Privacy Policy

1. Who is responsible

LUXNATION Hospitality Consulting GmbH, Leutascher Straße 58, 6100 Seefeld in Tirol, Austria, is the controller for the data described in sections 2(a), 2(b) and 2(g). For data drawn from a client's own connected accounts and files (sections 2(c) to 2(e)), we act on the client's instructions as its processor, under a data processing agreement. Our contact details are at the end of this policy.

2. What we process

a. Website visitors

Technical information such as IP address, browser and device type, and the pages requested, recorded in server logs by our hosting provider, together with any information you send us by email. This website does not use cookies, analytics or advertising trackers, and it loads no third-party fonts or scripts.

Contact form. If you use the contact form, we receive the details you enter: your name, your hotel or group, your email address, the subject you choose and, if you add them, your phone number, the number of rooms and your message. We use them only to answer your request and to follow up on it. The form reaches us by email through our email delivery provider. To protect the form from misuse, our hosting provider briefly processes your IP address to limit repeated submissions.

b. People who use the Platform

Name, work email address, organisation, role and preferences, together with records of sign-in and of approvals and comments made in the Platform.

c. Data from connected accounts

Data from the accounts a client chooses to connect, limited to what is needed to plan, publish and report on its marketing:

• Meta (Facebook Pages, Instagram accounts and advertising accounts): posts, performance figures, and campaign and advertising data
• TikTok (coming soon): account details, posts and performance figures
• Google Ads (coming soon): campaign and performance data

We do not access private messages.

d. Content

Photography, video, logos, copy and brand guidance provided or approved by the client.

e. Booking information

Figures about bookings, such as number, dates, value and source, obtained from the client's booking systems for reporting purposes.

f. AI-assisted drafting

We use AI service providers to help draft copy and suggestions. Content and brand guidance may be sent to them for that purpose. A member of our team initiates each request, and nothing is published without approval.

g. People who use the Feasibility Models

Your email address and the account details we set up for you, such as your name and role, the projects you can access, the figures and assumptions entered into the models, and records of sign-in. You sign in with a link sent to your email address; there are no passwords. Account details and model data are stored with Google (Firebase), and sign-in emails are sent through our email delivery provider. The Feasibility Models load their code from Google and from cdnjs, a public code library run by Cloudflare, so your browser connects to their servers and they receive your IP address.

3. Google user data (coming soon)

Google integrations are not yet available. When they are, LUXNATION's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

In practice this means:

• We will access only the Google data a client authorises.
• We will use that data only to provide the service to that client.
• We do not sell it, use it for advertising, or use it to build profiles.
• People at LUXNATION do not read it, except with the client's consent, to investigate a security issue, or where the law requires.

4. Meta and TikTok data

We use the Meta and TikTok interfaces only for the purposes the client has authorised, and we comply with each provider's developer terms. We do not sell this data or use it for any advertising unrelated to the client that connected the account.

5. Purposes and legal bases

• Contract: to provide the Platform, the Feasibility Models and the services agreed with a client
• Legitimate interests: to keep the Platform secure, to prevent misuse and to improve it
• Steps before a contract and legitimate interests: to answer a request you send us through the contact form or by email
• Consent: where we ask for it, for example before sending you news or updates
• Legal obligation: where Austrian or EU law requires us to keep or disclose information

6. Who receives personal data

We share personal data only with:

• service providers that host and operate the Platform and the Feasibility Models, including infrastructure, database, authentication, storage and email delivery providers
• AI service providers, as described in section 2(f)
• the platforms a client chooses to connect, such as Meta (and, when available, TikTok and Google), on that client's instruction
• the provider of a client's booking system, where the client asks us to connect it
• professional advisers and public authorities, where the law requires

Our service providers act on our instructions under data processing terms. A current list is available on request. We do not sell personal data.

7. Transfers outside the EEA

Some of our service providers process data outside the European Economic Area. Where personal data is transferred outside the EEA, we ensure that an appropriate safeguard is in place, such as an adequacy decision or standard contractual clauses approved by the European Commission.

8. Retention

We keep personal data only for as long as needed for the purposes described in this policy. Working copies of media are kept only for as long as needed to prepare, approve and publish content. Account data is kept while the client uses the Platform and is then deleted or anonymised, unless the law requires us to keep it for longer. Feasibility Models accounts are kept while the person has access and are then deleted, and model data is kept for as long as the project needs it, unless the law requires us to keep either for longer. Requests sent through the contact form are kept for as long as needed to answer them and any follow-up.

9. Security

We use technical and organisational measures appropriate to the risk. These include encryption of access credentials, access limited to named individuals, and separation of each client's data from every other client's.

10. Cookies

This website does not set cookies. The Platform uses only the browser storage that is strictly necessary to keep you signed in and to remember the settings you choose, such as the theme. It does not use cookies. The Feasibility Models use one cookie, which is strictly necessary to keep you signed in and is deleted when you sign out, and the browser storage needed to complete sign-in. Neither is used for analytics or advertising.

11. Your rights

Under the GDPR you have the right to:

• access the personal data we hold about you
• have inaccurate data corrected
• have your data erased, in certain cases
• restrict or object to our processing
• receive your data in a portable format
• withdraw consent at any time

A client can withdraw the Platform's access to its connected accounts at any time in each provider's own settings, and can ask us to delete its data. To exercise any right, write to us at the address below. If we cannot resolve a concern, you may complain to the Austrian Data Protection Authority (Datenschutzbehörde) at www.dsb.gv.at.

12. Children

This website, the Platform and the Feasibility Models are not directed at children, and we do not knowingly process their data.

13. Changes to this policy

We will publish any change to this policy on this page, with a new date.

14. Contact