Privacy notice

This notice explains how personal data is processed when you visit this website or use its enquiry and booking features.

1. Controller

Ruth Dick · Apartments Ruth
Ganshofstraße 18, 5020 Salzburg, Österreich / Austria
mail@apartments-ruth.at · +43 650 7500255

2. Visiting the website and hosting

This website is provided through OpenAI’s ChatGPT Sites using Cloudflare infrastructure. This involves processing IP addresses, requested URLs, access times, browser and device information, and technical error and security data. The purposes are delivering the pages, operating the website securely and preventing abuse. The legal basis is Article 6(1)(f) GDPR; our legitimate interest is a reliable and secure website.

The currently restricted preview also uses ChatGPT Sites access controls. When signing in or redeeming an invitation, the platform processes identity and access information. The public calendar and booking functions use the information you enter in the form and do not require importing your ChatGPT profile.

Our contracting entity for hosting is OpenAI Ireland Ltd. OpenAI processes personal data collected through the operation of the published website on our behalf under the ChatGPT Sites Data Processing Addendum, which also applies to ChatGPT Plus. OpenAI uses the providers described in its subprocessor list, including Cloudflare for web hosting.

Further provider information: OpenAI, OpenAI subprocessors and Cloudflare.

3. Availability, quotes and bookings

A price enquiry sends the selected apartment, arrival and departure dates, and number of guests to Guesty. A non-binding booking request additionally involves your first name, last name, email address and, if voluntarily provided, telephone number. Quote and enquiry status and confirmation of the data transmission are also processed. We need this information to handle your request, communicate with you and arrange your stay. An online enquiry is not possible without the required information; a telephone number is optional.

We use Guesty, Inc. for reservation management. For the guest data processed on our behalf, we are the controller and Guesty acts as our processor under our instructions. The Guesty Data Processing Addendum forms part of our contract. Guesty receives the information required for the requested service and uses subprocessors for cloud hosting, database services, messaging and email delivery, customer support and analytics. Details are provided in Guesty’s list of subprocessors (PDF). Enquiries, bookings and contract performance are based on Article 6(1)(b) GDPR. Legally required records are based on Article 6(1)(c). Preventing abusive or duplicate requests and payments is based on our legitimate interests under Article 6(1)(f).

4. Booking requests and payment

This website offers non-binding booking requests only. A booking becomes binding only after Ruth personally confirms it. No card payment form is loaded and no card details are collected through this website. Payment for a confirmed booking is by bank transfer or PayPal, arranged directly with Ruth after confirmation. The selected payment provider processes the payment data required for the transaction. When PayPal is used, its privacy notice applies. No PayPal form or payment button is loaded on this website.

5. Contact by email or telephone

If you contact us, we process your contact details and message to answer your enquiry and, where relevant, prepare or perform a booking. The legal basis is Article 6(1)(b) GDPR for contractual enquiries, or our legitimate interest in responding to messages under Article 6(1)(f) for other enquiries. The email and telecommunications providers used for the communication are involved.

6. Cookies and similar technologies

A price enquiry sets the technically necessary ruth_booking cookie. It contains a random session identifier linking a quote to your browser session. It expires one hour after the latest price enquiry and uses Secure, HttpOnly and SameSite=Strict protections. The associated enquiry feature cannot be used securely without it.

This cookie is required for the booking feature you expressly request, under section 165(3) of the Austrian Telecommunications Act 2021. Related personal data processing is based on Article 6(1)(b) and (f) GDPR. Platform access services may use their own necessary security and session technologies, as described in their notices. Our own pages do not include Google Analytics, advertising pixels or newsletter tracking. Cookies can be blocked or deleted using browser settings; this may limit functionality.

7. Interactive map and external links

The interactive map is opened on a separate map page. Opening that page loads map tiles from tile.openstreetmap.org (OpenStreetMap Foundation) and Leaflet program files from unpkg.com (UNPKG, delivered through Cloudflare). These providers receive your IP address and technical request information. Moving or zooming the map requests additional tiles. The map does not request your device’s location. The purpose is the requested display of the neighbourhood and routes. The legal basis is our legitimate interest in providing useful orientation for guests under Article 6(1)(f) GDPR.

