Last updated: 17 October 2026
1. Controller and contact details
The controller responsible for processing personal data on this website is:
JLB Projects GmbH
Marc-Aurel-Straße 4/16
1010 Vienna, Austria
Email: office@7destinations.at
Telephone: +43 677 62742614
We take the protection of your personal data seriously. We process personal data confidentially and in accordance with the General Data Protection Regulation (GDPR), the Austrian Data Protection Act and the Austrian Telecommunications Act 2021 (TKG 2021).
2. Purposes and legal bases
Depending on how you use our services, we process personal data for the following purposes:
- operating, securing and improving this website;
- responding to enquiries and taking steps before entering into a contract;
- processing apartment searches, reservations, accommodation contracts and related services;
- customer, supplier and contract administration;
- complying with accounting, tax, reporting and other statutory obligations; and
- analytics or third-party content, but only after you have given the required consent.
The relevant legal bases are Art. 6(1)(a) GDPR (consent), Art. 6(1)(b) GDPR (contract and pre-contractual steps), Art. 6(1)(c) GDPR (legal obligations) and Art. 6(1)(f) GDPR (legitimate interests, in particular secure and efficient website operation, business administration and the handling of enquiries). Where information is stored on or read from your device, section 165(3) TKG 2021 also applies.
3. Website access and server log files
When you access this website, the hosting provider may automatically process technical data such as your IP address, date and time of access, requested page or file, referrer URL, browser type and version, operating system and access status. This processing is necessary to deliver the website, ensure system security, diagnose faults and prevent misuse. The legal basis is Art. 6(1)(f) GDPR.
Log data is retained only for as long as required for these purposes and any applicable legal obligations, unless a security incident requires longer retention.
4. Contact enquiries
If you contact us by form, email or telephone, we process the information you provide, including your contact details and the content of your enquiry, in order to respond and, where applicable, to prepare or perform a contract. The legal basis is Art. 6(1)(b) GDPR or, for general enquiries, Art. 6(1)(f) GDPR.
We retain enquiry data for as long as necessary to handle the matter and thereafter in accordance with statutory retention periods or for the establishment, exercise or defence of legal claims.
5. Online search and booking requests
We use our Guesty reservation system for accommodation information, availability, prices and handling non-binding booking requests. The integration runs through our website server. No binding booking is concluded and no payment is processed on this website.
Details of the information transferred, legal bases, possible temporary holds, accommodation images and international transfers are provided below under “Availability and booking requests through Guesty” and “Email delivery and technical safeguards”.
5a. Card details and payments through Guesty and Stripe
We use the payment form in your personal Guesty Guest App and its connected Stripe payment account to prepare and process agreed card payments. This form is provided separately from our website; we do not request card numbers or card security codes on 7destinations.at. Please do not send these details by email or chat.
Processing may include your name, contact and billing details, card details, booking reference, amount, currency and payment status, as well as technical device and connection data for payment processing and fraud prevention. Our processing is based on preparing and performing the contract under Article 6(1)(b) GDPR, legal obligations under point (c) and secure payment processing under point (f). Adding a card does not confirm receipt of payment; charges follow the agreed booking and payment terms.
Guesty and Stripe may also process data outside the European Economic Area, including in the United States. Applicable transfer safeguards under Chapter V GDPR govern such transfers. More information about processing, roles, retention and international transfers is available in the Stripe Privacy Policy and the Stripe Privacy Center.
5b. Bank transfers, payment reconciliation and release of access instructions
For an agreed bank transfer to JLB Projects GmbH, we process in particular the payer’s name, booking or payment reference, amount, currency, payment date and bank details needed to allocate the payment. Payment information is reconciled with the booking and, where applicable, payment records from the booking platform or payment provider. This processing is necessary to perform the contract under Article 6(1)(b) GDPR and to comply with statutory accounting and retention obligations under Article 6(1)(c).
For a secure handover, we keep an internal record in Guesty that a staff member has verified full payment. Automatic access messages require this approval and a completed check-in form. Saving a payment method or completing the form alone does not replace payment reconciliation. If a payment cannot be allocated or you have a question, our team reviews the case; please contact office@7destinations.at. The internal approval record is intended for authorised staff. The purpose-based and statutory retention rules below apply to its storage.
6. Consent management with Real Cookie Banner
We use the WordPress plugin Real Cookie Banner, which is operated locally on our web server, to obtain, manage and document consent for optional cookies and similar technologies. A pseudonymous identifier (UUID), your selected services and service groups, the time and scope of your choice and technical information about the consent process are stored for this purpose. The plugin manufacturer devowl.io does not receive personal data about our website visitors through the ongoing operation of the plugin.
The processing is necessary to fulfil our legal documentation obligations pursuant to Art. 6(1)(c) GDPR and is also based on our legitimate interest in legally compliant and user-friendly consent management pursuant to Art. 6(1)(f) GDPR. Consent is generally stored for up to 365 days. You can change your privacy settings, view your privacy settings history or revoke your consent at any time using the cookie controls in the footer on any standard page of this website. Withdrawal does not affect the lawfulness of processing carried out before withdrawal. Technical information is available in the Real Cookie Banner data-processing documentation.
7. Cookies and optional services
Technically necessary cookies and similar technologies are used only to provide the website and its requested functions. Optional statistics, marketing or external-content services are not activated until you give consent. Details about each service, the provider, the processed data and the applicable retention periods are available directly in the privacy settings of the cookie banner.
Google Analytics 4
After your explicit consent, we use Google Analytics 4, a web analytics service provided by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. Google Analytics helps us understand how visitors use the website. Depending on your consent settings, online identifiers, device and browser information, pages viewed, referrer information, approximate location data and interaction data may be processed.
