Privacy policy

Privacy Policy

Christof GmbH has prepared this Privacy Policy in order to act as a trustworthy partner to visitors to this website and to respect and protect their right to privacy and confidentiality.

Within the meaning of Regulation (EU) 2016/679 (“GDPR”), Christof GmbH is the data controller responsible for the processing of personal data through this website. Christof GmbH processes personal data collected through www.christof.it in accordance with this Privacy Policy.

Collection of personal data and purposes of processing

Christof GmbH processes personal data voluntarily provided by visitors through this website, as well as personal and technical data that may be processed when the website is used and when third-party services are activated.

The website can generally be browsed without directly providing personal data. Certain functions and services, however, require the provision of personal data.

Visitors may provide personal data in particular:

  • to subscribe to our newsletter;

  • to register for events;

  • to submit their CV;

  • to request information about services, products, offers, room availability and quotations;

  • to book stays and holidays;

  • to purchase services, products or vouchers.

The processing is carried out in order to provide services requested by the visitor, process enquiries and bookings, comply with legal obligations or, where required, on the basis of the visitor's consent.

Legal bases for processing

Depending on the specific processing activity, personal data are processed on the following legal bases in particular:

  • Article 6(1)(a) GDPR: the data subject's consent;
  • Article 6(1)(b) GDPR: processing necessary for the performance of a contract or for taking steps at the request of the data subject prior to entering into a contract;
  • Article 6(1)(c) GDPR: compliance with a legal obligation;
  • Article 6(1)(f) GDPR: the legitimate interests pursued by the controller, provided that these interests are not overridden by the interests or fundamental rights and freedoms of the data subject.

For non-essential cookies and other non-essential tracking technologies, prior consent is obtained through our cookie banner where required by applicable law.

Disclosure and recipients of personal data

Personal data are not disclosed to third parties without an appropriate legal basis.

Personal data may in particular be disclosed to service providers supporting the technical operation of the website, the provision of certain functions, the processing of enquiries and bookings, website analytics, or marketing and communication services.

Personal data may also be disclosed to public authorities, courts or other competent bodies where this is required by law or by a binding order.

Depending on the services used, data may also be transferred to and processed by providers located outside the European Economic Area (EEA) or by international providers. Where required, legally recognised safeguards and transfer mechanisms are used for such transfers.

AI Chatbot and Other Communication Services (Yuupless AI)

