{"id":3,"date":"2025-05-06T20:03:35","date_gmt":"2025-05-06T20:03:35","guid":{"rendered":"https:\/\/fortyplusone.at\/?page_id=3"},"modified":"2026-02-24T17:31:56","modified_gmt":"2026-02-24T17:31:56","slug":"privacy-policy","status":"publish","type":"page","link":"https:\/\/fortyplusone.at\/es\/privacy-policy\/","title":{"rendered":"pol\u00edtica de privacidad"},"content":{"rendered":"<div data-elementor-type=\"wp-page\" data-elementor-id=\"3\" class=\"elementor elementor-3\" data-elementor-post-type=\"page\">\n\t\t\t\t<div class=\"elementor-element elementor-element-100a1196 e-flex e-con-boxed e-con e-parent\" data-id=\"100a1196\" data-element_type=\"container\">\n\t\t\t\t\t<div class=\"e-con-inner\">\n\t\t\t\t<div class=\"elementor-element elementor-element-51047442 elementor-widget elementor-widget-text-editor\" data-id=\"51047442\" data-element_type=\"widget\" data-widget_type=\"text-editor.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t\t\t\n<p><b>PRIVACY POLICY<\/b><\/p>\n<p><span style=\"font-weight: 400;\">Forty + One Hotel<\/span><\/p>\n<p><span style=\"font-weight: 400;\">Hotel BOSU SBS GmbH<\/span><\/p>\n<p><i><span style=\"font-weight: 400;\">Last updated: February 2026<\/span><\/i><\/p>\n<h1><b>1. Data Controller<\/b><\/h1>\n<p><span style=\"font-weight: 400;\">The data controller responsible for the processing of your personal data on this website is:<\/span><\/p>\n<p><b>Company: <\/b><span style=\"font-weight: 400;\">Hotel BOSU SBS GmbH<\/span><\/p>\n<p><b>Brand: <\/b><span style=\"font-weight: 400;\">Forty + One Hotel<\/span><\/p>\n<p><b>Address: <\/b><span style=\"font-weight: 400;\">Sch\u00f6nbrunner Stra\u00dfe 41, 1050 Viena, Austria<\/span><\/p>\n<p><b>Managing Director: <\/b><span style=\"font-weight: 400;\">Denys Sukhorebsky<\/span><\/p>\n<p><b>Company Registration: <\/b><span style=\"font-weight: 400;\">FN 631693 k \u2013 Tribunal de Comercio de Viena<\/span><\/p>\n<p><b>Operated by: <\/b><span style=\"font-weight: 400;\">Dwell Bell<\/span><\/p>\n<p><b>Correo electr\u00f3nico: <\/b><span style=\"font-weight: 400;\">info@fortyplusone.at<\/span><\/p>\n<p><b>Tel\u00e9fono: <\/b><span style=\"font-weight: 400;\">+43 1 424 00 34<\/span><\/p>\n<p>\u00a0<\/p>\n<p><span style=\"font-weight: 400;\">If you have any questions about data protection or wish to exercise your rights, please contact us at the email address above. We will respond within one month in accordance with GDPR requirements.<\/span><\/p>\n<h1><b>2. Overview and Scope<\/b><\/h1>\n<p><span style=\"font-weight: 400;\">This privacy policy explains how we collect, use, store, and protect your personal data when you visit our website (https:\/\/fortyplusone.at), make a booking, stay at our hotel, subscribe to our newsletter, or otherwise interact with us. It has been prepared in accordance with the General Data Protection Regulation (EU) 2016\/679 (\u201cGDPR\u201d) and the Austrian Data Protection Act (Datenschutzgesetz, \u201cDSG\u201d).<\/span><\/p>\n<p><span style=\"font-weight: 400;\">We process personal data only when there is a lawful basis to do so and only for the purposes described in this policy.<\/span><\/p>\n<h1><b>3. Legal Bases for Processing<\/b><\/h1>\n<p><span style=\"font-weight: 400;\">We process your personal data on the following legal bases under Article 6(1) GDPR:<\/span><\/p>\n<ul>\n<li style=\"font-weight: 400;\" aria-level=\"1\"><b>Consent (Art. 6(1)(a) GDPR): <\/b><span style=\"font-weight: 400;\">Where you have given explicit consent, e.g. for marketing emails\/newsletter, non-essential cookies (analytics, advertising), or sharing data with specific partners.<\/span><\/li>\n<li style=\"font-weight: 400;\" aria-level=\"1\"><b>Performance of a contract (Art. 6(1)(b) GDPR): <\/b><span style=\"font-weight: 400;\">Where processing is necessary to fulfil a booking or provide our hotel services to you.