1. Controller
Controller within the meaning of the General Data Protection Regulation (GDPR) for the processing described in this Policy, insofar as Summit Hospitality Solutions determines the purposes and means:
Summit Hospitality Solutions e.U.
Manuel Bertsch
Stiftgasse 4
5760 Saalfelden am Steinernen Meer
Austria
Phone: +43 664 185 86 87
Email: service@summit-hospitality-solutions.com
Further register details are in the legal notice. The controller is established in the European Union. No representative under Art. 27 GDPR has to be appointed. Our services are directed at businesses, not at children.
2. General Information on Data Processing
We process personal data exclusively in accordance with applicable data protection laws, in particular the GDPR, the Austrian Data Protection Act and relevant telecommunications rules.
We process personal data only to the extent necessary for providing our website, handling inquiries, the Digital Check, business communication, managing contacts and leads, sending newsletters, operating SummitConnect and SummitMoments, fulfilling contracts with our customers (hotels), ensuring system security, or where you have provided consent.
3. Website Access / Server Log Files
When our website is accessed, your browser automatically transmits technically necessary information to the server, including in particular IP address, date and time of access, requested page, referrer URL, browser type and version, operating system and device information.
Legal basis: Art. 6(1)(f) GDPR (legitimate interest in a secure and functional website).
4. Contact Form, Email, Phone and Business Communication
If you contact us, we process the data you provide for handling your inquiry, business communication and the initiation or performance of a business relationship.
Inquiries submitted via forms on our website (in particular contact, pricing and Homepage Check) are transmitted in encrypted form via Odoo. Your details are captured as an inquiry (lead) in Odoo and additionally sent by email to service@summit-hospitality-solutions.com. Further processing takes place in Odoo (contact and inquiry management) and in our email inbox (IONOS).
Legal basis: Art. 6(1)(b) GDPR where contract-related; otherwise Art. 6(1)(f) GDPR.
Digital Check (short analysis)
On our website you may use the Digital Check (short analysis). You answer questions about your property, systems, processes and guest information. A first rough assessment is generated in the browser from your answers. This assessment is not an on-site operational review, not a forecast and not a proposal.
To prepare the short analysis, assign it to your property and contact you, we process in particular:
- name
- email address
- phone number
- property name, property type, approximate number of rooms and employees, and website where provided
- information on systems and digital processes (e.g. PMS, POS, booking, inventory, internal communication, guest information)
- friction points and urgency
- optional free-text comments
- the assessment generated in the browser from your answers (digital standing, observations, model figures)
The details are transmitted to us in encrypted form via the website form in Odoo. Your details are captured as an inquiry (lead) in Odoo and additionally sent by email to service@summit-hospitality-solutions.com. The details are then processed in Odoo (contact and inquiry management) and in our email inbox (IONOS). The Digital Check does not subscribe you to our newsletter.
Use of the Digital Check requires your confirmation that you have read this Privacy Policy and agree to the processing for preparing the short analysis and for contacting you.
Legal basis: Art. 6(1)(a) GDPR (consent) and, where the inquiry is directed at initiating a business relationship, Art. 6(1)(b) GDPR. You may withdraw consent at any time with effect for the future, in particular by writing to service@summit-hospitality-solutions.com.
5. Processing in Odoo
We use Odoo for operating the website, forms, contact management, CRM, lead capture, inquiry handling, business communication, appointment organisation where applicable and newsletter administration.
Legal basis: Art. 6(1)(b) GDPR, Art. 6(1)(f) GDPR and, where required, Art. 6(1)(a) GDPR.
Existing customers sign in to the customer portal. We process the login details and the session for that. The legal basis is Art. 6(1)(b) GDPR.
Appointments booked on the website are stored in Odoo. Name, email address, a phone number if given, the chosen time and the time zone Europe/Vienna may be processed. The legal basis is Art. 6(1)(b) GDPR where the appointment prepares a contract, otherwise Art. 6(1)(f) GDPR.
6. Newsletter
If you subscribe to our newsletter, we process your email address and any further voluntarily provided data for sending the newsletter, managing the subscription and documenting your consent.
