Privacy Policy

Last updated: 2026-07-21

1. Controller

FENITO GmbH
Brauquartier 11/1, 8055 Graz, Österreich
E-Mail: graz@beletage.apartments
Phone: +43 664 600 46 860

2. Data processed

We process name, address, date of birth, ID data (Austrian registration law), contact details, booking details, payment data and communication content. Processing serves contract performance, statutory obligations (registration law, tax law), digital check-in, guest communication and billing.

3. Legal basis

Art. 6 (1)(b) GDPR (contract), (c) (legal obligations), (f) (legitimate interest — security, direct marketing to existing customers), (a) (consent — newsletter, optional cookies).

4. Recipients / processors

We share data with:

• DIRS21 (Buchungssystem, TourOnline AG, Deutschland)
• World4you Internet Services GmbH (hosting, Österreich)
• Payment service providers (Stripe, banks)
• Tax advisor & auditor
• Authorities (registration office, tax authorities)
• Revyoos (review aggregator) — fetched server-side by us; the website serves only static, pre-aggregated reviews (no third-party script/cookie in the browser)
• OpenStreetMap & unpkg.com (map display) — only when you click the map

5. Third country transfer

The review fetch from Revyoos is performed server-side by us (no transfer from your browser). If Google Analytics, Microsoft Clarity or YouTube are added later, data may be transferred to third countries (incl. the USA) — activated only after your prior explicit consent (legal basis: EU Standard Contractual Clauses / SCCs).

6. Cookies

This website currently sets no consent-requiring cookies and embeds no consent-requiring third-party services in your browser. Guest reviews are aggregated server-side and served statically (no third-party script or cookie). The map (OpenStreetMap) loads only when you actively click it. If we add optional services in the future (e.g. Google Analytics 4 or Microsoft Clarity), we will activate them only after your prior explicit consent.

7. Retention period

• Booking & registration data: 7 years (statutory)
• Email inquiries without booking: 12 months
• Server logs: up to 12 months
• Newsletter data: until unsubscribe

8. Your rights

You have the right to access, rectification, erasure, restriction, data portability, objection, and withdrawal of consent. Complaints can be lodged with the Austrian Data Protection Authority (Barichgasse 40-42, 1030 Vienna, dsb@dsb.gv.at).

9. Security

Transmission with SSL/TLS encryption. Servers within the EU. Booking data accessible only to authorised staff.