Privacy Policy

1. Data controller

Apartment Löwen
Agnieszka Kwiatkowska
Tarces 17
39024 Malles Venosta (BZ)
Italy
Email (PEC / certified): loewencafe@pec.it

2. General information on data processing

As a general rule, we process the personal data of our users only to the extent necessary to provide a functioning website and our content and services. The legal basis is Art. 6(1) of the General Data Protection Regulation (GDPR), unless stated otherwise below.

3. Hosting and server log files

This website is hosted via Cloudflare. When you visit the website, information is automatically stored in so-called server log files, transmitted by your browser: IP address, date and time of the request, page requested, browser type and version, operating system, and the previously visited page (referrer URL). This data is used exclusively to ensure the secure and trouble-free operation of the website (Art. 6(1)(f) GDPR, legitimate interest) and is not combined with other data sources. We do not use any analytics or tracking tools (e.g. Google Analytics).

4. Cookies

This website itself does not set any cookies of its own for analytics or marketing purposes. The third-party services embedded below may set technically necessary cookies when they load, which are the responsibility of those providers.

5. Embedded fonts (Google Fonts)

For a consistent appearance, we use the fonts “Cinzel” and “EB Garamond”, which are loaded from Google’s servers (fonts.googleapis.com, fonts.gstatic.com) when the page is loaded. In doing so, your IP address is transmitted to Google. The legal basis is Art. 6(1)(f) GDPR (a consistent, fast display of the website). For more information, see Google’s privacy policy.

6. Embedded map (OpenStreetMap / CARTO)

To show directions, we embed an interactive map based on the open-source library Leaflet. The map tiles are loaded from CARTO (basemaps.cartocdn.com) using data from OpenStreetMap. When the map is loaded, your IP address is transmitted to these providers. The legal basis is Art. 6(1)(f) GDPR (a clear presentation of our location).

7. Embedded libraries (CDN)

To display the map, the photo galleries, and the booking assistant (see below), we load JavaScript and CSS libraries (including Leaflet via unpkg.com, as well as Swiper.js and the n8n chat widget via cdn.jsdelivr.net) from the servers of these CDN providers. Here too, your IP address is transmitted for technical reasons. The legal basis is Art. 6(1)(f) GDPR (reliable, high-performance provision of the website’s functions).

8. Contact inquiries and booking assistant

If you fill out our contact form, we process the data you provide (name, email address, arrival and departure dates, number of guests, message) in order to handle your inquiry. After submission, the form passes this information to our AI-powered booking assistant - a chat widget that runs in the background on a workflow automation platform (n8n, hosted on n8n.cloud). Your chat messages are processed by an AI language model (Anthropic Claude) in order to check availability against our Google Calendar, suggest alternative dates, and reply to you. As soon as a plausible name and email address are available, the provider is notified of your inquiry by email via the delivery service Resend.

The legal basis is Art. 6(1)(b) GDPR (handling your inquiry as a pre-contractual measure). A hidden form field (a “honeypot”) serves exclusively to automatically detect spam bots; it remains invisible and empty for genuine visitors and is not evaluated as long as it stays empty.

Recipients of this data (processors or, as applicable, independent controllers) are n8n (workflow and chat infrastructure), Anthropic (provision of the AI language model), Google (calendar synchronization), and Resend (sending of the notification email). This may result in the transfer of data to countries outside the EU/EEA (e.g. the USA); where necessary, these providers rely on appropriate safeguards (e.g. EU Standard Contractual Clauses or the EU-US Data Privacy Framework).

9. Disclosure to third parties

Your data is disclosed to third parties only within the scope of the service providers named above for the purpose of handling your inquiry, or where we are legally obliged to do so. We do not sell your data.

10. Storage period

We store personal data only for as long as necessary to handle your inquiry, unless longer statutory retention periods apply (e.g. commercial- and tax-law requirements if a booking is concluded).

11. Your rights

Under the GDPR, you have the following rights: access (Art. 15), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20), and objection to processing (Art. 21). You may withdraw any consent given at any time, with effect for the future (Art. 7 (3)). To exercise these rights, please contact us at the address given above.

12. Right to lodge a complaint

You also have the right to lodge a complaint with a data protection supervisory authority regarding the processing of your personal data. The competent authority is the Garante per la protezione dei dati personali, Piazza Venezia 11, 00187 Rome, Italy (www.garanteprivacy.it).

13. Changes to this privacy policy

We will update this privacy policy whenever changes to our data processing make this necessary. The version published on this page is always the current, applicable version.