Privacy Policy
Published on 15/07/2026
This document describes the processing of personal data of users (hereinafter referred to as "Data Subjects") in the context of the use of this/these website/s or app/s (https://www.stafler.com), in accordance with the provisions of Article 13 of Regulation (EU) No 2016/679 (hereinafter referred to as "Regulation") and the relevant legal provisions. The data will be processed following the principles of lawfulness, fairness, transparency, purpose limitation, data minimization, accuracy, integrity, and confidentiality. What is described in this document does not include cookies and other navigation tracking tools, for which please refer to the cookie policy.
Data Controller
The Data Controller is Stafler, with its registered office at Mauls Nr. 10, Freienfeld bei Sterzing (BZ) - 39040, Tax ID/VAT IT01586550210 (hereinafter referred to as "Data Controller" or "Controller"). Data Subjects may contact the Data Controller or the Data Protection Officer (hereinafter referred to as DPO), if appointed, at the contact details provided in the "Contacts" section.
Purposes of Processing, Legal Basis, Nature of Provision, Consequences of Non-Provision, and Retention Period of Personal Data
The Controller processes the data provided by the Data Subjects for the purposes listed below.
| Purpose of Processing: Reservation | |
| Description | The processing of data is necessary to proceed with the requested reservation at our facility. |
| Legal Basis | Performance of a contract or pre-contractual measures requested by the data subject (art. 6 par. 1 lett. b) |
| Nature of Provision | Providing the data is necessary for the conclusion of a contract. |
| Consequences of Missing Consent | Failure to provide the data may result in total or partial inability to respond to the submitted request. |
| Retention Period | 10 years |
| Purpose of Processing: Purchase product/service | |
| Description | The processing of data is necessary to purchase the requested product/service. |
| Legal Basis | Performance of a contract or pre-contractual measures requested by the data subject (art. 6 par. 1 lett. b) |
| Nature of Provision | Providing the data is necessary for the conclusion of a contract. |
| Consequences of Missing Consent | Failure to provide the data may result in total or partial inability to proceed with the purchase. |
| Retention Period | 10 years |
| Purpose of Processing: Profiling | |
| Description | The processing is necessary to profile the user in order to provide a personalized browsing or shopping experience based on their characteristics and the individual user. |
| Legal Basis | Consent of the data subject (art. 6 par. 1 lett. a) |
| Nature of Provision | The provision of data is optional |
| Consequences of Missing Consent | Failure to provide the data will result in the inability to profile the user. |
| Retention Period | 2 years |
| Purpose of Processing: Insurance | |
| Description | The processing is necessary for the purchase of insurance for products or services. |
| Legal Basis | Performance of a contract or pre-contractual measures requested by the data subject (art. 6 par. 1 lett. b) |
| Nature of Provision | Providing the data is necessary for the conclusion of a contract. |
| Consequences of Missing Consent | Failure to provide the data may result in total or partial inability to activate the insurance policy. |
| Retention Period | 10 years |
| Purpose of Processing: Gift voucher | |
| Description | The processing is necessary for the purchase of the gift voucher. |
| Legal Basis | Performance of a contract or pre-contractual measures requested by the data subject (art. 6 par. 1 lett. b) |
| Nature of Provision | Providing the data is necessary for the conclusion of a contract. |
| Consequences of Missing Consent | Failure to provide the data may result in total or partial inability to issue the gift voucher. |
| Retention Period | 10 years |
| Purpose of Processing: Live chat | |
| Description | The processing is necessary to access the live chat with our operators |
| Legal Basis | Performance of a contract or pre-contractual measures requested by the data subject (art. 6 par. 1 lett. b) |
| Nature of Provision | Providing the data is necessary to fulfill a contractual obligation. |
| Consequences of Missing Consent | Failure to provide the data may result in total or partial inability to respond to the submitted request. |
| Retention Period | 1 year |
| Purpose of Processing: Availability request | |
| Description | The processing of data is necessary to respond to the availability request for the indicated dates. |
| Legal Basis | Performance of a contract or pre-contractual measures requested by the data subject (art. 6 par. 1 lett. b) |
| Nature of Provision | Providing the data is necessary to fulfill a contractual obligation. |
| Consequences of Missing Consent | Failure to provide the data may result in total or partial inability to respond to the submitted request. |
| Retention Period | 1 year |
| Purpose of Processing: Push notifications | |
| Description | Authorization is necessary to allow the site to send notifications to users. |
| Legal Basis | Consent of the data subject (art. 6 par. 1 lett. a) |
| Nature of Provision | Authorization to receive notifications is optional; failure to grant authorization will result in the blocking of notifications. |
| Consequences of Missing Consent | Failure to provide the data may result in total or partial inability to activate the notification function. |
| Retention Period | Until the withdrawal of consent. |
| Purpose of Processing: Loyalty card / Fidelity program / Points collection | |
