1. Who is responsible
The host is responsible for your enquiry: Sabine Dorn, Ferienwohnung am Bach, Sabine Dorn, Bach 33, A-6943 Riefensberg, email sabine.dorn@vorarlberg.at, phone 0043 664 6255407.
2. What happens to your enquiry
When you send an enquiry through the calendar, the following is processed: your name, email address, phone number (if you give it), arrival and departure, the number of guests and pets, your message, the language of the enquiry and the price the calendar showed you. The host needs these details to reply, to make you an offer and to handle your booking (Art. 6(1)(b) GDPR). Without them no enquiry is possible. Your enquiry also goes to the host by email; you only get a reply when the host sends one. If the host enters a booking by hand, for example after a phone call, the same applies to your details. The host can keep notes on your stay; apart from the host, only their cleaners see them (section 5).
If you booked through a platform such as Airbnb or Booking.com, the calendar takes only the booked dates from there, and from Airbnb the reservation code, never your name or contact details. This way the host sees all bookings in one place and never lets a day twice (Art. 6(1)(b) and (f) GDPR). For everything else, the platform’s privacy notice applies.
If the host quotes reviews from their own Airbnb or Booking.com listings on their page, it shows the text, the first name, the platform and the month, as they are public on the platform. This tells visitors how guests found their stay (Art. 6(1)(f) GDPR). If you would rather not be quoted, tell the host and they will take the quote down.
If the host asks you for a review with a personal link after your stay and you write one, your first name, the month of your stay, your stars and your text appear publicly on their page, together with whether you booked through this calendar or the host entered the stay. The legal basis is your consent (Art. 6(1)(a) GDPR). With the same link you change or delete your review for 60 days, after that through the host; deleting it withdraws your consent. If someone reports your review, “Isch frei?” looks at it; if it is hidden, you are told why.
If you pay by card through the payment link, you pay the host directly on a page of Stripe (Stripe Payments Europe, Ltd., Ireland). For this the calendar sends Stripe the property, the dates, the price, the booking number and your email address, to which Stripe sends the receipt (Art. 6(1)(b) GDPR). You enter your card details only at Stripe; the calendar never sees them and only learns whether and when you paid. If the host cancels the booking and refunds you, the calendar sends Stripe only the payment’s reference and the amount. Stripe also processes the payment as a controller in its own right, for example to prevent fraud and to meet legal duties, and may process data in the USA too (EU-US Data Privacy Framework). Stripe’s privacy policy has more.
3. How long
The calendar deletes your enquiry, notes included, by itself 90 days after your departure. Your review stays until you delete it, the host deletes all reviews or their page ends. If you stay, the host keeps what the law requires (such as the guest register and the invoice) outside this calendar.
4. Protection against abuse
When you send an enquiry, the calendar counts enquiries per network range to limit abuse (Art. 6(1)(f) GDPR): for at most 24 hours and only as a hash, never your IP address itself.
5. Who else sees the data
The calendar is a service of “Isch frei?” (Jan Nenning, Unterdorf 56, 6943 Riefensberg, Austria), which processes the data on the host’s behalf. It runs on Cloudflare, Inc. (USA); the data is stored in data centres in the EU. Emails are sent through Resend (Plus Five Five, Inc., USA), which stores them in the USA for 30 days. Both are certified under the EU-US Data Privacy Framework.
If the host gives their cleaners a cleaning schedule, it shows your arrival and departure dates, the number of guests and the host’s notes on your stay. The calendar never puts your name or contact details there. If the host has switched on notifications, the calendar also tells the host’s phone about your enquiry: without your name and encrypted so that only that device can read it.
6. Your rights
You have the right of access, rectification, erasure, restriction of processing, data portability and objection. Please contact the host. You may also lodge a complaint with the Austrian Data Protection Authority: dsb.gv.at.