Privacy Policy
Client: Goodie Tech OG
Date: 22.05.2025
Update: 22.05.2026 (recommended)
I. Overview
If we may welcome you as a customer or business partner of our company or if you use our GuestGoodie application (as a guest of a hotel), please read from Section III. ATTENTION: In Section II you will also find cookies that may be used when using GuestGoodie.
If you visit our website, please read from Section II.
II. Which data do we process when you visit our website?
Welcome to our website! Please get an overview of how we process your personal data when you visit our website (Art 13, Art 14 GDPR; § 165 Para 3 TKG).
Processed data during website visit
When visiting our website, the following data may be processed:
- Browser type
- Operating system
- Country
- Date
- Time and duration of access
- IP address¹ and visited pages on our website including entry and exit pages
- Contact page on website
- Device data: We may store personal data from your device. Such data includes geolocation data, IP address, unique identifiers (e.g. MAC address)
- Data you enter in the course of scheduling appointments
- Email address
- First and last name
- Email in the course of newsletter dispatch
- Payment data
¹ An IP address is a number assigned to a device. Using this IP address, devices can communicate over the Internet. Each IP address contains information about the Internet service provider used and the physical location of the device used. In this way, information about the user of the device can be obtained.
Legal basis
The processing of this data is necessary to ensure the security of the website's operation and to ensure the functionality of the website from a technical perspective. The collection of this data is partly done via technical cookies. These technical cookies are only used to the necessary extent (§ 165 Para 3 TKG). The processing of this data is justified by our legitimate interest in operating our website (Art 6 Para 1 lit f GDPR).
Data recipients for website operation
For the operation of our website, it may be necessary for us to disclose your data to the following recipients:
Google LLC (Google Analytics)
- Purpose: Marketing and website optimization (statistical purposes)
- Legal basis: Consent regarding Google Analytics (Art 6 Para 1 lit a GDPR)
- Business location: USA
- Secure third country transfer: Google LLC is listed under the EU-US Data Privacy Framework (HR & Non-HR data)
HubSpot, Inc. (CRM)
- Purpose: Sales data management (contact and sales activities)
- Legal basis: Predominantly legitimate interest (Art 6 Para 1 lit f GDPR)
- Business location: USA
- Secure third country transfer: HubSpot is listed under the EU-US Data Privacy Framework (Non-HR data)
Amazon.com, Inc (Amazon Web Services)
- Purpose: Website hosting
- Legal basis: Predominantly legitimate interest (Art 6 Para 1 lit f GDPR)
- Business location: USA
- Secure transfer: AWS is listed under the EU-US Data Privacy Framework (Non-HR data)
Microsoft (Clarity)
- Purpose: Analysis of visitor behavior on the website
- Legal basis: Consent (Art 6 Para 1 lit a GDPR)
- Business location: USA
- Secure transfer: Microsoft is listed under the EU-US Data Privacy Framework (HR & Non-HR data)
II.1. Overview of "technical" cookies used
The above-mentioned data is stored via so-called "cookies"². Cookies are text files that are stored on your computer and enable an analysis of the use of the website. They serve to recognize and store temporary data from homepage visits. We generally only use cookies to the extent necessary to communicate with you via the homepage.
These technical cookies are activated as soon as you visit our website.
The following cookies are used on our platform based on our predominantly legitimate interest (Art 6 Para 1 lit f GDPR):
An overview of the technical cookies used can be found in our Cookie Policy.
² You can prevent the storage of cookies by setting your browser software accordingly. However, we would like to point out that in this case you may not be able to use all the functions of this homepage to their full extent.
II.2. Overview of "Analytics Cookies" used
In addition to the "technical cookies" described above, we also use so-called analytics cookies (including "statistical cookies"). These analytics cookies enable us to better understand and evaluate your interests. With the help of analytics cookies, we can combine your "surfing behavior" beyond the boundaries of our website with data from other websites. This should enable us to better understand the interests of our homepage visitors and address them more specifically and to improve our website.