An AI-powered chatbot provided by Yuupless AI is integrated into our website. It is used to answer questions and handle enquiries. In accordance with Article 50(1) of Regulation (EU) 2024/1689 (EU AI Act), we inform users that they are interacting with an AI system when using the chatbot.
During use, the following data may be processed in particular: chat content (your messages and any information you voluntarily provide), technical metadata (e.g. timestamps and session or chat IDs), and browser or device information. Technically necessary cookies and/or local storage entries may be used to operate the chat. Optional analytics functions, where enabled, are used only with the required consent; in such cases, the relevant information is stored on or accessed from your device.
Where processing is necessary to handle your enquiry or take steps prior to entering into a contract, it is based on Article 6(1)(b) GDPR. Where processing serves the legitimate interests of ensuring efficient communication and the secure operation of the services, it is based on Article 6(1)(f) GDPR. Optional analytics functions are processed on the basis of your consent under Article 6(1)(a) GDPR, where such consent is required.
Communication via WhatsApp Business
Christof GmbH uses the WhatsApp Business Platform (API) to communicate with guests and prospective customers. For this purpose, we use the Yuupless AI assistance platform provided by Ebeling Raßloff Yuupless GbR, Forggenseestr. 89, 87672 Roßhaupten, Germany. Communication is used in particular to handle enquiries, provide information relating to bookings and stays, and assist our guests. Subject to the applicable legal requirements, we may also send satisfaction surveys, review requests and promotional messages.
The data processed may include, in particular, your telephone number, message content, timestamps and communication history. According to the platform provider, telephone numbers are stored in encrypted form.
If you send a voice message, it is automatically converted into text and further processed as a transcript; the audio file itself is not stored.
Images, videos and documents are stored by us only if your enquiry is transferred to our staff or a staff member explicitly retrieves the file. Otherwise, these files are not imported or retained by us. Stored files are deleted together with the associated conversation.
Telephone numbers may originate from various sources, in particular our booking and guest management system, booking portals or other partners. The specific source depends on the individual case. Where personal data is not collected directly from you, we provide the information required under Article 14 GDPR, unless a statutory exception applies.
Where communication is necessary to take steps prior to entering into a contract or to perform a contract, processing is based on Article 6(1)(b) GDPR. In other cases, where applicable, processing is based on Article 6(1)(f) GDPR (our legitimate interest in providing efficient communication and guest support).
Proactive marketing messages are sent only with your explicit consent, confirmed through a double opt-in procedure, on the basis of Article 6(1)(a) GDPR. Every marketing message includes an option to unsubscribe. You may withdraw your consent at any time with effect for the future and may object at any time to the processing of your personal data for direct marketing purposes.
Telephony and Voice AI
Incoming calls may be answered by an AI agent. At the beginning of the call, a verbal announcement informs you that you are speaking with an AI system.
Your telephone number, which according to the platform provider is stored in encrypted form, and a transcript of the conversation are processed. Audio recordings are not stored.
Where processing is necessary to take steps prior to entering into a contract or to perform a contract, it is based on Article 6(1)(b) GDPR. In other cases, where applicable, processing is based on Article 6(1)(f) GDPR for the purposes of handling calls efficiently and ensuring the secure operation of the communication service.
Email Sending and Contact Storage via Yuupless AI
The assistance platform may send emails on our behalf, for example conversation summaries, booking links or offers.
Transactional emails that are necessary to handle your enquiry or relate to a contract are sent on the basis of Article 6(1)(b) GDPR. Marketing emails are sent only with your explicit consent and confirmed double opt-in, on the basis of Article 6(1)(a) GDPR, and always include an unsubscribe link.
If you provide contact details, such as your email address or telephone number, these may, according to the platform provider, be stored in encrypted form to enable communication across different channels. You may withdraw your consent to marketing messages at any time with effect for the future by using the unsubscribe link included in the relevant message.
Yuupless AI Platform Service Providers and Transfers to Third Countries
Depending on the specific function and configuration, the following service providers may be used to operate the assistance platform:
  • Ebeling Raßloff Yuupless GbR, Forggenseestr. 89, 87672 Roßhaupten, Germany – operation of the assistance platform; processing location: Germany.
  • Vercel Inc. (USA) – application hosting and delivery; stated processing location: Frankfurt am Main, Germany (third-country access risk).
  • Neon Inc. (USA) – database hosting; stated processing location: Frankfurt am Main, Germany (AWS eu-central-1; third-country access risk).
  • Upstash, Inc. (USA) – session caching, rate limiting and real-time event bus; stated processing location: Frankfurt am Main, Germany (AWS eu-central-1; third-country access risk).
  • OpenAI (USA) – generation of assistant responses; processing location: USA (third-country access risk).
  • Anthropic PBC (USA) – generation of assistant responses; processing location: USA (third-country access risk).
  • Mistral AI SAS (France) – generation of assistant responses; processing location: France.
  • Google Ireland Ltd. – conversation quality assessment and operational assistance functions; processing locations: Ireland and the USA (third-country access risk).
  • Meta Platforms Ireland Ltd. – delivery of WhatsApp communications; processing locations: Ireland and the USA (third-country access risk).
  • Twilio Inc. (USA) – telephony and SMS infrastructure; processing location: USA (third-country access risk).
  • ElevenLabs Inc. (USA) – speech synthesis and speech recognition; processing location: USA (third-country access risk).
  • Microsoft Ireland Operations Ltd. – email delivery through connected mailboxes; stated processing location: Ireland (EU Data Boundary; third-country access risk).