The legal basis is Art. 6(1)(a) GDPR and section 165(3) TKG 2021. Data may also be processed by Google LLC in the United States. Google states that it participates in the EU-U.S. Data Privacy Framework and also uses contractual safeguards where required. You may withdraw your consent at any time through the cookie settings. Further information is available at policies.google.com/privacy.
Elfsight review widget
After your explicit consent, we load a review widget supplied by Elfsight. In particular, your IP address and browser and device information may be transmitted to and processed by Elfsight in order to display external reviews. The legal basis is Art. 6(1)(a) GDPR and section 165(3) TKG 2021. You may withdraw your consent at any time through the cookie settings. Further information is available at elfsight.com/privacy-policy.
External links to Google Maps
Our website contains links to Google Maps. We do not embed interactive Google maps. Merely visiting our pages does not establish a connection to Google Maps through these links.
Only when you select “Open in Google Maps” do you open Google’s external website in a new tab. Google then processes personal data, such as your IP address and browser information, under its own privacy terms. If you are signed in, Google may associate data with your account. Processing outside the European Economic Area is also possible. Please see the Google Privacy Policy for details. These external Google Maps links do not require cookie consent on our website.
8. Recipients and international transfers
Personal data is disclosed only where this is necessary for the stated purposes, required by law or covered by your consent. Recipients may include hosting, IT, booking, communication, payment, accounting and professional service providers, as well as authorities or courts where legally required. Processors are contractually bound in accordance with Art. 28 GDPR.
Where data is transferred outside the European Economic Area, we rely on an adequacy decision, the EU Standard Contractual Clauses or another safeguard permitted under Chapter V GDPR, unless a statutory exception applies.
9. Retention
We store personal data only for as long as necessary for the relevant purpose. Contract and accounting documents are generally retained for the applicable statutory period, usually at least seven years under Austrian commercial and tax law. Data may be retained for longer where this is necessary for pending proceedings or the establishment, exercise or defence of legal claims. Consent records are generally retained for up to 365 days unless longer retention is necessary to demonstrate compliance.
10. Your rights
Subject to the statutory requirements, you have the right to obtain information about your personal data (Art. 15 GDPR), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20) and to object to processing based on legitimate interests (Art. 21). You may withdraw consent at any time with effect for the future.
To exercise your rights, contact us at office@7destinations.at or at the postal address stated above. We may request information necessary to verify your identity.
You also have the right to lodge a complaint with the Austrian Data Protection Authority: Österreichische Datenschutzbehörde, Barichgasse 40–42, 1030 Vienna, Austria; email dsb@dsb.gv.at; website www.dsb.gv.at.
11. Security and automated decisions
We use appropriate technical and organisational measures to protect personal data. This website uses encrypted HTTPS connections. Nevertheless, internet communications cannot be guaranteed to be completely secure.
We do not use solely automated decision-making, including profiling, that produces legal effects concerning you or similarly significantly affects you within the meaning of Art. 22 GDPR.
12. Changes to this policy
We may update this privacy policy when legal requirements, our services or the technologies used on the website change. The version published on this page is the current version.
Property owner enquiries
We process the contact and property details you provide to respond to your enquiry and assess a potential cooperation. Your enquiry is stored in the protected administrative area of this website and a notification is sent to office@7destinations.at. Access is limited to authorised staff. Processing serves to take steps at your request prior to entering into a contract (Article 6(1)(b) GDPR). We retain the information while it is needed to assess and handle the enquiry; where a contract results or statutory retention obligations apply, those purposes and obligations determine further retention. The controller and your rights are described above.
Availability and booking requests through Guesty
To check availability and prices, our website server sends your dates, guest count and chosen accommodation to our Guesty reservation system. When you submit a booking request, we also send your first and last name, email address, telephone number, selected offer and acknowledgement of the privacy information to Guesty, where our authorised team handles the request. Processing serves to handle your request and take steps at your request prior to a contract under Article 6(1)(b) GDPR. A booking request is not a confirmed booking; dates may be held for up to 24 hours. We retain requests while needed to handle them and, where applicable, a resulting contract and statutory obligations. Accommodation images may load from the image servers recorded in Guesty; those servers receive connection information technically required by your browser. The controller, contact information and your rights are described above.
We store your preferred reply language (German or English) privately on the website server together with the technical enquiry reference, property ID, travel dates and guest count. For website requests with held dates, we also include the language in the internal notification to our Office mailbox. Our team applies this preference when handling the enquiry in Guesty. The Booking Engine API does not set the preferred guest language automatically. The language selection is used only to handle your enquiry. The technical safeguard records also contain pseudonymous keyed checks derived from your contact details, quote and enquiry references, receipt time, processing status and mail handoff status. These records are currently not deleted automatically; a specific retention period and controlled cleanup remain to be defined. Unresolved technical holds protect against duplicate enquiries.
Email delivery and technical safeguards
Internal enquiry notifications are sent through Microsoft 365 / Exchange Online. Microsoft processes email content and delivery data under its applicable Data Protection Addendum. The primary enquiry and its mail handoff status are stored privately in WordPress; additional full-content mailer logging is disabled. To limit abusive form submissions, the website uses a keyed hash of the connecting IP address for up to one hour; the rate-limit record does not store the IP address in plain text. These security measures serve our legitimate interest in operating a reliable website under Article 6(1)(f) GDPR.
Guesty processes booking enquiry data as a service provider under its Data Processing Addendum. Microsoft and Guesty use affiliated companies and subprocessors; processing outside the EU/EEA may occur. Their published contractual safeguards for international transfers include the EU Standard Contractual Clauses where applicable. Further information and copies of the relevant safeguards may be requested using the controller contact above.