Privacy Policy

Visiting the website and technical logs

Each time you access our website, technically necessary access data is processed. This includes in particular the IP address, date and time, pages or files accessed, amount of data transferred, status messages, browser, operating system and the previously visited page, if your browser transmits it. IP addresses and other identifiers may be personal data. We process this data to deliver the website, to fix errors and to protect against misuse. The legal basis is Art. 6(1)(f) GDPR. Our legitimate interest lies in the secure and functional operation of our online services. Recipients are our service providers commissioned with hosting, technical maintenance and IT security.

Technical log data is only stored for as long as necessary for secure operation and for investigating specific errors or security incidents. In the event of a specific incident, the affected log data may be retained until the investigation is completed and, where necessary, to establish or defend legal claims.

Contact, contract processing and storage period

If you contact us via a form, by e-mail or by phone, we process your contact details, the content of your enquiry and the information required to handle it. For event enquiries this may include the preferred date, number of guests and event requirements. Processing is carried out for pre-contractual measures or contract performance under Art. 6(1)(b) GDPR, or for other matters under Art. 6(1)(f) GDPR based on our legitimate interest in answering enquiries. General enquiries without a contractual connection are generally deleted no later than six months after they have been dealt with. Contract-related documents are subject to the retention periods described below.

We process booking, contract and invoice data to perform and invoice the contract under Art. 6(1)(b) GDPR. Statutory retention obligations are fulfilled under Art. 6(1)(c) GDPR. Tax-relevant books and records must generally be kept for seven years from the end of the respective calendar year; longer retention may be necessary if proceedings are pending. Other data is deleted as soon as its purpose no longer applies and no legal obligation or storage required to establish or defend claims prevents this. Art. 6(1)(f) GDPR applies here; our interest lies in protecting our legal position. For vouchers that can still be redeemed, we keep the data required for redemption until redemption or until the claim legally expires.

We need the information marked as required in a booking or enquiry to process it or perform the contract. Without this information we cannot provide the requested service, or not in full. Any other information as well as consent to analytics, advertising or external content is voluntary.

Google Tag Manager

Google Tag Manager from Google Ireland Limited, Dublin, Ireland manages the technical integration of the services described below. It is not an analytics tool in its own right. When it is loaded, however, Google may receive technical connection data, in particular the IP address. Optional tags are subject to the consent requirements of the respective service. Using our own website domain to deliver tags changes neither the purpose nor the recipients of the subsequent processing.

Google Analytics 4

We use Google Analytics 4 from Google Ireland Limited, Dublin, Ireland, to analyse the use of our website and improve our services. With your consent, this may involve processing page views, interactions, technical device and browser data, referral sources, approximate location information and pseudonymous user or session identifiers. Pseudonymous data is not anonymous data. According to Google, Google Analytics 4 does not log or store individual IP addresses; the IP address is nevertheless processed technically during transmission. The analysis also covers transmitted booking events, provided you have consented to the corresponding measurement. The legal basis is Art. 6(1)(a) GDPR.

The cookies “_ga” and “_ga_*” are used to recognise browsers and assign sessions. Google states a default lifetime of two years; the lifetime can be configured. User- and event-level data is deleted in accordance with the retention period set in the Analytics account. Aggregated reports may remain for longer. Information from Google is available at https://policies.google.com/privacy and https://support.google.com/analytics/answer/11397207.

Google Ads

Google Ads is an advertising service of Google Ireland Limited, Dublin, Ireland. With your consent, we can recognise whether a visit or booking resulted from a Google ad and build audiences for advertising. This involves processing in particular ad and click identifiers, page views, device information and transmitted booking events such as booking value and currency. Google may combine this information with its own data and use it for personalised advertising. Depending on the visit, the cookies used include in particular “_gcl_au”, “_gcl_aw” and “_gcl_dc”. The legal basis is Art. 6(1)(a) GDPR. Information: https://business.safety.google/privacy/ and https://business.safety.google/adscookies/.

Meta Pixel

We use the Meta Pixel from Meta Platforms Ireland Limited, Dublin, Ireland, to measure the effectiveness of our advertising on Facebook and Instagram and to enable interest-based advertising. With your consent, this involves processing in particular pages visited, interactions, technical browser and device data, IP address, cookie or click identifiers and, where applicable, transmitted booking events. Meta may link the website visit to a Facebook or Instagram account and use the information for its own purposes. In particular “_fbp” and, after an ad click, “_fbc” may be used for this. The legal basis is Art. 6(1)(a) GDPR.