| Description | The processing is necessary to join the loyalty program/obtain the loyalty card/access the points collection. |
| Legal Basis | Consent of the data subject (art. 6 par. 1 lett. a) |
| Nature of Provision | The provision of data is optional |
| Consequences of Missing Consent | N.A. |
| Retention Period | Until the withdrawal of consent. |
| Purpose of Processing: Marketing in general | |
| Description | The processing is necessary to receive commercial communications in the forms provided by the Data Controller, which may include, for example, emails, SMS, printed materials, etc. |
| Legal Basis | Consent of the data subject (art. 6 par. 1 lett. a) |
| Nature of Provision | The provision of data is optional |
| Consequences of Missing Consent | Failure to provide the data will only result in the impossibility of receiving commercial communications. |
| Retention Period | Until the withdrawal of consent or 2 years. |
| Purpose of Processing: Purchase of product/service | |
| Description | The processing of data is necessary to purchase the requested product/service. |
| Legal Basis | Performance of a contract or pre-contractual measures requested by the data subject (art. 6 par. 1 lett. b) |
| Nature of Provision | Providing the data is necessary for the conclusion of a contract. |
| Consequences of Missing Consent | Failure to provide the data may result in the total or partial inability to proceed with the purchase. |
| Retention Period | 10 years |
| Purpose of Processing: Survey/Feedback questionnaire (e.g., request for customer experience feedback) | |
| Description | The processing is related to previous contractual relationships and aims to ascertain customer satisfaction, evaluate the service provided, and receive any suggestions for improvement. |
| Legal Basis | Performance of a contract or pre-contractual measures requested by the data subject (art. 6 par. 1 lett. b) |
| Nature of Provision | The provision of data is optional |
| Consequences of Missing Consent | Failure to provide the data will only result in the inability to participate in the survey/questionnaire. |
| Retention Period | 1 year |
| Purpose of Processing: Request or book an appointment | |
| Description | The processing of data is necessary to make a booking request |
| Legal Basis | Performance of a contract or pre-contractual measures requested by the data subject (art. 6 par. 1 lett. b) |
| Nature of Provision | Providing the data is necessary to fulfill a contractual obligation. |
| Consequences of Missing Consent | Failure to provide the data may result in total or partial inability to respond to the submitted request. |
| Retention Period | 6 months |
| Purpose of Processing: Participation in training-promotional events | |
| Description | The processing of data is necessary to participate in the organized event |
| Legal Basis | Performance of a contract or pre-contractual measures requested by the data subject (art. 6 par. 1 lett. b) |
| Nature of Provision | The provision of data is necessary to fulfill a contractual obligation |
| Consequences of Missing Consent | Failure to provide the data may result in the total or partial impossibility of proceeding with the registration. |
| Retention Period | 2 years or 10 years in case of accounting and tax obligations. |
| Purpose of Processing: Geolocation and user position | |
| Description | Authorization is necessary to allow the site to locate your position. |
| Legal Basis | Consent of the data subject (art. 6 par. 1 lett. a) |
| Nature of Provision | Authorization is optional; failure to grant authorization will result in the inability to track the user's position. |
| Consequences of Missing Consent | N.A. |
| Retention Period | Until the withdrawal of consent. |
| Purpose of Processing: Third party marketing | |
| Description | The processing is necessary to receive commercial communications from entities other than the Data Controller, which will be identified at the time of consent request. |
| Legal Basis | Consent of the data subject (art. 6 par. 1 lett. a) |
| Nature of Provision | The provision of data is optional |
| Consequences of Missing Consent | Failure to provide the data will only result in the impossibility of receiving commercial communications. |
| Retention Period | According to the timing established by third parties. |
| Purpose of Processing: Statistical analysis | |
| Description | The processing involves analyzing already obtained data to generate sales statistics, digital channel analysis, or other tools used. The statistics provide an aggregated result that does not allow for the direct identification of individuals. |
| Legal Basis | |
| Purpose of Processing: Newsletter | |
| Description | The processing is necessary to subscribe to the newsletter and to receive commercial communications |
| Legal Basis | Consent of the data subject (art. 6 par. 1 lett. a) |
| Nature of Provision | The provision of data is optional |
| Consequences of Missing Consent | The failure to provide data will only result in the failure to subscribe and the inability to receive the newsletter |
| Retention Period | Until the withdrawal of consent. |
Processing Methods
The processing is carried out through manual and/or automated methods, including the use of IT and telematic technologies (e.g., CRM, management software, and mailing list services), after applying appropriate technical and organizational security measures to ensure the safety, integrity, and confidentiality of personal data, thereby minimizing the risks of destruction, loss, unauthorized access, modification, and unauthorized disclosure.