For recipients identified as involving a “third-country access risk”, access from outside the European Economic Area cannot be ruled out, even where the processing itself takes place within the EU, for example because the provider is headquartered in the USA.
Where personal data is transferred to third countries, the transfer is carried out in compliance with Articles 44 et seq. GDPR and on the basis of the applicable transfer mechanisms. According to the platform provider, EU Standard Contractual Clauses are used where required.
According to the platform provider, chat content is not used to train AI models.
The current list of data processors and service providers used is available at: https://ai.yuupless.com/trust
Further information about data processing by the chatbot platform is available in the Yuupless AI Privacy Policy: https://ai.yuupless.com/legal/datenschutz

Third-party services and content

This website may incorporate services and content provided by third parties, including:

  • Google Tag Manager – provider: Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland, and/or Google LLC, 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA.
  • Google Analytics – provider: Google Ireland Limited and/or Google LLC.
  • Google Maps – provider: Google Ireland Limited and/or Google LLC.
  • Google reCAPTCHA – provider: Google Ireland Limited and/or Google LLC.
  • YouTube – provider: Google Ireland Limited and/or Google LLC.
  • Facebook and Instagram – providers: Meta Platforms Ireland Limited and/or Meta Platforms Inc.
  • Meta Pixel – provider: Meta Platforms Ireland Limited and/or Meta Platforms Inc.
  • Vimeo – provider: Vimeo Inc., 555 West 18th Street, New York, NY 10011, USA.
  • OpenStreetMap – provider of the OpenStreetMap services used by us: OpenStreetMap Foundation (OSMF).

Google Tag Manager and Google Consent Mode

We use Google Tag Manager to technically manage and implement tags and services on our website.

Google Tag Manager is used in particular to manage the activation of different website tags according to the consent preferences selected by visitors through our cookie banner.

We use Google Consent Mode in its advanced implementation (Advanced Consent Mode). In this configuration, Google tags are technically loaded when the website is accessed. Before consent is given, or where the relevant consent has been refused, the applicable consent parameters for the relevant Google services are set to “denied”.

Where consent has been denied, Google tags that support Consent Mode do not set or read cookies relating to the purposes for which consent has been denied. Depending on the configuration, however, so-called cookieless pings or signals may be transmitted to Google. These may contain technical information such as timestamps, browser/User-Agent information, referrer information, information about the consent status and randomly generated technical values.

These limited signals are used, among other things, to respect the user's consent choices and, where supported by the relevant Google services, to enable statistical and conversion modelling. Where consent has been denied, these signals are not used to set cookies or to create remarketing profiles or identify users across different websites.

Only after the relevant consent has been given are the respective Google services activated in accordance with the consent provided and able to use the associated measurement or marketing functions, including the cookies and other technologies required for those functions.

The choices made through our cookie banner are communicated to the relevant Google services and determine how those services operate.

Further information about Google Consent Mode is available from Google.

Google Privacy Policy: Google Privacy Policy

Google Analytics

We use Google Analytics, a web analytics service provided by Google, to analyse the use of our website statistically and to improve our website and services.

Google Analytics may collect information about the use of the website, including, for example, pages viewed, interactions, technical information about the device and browser used and information about the source of the visit.

Google Analytics is operated in accordance with the consent preferences selected through our cookie banner.

Where the visitor gives consent to analytics/tracking technologies, Google Analytics may use the relevant cookies and measurement technologies and transmit more comprehensive usage data to Google.

Where the relevant consent is refused, Analytics storage functions are disabled. Under Advanced Consent Mode, limited cookieless signals may nevertheless be transmitted to Google Analytics. These signals do not use Analytics cookies and may be used by Google, among other purposes, for statistical and conversion modelling.

Processing associated with activated Analytics functions is based on the visitor's consent pursuant to Article 6(1)(a) GDPR where such consent is required by applicable law.

You may change or withdraw your consent at any time with effect for the future through the cookie settings on our website.

Google Privacy Policy: Google Privacy Policy

Google Maps

We use Google Maps on our website to display geographical information and the location of our property and to make it easier for visitors to find their way to us.