For the collection and transmission of event data to Meta, there is joint controllership under Art. 26 GDPR to the extent covered by the contractual terms. The allocation of responsibilities is set out in the controller addendum at https://www.facebook.com/legal/controller_addendum. Meta is responsible in particular for handling data subject rights regarding the data stored by Meta. You can also exercise your rights against us. Subsequent processing by Meta is carried out under Meta's own responsibility. Further information: https://www.facebook.com/privacy/policy/ and https://www.facebook.com/privacy/policies/cookies/.

Microsoft Advertising and Clarity

We use Microsoft Advertising with Universal Event Tracking, including the integrated Clarity functions. The provider is Microsoft Corporation, Redmond, USA, and its European company Microsoft Ireland Operations Limited, Dublin, Ireland. With your consent, page views, ad and click identifiers, technical browser and device data, IP address as well as interactions and booking events are processed. This serves to measure ad performance, build advertising audiences and improve our website. Clarity can analyse clicks, scrolling and page usage in session recordings and so-called heatmaps. Microsoft may also process the data for its own advertising and product purposes. The legal basis is Art. 6(1)(a) GDPR.

Cookie names include in particular “_uetsid”, “_uetvid”, “_uetmsclkid”, “MUID”, “_clck” and “_clsk”. Microsoft states a data retention period of 390 days for UET. According to the provider, Clarity session recordings are generally stored for 30 days, and flagged or favourited sessions as well as heatmap and aggregated click data for nine months. Further information: https://privacy.microsoft.com/de-de/privacystatement, https://learn.microsoft.com/en-us/clarity/setup-and-installation/clarity-cookies and https://learn.microsoft.com/en-us/clarity/setup-and-installation/data-retention.

LinkedIn Insight Tag

We use the LinkedIn Insight Tag from LinkedIn Ireland Unlimited Company, Dublin, Ireland, to measure the performance of LinkedIn ads and to build advertising audiences. With your consent, this may involve processing in particular the IP address, page view, referral source, browser and device data, timestamps and cookie identifiers. LinkedIn may link the visit to a member account. The legal basis is Art. 6(1)(a) GDPR. Where LinkedIn processes data for its own purposes, LinkedIn is independently responsible. Information: https://www.linkedin.com/legal/privacy-policy and https://www.linkedin.com/legal/l/cookie-table.

Cookie overview

The following overview lists the main cookie names of the services used. Which of these cookies are stored depends on your consent, the function used and your browser settings. The provider defaults listed must be distinguished from the retention of the data transmitted to the provider. Lifetimes may restart on renewed use; browsers may shorten them or block cookies.

Superchat and WhatsApp

For contact via our chat widget we use Superchat from SuperX GmbH, Berlin, Germany. Use involves processing in particular contact details, message content, timestamps, technical connection data and any attachments sent. Handling your request is based on Art. 6(1)(b) GDPR where there is a contractual connection, otherwise on Art. 6(1)(f) GDPR based on our interest in efficient customer communication. Non-essential device access or non-essential advance loading of the widget requires your consent. The storage periods described for contact enquiries apply to chat content. Information: https://www.superchat.com/de/datenschutz.

If you voluntarily choose to contact us via WhatsApp, your phone number, profile information, communication metadata and message content are also processed by WhatsApp Ireland Limited, Ireland. Data may be transferred to countries outside the EEA. WhatsApp's privacy notice at https://www.whatsapp.com/legal/privacy-policy-eea also applies. Alternatively, you can contact us by e-mail or phone. You will only receive promotional messages via WhatsApp on the basis of separate consent, which you can withdraw at any time, for example by sending “STOP”.

Newsletter and Brevo

If you subscribe to our newsletter, we process your e-mail address and any voluntary information to send you information about events, offers and promotions. For the sign-up form and sending we use Brevo, a service of the Sendinblue group. The service provider receives the data required for sign-up, sending and documentation. The legal bases for newsletter advertising are your consent under Art. 6(1)(a) GDPR and § 174 TKG 2021. A booking does not constitute consent to the newsletter. You can unsubscribe at any time via the unsubscribe link or by sending us a message.