Subscription takes two steps. After you sign up, we send an email with a confirmation link. Only a click on that link counts as consent, and only confirmed addresses receive the newsletter. To prove consent we store the email address and the time of signup and of confirmation, for the life of the subscription and for up to three years after unsubscribe.
Legal basis: Art. 6(1)(a) GDPR.
7. Cookies and Similar Technologies (Website)
On the first visit you choose what is loaded beyond running the website. Without that choice we use only what the website needs in order to work.
Technically required are:
- language
- the session, so forms and sign-in work
- time zone
- your choice in the cookie notice
This storage is based on Art. 6(1)(f) GDPR and, where the device is concerned, on Section 165(3) of the Austrian Telecommunications Act 2021. The button for this choice is “Necessary only”.
We do not set analytics cookies or marketing cookies. This website does not run audience measurement.
Live chat loads only if you choose “Accept all”. We then process the conversation and the technical data needed to answer it. The legal basis is Art. 6(1)(a) GDPR together with Section 165 of the Austrian Telecommunications Act 2021. You can withdraw consent in the cookie notice or by email to service@summit-hospitality-solutions.com. The chat is then no longer loaded.
8. SummitConnect – Cloud Software for Hotels
8.1 Subject Matter
SummitConnect is a web-based SaaS solution for hotels and hospitality businesses for operational workflows including user management, tasks, handovers, checklists, maintenance, handbook entries, scheduling, lost and found and notifications.
8.2 Roles: Controller and Processor
- Controller is usually the respective hotel / hospitality business.
- Processor is Summit Hospitality Solutions insofar as we host and operate SummitConnect on behalf of the hotel.
Detailed obligations are set out in the Data Processing Agreement (DPA / AVV) pursuant to Art. 28 GDPR.
8.3–8.9 Further details
Categories of data subjects include hotel employees and administrators. Processed data may include master data, authentication data (passwords stored only in encrypted/hashed form), operational data, uploads and technical logs. SummitConnect does not use advertising tracking or analytics cookies. Data is transmitted via HTTPS; technically necessary information may be stored in localStorage. Hosting: Hetzner Online GmbH, Germany; backups currently retained for 14 days. Employees should primarily contact their hotel as controller; additionally service@summit-hospitality-solutions.com.
9. SummitMoments – Digital Guest Directory for Hotels
9.1 Subject Matter
SummitMoments is a web-based SaaS solution for digital guest information, hotel offers and bookable add-on services. Guests may use the platform via in-room tablets, room-specific QR codes or mobile browsers — without installing a separate app.
9.2 Roles: Controller and Processor
- Controller is usually the respective hotel / hospitality business that uses SummitMoments for guest communication, information and add-on services.
- Processor is Summit Hospitality Solutions insofar as we host and operate SummitMoments on behalf of the hotel.
Detailed obligations are set out in the Data Processing Agreement (DPA / AVV) pursuant to Art. 28 GDPR.
9.3 Categories of Data Subjects
- hotel guests using SummitMoments
- hotel staff and administrators managing content and offers
- hotel contact persons for support and contract matters
9.4 Categories of Personal Data Processed
- guest data: name, room number, stay period, language — where provided by the hotel, via QR assignment or PMS interface
- inquiry data: requested add-on services, reservation or booking requests, message content, voluntarily provided contact details
- usage data: accessed sections, timestamps, metadata on offers and interactions
- technical log data: IP address, access time, browser/device information, session information
- content uploaded by the hotel where it may contain personal data
SummitMoments does not use advertising tracking, marketing profiling or analytics cookies.
9.5 Purposes and Legal Bases
Processing in particular for providing the digital guest directory, displaying information and offers, receiving and forwarding guest inquiries, performing the SaaS contract, support, security, backups and, where applicable, PMS synchronisation.
Legal bases: Art. 6(1)(b) GDPR, Art. 6(1)(f) GDPR, Art. 28 GDPR, Art. 6(1)(c) GDPR and Art. 6(1)(a) GDPR where consent is required and obtained.
9.6 Technical Browser Storage
SummitMoments may store technically necessary information in the browser (e.g. session data or language settings). Transmission is encrypted via HTTPS.
