Cookies and similar technologies

Necessary

Always active, permitted without consent and cannot be switched off.

kz-booking-v2: your progress in the booking flow, so that entries are not lost when you go back. Stored in the browser.

Language: your chosen language.

kz_consent: your choice in these settings.

kz_konto: keeps you signed in to “Mein Kastellatz”, a random session identifier, sent over HTTPS only (Secure), not readable by scripts (HttpOnly), SameSite=Lax. Valid for up to 30 days after your last visit (sliding) and deleted when you sign out. Set when you sign in or open the personal link in your email (offer or booking confirmation); that link only gives access to that one offer or booking.

kz_lang: remembers your language (de, it or en) in the guest app (/app). Valid for one year and contains no personal data.

kz_saison: remembers whether you want to see the home page in its summer or winter version when you use the switch in the header. Valid for 30 days, sent over HTTPS only (Secure), not readable by scripts (HttpOnly), SameSite=Lax; contains no personal data.

kz_attr: origin of a visit (for example a campaign link), including the landing page, for attributing the booking. Stored in sessionStorage and deleted when you close the tab.

kz_av_*: a small random identifier that, on an offer page, remembers that this session's visit has already been counted. Stored in sessionStorage and deleted when you close the tab.

kz_embed: which external content you released in this session with “Load content”. Stored in sessionStorage and deleted when you close the tab.

ktz-chat-session, ktz-chat-auf, ktz-chat-ok, ktz-max, ktz-teaser: ID and state of the Kastellatz Concierge (chat) for the length of your visit, a random conversation ID, whether the window is open or enlarged, whether the hint has been shown. Stored in sessionStorage and deleted when you close the tab; the conversation text is not stored there. Data is sent to the Concierge (language model by xAI, USA) only when you send the first message, see Privacy.

Stripe: card payment processing and fraud prevention, as soon as the payment field is loaded.

Statistics

PostHog: anonymous reach measurement without cookies. The data passes through our own server. The measurement is on by default; you can object (Art. 21 GDPR) by choosing “Only necessary” in the cookie settings. The transmission then stops.

Marketing

Google tag (www.googletagmanager.com) with Consent Mode v2 and the Meta pixel (connect.facebook.net). Both are off by default and are only loaded if you agree in the cookie settings and the hotel has set them up.

External content

Hiking map, weather map, maps of excursions and Watles webcam. Off by default: instead of the content you see a placeholder with the buttons “Load content” and “Always allow”. Only then is a connection to the respective provider established.

Providers: interactive hiking map of the Vinschgau tourist board (maps.vinschgau.net), webcam of the Watles cable car (watles.it-wms.com), interactive weather map from Windy (embed.windy.com), maps of excursions and hikes from Google Maps (www.google.com).

Exception: on the “Map & directions” page the satellite images load directly from Google (maps.googleapis.com) when the page opens, without a prior click. Google receives your IP address; more in the privacy policy.

Our hotel camera image is served through our own server. Your browser does not connect to an external webcam service for this image.

Forecasts and mountain reports are retrieved by our server and displayed directly on this website. Your browser does not connect to a weather provider for this. The data source is shown alongside the forecast.

The 360° tour is a link to the provider. Its statistics (Matomo) only load after your click, on the provider's site.