Protecting your personal data is important to us. We process your data solely on the basis of applicable law (General Data Protection Regulation — GDPR, Austrian Data Protection Act — DSG, Austrian Telecommunications Act 2021 — TKG). This policy informs you about what data we process when you visit this website and make reservations, for what purpose, on what legal basis, and what rights you have.
1. Controller
Ernst Ludwig Bauer INTEMPO — kunst und kulTOURen
Schloss 1, 9062 Moosburg, Austria
Phone: +43 699 1105 44 99
Email: ernst.bauer@intempo.at
A data protection officer is not legally required and has not been appointed. For all data protection matters, please contact us directly using the details above.
2. Hosting and server log files
This website is hosted by Vercel Inc., 440 N Barranca Ave #4133, Covina, CA 91723, USA. When you access the website, Vercel processes technically necessary data: IP address, date and time of access, page accessed, browser type, and operating system (server log files). This data is required to deliver and secure the website and is not combined with other data sources.
Legal basis: Art. 6(1)(f) GDPR (legitimate interest in the secure and stable operation of the website). We have a data processing agreement with Vercel under Art. 28 GDPR. Vercel is certified under the EU-US Data Privacy Framework (DPF); EU Standard Contractual Clauses apply in addition. Log files are automatically deleted by Vercel after a short time.
3. Images and content (content delivery)
Images and content on this website are loaded via the content management system Sanity (Sanity AS, Måltrostveien 26, 0786 Oslo, Norway) and its delivery network (cdn.sanity.io). Your IP address is transmitted to Sanity, as this is technically necessary to retrieve images. Sanity AS is based in the EEA; where subprocessors are used in third countries (cloud infrastructure), this is based on EU Standard Contractual Clauses.
Legal basis: Art. 6(1)(f) GDPR (legitimate interest in the performant display of website content).
4. Spam protection (Cloudflare Turnstile)
To protect our forms from abuse, we use Cloudflare Turnstile (Cloudflare Inc., 101 Townsend St., San Francisco, CA 94107, USA). Turnstile verifies, without picture puzzles, whether a request originates from a human, processing technical browser characteristics and the IP address for this purpose. This sets the cookies __cf_bm and __cflb (see section 5). No cookies are set for advertising purposes and no user profiles are created.
Legal basis: Art. 6(1)(f) GDPR (legitimate interest in protection against automated attacks and spam). Cloudflare is certified under the EU-US Data Privacy Framework (DPF); EU Standard Contractual Clauses apply in addition.
5. Cookies and local storage
This website does not use analytics, statistics, or marketing cookies, and no advertising trackers. Only technically necessary cookies are set:
Name Purpose Type Duration
intempo_consent stores your choice from the cookie notice essential 1 year
i18n_redirected remembers your language choice (DE/EN/IT) essential 1 year
__cf_bm Cloudflare Turnstile — detects automated access essential 30 minutes
__cflb Cloudflare Turnstile — load balancing essential up to 24 hours
These cookies are technically necessary for the operation and security of the website and are set regardless of consent.
Legal basis: § 165 para. 3 of the Austrian Telecommunications Act 2021 (TKG) (strictly necessary storage). Via the "Settings" link in the footer, you can manage additional, non-essential categories (currently: none). You can also delete or block cookies in your browser at any time.
6. Contact form
If you write to us via the contact form, we process the data you provide (name, email address, message) to handle your inquiry and any follow-up questions.
Legal basis: Art. 6(1)(b) GDPR (pre-contractual measures), otherwise Art. 6(1)(f) GDPR (legitimate interest in responding to inquiries). We delete inquiry data once the request has been resolved and no statutory retention obligations apply, at the latest after 12 months.
7. Reservations and orders
If you make a reservation for a trip or event, or order products (e.g. vouchers, castle breakfast, book) via the reservation form, we process: name, phone number, email address, chosen trip or product, date, and number of participants. We use this data solely to process your reservation or order, including confirmation, payment processing, and invoicing.
Legal basis: Art. 6(1)(b) GDPR (performance of a contract). We retain booking and invoicing data for 7 years in accordance with tax and commercial law obligations (§ 132 BAO, § 212 UGB); it is deleted thereafter.
8. Disclosure to third parties
We only disclose your data where necessary: to service partners of the booked trip (e.g. restaurants, opera and ticket offices, accommodation and coach operators), limited to the information required for execution (usually name and number of participants); to our IT service providers as processors (Vercel, Sanity, Cloudflare — see sections 2–4); and to authorities where we are legally obliged to do so. We do not sell your data or pass it on for advertising purposes.
9. Contact via WhatsApp
We offer contact via WhatsApp (WhatsApp Ireland Ltd., 4 Grand Canal Square, Dublin 2, Ireland, part of the Meta group of companies). If you contact us via WhatsApp, WhatsApp’s own privacy notices additionally apply; data may also be transferred to the USA. Use of this channel is voluntary — you can also reach us by email or phone.
Legal basis: Art. 6(1)(b) or (f) GDPR; the transmission to WhatsApp is based on your active decision to use this channel.
10. Photographs at events
Photos and videos may be taken at our trips and events for documentation and promotional purposes, on which participants may be recognisable.
Legal basis: Art. 6(1)(f) GDPR (legitimate interest in documenting and promoting our events), subject to your legitimate interests. You may object to being photographed or to publication at any time — most easily directly on site with the tour guide, or by email to ernst.bauer@intempo.at. We remove already published images following an objection, where technically possible.
11. Links to other websites
This website contains links to external offerings (Instagram, Threads, schloss-moosburg.at, WhatsApp). These are plain links without embedded plugins — no data is transmitted to these providers merely by visiting our website. Only once you follow a link does that provider’s own privacy policy apply.
12. Your rights
You generally have the right to access (Art. 15 GDPR), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20), and objection (Art. 21) regarding data we hold about you. You may withdraw any consent given at any time, without affecting the lawfulness of processing carried out before the withdrawal.
An informal message to ernst.bauer@intempo.at is sufficient to exercise your rights.
If you believe that the processing of your data violates data protection law, you may lodge a complaint with the supervisory authority. In Austria, this is the Austrian Data Protection Authority (Österreichische Datenschutzbehörde), Barichgasse 40–42, 1030 Vienna, Phone +43 1 52 152-0, Email dsb@dsb.gv.at, www.dsb.gv.at.
13. Data security
This website is delivered exclusively via an encrypted connection (HTTPS/TLS). We take appropriate technical and organisational measures to protect your data against loss and unauthorised access.
14. Changes to this policy
We update this privacy policy whenever the website, the services used, or the legal situation change. The version published here at any given time applies.
Last updated: 2 September 2026