Skip to main content
Contact
Legal

Privacy policy

How we handle your data – short, honest and without tracking.

1. Controller

The controller responsible for the processing of personal data on this website is:

Helmut Knauss – Ennsflusswandern / Kajaktiv
Aich 56, 8966 Aich-Assach, Austria
Phone: +43 650 4214383
Email: info@ennsflusswandern.at

We process personal data exclusively on the basis of the General Data Protection Regulation (GDPR; German: DSGVO), the Austrian Data Protection Act (Datenschutzgesetz, DSG) and the Austrian Telecommunications Act 2021 (Telekommunikationsgesetz 2021, TKG 2021).

2. Key points at a glance

  • No tracking: we do not use any analytics or marketing tools, advertising cookies or profiling.
  • No cookie banner needed: only technically necessary storage is used.
  • No reCAPTCHA and no social media plugins: Facebook and Instagram are included only as ordinary links.
  • Fonts and scripts are hosted on our own server. External content is loaded only for displaying maps (OpenStreetMap) and – only after you click – for a YouTube video.
. Hosting, Cloudflare & server log files

This website is operated by a web hosting provider acting on our behalf as a processor (Art. 28 GDPR). When you visit the website, the following data is automatically stored in server log files: IP address, date and time of access, page accessed, amount of data transferred, referrer URL, and browser and operating system.

We need this data to operate the website securely and reliably and to detect attacks. The legal basis is our legitimate interest (Art. 6(1)(f) GDPR). The log files are deleted after 14 days unless they are needed for longer to investigate a specific security incident. Data is transmitted in encrypted form (HTTPS).

To deliver this website securely and quickly, we use the content delivery network and security service of Cloudflare (Cloudflare Germany GmbH, Rosental 7, 80331 Munich, Germany; parent company Cloudflare, Inc., 101 Townsend St., San Francisco, CA 94107, USA). All requests to the website pass through Cloudflare’s servers. Technical data such as your IP address, the pages requested, browser information and the time of access are processed in order to fend off attacks and deliver the website quickly. Email addresses on the website are encoded by Cloudflare to protect them against spam and are only decoded in your browser.

The legal basis is our legitimate interest in a secure and stable website (Art. 6(1)(f) GDPR). Processing in the USA is possible; Cloudflare, Inc. is certified under the EU-US Data Privacy Framework. More information: Cloudflare’s privacy policy.

4. Cookies & local storage

We use only technically necessary cookies and storage (§ 165(3) TKG 2021):

  • Language selection (cookie “pll_language”): remembers the language you selected for the website; stored for up to 1 year.
  • Light/dark mode (local browser storage “ennsflussw-theme”): only remembers your choice if you switch dark mode yourself. No personal data is stored, and the information never leaves your browser.
  • Login: when logging in to the admin area, WordPress sets session cookies. This only affects editors, not visitors.
  • Security (Cloudflare): Cloudflare may set technically necessary cookies (e.g. “__cf_bm”) to distinguish humans from bots. They contain no information that identifies you personally and expire after 30 minutes at the latest.

You can delete or block cookies and local storage in your browser at any time. The website remains usable; only your settings will be lost.

5. Contact form, email & phone

If you contact us via the contact form, by email or by phone, we process the data you provide (name, email address, subject, message and, where applicable, phone number) in order to answer your enquiry and to prepare a booking.

The contact form sends your details to us by email and additionally stores them in our website database so that no enquiry gets lost. Neither reCAPTCHA nor any other external services are used.

The legal basis is the performance of pre-contractual measures (Art. 6(1)(b) GDPR) or your consent (Art. 6(1)(a) GDPR), which you give by ticking the box in the form. You can withdraw your consent at any time, informally, by email; this does not affect the lawfulness of processing carried out before the withdrawal.

As a rule, we store your enquiry for 1 month after it has been dealt with – longer only if this is necessary to process a booking or if statutory retention obligations apply.

6. Maps (OpenStreetMap)

Our interactive maps (stages, stops) are displayed using the Leaflet map library, which is hosted on our own server. The map tiles themselves are loaded from the servers of the OpenStreetMap Foundation (St John’s Innovation Centre, Cowley Road, Cambridge, CB4 0WS, United Kingdom). In the process, your IP address is transmitted to these servers.

An adequacy decision of the European Commission exists for the United Kingdom. The legal basis is our legitimate interest in presenting the route clearly (Art. 6(1)(f) GDPR). No cookies are set. Further information: OpenStreetMap Foundation privacy policy.

7. YouTube video

On the home page we show a video from YouTube (Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland). The video is only loaded when you click “Play” (two-click solution). Before that, no connection to YouTube is established.

After your click, the video is embedded via the domain youtube-nocookie.com. In the process, data such as your IP address is transmitted to Google; processing in the USA is possible. Google is certified under the EU-US Data Privacy Framework. The legal basis is the consent you give by clicking (Art. 6(1)(a) GDPR). Further information: Google privacy policy.

8. Fonts & scripts

All fonts (Roboto, Ethnocentric) and the software libraries used are loaded directly from our own server. No connection is made to Google Fonts or any other content delivery networks.

Our website contains links to other websites, e.g. to online booking and the rental shop on kajaktiv.at, to Facebook, Instagram, Google Maps (directions to the stops), the ÖBB timetable or press articles. These links are ordinary references: only when you click a link are you taken to the respective provider’s website. From then on, that provider’s privacy policy applies.

Bookings and orders are handled via kajaktiv.at. The data processed there is described in the kajaktiv.at privacy policy.

10. Recipients & retention period

To handle enquiries, bookings and legal obligations, personal data may be transferred to the following recipients to the extent necessary:

  • Cloudflare (delivery and protection of the website, processor)
  • our web hosting and IT service provider (processor)
  • the local tourism association and the municipal registration office (Registration Act [Meldegesetz], local and overnight-stay taxes)
  • Statistics Austria (Statistik Austria)
  • tax advisers and auditors
  • legal representatives and debt collection agencies (only where required)

We store personal data only for as long as is necessary for the respective purpose or as required by statutory retention obligations (e.g. 7 years under § 132 of the Austrian Federal Fiscal Code [Bundesabgabenordnung, BAO]).

11. Your rights

You have the right at any time to access (Art. 15 GDPR), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20) and to object (Art. 21), as well as the right to withdraw any consent you have given at any time. Just write to us at info@ennsflusswandern.at.

If you believe that the processing of your data violates data protection law, you can lodge a complaint with the Austrian Data Protection Authority (Datenschutzbehörde): Barichgasse 40–42, 1030 Vienna, dsb@dsb.gv.at, www.dsb.gv.at.

Last updated: October 2026