/privacy.

Snow report (intermaps.com): delivers the live winter sports report for the Warth-Schröcken ski resort, loads only after you click “Load snow report”.

Online reservation and online check-in (easyresv3.wintersteiger.at): the provider is WINTERSTEIGER AG (Dimmelstraße 9, 4910 Ried im Innkreis, Austria), which operates the easyRent reservation system on our behalf as our processor; it loads only after you click. What you enter there (such as name, contact details, body measurements for the equipment and dates) we process to carry out your reservation (Art. 6(1)(b) GDPR).

Ski pass tickets (skiarlberg.at): purchase and processing take place exclusively via Ski Arlberg — we are not a point of sale. This tile, too, loads only after you click.

Webcams Ski Arlberg: the same live cameras that Ski Arlberg (skiarlberg.at) also shows itself. Provider depends on the camera: Panomax GmbH (panomax.com), Feratel media technologies GmbH (webtv.feratel.com) or foto-webcam.eu. Each camera opens individually in a popup only after you click it — only then is a connection established to the respective provider.

Piste map (winter.intermaps.com): the interactive map of the ski area, loads only after a click.

By clicking, you consent to the connection to the respective provider (Art. 6(1)(a) GDPR). For providers outside the EU, such as Google, a transfer to the USA is possible.

Weather, webcam previews and address suggestions

Some content is fetched from external services by our server on your behalf, so that these providers never receive your IP address: the live weather data (Open-Meteo), the webcam preview images and — in the booking form, while you type — suggestions for address and town (komoot Photon based on OpenStreetMap, OpenPLZ API, only for Austria, Germany, Switzerland and Liechtenstein). The providers only receive the coordinates or the search term you typed, no information about you. The address suggestions are optional; all fields can also be filled in without them. The purpose is to show you up-to-date information and make filling in the form easier without passing your data on to these providers. The legal basis is our legitimate interest in an informative and data-minimising website (Art. 6(1)(f) GDPR) and, in the booking form, the handling of your enquiry (Art. 6(1)(b) GDPR). Our server keeps the services’ responses in its cache for at most one day so that the providers are not queried unnecessarily often; only the search term is stored, nothing about you.

Search and chat assistant with AI

In the site search and in the chat assistant you can ask questions to an artificial intelligence. Your question is sent via our server to Anthropic (contracting party: Anthropic Ireland, Limited; processing by Anthropic, PBC, San Francisco, USA), which generates the answer with the Claude language model on the basis of the public content of this website. Anthropic only receives the text of your question, the language of the page and, in the chat, up to seven previous messages of the conversation — not your IP address, no cookies and no device data. We ourselves do not store the conversations, neither on our server nor in your browser; to prevent misuse, your IP address is processed only briefly in memory to limit the number of requests. Under its terms of business, Anthropic does not use data submitted via its interface to train its models and deletes it automatically within 30 days. The transfer to the USA is based on the European Commission’s standard contractual clauses (Art. 46(2)(c) GDPR); Anthropic is not certified under the EU-US Data Privacy Framework.

The legal basis is your consent (Art. 6(1)(a) GDPR), including the transfer to the USA: before your first question you confirm with “I agree” that your questions may be sent to Anthropic. The consent applies only to the current page view and is not stored; you can withdraw it at any time by not asking any further questions. Without consent you can still find answers using the normal site search. The answers are generated automatically and may contain errors — only the information on our website and our personal advice are binding. Please do not enter any sensitive personal data in the chat; for bookings, please use the enquiry form or write to us directly.

Booking Requests and Contact

The information you enter in the booking form (name, e-mail address, phone number, dates, number of guests and, if you wish, address and message) is transmitted to our server in encrypted form when you submit it. We receive the enquiry by e-mail together with a PDF summary, and you receive an automatic confirmation at the address you provided; the e-mails are sent via Microsoft 365 (Microsoft Ireland Operations Limited). Microsoft Ireland belongs to Microsoft Corporation (USA); access from the USA is possible and is safeguarded by the EU-US Data Privacy Framework, under which Microsoft is certified (Art. 45 GDPR), and by standard contractual clauses. Microsoft acts as our processor. The legal basis is the handling of your enquiry prior to a possible contract (Art. 6(1)(b) GDPR). Without your name, e-mail address and phone number we cannot process your enquiry; address and message are optional.

We need your phone number so that we can reach you quickly with questions about your request — for example about the room, the dates or availability — and before your arrival; we use it only for this request. To prevent misuse of the form, internet addresses in your details are made unrecognisable in both emails, and for one hour we store a checksum of your email address and IP address, whose key changes daily, in order to limit the number of requests (Art. 6(1)(f) GDPR).

If no booking results, we delete your enquiry no later than one year after the last contact. If a booking is made, we keep the documents for as long as tax and commercial law requires, usually seven years (Section 132 BAO, Section 212 UGB). Contact our team: [email protected].

The WhatsApp button opens WhatsApp with a pre-filled message to our number. The provider is WhatsApp Ireland Limited; its privacy policy applies. The connection is only established once you actively click the button.

Recipients and transfers to third countries

We only pass on your data to service providers we need for our operations and who, as processors, are contractually bound by our instructions: Cloudflare, Inc. (hosting and storage), Microsoft Ireland Operations Limited (e-mail), Anthropic, PBC (AI answers) and Cisco Systems, Inc. with Cisco Meraki (guest Wi-Fi). Google only receives data with your consent and processes it as an independent controller; WhatsApp and the providers of embedded content only receive data after your click. Where data reaches the USA in the process, this is based on the adequacy decision for the EU-US Data Privacy Framework (Art. 45 GDPR) or the European Commission’s standard contractual clauses (Art. 46 GDPR). There is no automated decision-making or profiling within the meaning of Art. 22 GDPR.

The complete list of all services with provider, registered office, purpose and storage period can be found above under “All services used at a glance”, and details on the US services under “Transfer to the USA”.

Retention periods at a glance

Visitor statistics (only with your consent): 30 days.
Cloudflare Web Analytics (only with your consent): aggregated figures according to Cloudflare’s retention periods, no cookies.
Guest Wi-Fi sign-ins: 60 days.
Guest Wi-Fi connection logs at Cisco Meraki: according to the settings of our Meraki account.
Misuse protection for booking requests (checksums of email and IP address): one hour.
Cloudflare security cookies: “__cf_bm” up to 30 minutes, “cf_clearance” up to one year depending on the Cloudflare setting.
Record of your cookie choice: three years; if you consented, four years (twelve months’ validity of your choice plus three years).
Booking enquiries without a booking: one year after the last contact; with a booking: usually seven years (statutory retention obligation).
Google Ads cookies (only with your consent): up to 90 days according to Google.
Settings in your browser’s local storage: until you delete them; your cookie choice is valid for twelve months.
Questions to the AI: not stored by us; Anthropic keeps them only briefly.

Your Rights

You have the right to access, rectify, erase, and restrict the processing of your data, as well as to data portability and objection. Simply contact us at [email protected].

Your right to object

Where processing is based on our legitimate interest, you may object to it at any time on grounds relating to your particular situation (Art. 21 GDPR). You may withdraw your consent at any time with effect for the future; this does not affect the lawfulness of processing carried out before the withdrawal.

You also have the right to lodge a complaint with the Austrian data protection authority: Barichgasse 40–42, 1030 Vienna, dsb.gv.at.

Last updated: September 2026.

Back to the homepage →