Privacy policy

Last updated: October 2026

Who is responsible

Gustaffo digital service GmbH
Lindengasse 56/18-19
1070 Vienna, Austria
Email: [email protected]
Phone: +43 676 6817193

This policy covers this website, the ways you can contact us, and the data we handle about our customers and the people who use the Gustaffo platform on their behalf.

Hotel guests: when hotels use the Gustaffo platform for inquiries, bookings, payments, check-in or check-out, the hotel is responsible for its guests’ data. Gustaffo processes that data only on the hotel’s behalf and on its instructions, under a data processing agreement (Art. 28 GDPR). Guests can find details in the privacy policy of their hotel and can exercise their rights with the hotel.

No cookies, no tracking

This website does not use cookies, analytics or advertising trackers. Our fonts are stored on our own server, so no data is sent to font providers. The site stores one small, temporary value in your browser (session storage) so an animation of our logo works between pages. It contains no personal data and is deleted when you close the tab.

Hosting and server logs

The website is hosted by Cloudflare. When you visit it, Cloudflare processes technical data such as your IP address, the date and time, the page requested and your browser type. This is needed to deliver the website and protect it against attacks (legitimate interest, Art. 6(1)(f) GDPR). Cloudflare, Inc. is certified under the EU-U.S. Data Privacy Framework.

Contact form

The contact form is provided by Microsoft Forms (Microsoft Ireland Operations Ltd). When you send a message, we receive your name, your hotel or company if you enter it, your email address and your message. We use this only to answer your request (Art. 6(1)(b) GDPR, or Art. 6(1)(f) GDPR for general questions). Microsoft may set technically necessary cookies inside the form.

Booking a demo

Demo appointments are booked through Microsoft Bookings (Microsoft Ireland Operations Ltd). We receive the details you enter, such as your name, email address and the time you choose, and use them to arrange and hold the meeting (Art. 6(1)(b) GDPR).

Email and phone

If you email or call us, we use your details to handle your request (Art. 6(1)(b) or (f) GDPR).

Customers and platform users

When a hotel or company works with us, we process the details of its contact persons and of the employees who use the Gustaffo platform:

• Contract and billing: names, business email addresses, phone numbers and invoice details, to conclude and carry out the contract and to bill for it (Art. 6(1)(b) GDPR) and to meet tax and accounting duties (Art. 6(1)(c) GDPR).
• User accounts: name, business email address, role and access rights, so employees can log in and work with the platform (Art. 6(1)(b) GDPR).
• Usage and security logs: login times, IP addresses and actions in the platform, to keep the service secure, trace errors and prevent misuse (Art. 6(1)(f) GDPR).
• Support: requests sent through our customer support portal, provided by Atlassian, and by email, to answer and resolve them (Art. 6(1)(b) GDPR).
• Service messages: information about maintenance, new features and changes that affect the service (Art. 6(1)(b) or (f) GDPR).

Service providers

We use carefully selected service providers to host and run our website and platform, for example for hosting, email and support. They process personal data only on our instructions and under data processing agreements. Where a provider is located outside the EU or EEA, we make sure the transfer is protected, for example by the EU-U.S. Data Privacy Framework or the EU standard contractual clauses. Customers can request the current list of providers from us.

How long we keep data

We keep your data only as long as we need it to handle your request and any follow-up. If a business relationship develops, we keep it for the duration of that relationship. Afterwards we delete it, unless the law requires us to keep it longer, for example for tax purposes.

Links to other websites

Our website links to LinkedIn, Instagram, our customer support portal and our status page. These are only links: no data is sent to these services until you click them. Once you do, their own privacy policies apply.

Your rights

You have the right to access, correct and delete your personal data, to restrict or object to its processing, and to data portability. If you have given consent, you can withdraw it at any time for the future. To use these rights, email [email protected].

You can also complain to the Austrian Data Protection Authority (Datenschutzbehörde), Barichgasse 40-42, 1030 Vienna, www.dsb.gv.at.