<\/span><\/li>\n<li style=\"font-weight: 400;\" aria-level=\"1\"><b>Legal obligation (Art. 6(1)(c) GDPR): <\/b><span style=\"font-weight: 400;\">Where we are required by law to process your data, e.g. guest registration (Meldegesetz), tax retention obligations, or reporting to tourism authorities.<\/span><\/li>\n<li style=\"font-weight: 400;\" aria-level=\"1\"><b>Legitimate interest (Art. 6(1)(f) GDPR): <\/b><span style=\"font-weight: 400;\">Where processing is necessary for our legitimate interests, e.g. website security, fraud prevention, and improving our services, provided these interests are not overridden by your rights.<\/span><\/li>\n<\/ul>\n<h1><b>4. Personal Data We Collect<\/b><\/h1>\n<h2><b>4.1 Website Visit Data<\/b><\/h2>\n<p><span style=\"font-weight: 400;\">When you visit our website, the following data is automatically collected for technical and security reasons (legal basis: legitimate interest, Art. 6(1)(f) GDPR):<\/span><\/p>\n<ul>\n<li style=\"font-weight: 400;\" aria-level=\"1\"><span style=\"font-weight: 400;\">IP address (anonymised where possible)<\/span><\/li>\n<li style=\"font-weight: 400;\" aria-level=\"1\"><span style=\"font-weight: 400;\">Date, time, and duration of the visit<\/span><\/li>\n<li style=\"font-weight: 400;\" aria-level=\"1\"><span style=\"font-weight: 400;\">Browser type and version, operating system<\/span><\/li>\n<li style=\"font-weight: 400;\" aria-level=\"1\"><span style=\"font-weight: 400;\">Referring URL (the page from which you accessed our site)<\/span><\/li>\n<li style=\"font-weight: 400;\" aria-level=\"1\"><span style=\"font-weight: 400;\">Pages accessed on our website<\/span><\/li>\n<\/ul>\n<h2><b>4.2 Booking and Guest Data<\/b><\/h2>\n<p><span style=\"font-weight: 400;\">When you make a reservation or stay at our hotel, we collect the following data (legal basis: contract performance, Art. 6(1)(b), and legal obligation, Art. 6(1)(c) GDPR):<\/span><\/p>\n<ul>\n<li style=\"font-weight: 400;\" aria-level=\"1\"><span style=\"font-weight: 400;\">Full name, date of birth, nationality<\/span><\/li>\n<li style=\"font-weight: 400;\" aria-level=\"1\"><span style=\"font-weight: 400;\">Home address<\/span><\/li>\n<li style=\"font-weight: 400;\" aria-level=\"1\"><span style=\"font-weight: 400;\">Email address and phone number<\/span><\/li>\n<li style=\"font-weight: 400;\" aria-level=\"1\"><span style=\"font-weight: 400;\">Passport or ID number (as required by Austrian Meldegesetz for guest registration)<\/span><\/li>\n<li style=\"font-weight: 400;\" aria-level=\"1\"><span style=\"font-weight: 400;\">Payment information (processed securely via Adyen through our booking system Mews)<\/span><\/li>\n<li style=\"font-weight: 400;\" aria-level=\"1\"><span style=\"font-weight: 400;\">Booking dates and preferences<\/span><\/li>\n<li style=\"font-weight: 400;\" aria-level=\"1\"><span style=\"font-weight: 400;\">Accompanying guests\u2019 names and relevant details<\/span><\/li>\n<\/ul>\n<h2><b>4.3 Contact Form and Email<\/b><\/h2>\n<p><span style=\"font-weight: 400;\">When you contact us via the website form or email, we collect your name, email address, and the content of your message (legal basis: consent, Art. 6(1)(a), or pre-contractual measures, Art. 6(1)(b) GDPR).<\/span><\/p>\n<h2><b>4.4 Newsletter \/ Email Marketing<\/b><\/h2>\n<p><span style=\"font-weight: 400;\">If you subscribe to our newsletter, we collect your email address and, optionally, your name. We use Mailchimp (The Rocket Science Group LLC, Atlanta, USA) to manage our email marketing. Your data is stored on Mailchimp\u2019s servers in the United States \u2013 see Section 9 for information about international transfers.<\/span><\/p>\n<p><span style=\"font-weight: 400;\">Legal basis: Your explicit consent (Art. 6(1)(a) GDPR). You may unsubscribe at any time using the unsubscribe link in each email or by contacting us directly. Withdrawing consent does not affect the lawfulness of processing carried out before the withdrawal.