Any profiling via cookies is carried out only with the user's specific consent: more information is available in the cookie policy and/or the informational banner upon first access. User profiling carried out with tools other than cookies is described in the paragraph referring to the purposes of processing, where applicable.
Transfer of Personal Data outside the EU/EEA
The transfer of personal data to countries outside the European Union is carried out in full compliance with Articles 44 et seq. of Regulation (EU) 2016/679 (GDPR), ensuring the adoption of appropriate legal instruments, such as the existence of an adequacy decision by the European Commission, the signing of standard contractual clauses, or other appropriate safeguards provided for by applicable legislation.
Data Subject Rights
At any time, the Data Subject may access their information and request its rectification, deletion, or integration, restriction of processing, or object to its processing where there are legitimate reasons, as well as data portability to another Data Controller (where applicable). They may also object in whole or in part to the processing and have the right not to be subject to automated decision-making processes concerning natural persons, including profiling. To exercise the rights set out in Articles 15-22 of the GDPR, the Data Subject may contact the Data Controller using the contact details provided in the "Contacts" section. The Data Controller is obliged to respond to the request within 1 month or communicate any delay in response in case of numerous and/or complex requests (the extension cannot exceed 2 months). In any case, the Data Subject always has the right to file a complaint with the competent Supervisory Authority (Data Protection Authority) if they believe that the processing of their personal data is contrary to the current legislation.
Contacts
To exercise the rights provided by the law and for more information about the processing of personal data, you can contact the Data Controller at their office or by email at: info@stafler.com.
Alveni AI Telephone Assistant (Call Forwarding)
What data is processed?
The hotel’s telephone system uses the telephone assistant provided by Alveni AG, R2 Tower, Richtistrasse 2, 8304 Wallisellen, Switzerland ( https://alveni.ai/). Under certain conditions, this service enables incoming calls to be forwarded to an AI-supported telephone response solution.
When the telephone assistant is active, only the data that you voluntarily provide during the call, or that is technically required to handle the call, is processed, for example:
- Information you voluntarily provide (e.g. name, reason for the call, email address, callback request)
- Your telephone number (if transmitted)
- Transcripts of the conversation
- Date and time of the call as well as technical connection metadata
This information is processed in encrypted form and is used exclusively to forward your request to the responsible hotel team, enable callbacks, or answer inquiries. No further use — such as for advertising purposes, profiling, or training AI models — takes place.
Technically required data processing
For the technical operation of the telephone assistant, the following data is processed:
- Technical connection data (e.g. phone number, call duration, date/time) to assign calls and ensure connection stability
- Temporary real-time processing of audio to generate transcripts
- Transcripts are pseudonymised during processing, processed in encrypted form, and deleted in accordance with the retention periods stated below
- Logs and error records to detect misuse (e.g. spam) and to ensure system functionality
- All data transmissions are encrypted (TLS/SRTP) to ensure secure communication
Processing and storage
All processing takes place on servers within the EU; the AI models used are operated locally. Personal data is transferred to third countries only on the basis of EU Standard Contractual Clauses or other appropriate safeguards pursuant to Art. 46 GDPR.
- By default, transcripts and metadata stored by Alveni AI are automatically deleted after 30 days. Earlier deletion is possible upon request.
- The email summary received by the hotel is subject to the hotel’s respective retention obligations.
- No voice recognition is performed, no voice profiles are created, and no audio signatures are used for identification purposes.
- No AI model training is carried out using personal data, and the processed data is not used for profiling purposes.
For certain functions, Alveni AG uses technical sub-processors (e.g. for hosting or telephony infrastructure). These are contractually bound in accordance with Art. 28 GDPR and receive only the data strictly necessary for technical provision.
Tracking and cookies
- No cookies or tracking tools are used for the telephone function.
- No fully automated decision-making with legal effect takes place.
- Callers are clearly informed at the beginning of the call that they are speaking with an AI-supported assistant. At any time, they may request to be transferred to a human employee.
Legal basis
Data processing is carried out on the basis of Art. 6(1)(f) GDPR (legitimate interest), in particular to ensure reliable telephone availability and efficient handling of incoming inquiries. Where processing is required for the initiation or performance of a contract (e.g. reservation inquiries), it is additionally based on Art. 6(1)(b) GDPR.