Google Maps is activated and loaded only after you have given the relevant consent through our cookie banner. Without this consent, the interactive Google Maps map is not loaded.

Once consent has been given, Google may process, among other things, your IP address, information about the device and browser used and information about your use of the map. Data may be transmitted to and processed on Google's servers.

If you are signed into your Google account, Google may potentially associate the information collected with other information associated with your account.

The processing is based on your consent pursuant to Article 6(1)(a) GDPR.

You may change or withdraw your consent at any time through the cookie settings on our website.

Google Privacy Policy: Google Privacy Policy

OpenStreetMap

We use OpenStreetMap to display geographical information and the location of our property on an interactive map and to make it easier for our guests to find their way to us.

OpenStreetMap is activated and loaded only after you have given the relevant consent through our cookie banner. Without this consent, map content from the OpenStreetMap services is not loaded.

Once the map has been activated, a connection is established to servers operated by the OpenStreetMap Foundation (OSMF). In this context, information such as the IP address, information about the browser and device used, the operating system, the referrer, the date and time of access and information about the requested map data may be processed.

The OpenStreetMap Foundation processes this data as an independent data controller and not as a data processor acting on our behalf.

The processing associated with activating the map on our website is based on your consent pursuant to Article 6(1)(a) GDPR.

You may change or withdraw your consent at any time through the cookie settings on our website.

OpenStreetMap Foundation – Privacy Policy: OpenStreetMap Foundation – Privacy Policy

The map is also displayed with the required attribution © OpenStreetMap contributors and reference to the applicable OpenStreetMap licence.

Google reCAPTCHA

Where Google reCAPTCHA is used on our website, it is used to protect forms and other functions against automated access and misuse.

Depending on the technical configuration, Google may process information about the device and browser used, the IP address and other technical usage data.

Where consent is required by applicable law, Google reCAPTCHA is activated only after the relevant consent has been given through our cookie banner.

Google Privacy Policy: Google Privacy Policy

YouTube

Where YouTube videos are embedded on our website, such content is activated, where required by applicable law, only after the relevant consent has been given through our cookie banner.

Loading or playing a YouTube video may establish a connection to Google's servers. In this context, information such as the IP address, technical information about the device and browser and information about the use of the video may be processed.

Google Privacy Policy: Google Privacy Policy

Facebook and Instagram

Our website may incorporate content or functions from the social networks Facebook and Instagram operated by Meta.

Where required by applicable law, a connection to Meta's servers and the associated processing of personal data takes place only after the relevant consent has been given through our cookie banner.

Further information about data processing by Meta is available in Meta's Privacy Policy.

Meta Privacy Policy: Meta Privacy Policy

Meta Pixel

We use Meta Pixel provided by Meta to analyse the use of our website and the effectiveness of our advertising activities, as well as to support the delivery and optimisation of advertising on Meta's platforms. Meta Pixel may collect information about which pages are visited, which interactions take place on the website and which technical information is available about the device and browser used. In this context, information such as the IP address, browser and device information, referrer information, pages visited, access times and information relating to certain actions or events carried out on the website may be transmitted to Meta.Meta Pixel may use cookies and similar tracking technologies to recognise visitors or events, measure conversions and, where configured accordingly, create or use audiences for advertising purposes and optimise advertising. Meta may combine information transmitted through Meta Pixel with other information and process it for its own purposes.Meta Pixel is implemented via Google Tag Manager and is managed in accordance with the consent preferences selected through our cookie banner. Activation of Meta Pixel for analytics, marketing or advertising purposes takes place only after the relevant consent has been given, where such consent is required by applicable law. Without the relevant consent, the corresponding Meta Pixel tracking functions for these purposes are not activated.Processing in connection with the use of Meta Pixel is based on the visitor's consent pursuant to Article 6(1)(a) GDPR where such consent is required by applicable law. You may change or withdraw your consent at any time with effect for the future through the cookie settings on our website.Depending on the configuration and use of Meta Pixel, data may be transferred to Meta Platforms Ireland Limited and/or Meta Platforms Inc. and may therefore also be transferred to recipients located outside the European Economic Area (EEA) and processed there. Where required, legally recognised safeguards and transfer mechanisms are used for such transfers.
Meta Privacy Policy: Meta Privacy Policy

Vimeo

Where Vimeo videos are embedded on our website, loading or playing a video may establish a connection to Vimeo's servers.