<\/span><\/p>\n<h2><b>4.5 Cookies and Tracking Technologies<\/b><\/h2>\n<p><span style=\"font-weight: 400;\">See Section 8 below for detailed information about cookies and tracking.<\/span><\/p>\n<h1><b>5. Purposes of Processing<\/b><\/h1>\n<p><span style=\"font-weight: 400;\">We use your personal data for the following purposes:<\/span><\/p>\n<ul>\n<li style=\"font-weight: 400;\" aria-level=\"1\"><span style=\"font-weight: 400;\">Fulfilling reservations and providing hotel services<\/span><\/li>\n<li style=\"font-weight: 400;\" aria-level=\"1\"><span style=\"font-weight: 400;\">Mandatory guest registration under Austrian law (Meldegesetz)<\/span><\/li>\n<li style=\"font-weight: 400;\" aria-level=\"1\"><span style=\"font-weight: 400;\">Reporting to the municipality\/city and tourism association as required by law<\/span><\/li>\n<li style=\"font-weight: 400;\" aria-level=\"1\"><span style=\"font-weight: 400;\">Processing payments via Adyen<\/span><\/li>\n<li style=\"font-weight: 400;\" aria-level=\"1\"><span style=\"font-weight: 400;\">Responding to your enquiries<\/span><\/li>\n<li style=\"font-weight: 400;\" aria-level=\"1\"><span style=\"font-weight: 400;\">Sending newsletters and marketing communications (only with your explicit consent, via Mailchimp)<\/span><\/li>\n<li style=\"font-weight: 400;\" aria-level=\"1\"><span style=\"font-weight: 400;\">Website analytics and performance measurement (Google Analytics, with consent)<\/span><\/li>\n<li style=\"font-weight: 400;\" aria-level=\"1\"><span style=\"font-weight: 400;\">Online advertising measurement and remarketing (Meta Pixel, Google Ads, with consent)<\/span><\/li>\n<li style=\"font-weight: 400;\" aria-level=\"1\"><span style=\"font-weight: 400;\">Website operation, security, and improvement<\/span><\/li>\n<li style=\"font-weight: 400;\" aria-level=\"1\"><span style=\"font-weight: 400;\">Compliance with tax and accounting obligations<\/span><\/li>\n<\/ul>\n<h1><b>6. Data Recipients and Third-Party Sharing<\/b><\/h1>\n<p><span style=\"font-weight: 400;\">We share your personal data with the following categories of recipients, only to the extent necessary:<\/span><\/p>\n<h2><b>6.1 Legal and Regulatory Authorities<\/b><\/h2>\n<ul>\n<li style=\"font-weight: 400;\" aria-level=\"1\"><span style=\"font-weight: 400;\">Municipality\/City of Vienna \u2013 for mandatory guest registration (Meldegesetz)<\/span><\/li>\n<li style=\"font-weight: 400;\" aria-level=\"1\"><span style=\"font-weight: 400;\">Vienna Tourism Association (Wien Tourismus) \u2013 for statistical reporting as required by law<\/span><\/li>\n<li style=\"font-weight: 400;\" aria-level=\"1\"><span style=\"font-weight: 400;\">Tax authorities \u2013 as required by Austrian tax law<\/span><\/li>\n<\/ul>\n<h2><b>6.2 Service Providers (Data Processors)<\/b><\/h2>\n<p><span style=\"font-weight: 400;\">We use the following service providers who process data on our behalf under data processing agreements (Art. 28 GDPR):<\/span><\/p>\n<ul>\n<li style=\"font-weight: 400;\" aria-level=\"1\"><b>Mews Systems s.r.o. <\/b><span style=\"font-weight: 400;\">(mews.com, Prague, Czech Republic) \u2013 Property management and booking system. Mews processes your booking and guest data on our behalf.<\/span><\/li>\n<li style=\"font-weight: 400;\" aria-level=\"1\"><b>Adyen N.V. <\/b><span style=\"font-weight: 400;\">(adyen.com, Amsterdam, Netherlands) \u2013 Payment processing. Adyen processes your payment data securely on our behalf via Mews. Adyen is PCI DSS Level 1 certified.<\/span><\/li>\n<li style=\"font-weight: 400;\" aria-level=\"1\"><b>DigitalOcean, LLC <\/b><span style=\"font-weight: 400;\">(digitalocean.com, New York, USA) \u2013 Website hosting. Our website is hosted on DigitalOcean servers. See Section 9 for information about international transfers.