Further information: OpenStreetMap Foundation, UNPKG and Cloudflare. Airbnb reviews are provided as links only. Displaying a link does not load an Airbnb review widget. Clicking it opens Airbnb, where its Privacy Policy applies.

8. Retention periods

• Booking cookie: one hour after the latest price enquiry.
• Technical quote and session records in this website: quotes can be used for no more than 15 minutes. Encrypted local quote records are automatically removed on the next use of the booking API after 24 hours without an update. Expired technical locks preventing duplicate submissions are also cleared there. This does not delete the actual reservation in Guesty.
• Enquiries and correspondence: as long as needed to handle the enquiry and associated follow-up questions. Retention then ends unless legal obligations or specific evidence needed for legal claims require further storage. If a booking is made, relevant parts become contractual records.
• Contract, payment and invoice records: for contract performance and subsequently for applicable statutory retention periods. Tax-relevant documents are generally retained for seven years from the end of the relevant calendar year, or longer where proceedings require it. This period does not apply to all technical records or enquiries.
• Guest data held in Guesty: Guesty states that personal data remains in our active account to manage reservations, communicate with guests and maintain records. It retains personal data only as long as necessary to provide its services and meet legal obligations; afterwards it deletes or irreversibly anonymises the data. Guesty has not specified a fixed retention period for all guest data. We can request deletion of specific data or all account data through Guesty’s privacy team. To request deletion of your data, please contact us using the address above; applicable legal retention obligations remain unaffected. If you contact Guesty directly about your data, Guesty forwards your request to us.
• Providers’ own operational and security logs and backups: providers do not consistently publish fixed day-based periods for the services used here. Retention depends on operational and security purposes, legal obligations and the deletion criteria in their linked privacy notices. We therefore do not promise a single fixed deletion period for all providers. For ChatGPT Sites, we do not currently have confirmed specific retention periods for hosting and access logs, security logs or website database backups. The cleanup periods described above for technical quote and session records apply to active database entries; they do not promise simultaneous deletion from backups or provider logs.

9. Recipients and processing outside Europe

Recipients, to the extent necessary, include the hosting, reservation, payment, communications and map providers described above and their relevant subprocessors. Banks, tax advisers or authorities may also receive data where necessary for the transaction or required by law.

We do not promise storage exclusively within the European Economic Area. Guesty has confirmed that its main cloud hosting uses Amazon Web Services (AWS) in the United States. For transfers to the United States and other countries without an applicable adequacy decision, Guesty states that it relies on the European Commission’s Standard Contractual Clauses. OpenAI and Cloudflare operate international infrastructure; ChatGPT Sites does not provide a guarantee of exclusively European data storage. OpenAI lists the United States as the processing location for Cloudflare web hosting. For transfers from the EEA or Switzerland to other countries, the ChatGPT Sites Data Processing Addendum provides for standard contractual clauses or a European Commission adequacy decision as the transfer basis.

For international transfers, providers describe relying, depending on the recipient and service, on adequacy decisions under Article 45 GDPR or standard contractual clauses and additional safeguards under Article 46 GDPR. The EU-US Data Privacy Framework applies to a US recipient only where that recipient and processing are covered by it. You may contact us at the address above for information about the relevant safeguards and how to obtain a copy. The linked provider information gives further details; agreeing to a booking does not replace a required legal basis for an international transfer.

10. Your rights

Subject to the applicable legal conditions, you have rights of access, rectification, erasure, restriction of processing and data portability. You may object to processing based on legitimate interests on grounds relating to your particular situation. Where processing relies on consent, you may withdraw it at any time for the future. Please contact mail@apartments-ruth.at.

You may also complain to a data protection supervisory authority, particularly the Austrian Data Protection Authority, Barichgasse 40–42, 1030 Vienna, Austria, dsb@dsb.gv.at.

Last updated: 28 October 2026