Privacy Policy

1. Data Controller

The data controller for this platform is dectria GmbH, Sulb 48, 8543 St. Martin im Sulmtal, Austria. The Campivio platform is operated by dectria GmbH and provides campsite operators with a booking and guest management solution.

2. Overview

This privacy policy informs you about what personal data we collect, process, and store when you use the Campivio platform. Protecting your data is very important to us. We process personal data only in accordance with the General Data Protection Regulation (GDPR) and the Austrian Data Protection Act (DSG).

3. Legal Basis

Your data is processed on the basis of Art. 6(1)(b) GDPR (contract performance — booking and check-in), Art. 6(1)(c) GDPR (legal obligation — registration requirement under §5 MeldeG), and Art. 6(1)(f) GDPR (legitimate interests — operation and security of the platform).

4. What Data Is Collected?

The following personal data is collected when using the platform:

• Booking data: name, email address, number of guests, selected dates, license plate (optional)
• Registration data (per §5 and §16 MeldeG): name, date of birth, place of birth, gender, nationality, country of residence, address (street, postal code, city, country), travel document for non-Austrian guests (document type, number, issue date, issuing authority), digital signature (stored as image with timestamp and IP address)
• Payment data: Payment processing is handled by Stripe. Credit card data is processed exclusively by Stripe and is not stored on our servers.
• Technical data: IP address, browser type, access time — for security and troubleshooting purposes
• The digital signature is captured as a simple electronic signature within the meaning of the eIDAS Regulation (EU No. 910/2014). It serves to confirm the accuracy of the registration data pursuant to §5 MeldeG.

5. Purpose of Data Processing

• Processing and managing pitch bookings
• Fulfilling the legal registration requirement (§5 MeldeG)
• Processing payments via Stripe
• Sending booking confirmations and check-in links via email
• Compliance with legal retention obligations

6. Data Sharing

Your data is shared only with the following service providers, insofar as this is necessary for providing the service:

• Stripe Inc. — payment processing (headquartered in the USA, EU Standard Contractual Clauses)
• Resend Inc. — email delivery of booking confirmations and check-in links (headquartered in the USA, EU Standard Contractual Clauses)
• WorkOS Inc. — authentication and single sign-on, if sign-in is used (headquartered in the USA, EU Standard Contractual Clauses)
• Render Inc. / Vercel Inc. — platform hosting (headquartered in the USA, EU Standard Contractual Clauses)

7. Cookies

We use two categories of cookies. (a) Strictly necessary cookies — session management, WorkOS authentication, secure payment processing via Stripe Checkout. These are required to operate the platform (legal basis: Art. 6(1)(b) GDPR, performance of a contract) and cannot be opted out of. (b) Analytics cookies — anonymous product analytics via PostHog (EU hosting at eu.i.posthog.com, all inputs masked, Stripe iframes not recorded). These are set only after your explicit consent (Art. 6(1)(a) GDPR + § 165 TKG) and can be withdrawn at any time via the cookie banner. No third-party tracking takes place; no advertising cookies are used.

8. Data Retention

Guest registration data is retained for seven years from the date of departure in accordance with §22 MeldeG. Booking data is stored for the duration of statutory retention periods (7 years per §132 BAO). Payment data is retained by Stripe in accordance with their privacy policy. Data is deleted after the statutory retention periods expire.

9. Your Rights

Under the GDPR, you have the following rights:

• Right of access (Art. 15 GDPR)
• Right to rectification (Art. 16 GDPR)
• Right to erasure (Art. 17 GDPR)
• Right to restriction of processing (Art. 18 GDPR)
• Right to data portability (Art. 20 GDPR)
• Right to object (Art. 21 GDPR)

To exercise your rights, contact us at office@dectria.com.

10. Right to Complain

You have the right to file a complaint with the Austrian Data Protection Authority (dsb.gv.at) if you believe that the processing of your data violates the GDPR.

11. Changes

We reserve the right to update this privacy policy as needed to reflect changes in legal requirements or platform changes. The current version is always available on this page.