<\/span><\/li>\n<li style=\"font-weight: 400;\" aria-level=\"1\"><b>Meta Platforms Ireland Limited <\/b><span style=\"font-weight: 400;\">(Facebook\/Meta, Dublin, Ireland) \u2013 Meta Pixel for advertising analytics (only activated with your cookie consent). Data may be transferred to the USA \u2013 see Section 9.<\/span><\/li>\n<li style=\"font-weight: 400;\" aria-level=\"1\"><b>Google Ireland Limited <\/b><span style=\"font-weight: 400;\">(Google, Dublin, Ireland) \u2013 Google Analytics for website usage analysis and Google Ads for advertising measurement (only activated with your cookie consent). Data may be transferred to the USA \u2013 see Section 9.<\/span><\/li>\n<li style=\"font-weight: 400;\" aria-level=\"1\"><b>The Rocket Science Group LLC (Mailchimp) <\/b><span style=\"font-weight: 400;\">(mailchimp.com, Atlanta, USA) \u2013 Email marketing and newsletter distribution (only if you have subscribed). See Section 9 for international transfers.<\/span><\/li>\n<\/ul>\n<p>\u00a0<\/p>\n<p><span style=\"font-weight: 400;\">We do not sell your personal data to any third party.<\/span><\/p>\n<h1><b>7. Data Retention Periods<\/b><\/h1>\n<p><span style=\"font-weight: 400;\">We retain your personal data only for as long as is necessary for the purpose for which it was collected or as required by law:<\/span><\/p>\n<table>\n<tbody>\n<tr>\n<td>\n<p><b>Data Category<\/b><\/p>\n<\/td>\n<td>\n<p><b>Retention Period<\/b><\/p>\n<\/td>\n<td>\n<p><b>Legal Basis<\/b><\/p>\n<\/td>\n<\/tr>\n<tr>\n<td>\n<p><span style=\"font-weight: 400;\">Guest registration data<\/span><\/p>\n<\/td>\n<td>\n<p><span style=\"font-weight: 400;\">7 years<\/span><\/p>\n<\/td>\n<td>\n<p><span style=\"font-weight: 400;\">Austrian tax retention (\u00a7 132 BAO)<\/span><\/p>\n<\/td>\n<\/tr>\n<tr>\n<td>\n<p><span style=\"font-weight: 400;\">Booking and payment data<\/span><\/p>\n<\/td>\n<td>\n<p><span style=\"font-weight: 400;\">7 years<\/span><\/p>\n<\/td>\n<td>\n<p><span style=\"font-weight: 400;\">Tax and accounting obligations<\/span><\/p>\n<\/td>\n<\/tr>\n<tr>\n<td>\n<p><span style=\"font-weight: 400;\">Contact form enquiries<\/span><\/p>\n<\/td>\n<td>\n<p><span style=\"font-weight: 400;\">6 months<\/span><\/p>\n<\/td>\n<td>\n<p><span style=\"font-weight: 400;\">After completion of enquiry<\/span><\/p>\n<\/td>\n<\/tr>\n<tr>\n<td>\n<p><span style=\"font-weight: 400;\">Newsletter subscriber data<\/span><\/p>\n<\/td>\n<td>\n<p><span style=\"font-weight: 400;\">Until unsubscribe<\/span><\/p>\n<\/td>\n<td>\n<p><span style=\"font-weight: 400;\">Consent (Art. 6(1)(a) GDPR)<\/span><\/p>\n<\/td>\n<\/tr>\n<tr>\n<td>\n<p><span style=\"font-weight: 400;\">Server log files<\/span><\/p>\n<\/td>\n<td>\n<p><span style=\"font-weight: 400;\">14 days<\/span><\/p>\n<\/td>\n<td>\n<p><span style=\"font-weight: 400;\">Website security (legitimate interest)<\/span><\/p>\n<\/td>\n<\/tr>\n<tr>\n<td>\n<p><span style=\"font-weight: 400;\">Cookie consent records<\/span><\/p>\n<\/td>\n<td>\n<p><span style=\"font-weight: 400;\">3 years<\/span><\/p>\n<\/td>\n<td>\n<p><span style=\"font-weight: 400;\">Proof of consent (accountability)<\/span><\/p>\n<\/td>\n<\/tr>\n<tr>\n<td>\n<p><span style=\"font-weight: 400;\">Google Analytics data<\/span><\/p>\n<\/td>\n<td>\n<p><span style=\"font-weight: 400;\">14 months<\/span><\/p>\n<\/td>\n<td>\n<p><span style=\"font-weight: 400;\">Consent; GA4 default retention<\/span><\/p>\n<\/td>\n<\/tr>\n<tr>\n<td>\n<p><span style=\"font-weight: 400;\">Marketing consent data<\/span><\/p>\n<\/td>\n<td>\n<p><span style=\"font-weight: 400;\">Until withdrawal<\/span><\/p>\n<\/td>\n<td>\n<p><span style=\"font-weight: 400;\">Consent (Art. 6(1)(a) GDPR)<\/span><\/p>\n<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n<p>\u00a0<\/p>\n<p><span style=\"font-weight: 400;\">After the retention period expires, data is securely deleted or anonymised.