After you unsubscribe, your address is removed from the active mailing list. We may continue to keep the necessary proof of subscription and withdrawal on the basis of Art. 6(1)(c) or (f) GDPR to meet our obligations of proof and to defend against claims. Minimal blocking information may remain stored so that the withdrawal is permanently respected. Opens and clicks are only analysed on a personal level on the basis of additional, appropriately informed consent. Information: https://www.brevo.com/de/legal/privacypolicy/.

Table reservations with Molzait

For table reservations at Mirage Garden we use molzait GmbH, Vienna, Austria, via reserve.molzait.com. A reservation involves processing in particular name, contact details, date, time, number of guests, any requests and technical connection data. The legal basis for handling the reservation is Art. 6(1)(b) GDPR. Technically necessary storage for the reservation you requested falls under the exemption of § 165(3) TKG 2021. Additional analytics or marketing technologies require separate consent. Reservation data is deleted once the reservation has been completed, unless it is needed for invoicing or for handling specific claims. Information: https://molzait.com/privacy.

Please only provide special categories of personal data, such as health data on allergies, to the extent necessary for the service you wish to receive. We process such voluntary information on the basis of your explicit consent under Art. 9(2)(a) GDPR in order to accommodate your request. Without this consent, such information cannot be processed.

YouTube

We embed videos via YouTube, a service of Google Ireland Limited, Dublin, Ireland. When you start an embedded video, in particular the IP address, page visited, browser and device data and usage information are transmitted to Google. Even the privacy-enhanced mode via “youtube-nocookie.com” does not rule out data transfers or storage in the browser. The legal basis is your consent under Art. 6(1)(a) GDPR and, where device access takes place, § 165(3) TKG 2021. Information: https://policies.google.com/privacy.

Google Maps and virtual tour

To show our location we use Google Maps from Google Ireland Limited, Dublin, Ireland. On the Mirage website this also includes the virtual tour with Google Street View. When the map or the tour is loaded, in particular the IP address, browser and device information and the page visited are transmitted to Google. Google may use cookies or similar identifiers and link data to a signed-in Google account. The legal basis for activation is your consent under Art. 6(1)(a) GDPR and, where device access takes place, § 165(3) TKG 2021. Information: https://policies.google.com/privacy.

Guest reviews with Trustindex

To display guest reviews we use Trustindex Ltd, Hungary. When a review display is loaded externally, the IP address, browser information and the page visited may be transmitted to Trustindex. The external widget is embedded on the basis of your consent under Art. 6(1)(a) GDPR and, where device access takes place, § 165(3) TKG 2021. Publicly published reviews may contain the name or profile picture of the reviewing user. Information: https://www.trustindex.io/privacy-policy/. A simple link to a review platform only establishes a connection to that platform when clicked.

Social media links

Our website contains links to external platforms such as Instagram. A simple link does not transmit any data to the linked platform when our page loads. Only when you click it do you leave our website; the privacy notices of the respective provider then apply. The separate processing by the Meta Pixel is described above.

Photo and video recordings at events

Photo or video recordings may be made at events for documentation purposes. Overview and event recordings may be based on Art. 6(1)(f) GDPR, provided our interest in documentation and reporting does not outweigh the rights of the persons depicted in the specific case. Information about recordings, purposes of use and contact persons is provided on site, or these are clearly recognisable. Publications may appear on our website, on our social media channels and in press or print media. Unpublished recordings are deleted after selection and once the documentation purpose has been fulfilled; published recordings are reviewed for their continued necessity and removed when the purpose no longer applies, insofar as this is within our control. Recordings published on the internet may be further distributed by third parties.

Recipients and transfers to third countries

Personal data is only received by the recipients required for the respective purpose. These include our IT, communication, booking, payment and advertising service providers and, where necessary, tax advisers, legal advisers and competent authorities. Service providers that process data exclusively on our behalf are bound under Art. 28 GDPR. For independent or joint controllers, the respective roles and agreements described apply.

With Google, Meta, Microsoft, LinkedIn and WhatsApp as well as any sub-processors used, data may also be processed in the USA or other countries outside the European Economic Area. For transfers to Switzerland there is an adequacy decision of the European Commission. Transfers to the USA are based on an applicable adequacy decision, provided the specific recipient effectively participates in the EU-US Data Privacy Framework and the processing is covered by it. Otherwise, appropriate safeguards under Art. 46 GDPR are required, in particular the European Commission's standard contractual clauses and, where applicable, supplementary measures. You can request information about the safeguards specifically used for your data, or a copy of them, via our contact details above.