9.7 Hosting and Backups
Operated on servers of Hetzner Online GmbH, Germany. Backups are currently retained for 14 days.
9.8 Retention Period
Generally for the duration of the contractual relationship with the hotel; deletion after contract termination in accordance with the DPA.
9.9 Data Subject Rights
If you use SummitMoments as a hotel guest, the hotel is usually your first point of contact. You may also contact us at service@summit-hospitality-solutions.com.
10. Fonts
The fonts on this website are served from our own server. No connection to Google is made for them.
SummitConnect and SummitMoments may still load fonts from Google Fonts. Your IP address may then be transmitted to Google.
Legal basis for SummitConnect and SummitMoments: Art. 6(1)(f) GDPR. Where consent is required, we obtain it or switch to locally hosted fonts.
11. Recipients and Processors
Recipients can include Odoo S.A., Chaussée de Namur 40, 1367 Grand-Rosière, Belgium, for this website via Odoo Online (forms, CRM, appointments, customer portal and newsletter); IONOS SE, Elgendorfer Straße 57, 56410 Montabaur, Germany, for email; Cloudflare, Inc., 101 Townsend Street, San Francisco, USA, only for DNS and the encrypted redirect of the address without www (IP address and the address requested may be processed; page content, forms and email do not pass through Cloudflare); Hetzner Online GmbH, Industriestraße 25, 91710 Gunzenhausen, Germany, for SummitConnect and SummitMoments; Google Ireland Limited, Dublin, and where applicable Google LLC, USA, where SummitConnect or SummitMoments load Google Fonts (this website does not); IT providers, advisers and authorities where required; and the respective hotel.
12. International Transfers
Transfers outside the EEA occur only where necessary, where you have consented or where another lawful basis exists. Use of Google Fonts may involve transfers to third countries (e.g. the USA). For the redirect of the address without www, Cloudflare, Inc. (USA) processes connection data. Such transfers rely on the European Commission’s standard contractual clauses under Art. 46 GDPR.
13. Retention Periods
- Contact inquiries and the Digital Check with no later contract: until the inquiry is finished and for no longer than three years after the last contact, unless a legal duty requires otherwise.
- Contract and communication data: for the business relationship and afterwards for as long as legal duties require.
- Newsletter: until unsubscribe. Proof of consent is kept for up to three years after unsubscribe.
- Invoices and tax records: seven years under Section 132 of the Austrian Federal Fiscal Code.
- Website server logs: only for as long as security and troubleshooting require.
- Cookie choice: until you change it or delete it in the browser.
- SummitConnect and SummitMoments: for the contract with the hotel. Backups are currently kept for up to 14 days. Deletion after the contract ends follows the data processing agreement.
14. Data Security
We take appropriate technical and organisational measures including access controls, authorisation concepts, hotel-scoped data separation, encrypted transmission (HTTPS/TLS), hashed password storage, rate limiting and regular backups.
15. Requirement to Provide Data
Providing certain personal data may be necessary to process your inquiry, complete the Digital Check, conduct business communication, send the newsletter or use SummitConnect or SummitMoments on behalf of your hotel.
16. No Automated Decision-Making
No decision based solely on automated processing within the meaning of Art. 22 GDPR takes place unless expressly stated otherwise. The Digital Check figure is a rough orientation in the browser. It has no legal effect and is not a decision under Art. 22 GDPR.
17. Your Rights
You have the right of access, rectification, erasure, restriction, data portability and objection, and may withdraw consent at any time.
Contact: service@summit-hospitality-solutions.com. SummitConnect users should primarily contact their hotel; hotel guests using SummitMoments should primarily contact the respective hotel regarding guest data.
18. Right to Lodge a Complaint
Austrian Data Protection Authority
Barichgasse 40–42
1030 Vienna
Email: dsb@dsb.gv.at
Website: www.dsb.gv.at
You may also complain to the supervisory authority of your habitual residence, your place of work or the place of the alleged infringement (Art. 77 GDPR).
19. Changes to this Privacy Policy
We reserve the right to amend this Privacy Policy where necessary so that it reflects current legal requirements and the actual processing on our website, in SummitConnect and in SummitMoments.
Effective date: 5 October 2026