We respect that not every website visitor wants this. Therefore, we process your data in the context of analytics cookies only if you agree to it (Art 6 Para 1 lit a GDPR). You can revoke this consent at any time, whereby the data processing carried out up to the time of revocation remains justified.
The following analytics cookies are currently used:
An overview of the analytics cookies used can be found in our Cookie Policy.
III. For what purposes do we process your data when you are our customer, have a business relationship with us or use our application(s)?
In the course of our business relationship with customers and business partners as well as the provision of GuestGoodie for users, we process data based on contractual (processing of the contractual relationship with you, pre-contractual obligations, billing of services, sending of documents, communication for contract processing, provision of the application) and legal obligations (legally required retention in accordance with § 132 BAO) (Art 6 Para 1 lit b and c GDPR) as well as based on our legitimate interests or based on legitimate interests of third parties (Art 6 Para 1 lit f GDPR), namely:
Processing purposes
- Internal administration: for the purpose of internal administration and management of your business case to the necessary extent (e.g.: processing your business case, due diligence review by potential investors, filing, archiving purposes, correspondence with you)
- GuestGoodie application: for the purpose of providing the GuestGoodie application
-
Direct marketing: for the purpose of direct
marketing (e.g.: postal mail, email dispatch, satisfaction surveys,
congratulatory letters, statistical evaluations)
- We would like to expressly inform you that you can object to the processing of your data for the purpose of direct marketing.
- Legal claims: Assertion and defense of legal claims
in each case to the necessary extent. The processing of your data serves the initiation, maintenance and processing of our business relationships. If you do not provide us with this data, we unfortunately cannot process your business case.
If applicable, we process your data based on your voluntary, express consent (Art 6 Para 1 lit a GDPR).
III.1. Which data is processed in connection with the processing of a business relationship?
When processing or fulfilling the business relationship with our customers and service providers, the following personal data or categories of personal data are processed:
- Availability to obtain services
- Name of employees and providers
- Email of employees and providers
- (voluntary) Photo of the employee and provider
- Order processing time
- Employee log-ins
- Payment data
III.2. Which data is processed when using the GuestGoodie application?
In the course of using the GuestGoodie application, the following personal data or categories of personal data are processed:
- Guest name
- Check-in date
- Check-out date
- (if applicable) Guest email
- Room number
- Guest orders
IV. How long is your data stored?
We will only store your data for as long as is necessary for the purposes for which we collected your data. In this context, legal retention obligations must be taken into account (for example, for tax reasons, contracts and other documents from our contractual relationship must generally be retained for a period of seven years (§ 132 BAO)).
In justified individual cases, for example to assert and defend legal claims, we may also store your data for up to 30 years after the end of the business relationship.
Data from interested parties is stored for up to one year from the time of the last contact by the interested party.
