Privacy policy

We only process personal data as far as needed to run this website, handle your booking and host your stay — in line with the EU General Data Protection Regulation (GDPR) and the Austrian Data Protection Act (DSG). Last updated: October 2026.

1. Controller

Everstays Operations GmbH
Schnirchgasse 11
1030 Wien, Austria
Email: stay@everstays-vienna.com
WhatsApp: +43 1 587108555

2. In short

3. Hosting and server logs

The website is delivered through the network of Cloudflare, Inc. (USA). When you visit, the server processes technically necessary data: IP address, date and time, requested address, browser and device type. This keeps delivery secure and stable, e.g. by protecting against attacks. Legal basis: our legitimate interest (Art. 6(1)(f) GDPR). Cloudflare is certified under the EU-US Data Privacy Framework (Art. 45 GDPR).

4. Availability search

When you enter travel dates and the number of guests on the home page, our server asks Hospitable for availability and price. Only the dates and number of guests are sent — not your IP address or any other details about you.

5. Booking on our booking pages

The booking pages (/book/…) embed the Hospitable booking window. As soon as it loads, your browser connects to servers of Hospitable (including booking.hospitable.com, api.hospitable.com, ph.hospitable.com) and Stripe, which transmits your IP address.

For a booking we process: name, email address, phone number, travel dates, number of guests, your message to us, and payment and booking details. The purpose is to perform the accommodation contract; legal basis: Art. 6(1)(b) GDPR. A booking is not possible without this information.

Hospitable processes the data as our processor (Art. 28 GDPR). Hospitable is based in the USA; transfers rely on appropriate safeguards under Art. 44 et seq. GDPR (EU standard contractual clauses or the EU-US Data Privacy Framework).

6. Payment

Payments are handled by Stripe (for customers in the EEA: Stripe Payments Europe, Limited, Ireland). Stripe collects and processes your card details itself — we never see them. To prevent fraud, Stripe sets a cookie in the booking window (m.stripe.com). Legal basis: Art. 6(1)(b) and (f) GDPR. Stripe is a controller for parts of this processing: stripe.com/privacy.

7. Contact by email or WhatsApp

If you write to us, we process your details to answer your enquiry (Art. 6(1)(b) GDPR for booking enquiries, otherwise Art. 6(1)(f)). The request form on the home page opens your own email program; it stores nothing itself. If you use WhatsApp, WhatsApp Ireland Limited (Meta) also processes your data under its own terms.

8. Legal duties as an accommodation provider

For your stay we are legally required to register guests (guest register under the Austrian Registration Act 1991) and to settle the Vienna city tax. We keep booking and invoice records as required by tax law (§ 132 Austrian Federal Fiscal Code: 7 years). Legal basis: Art. 6(1)(c) GDPR.

9. Links to other services

Our pages contain links, for example to Google Maps, Wikimedia Commons or restaurant websites. You only leave our site when you click such a link; the privacy policy of that provider then applies.

10. Retention

We keep data only as long as needed for the purpose, or as long as statutory retention duties apply. Enquiries without a booking are deleted once they are settled and no follow-up is expected.

11. Your rights

You have the right of access, rectification, erasure, restriction of processing, data portability and objection (Art. 15–21 GDPR). Just write to stay@everstays-vienna.com. We do not use automated decision-making or profiling.

You may also lodge a complaint with the supervisory authority: Austrian Data Protection Authority (Datenschutzbehörde), Barichgasse 40–42, 1030 Vienna, www.dsb.gv.at.