<\/span><\/p>\n<h1><b>8. Cookies and Tracking Technologies<\/b><\/h1>\n<p><span style=\"font-weight: 400;\">Our website uses cookies \u2013 small text files stored on your device by your browser.<\/span><\/p>\n<h2><b>8.1 Types of Cookies<\/b><\/h2>\n<p><b>Strictly necessary cookies: <\/b><span style=\"font-weight: 400;\">These are essential for the website to function (e.g. session management, cookie consent preferences, security). They do not require your consent (\u00a7 165(3) TKG 2021, Art. 5(3) ePrivacy Directive).<\/span><\/p>\n<p><b>Analytics cookies (Google Analytics): <\/b><span style=\"font-weight: 400;\">These help us understand how visitors use our website. We only set these cookies after you have given explicit consent.<\/span><\/p>\n<p><b>Advertising\/marketing cookies (Meta Pixel, Google Ads): <\/b><span style=\"font-weight: 400;\">These are used to measure the effectiveness of our advertising and to display relevant ads. We only set these cookies after you have given explicit consent.<\/span><\/p>\n<h2><b>8.2 Google Analytics<\/b><\/h2>\n<p><span style=\"font-weight: 400;\">Our website uses Google Analytics 4 (GA4), a web analytics service provided by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. Google Analytics uses cookies to analyse your use of the website. The information generated is usually transferred to a Google server in the USA and stored there.<\/span><\/p>\n<p><span style=\"font-weight: 400;\">We have enabled IP anonymisation, so your IP address is truncated within the EU\/EEA before being transmitted. Google Analytics is activated only after you provide explicit consent via our cookie consent banner.<\/span><\/p>\n<p><span style=\"font-weight: 400;\">You can find Google\u2019s privacy policy at: https:\/\/policies.google.com\/privacy<\/span><\/p>\n<h2><b>8.3 Google Ads \/ Conversion Tracking<\/b><\/h2>\n<p><span style=\"font-weight: 400;\">Our website uses Google Ads conversion tracking, provided by Google Ireland Limited. When you click on an ad served by Google, a conversion tracking cookie is placed on your device. This cookie helps us measure the effectiveness of our advertising campaigns. Google Ads conversion tracking is activated only after you provide explicit consent.<\/span><\/p>\n<h2><b>8.4 Meta Pixel (Facebook Pixel)<\/b><\/h2>\n<p><span style=\"font-weight: 400;\">Our website uses the Meta Pixel (formerly Facebook Pixel), a tracking tool provided by Meta Platforms Ireland Limited, 4 Grand Canal Square, Dublin 2, Ireland. The Meta Pixel is activated only after you provide explicit consent via our cookie consent banner.<\/span><\/p>\n<p><span style=\"font-weight: 400;\">The Meta Pixel collects data such as your IP address, browser information, pages visited, and actions taken on our website. This data is used to measure the effectiveness of our advertising campaigns and to display targeted advertisements on Facebook and Instagram. Data may be transferred to Meta Platforms, Inc. in the United States \u2013 see Section 9.<\/span><\/p>\n<h2><b>8.5 Your Cookie Choices<\/b><\/h2>\n<p><span style=\"font-weight: 400;\">When you first visit our website, a cookie consent banner is displayed. You may accept or reject non-essential cookies by category (analytics, marketing). You can change your cookie preferences at any time by clicking the cookie settings link in the footer of our website. Withdrawing consent does not affect the lawfulness of processing carried out before the withdrawal.