V. Who may receive your data?
In the course of our business relationship and the use of the application, it may be necessary for us to transmit your data to the following recipients:
HubSpot, Inc. (CRM)
- Purpose: Sales data management (contact and sales activities)
- Legal basis: Predominantly legitimate interest (Art 6 Para 1 lit f GDPR)
- Business location: USA
- Secure third country transfer: HubSpot is listed under the EU-US Data Privacy Framework (Non-HR data)
Amazon.com, Inc (Amazon Web Services)
- Purpose: Hosting of GuestGoodie
- Legal basis: Predominantly legitimate interest (Art 6 Para 1 lit f GDPR)
- Business location: USA
- Secure transfer: AWS is listed under the EU-US Data Privacy Framework (Non-HR data)
The accommodation provider
- Purpose: Execution of ordered services or goods
- Legal basis: Contractual obligation (Art 6 Para 1 lit b GDPR)
- Secure transfer: Within the EU or EEA
Provider of the ordered goods or service
- Purpose: Execution of ordered services or goods
- Legal basis: Contractual obligation (Art 6 Para 1 lit b GDPR)
- Secure transfer: Within the EU or EEA
Runple GmbH
- Purpose: Accounting software
- Legal basis: Predominantly legitimate interest (Art 6 Para 1 lit f GDPR)
- Business location: Austria
- Secure transfer: Within the EU
Microsoft
- Purpose: Outlook
- Legal basis: Predominantly legitimate interest (Art 6 Para 1 lit f GDPR)
- Business location: USA
- Secure transfer: Microsoft is listed under the EU-US Data Privacy Framework
Auditor and tax advisor (Wirtschaftstreuhand-Kanzlei Marihart-Kretzschmar)
- Purpose: Tax consulting
- Legal basis: Contractual necessity
- Country: Austria
- Basis for transfer: Within the EEA
Banks (BAWAG; easybank)
- Purpose: Payment processing
- Legal basis: Contractual obligation
- Country: Austria
- Basis for transfer: Within the EEA
Lawyers, courts, dispute resolution (Dr. Tobias Tretzmüller Rechtsanwalts GmbH)
- Purpose: Pursuit and defense of legal claims
- Legal basis: Predominantly legitimate interests
- Country: Austria
- Basis for transfer: Within the EEA
HubSpot (Newsletter)
- Purpose: Newsletter dispatch
- Legal basis: Consent
- Country: USA
- Basis for transfer: HubSpot is listed under the EU-US Data Privacy Framework (Non-HR data)
exali AG (Insurance)
- Purpose: Insurance
- Legal basis: Predominantly legitimate interests
- Country: Germany
- Basis for transfer: Within the EEA
Stripe, Inc
- Purpose: Payment processing
- Legal basis: Contractual necessity (Art 6 Para 1 lit b GDPR)
- Business location: USA
- Secure transfer: Stripe Inc is listed under the EU-US Data Privacy Framework
VI. Collection of data from other sources (Art 14 GDPR)
We do not obtain data from third-party sources
VII. Does automated decision-making or profiling take place (Art 13 Para 2 lit f GDPR)?
No automated decision-making or profiling takes place in our company.
VIII. What rights do you have regarding data processing?
We would like to inform you that, provided the legal requirements are met, you:
Your rights at a glance
- Right to information: Have the right to request information about which of your data is processed by us (see Art 15 GDPR in detail)
- Right to rectification: Have the right to request the rectification or completion of incorrect or incomplete data concerning you (see Art 16 GDPR in detail)
- Right to erasure: Have the right to erasure of your data (see Art 17 GDPR in detail)
- Right to object: Have the right to object to processing of your data that is necessary to protect our legitimate interests or those of a third party (see Art 21 GDPR in detail). This applies in particular to the processing of your data for advertising purposes
- Data portability: Have the right to receive the transfer of the data you have provided in a structured, common and machine-readable format
Withdrawal of consent
If we process your data based on your consent, you have the right to withdraw this consent at any time by email. This does not affect the lawfulness of the data processing carried out up to this point (Art 7 Para 3 GDPR).
IX. What complaint rights do you have?
Should there be, contrary to expectations, a violation of your right to lawful processing of your data, please contact us by post or email. We will endeavor to process your request promptly. However, you also have the right to lodge a complaint with the supervisory authority responsible for data protection matters.
Austrian Data Protection Authority
Address:
Österreichische Datenschutzbehörde
Barichgasse 40-42
1030 Vienna
X. How can you contact us?
Should you have any further questions about the processing of your data, you are welcome to contact our data protection coordinator using the contact details provided below.
XI. Controller
The controller within the meaning of Art 4 No 7 GDPR is:
Name: Goodie Tech OG
Address: Adamsgasse 18/Top 12, 1030 Vienna, Austria
Phone: +43 699 119 719 73
Email: selina@guestgoodie.com
Author of this privacy policy: RA Dr. Tobias Tretzmüller, LL.M.; www.digital-recht.at
*Use of this privacy policy, or even parts thereof, without the consent of the author constitutes a copyright infringement