Privacy policy

Last updated: 2 November 2026

This policy explains how DoTheThing GmbH uses personal data when you visit www.dothething.world, apply for or book a stay at Pension Christoph, or contact us. We follow the EU General Data Protection Regulation (GDPR) and the Austrian Data Protection Act (DSG).

Who we are

The controller is DoTheThing GmbH, Seebühel 29, 6233 Kramsach, Austria, which operates Pension Christoph. You can contact us at office@dothething.world or through the contact form at www.dothething.world/contact. We are not required to appoint a data protection officer. Please send any privacy question to us at the same address.

What we collect, why, and on what legal basis

Visiting our website

  • What: technical data such as IP address, browser, device and pages visited

  • Why: to run the site securely

  • Legal basis: our legitimate interest in a working, secure website (Art. 6(1)(f))

Website statistics

  • What: visits and how the site is used, through Squarespace analytics cookies

  • Why: to understand which pages are useful

  • Legal basis: your consent through the cookie banner (Art. 6(1)(a))

Contacting us (email, contact form or messages)

  • What: name, contact details and your message

  • Why: to answer you

  • Legal basis: steps before a contract (Art. 6(1)(b)) or our legitimate interest in replying (Art. 6(1)(f))

Booking a call

  • What: name, email and the time you choose

  • Why: to hold the call

  • Legal basis: steps before a contract (Art. 6(1)(b))

Applying for a camp or event

  • What: name, contact details, riding level, your answers, and whether you agree to filming and to our mailing list

  • Why: to select participants and plan the event

  • Legal basis: steps before a contract (Art. 6(1)(b)); consent for the mailing list (Art. 6(1)(a))

Booking and staying with us

  • What: contact details, travel and flight details for transfers, booking details, invoices and payments

  • Why: to provide your stay, transfers and coaching, and to invoice you

  • Legal basis: contract (Art. 6(1)(b)); legal obligation for accounting (Art. 6(1)(c))

Guest registration

  • What: name, date of birth, sex, nationality, home address, arrival and departure dates; for guests from abroad, also the type, number, issuing authority and date of issue of your travel document

  • Why: Austrian law requires us to register every guest and report them electronically to the local tourist board for registration, tourist tax and statistics

  • Legal basis: legal obligation (Art. 6(1)(c)) under the Austrian Registration Act (Meldegesetz) and Tyrolean tourism law

Food allergies and dietary needs

  • What: the allergies, intolerances and dietary needs you tell us

  • Why: only to prepare safe food for you

  • Legal basis: your explicit consent (Art. 9(2)(a)), because this is health data

Coaching participation

  • What: riding level and any health condition or injury relevant to coaching

  • Why: so your coach can keep you safe

  • Legal basis: your explicit consent (Art. 9(2)(a))

Photos and video

  • What: images and video in which you can be identified

  • Why: to promote our business on our website and social media

  • Legal basis: your consent (Art. 6(1)(a)), given on a separate form

Our newsletter

  • What: your email address

  • Why: to send news, events and offers

  • Legal basis: your consent (Art. 6(1)(a))

You don't have to give us allergy or health information, or consent to photos. If you don't, we can't cater for your needs or use your image, but you can still stay with us. We don't use automated decision-making or profiling.

Cookies

Our website runs on Squarespace. It uses cookies the site needs to work, for example for security and to remember your cookie choice. These don't need your consent. Squarespace's analytics cookies are used only if you accept them in the cookie banner. You can change your choice at any time through the cookie settings link at the bottom of every page. We don't use advertising cookies or tracking pixels.

Newsletter

When you sign up, your email address is stored in a Google Sheet in our Google Workspace account. Every newsletter has an unsubscribe link, or you can email us. We delete your address when you unsubscribe.

Social media

We have pages on Instagram, Facebook and TikTok. If you message us or interact with our pages there, the platform also processes your data under its own privacy policy. For our Instagram and Facebook pages, we and Meta Platforms Ireland Ltd are joint controllers for page statistics (Page Insights), and Meta handles requests about these. If you contact us on WhatsApp Business, WhatsApp (Meta) processes your phone number and messages.

Who receives your data

We share your data only when it's needed for the purposes above:

  • Our service providers, who process data on our behalf under a data processing agreement: Squarespace (website and hosting), Google (Workspace: email, Drive, Forms, Calendar and Gemini), Atlassian (Trello, for planning), Anthropic (Claude, our internal working tools) and Meta (WhatsApp Business).

  • People who deliver your stay: our caterer or chef (dietary and allergy needs only), your coach (your riding level and relevant health or injury information) and transfer drivers (your name, flight and pick-up details).

  • Authorities: Tourismusverband Alpbachtal and the municipality of Kramsach (guest registration, tourist tax and statistics), the tax office, and others where the law requires it.

  • Our tax adviser (WTIV Steuerberatung), for accounting.

  • Banks and payment providers: Sparkasse Rattenberg Bank AG for bank transfers and Global Payments for card payments.

We never sell your data.

Transfers outside the EU

Some of our providers (Google, Squarespace, Atlassian, Anthropic and Meta) are based in the USA or may access data from there. Where a provider is certified under the EU-US Data Privacy Framework, we rely on the European Commission's adequacy decision. Otherwise we rely on the Commission's standard contractual clauses (Art. 46 GDPR).

How long we keep your data

  • Guest registration records: 7 years from the last entry, as required by law.

  • Invoices and accounting records: 7 years (Federal Fiscal Code, BAO § 132).

  • Booking correspondence: 3 years after your stay, in case of claims.

  • Applications: deleted 3 months after the event, unless you booked or joined our mailing list.

  • Allergy, dietary and health information: deleted within 30 days after your stay. If an injury or incident happens, we keep the relevant records until any claim is settled.

  • Newsletter: until you unsubscribe.

  • Photos and video: until you withdraw your consent. After that we won't publish them again, and we'll remove them from our website and social media.

Your rights

You have the right to access your data, to correct or delete it, to restrict its use, to data portability, and to object to processing based on our legitimate interests. Where we rely on your consent, you can withdraw it at any time; this doesn't affect anything we did before you withdrew it. To use any of these rights, email office@dothething.world. We'll reply within one month.

You can also complain to the Austrian Data Protection Authority (Österreichische Datenschutzbehörde), Barichgasse 40–42, 1030 Vienna, dsb@dsb.gv.at, www.dsb.gv.at.

Children

Bookings are made by adults. For guests under 14, a parent or guardian gives any consent on their behalf.

Changes

We'll update this policy when our services change. The current version is always on www.dothething.world.