<\/span><\/p>\n<h1><b>9. International Data Transfers<\/b><\/h1>\n<p><span style=\"font-weight: 400;\">Some of our service providers are located outside the European Economic Area (EEA), specifically in the United States. Where personal data is transferred to countries outside the EEA, we ensure appropriate safeguards are in place in accordance with Chapter V of the GDPR:<\/span><\/p>\n<ul>\n<li style=\"font-weight: 400;\" aria-level=\"1\"><b>EU-U.S. Data Privacy Framework (DPF): <\/b><span style=\"font-weight: 400;\">Google LLC, Meta Platforms Inc., The Rocket Science Group LLC (Mailchimp), and DigitalOcean LLC are certified under the EU-U.S. Data Privacy Framework (European Commission adequacy decision of 10 July 2023). Transfers to these companies are therefore covered by this adequacy decision.<\/span><\/li>\n<li style=\"font-weight: 400;\" aria-level=\"1\"><b>Standard Contractual Clauses (SCCs): <\/b><span style=\"font-weight: 400;\">Where the Data Privacy Framework does not apply or as an additional safeguard, we rely on the European Commission\u2019s Standard Contractual Clauses as the transfer mechanism.<\/span><\/li>\n<\/ul>\n<p>\u00a0<\/p>\n<p><span style=\"font-weight: 400;\">You may request a copy of the relevant safeguards by contacting us at info@fortyplusone.at.<\/span><\/p>\n<h1><b>10. Your Rights Under the GDPR<\/b><\/h1>\n<p><span style=\"font-weight: 400;\">Under the GDPR and the Austrian DSG, you have the following rights regarding your personal data:<\/span><\/p>\n<table>\n<tbody>\n<tr>\n<td>\n<p><b>Right<\/b><\/p>\n<\/td>\n<td>\n<p><b>Description<\/b><\/p>\n<\/td>\n<\/tr>\n<tr>\n<td>\n<p><span style=\"font-weight: 400;\">Right of Access (Art. 15)<\/span><\/p>\n<\/td>\n<td>\n<p><span style=\"font-weight: 400;\">You can request confirmation of whether we process your data and obtain a copy of it.<\/span><\/p>\n<\/td>\n<\/tr>\n<tr>\n<td>\n<p><span style=\"font-weight: 400;\">Right to Rectification (Art. 16)<\/span><\/p>\n<\/td>\n<td>\n<p><span style=\"font-weight: 400;\">You can request correction of inaccurate or incomplete personal data.<\/span><\/p>\n<\/td>\n<\/tr>\n<tr>\n<td>\n<p><span style=\"font-weight: 400;\">Right to Erasure (Art. 17)<\/span><\/p>\n<\/td>\n<td>\n<p><span style=\"font-weight: 400;\">You can request deletion of your data where there is no compelling reason for continued processing.<\/span><\/p>\n<\/td>\n<\/tr>\n<tr>\n<td>\n<p><span style=\"font-weight: 400;\">Right to Restriction (Art. 18)<\/span><\/p>\n<\/td>\n<td>\n<p><span style=\"font-weight: 400;\">You can request that we restrict the processing of your data in certain circumstances.<\/span><\/p>\n<\/td>\n<\/tr>\n<tr>\n<td>\n<p><span style=\"font-weight: 400;\">Notification Obligation (Art. 19)<\/span><\/p>\n<\/td>\n<td>\n<p><span style=\"font-weight: 400;\">We will notify each recipient of any rectification, erasure, or restriction unless this proves impossible or involves disproportionate effort.<\/span><\/p>\n<\/td>\n<\/tr>\n<tr>\n<td>\n<p><span style=\"font-weight: 400;\">Right to Data Portability (Art. 20)<\/span><\/p>\n<\/td>\n<td>\n<p><span style=\"font-weight: 400;\">You can request your data in a structured, commonly used, machine-readable format.<\/span><\/p>\n<\/td>\n<\/tr>\n<tr>\n<td>\n<p><span style=\"font-weight: 400;\">Right to Object (Art. 21)<\/span><\/p>\n<\/td>\n<td>\n<p><span style=\"font-weight: 400;\">You can object to processing based on legitimate interest. We will cease processing unless we have compelling grounds.<\/span><\/p>\n<\/td>\n<\/tr>\n<tr>\n<td>\n<p><span style=\"font-weight: 400;\">Automated Decisions (Art. 22)<\/span><\/p>\n<\/td>\n<td>\n<p><span style=\"font-weight: 400;\">You have the right not to be subject to decisions based solely on automated processing, including profiling.<\/span><\/p>\n<\/td>\n<\/tr>\n<tr>\n<td>\n<p><span style=\"font-weight: 400;\">Right to Withdraw Consent (Art. 7(3))<\/span><\/p>\n<\/td>\n<td>\n<p><span style=\"font-weight: 400;\">Where processing is based on consent, you may withdraw it at any time. This does not affect the lawfulness of processing before withdrawal.