Where required by applicable law, the service is activated only after the relevant consent has been given through our cookie banner.

Further information about data processing by Vimeo is available in Vimeo's Privacy Policy.

Vimeo Privacy Policy: Vimeo Privacy Policy

Cookies and other tracking technologies

Cookies are small text files and similar technologies that may be stored on your device or used to access information stored on your device.

Our website distinguishes between the following categories:

  • Technically necessary cookies: These are required for the operation, security and essential functions of the website. Where legally permitted, they are used without consent because they are technically necessary.
  • Functional cookies: These enable additional functions and the storage of user preferences. Where required by law, they are activated only after the relevant consent has been given.
  • Tracking and performance cookies: These are used in particular for statistical analysis and to improve our website. Google Analytics may be used for these purposes. They are activated in accordance with your consent preferences.
  • Targeting and advertising cookies: Where used, these serve purposes such as measuring advertising campaigns, personalised advertising or other marketing activities. They are activated only after the relevant consent has been given.

The specific cookies and other tracking technologies used, their providers, purposes and retention periods are described in our cookie settings and the associated detailed cookie information.

Consent and withdrawal

Consent to non-essential cookies and tracking technologies is obtained through our cookie banner.

Consent is voluntary. Where offered by the cookie banner, visitors can accept or reject individual categories separately.

You may change or withdraw your consent at any time with effect for the future through the cookie settings on our website.

Withdrawal does not affect the lawfulness of processing carried out on the basis of consent before the withdrawal.

Rejecting certain categories may mean that some functions of the website are not available.

Links to third-party websites

Our website may contain links to third-party websites. These websites are operated independently by their respective providers and are subject to their own privacy policies.

We have no control over the content or data processing carried out by such websites.

Retention and deletion of personal data

Personal data are retained only for as long as necessary for the purposes for which they were collected or for as long as statutory retention obligations apply.

The specific retention period depends on the nature of the data, the purpose of the processing and the applicable statutory and contractual retention requirements.

The retention periods applicable to cookies and tracking technologies are stated in the cookie settings and the associated cookie information.

After the applicable retention period has expired, data are deleted or, where technically and legally appropriate, anonymised.

Rights of data subjects

Under Articles 15 et seq. GDPR, data subjects have, in particular, the right to:

  • obtain access to their personal data;
  • request rectification of inaccurate or completion of incomplete personal data;
  • request erasure of personal data where the legal requirements are met;
  • request restriction of processing;
  • object to processing where the legal requirements are met;
  • receive their personal data in a structured, commonly used and machine-readable format where the requirements of Article 20 GDPR are met;
  • withdraw consent at any time with effect for the future.

To exercise your rights, please contact us at info@christof.it.

You also have the right to lodge a complaint with the competent data protection supervisory authority.

Supervisory Authority

Data subjects have the right to lodge a complaint with a supervisory authority if they believe that the processing of their personal data violates Regulation (EU) 2016/679 (“GDPR”).In Italy, the competent supervisory authority is:
Garante per la protezione dei dati personali
Piazza Venezia n. 11
00187 Rome, Italy
Tel.: +39 06 696771
E-mail: garante@gpdp.it

Data security

Christof GmbH implements appropriate technical and organisational measures to protect personal data against loss, destruction, alteration, unauthorised access, unauthorised disclosure and other unlawful processing.

Security measures are selected and, where necessary, updated taking into account the state of the art, the nature of the data processed and the risks associated with the processing.

Under-age visitors

The website is not specifically directed at persons under the age of 16. We do not knowingly intend to collect personal data from persons under the age of 16.

If we become aware that personal data relating to a child have been collected without an appropriate legal basis, we will take appropriate measures to delete such data.