Privacy Policy & Cookies

Name: Brownies Apartments Wagrain
Address: Wagrain, Salzburg, 5602, AT
Telephone: +43 699 1134 2776
Price range: €89 - €728 pro Apartment und Nacht

Last updated: 6 November 2026

The protection of your personal data is very important to us. We therefore process your data exclusively on the basis of the applicable legal provisions (GDPR, DSG, TKG 2003).

1) Controller

Owner: Christopher Brown
Registered office: Wagrain, Austria
Commercial Court: Regional Court of Salzburg
Competent supervisory authority: District Authority St. Johann
Chamber membership: Tourism

T: +43 699 1134 2776
E: office@brownies-apartments.com

2) Hosting & Server Log Files

Our website is hosted on servers of netcup GmbH (Germany). A data processing agreement pursuant to Art. 28 GDPR is in place with the provider. The content delivery network Cloudflare (Cloudflare, Inc., USA) sits in front of the server. Cloudflare forwards requests to our website and repels attacks; for technical reasons, IP address and request data are processed in the process. Data is transferred to the USA on the basis of the EU Commission's standard contractual clauses or the EU-US Data Privacy Framework. Legal basis: Art. 6 para. 1 lit. f GDPR (secure and fast operation of the website).

The hosting provider automatically collects and stores information in so-called server log files:

IP address of the visitor
Date and time of access
Accessed page or file
Referrer URL (previously visited page)
Browser type and operating system
Amount of data transferred and status of retrieval

These data are technically necessary to display the website and serve system security purposes (e.g. defence against attacks).
Legal basis: Art. 6 para. 1 lit. f GDPR (legitimate interest in secure operation).
Retention period: maximum 14 days.

3) Contact

If you contact us by email or via a form, the data you provide (e.g. name, email address, phone number, message) will be stored for the purpose of processing your request and for follow-up questions. These data will not be passed on without your consent.

Legal basis:
Art. 6 para. 1 lit. b GDPR (pre-contractual/contractual communication) and
Art. 6 para. 1 lit. f GDPR (legitimate interest in efficient communication).

Retention period: until your request has been completed or in accordance with statutory retention obligations, where applicable.

4) Contact and Booking Forms

For contact and booking enquiries we use forms on the website (Breakdance Forms for Oxygen). The data you enter (name, email address, subject and message and, for booking enquiries, number of guests, arrival and departure dates, the apartment you are interested in and optionally a phone number) is sent to us by email and stored in the website database. We send a confirmation of receipt to the email address you provide. Emails are sent via the mailbox of our domain (SMTP).

Recipient: our email provider (netcup GmbH, email transport). Legal basis: Art. 6 para. 1 lit. b GDPR. Your data is not passed on to third parties.

5) Spam Protection of the Forms

To protect against automated access, our forms contain an additional field that is invisible to visitors (honeypot). No data is transmitted to third parties and no cookies are set.

Legal basis: Art. 6 para. 1 lit. f GDPR (legitimate interest in preventing automated access).

Your data is not passed on to third parties.

6) Links (Google Maps, Facebook, WhatsApp)

Our website contains links to Google Maps to show you the location of our apartments. We also link to our Facebook profile, WhatsApp and the websites of tourism and leisure providers in the region. Only when you actively click one of these links is a connection to the servers of the respective provider (e.g. Google, Meta Platforms, WhatsApp) established. We do not embed an interactive map (e.g. via iframe or API) or any social media plugins ourselves.

By clicking the link, personal data (e.g. your IP address) may be transmitted to Google.
Provider: Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland.
Legal basis: Art. 6 para. 1 lit. f GDPR (legitimate interest in a user-friendly presentation).
Google Privacy Policy:
https://policies.google.com/privacy?hl=en

7) Cookies

Our website uses technically necessary cookies and, for reach measurement (section 9), a session identifier that is stored as a cookie and in your browser's local storage. No cookies from Google are set.

Name	Purpose	Duration	Type
wordpress_test_cookie	Checks whether cookies are enabled in the browser	Session	technically necessary
wordpress_logged_in_* / wordpress_sec_*	Login session (backend only)	Session	technically necessary
wp-settings-* / wp-settings-time-*	Backend/editor settings	up to 1 year	technically necessary
unique_session_id (cookie and local storage)	Random identifier used to recognise a session in the reach measurement (AnalyticsWP)	365 days	Reach measurement

Legal basis: Art. 6 para. 1 lit. f GDPR (legitimate interest in secure operation and in reach analysis).

8) WordPress & Oxygen

Our website is based on WordPress and the website builder Oxygen. Oxygen does not process personal data and does not set its own tracking cookies. WordPress uses only functional cookies required for login, security and usability.

9) Reach Measurement (AnalyticsWP)

We use the WordPress plugin AnalyticsWP. It runs on our own server; the data is stored in our website's database and is not transmitted to an external analytics service. For each page view the following is recorded: a random session identifier (cookie and local storage), the page visited, the referrer, the device type, the browser identifier (user agent), the IP address (often the address of the upstream Cloudflare server) and campaign parameters (UTM). Logged-in editors and administrators are not recorded. Measurement has been running since 26 March 2025. No automatic deletion is set up; you can request the deletion of your data at any time. Legal basis: Art. 6 para. 1 lit. f GDPR (reach analysis). We do not use Google Analytics, YouTube, social media plugins or advertising networks; fonts and scripts are loaded from our own server.

10) Your Rights

You have the right to:

Information about your stored data (Art. 15 GDPR)
Rectification of inaccurate data (Art. 16 GDPR)
Erasure (“right to be forgotten”, Art. 17 GDPR)
Restriction of processing (Art. 18 GDPR)
Data portability (Art. 20 GDPR)
Objection to certain processing activities (Art. 21 GDPR)

If you believe that the processing of your data violates data protection law, you may lodge a complaint with the competent supervisory authority:

Austrian Data Protection Authority
Barichgasse 40–42, 1030 Vienna
Website:
www.dsb.gv.at

11) Security

We use technical and organisational measures (e.g. SSL/TLS encryption) to protect your personal data against loss, manipulation or unauthorised access. These security measures are regularly reviewed and adapted to the state of the art.

12) Changes to This Privacy Policy

We reserve the right to update this privacy policy if necessary, for example in the event of changes to legal requirements or the introduction of new functions. The current version is always available on this page.