<\/span><\/p>\n<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n<p>\u00a0<\/p>\n<p><span style=\"font-weight: 400;\">To exercise any of these rights, please contact us at info@fortyplusone.at. We will respond within one month. If we need to extend this period (by up to two additional months due to complexity or volume), we will inform you within the first month.<\/span><\/p>\n<p><\/p>\n<p><strong>Right to lodge a complaint: <\/strong>If you believe your data protection rights have been violated, you have the right to lodge a complaint with the Austrian Data Protection Authority (Datenschutzbeh\u00f6rde):<\/p>\n<p> <\/p>\n<p><strong>Address: <\/strong>Barichgasse 40-42, 1030 Vienna, Austria<\/p>\n<p> <\/p>\n<p><strong>Website: <\/strong><a href=\"https:\/\/www.dsb.gv.at\/\">https:\/\/www.dsb.gv.at\/<\/a><\/p>\n<p> <\/p>\n<p><strong>Correo electr\u00f3nico: <\/strong>dsb@dsb.gv.at<\/p>\n<h1><b>11. Guest Registration<\/b><\/h1>\n<p><span style=\"font-weight: 400;\">Under the Austrian Registration Act (Meldegesetz), we are legally required to register all guests and report their data to the relevant municipal authority. This is a legal obligation (Art. 6(1)(c) GDPR) and does not require your consent.<\/span><\/p>\n<p><span style=\"font-weight: 400;\">If you are the main traveller or group leader, we kindly ask you to inform any accompanying guests about this data processing prior to arrival.<\/span><\/p>\n<p><span style=\"font-weight: 400;\">Data shared with the municipality\/city and the tourism association is limited to what is required by law and is transmitted securely.<\/span><\/p>\n<h1><b>12. Server Log Files<\/b><\/h1>\n<p><span style=\"font-weight: 400;\">Our web hosting provider (DigitalOcean) automatically collects and stores information in server log files that your browser transmits when you visit our website. This includes your IP address, browser type and version, operating system, referring URL, Internet service provider, and date\/time of access.<\/span><\/p>\n<p><span style=\"font-weight: 400;\">This data is processed on the basis of our legitimate interest in ensuring website security and stability (Art. 6(1)(f) GDPR). Log files are retained for 14 days and then automatically deleted. This data is not combined with other personal data sources.<\/span><\/p>\n<h1><b>13. Contact Form and Email Communication<\/b><\/h1>\n<p><span style=\"font-weight: 400;\">If you contact us via our website form or by email, we store your name, email address, and message content for the purpose of processing your enquiry and for follow-up correspondence. This data is retained for 6 months after the enquiry has been completed, unless a longer retention is required for contractual or legal reasons.<\/span><\/p>\n<p><span style=\"font-weight: 400;\">Legal basis: Consent (Art. 6(1)(a) GDPR) if you initiated the contact, or pre-contractual measures (Art. 6(1)(b) GDPR) if the enquiry relates to a potential booking. We will not share this data with third parties without your consent.<\/span><\/p>\n<h1><b>14. Email Security<\/b><\/h1>\n<p><span style=\"font-weight: 400;\">If you send us personal data by email outside of this website, we cannot guarantee the secure transmission and protection of your data. We recommend that you do not send confidential or sensitive data via unencrypted email.