Voluntary nature and right to object
Providing personal data during the call is voluntary. You decide which information you wish to disclose. You have the right to object to the processing of your personal data at any time with effect for the future. Please send your request or objection to: privacy@alveni.ai.
Further information
Detailed information on data protection can be found in the privacy policy of Alveni AG: https://alveni.ai/datenschutz/
Assistente telefonico AI di Alveni (inoltro delle chiamate)
Quali dati vengono trattati?
Il sistema telefonico dell’hotel utilizza l’assistente telefonico di Alveni AG, R2 Tower, Richtistrasse 2, 8304 Wallisellen, Svizzera ( https://alveni.ai/). Questo servizio consente, a determinate condizioni, l’inoltro delle chiamate in entrata a una soluzione di risposta telefonica supportata dall’intelligenza artificiale.
Quando l’assistente telefonico è attivo, vengono trattati esclusivamente i dati che Lei fornisce volontariamente durante la chiamata o che sono tecnicamente necessari per la gestione della conversazione, ad esempio:
- Informazioni fornite volontariamente (ad es. nome, motivo della chiamata, indirizzo e-mail, richiesta di richiamata)
- Il Suo numero di telefono (se trasmesso)
- Trascrizioni del contenuto della conversazione
- Data e ora della chiamata nonché metadati tecnici di connessione
Tali informazioni vengono trattate in forma cifrata e utilizzate esclusivamente per inoltrare la Sua richiesta al team alberghiero competente, consentire le richiamate o rispondere alle richieste. Non avviene alcun ulteriore utilizzo — ad esempio per finalità pubblicitarie, di profilazione o per l’addestramento di modelli di IA.
Trattamento dei dati tecnicamente necessario
Per il funzionamento tecnico dell’assistente telefonico vengono trattate le seguenti informazioni:
- Dati tecnici di connessione (ad es. numero, durata, data/ora) per l’assegnazione delle chiamate e la stabilità della connessione
- Trattamento temporaneo in tempo reale dell’audio per la generazione delle trascrizioni
- Le trascrizioni vengono pseudonimizzate durante il trattamento, elaborate in forma cifrata e cancellate secondo i termini indicati di seguito
- Log e registri di errore per il rilevamento di abusi (ad es. spam) e per garantire la funzionalità del sistema
- Tutte le trasmissioni di dati avvengono in forma cifrata (TLS/SRTP) per garantire la sicurezza della comunicazione
Trattamento e conservazione
Tutti i trattamenti avvengono su server situati all’interno dell’UE; i modelli di IA utilizzati sono gestiti localmente. Il trasferimento di dati personali verso paesi terzi avviene esclusivamente sulla base di clausole contrattuali standard dell’UE o di altre garanzie adeguate ai sensi dell’art. 46 del GDPR.
- Di norma, le trascrizioni e i metadati memorizzati da Alveni AI vengono cancellati automaticamente dopo 30 giorni. È possibile richiederne la cancellazione anticipata.
- Il riepilogo inviato via e-mail all’hotel è soggetto ai rispettivi obblighi di conservazione dell’hotel.
- Non viene effettuato alcun riconoscimento vocale, non vengono creati profili vocali né utilizzate firme audio a fini di identificazione.
- Non viene effettuato alcun addestramento di modelli di IA con dati personali e i dati trattati non vengono utilizzati per finalità di profilazione.
Per alcune funzionalità, Alveni AG si avvale di sub-responsabili tecnici (ad es. per hosting o infrastruttura di telefonia). Tali soggetti sono vincolati contrattualmente ai sensi dell’art. 28 del GDPR e ricevono esclusivamente i dati strettamente necessari alla fornitura tecnica del servizio.
Tracking e cookie
- Per la funzione telefonica non vengono utilizzati cookie né strumenti di tracciamento.
- Non avvengono decisioni completamente automatizzate con effetti giuridici.
- I chiamanti vengono chiaramente informati all’inizio della chiamata che stanno parlando con un assistente supportato dall’IA. In qualsiasi momento è possibile richiedere il trasferimento a un operatore umano.
Base giuridica
Il trattamento dei dati avviene sulla base dell’art. 6, par. 1, lett. f) del GDPR (legittimo interesse), in particolare per garantire una reperibilità telefonica affidabile e una gestione efficiente delle richieste in entrata. Qualora il trattamento sia necessario per l’avvio o l’esecuzione di un contratto (ad es. richieste di prenotazione), esso avviene inoltre sulla base dell’art. 6, par. 1, lett. b) del GDPR.