<\/span><\/p>\n<h1><b>15. Data Security<\/b><\/h1>\n<p><span style=\"font-weight: 400;\">We implement appropriate technical and organisational measures to protect your personal data against unauthorised access, loss, destruction, or alteration, in accordance with Article 32 GDPR. These measures include:<\/span><\/p>\n<ul>\n<li style=\"font-weight: 400;\" aria-level=\"1\"><span style=\"font-weight: 400;\">SSL\/TLS encryption for all data in transit<\/span><\/li>\n<\/ul>\n<p><span style=\"font-weight: 400;\">Access controls and authentication for internal systems<\/span><\/p>\n<p><span style=\"font-weight: 400;\">Regular security assessments and updates<\/span><\/p>\n<p><span style=\"font-weight: 400;\">Data processing agreements (Art. 28 GDPR) with all service providers<\/span><\/p>\n<p><span style=\"font-weight: 400;\">PCI DSS-compliant payment processing through Adyen<\/span><\/p>\n<h1><b>16. Children\u2019s Data<\/b><\/h1>\n<p><span style=\"font-weight: 400;\">Our website and services are not directed at children under 16. We do not knowingly collect personal data from children under 16 without parental consent. If you believe a child\u2019s data has been collected without appropriate consent, please contact us and we will delete it promptly.<\/span><\/p>\n<h1><b>17. Changes to This Privacy Policy<\/b><\/h1>\n<p><span style=\"font-weight: 400;\">We may update this privacy policy from time to time to reflect changes in our practices, legal requirements, or services. The current version will always be available on our website at https:\/\/fortyplusone.at\/privacy-policy\/. We encourage you to review this policy periodically. Material changes will be communicated via our website.<\/span><\/p>\n<h1><b>18. Online Dispute Resolution<\/b><\/h1>\n<p><span style=\"font-weight: 400;\">In accordance with the Regulation on Online Dispute Resolution in Consumer Affairs (ODR Regulation), we inform you that the European Commission\u2019s Online Dispute Resolution Platform is available at: https:\/\/ec.europa.eu\/odr<\/span><\/p>\n<p><span style=\"font-weight: 400;\">We are neither willing nor obliged to participate in dispute resolution proceedings before a consumer arbitration board.<\/span><\/p>\n<h1><b>19. Contact<\/b><\/h1>\n<p><span style=\"font-weight: 400;\">For all data protection enquiries, please contact:<\/span><\/p>\n<p>\u00a0<\/p>\n<p><b>BOSU SBS Hotel GmbH \/ <\/b><span style=\"font-weight: 400;\">Forty + One Hotel<\/span><\/p>\n<p><b>Operator: <\/b><span style=\"font-weight: 400;\">Dwell Bell<\/span><\/p>\n<p><b>Address: <\/b><span style=\"font-weight: 400;\">Sch\u00f6nbrunner Stra\u00dfe 41, 1050 Viena, Austria<\/span><\/p>\n<p><b>Correo electr\u00f3nico: <\/b><span style=\"font-weight: 400;\">info@fortyplusone.at<\/span><\/p>\n<p><b>Tel\u00e9fono: <\/b><span style=\"font-weight: 400;\">+43 1 424 00 34<\/span><\/p>\n\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<\/div>","protected":false},"excerpt":{"rendered":"<p>PRIVACY POLICY Forty + One Hotel BOSU SBS Hotel GmbH Last updated: February 2026 1. Data Controller The data controller responsible for the processing of your personal data on this website is: Company: BOSU SBS Hotel GmbH Brand: Forty + One Hotel Address: Sch\u00f6nbrunner Stra\u00dfe 41, 1050 Vienna, Austria Managing Director: Denys Sukhorebsky Company Registration: [&hellip;]<\/p>","protected":false},"author":1,"featured_media":0,"parent":0,"menu_order":0,"comment_status":"closed","ping_status":"open","template":"","meta":{"_acf_changed":false,"footnotes":""},"class_list":["post-3","page","type-page","status-publish","hentry"],"acf":[],"_links":{"self":[{"href":"https:\/\/fortyplusone.at\/es\/wp-json\/wp\/v2\/pages\/3","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/fortyplusone.at\/es\/wp-json\/wp\/v2\/pages"}],"about":[{"href":"https:\/\/fortyplusone.at\/es\/wp-json\/wp\/v2\/types\/page"}],"author":[{"embeddable":true,"href":"https:\/\/fortyplusone.at\/es\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/fortyplusone.at\/es\/wp-json\/wp\/v2\/comments?post=3"}],"version-history":[{"count":16,"href":"https:\/\/fortyplusone.at\/es\/wp-json\/wp\/v2\/pages\/3\/revisions"}],"predecessor-version":[{"id":1100,"href":"https:\/\/fortyplusone.at\/es\/wp-json\/wp\/v2\/pages\/3\/revisions\/1100"}],"wp:attachment":[{"href":"https:\/\/fortyplusone.at\/es\/wp-json\/wp\/v2\/media?parent=3"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}