Volontarietà e diritto di opposizione
Il conferimento dei dati personali durante la chiamata è volontario. Lei decide quali informazioni desidera fornire. Ha il diritto di opporsi in qualsiasi momento al trattamento dei Suoi dati personali con effetto per il futuro. La preghiamo di inviare la Sua richiesta o opposizione a: privacy@alveni.ai.
Ulteriori informazioni
Informazioni dettagliate sulla protezione dei dati sono disponibili nell’informativa sulla privacy di Alveni AG: https://alveni.ai/datenschutz/
Alveni AI Chat Application on Website (Website Chatbot)
What data is processed?
Our website uses the chat application provided by Alveni AG, R2 Tower, Richtistrasse 2, 8304 Wallisellen, Switzerland ( https://alveni.ai/). The website chatbot supports visitors by answering questions and providing information about the hotel, offers, services, or other provided content.
When you use the chat, only the data that you voluntarily provide or that is required for the technical provision of the service is processed, in particular:
- Information you voluntarily provide (e.g. name, request, email address, desired contact method)
- Contents of your chat messages and conversation history
- Date and time of chat usage
- Technical connection data (e.g. IP address, session information)
The information transmitted is processed in encrypted form and used exclusively to answer your request, forward it to the responsible internal team, or enable communication with you. No further use — in particular for advertising purposes, profiling, or training AI models with personal data — takes place.
Technically necessary data processing
For the secure and reliable operation of the chat application, the following data is processed:
- The IP address is processed to establish the technical connection, ensure the security of the service, and detect misuse (e.g. spam).
- A technically necessary cookie with a unique session ID is used. This enables the chat session to be recognized and the conversation history to be continued during a later visit.
- Technical logs and error reports may be processed to ensure the stability, security, and functionality of the application.
The cookie is stored for a maximum of 30 days from the last use. You can disable the storage of cookies at any time in your browser settings. Without cookies, the chat function may not be fully available technically.
Processing and storage
Chat data is processed in encrypted form. Chat contents are stored only for as long as necessary to provide the service, process your request, or ensure technical security.
- Chat contents are not used for advertising or personalized profiles.
- No AI model training is carried out using personal chat data.
- No personal data is analyzed or evaluated for identifying individual users.
- No automated decision-making with legal effect takes place.
For certain technical functions, Alveni AG uses subprocessors (e.g. hosting or infrastructure providers). These are contractually obligated in accordance with Art. 28 GDPR and receive only the data necessary for the technical provision of the service.
Tracking and cookies
No additional tracking or analytics tools such as Google Analytics are used for the chat function. The technically necessary cookie is used exclusively for chat functionality and not for tracking your usage behavior.
Legal basis
Data processing is carried out on the basis of Art. 6 para. 1 lit. f GDPR (legitimate interest), in particular to enable direct, efficient, and reliable communication with you and to ensure the security and functionality of the chat application.
If the communication relates to a reservation or a contractual request, processing may additionally be based on Art. 6 para. 1 lit. b GDPR (performance of a contract or steps prior to entering into a contract).
Voluntary nature and right to object
Providing personal data in the chat is voluntary. You decide which information you wish to provide. The chat can generally also be used without providing personal data.
You have the right to object to the processing of your personal data at any time with effect for the future. Please send your request or objection to: privacy@alveni.ai.
Further information
Detailed information on data protection can be found in the privacy policy of Alveni AG: https://alveni.ai/datenschutz/
Joint Controllership with Romantik® Hotels & Restaurants AG
Stafler, Mauls Nr. 10 processes personal data in certain cases jointly with Romantik® Hotels & Restaurants AG, Friedrich‑Ebert‑Anlage 18, 60325 Frankfurt am Main, in accordance with Art. 26 GDPR.
Joint controllership applies in particular to:
- Bookings via Romantik® Hotels & Restaurants AG’s central platforms
- Management of network customers
- Joint marketing and communication activities
- Customer loyalty programs (e.g. RomantikCard)
- Processing of reviews and feedback
For processing activities carried out exclusively by the hotel (e.g. direct bookings, on‑site stays, local payment processing), the hotel acts as the sole controller.
Data subject rights may be exercised against either the hotel or Romantik® Hotels & Restaurants AG.
Data protection notice
Your personal data is processed by the hotel and, where applicable, jointly with Romantik® Hotels & Restaurants AG in accordance with Art. 26 GDPR (e.g. for bookings via central platforms, loyalty programs or marketing activities).
Further information on data protection is available on our website or at the reception.
