1. Controller and contact
Nextpulse GmbH, Vogelweiderstrasse 10/22, 5020 Salzburg, Austria. E-mail: performance@nextpulse.at. Telephone: +43 677 61691788.
A data protection officer is currently not appointed. Data protection enquiries may be addressed to the e-mail address stated above.
2. Visiting the website and server logs
When staystryk.com is accessed, Nextpulse processes the IP address, time, requested resource, referrer, browser and device information, and security and error data. The purposes are delivery, stability, abuse prevention and error analysis. Delivery takes place via the network of the Cloudflare group of companies.
The legal basis is Art. 6(1)(f) GDPR; the legitimate interest lies in the secure and functional operation of the website. Server logs are deleted after the necessary error and security review is complete. For a specific incident, only evidence needed for investigation or legal claims is retained until that purpose ends.
Nextpulse does not use analytics, advertising or tracking services on the website. Details of storage in the browser are set out in the cookie information.
3. Enquiries and requests for demo access
Processed are: business name and type, number of rooms or units, country, contact person, business contact details, existing system, concern, time frame, preferred contact method, language and referring page.
The purpose is to handle the enquiry, set up any requested demo access and prepare a contract. The legal basis is Art. 6(1)(b) GDPR insofar as the enquirer itself wishes to become a contracting party; otherwise Art. 6(1)(f) GDPR, on the basis of the legitimate interest in communicating with the enquiring business.
Enquiries are transmitted to Nextpulse by e-mail and recorded in customer management. Enquiries that do not lead to a contract are deleted once fully handled and no further communication is needed. Business records subject to statutory retention are kept until the applicable legal period ends.
4. Trial and customer accounts, Nextpulse ID
For trial and customer access, as well as user accounts of hotel staff, Nextpulse operates the Nextpulse ID identity account. Processed are name, e-mail address, assignment to company and operation, details of the second factor, login and session data and, in the case of online registration, confirmation of business status, authority to represent and the document versions accepted.
The purpose is secure login, management of access and evidence of the conclusion of the contract. The legal bases are Art. 6(1)(b) GDPR towards the customer and Art. 6(1)(f) GDPR towards the customer’s employees; the legitimate interest lies in secure access management. Account data is deleted after the account is closed, as soon as it is no longer required for these purposes; evidence of contract conclusion and accepted documents is deleted after expiry of the limitation periods.
5. Contract and billing
Nextpulse processes company and representation data, contact persons, contract, order and service data, invoice and payment data, and contract correspondence. Odoo supports customer and contract administration. STRYK invoices are issued in STRYK.
The legal bases are Art. 6(1)(b) GDPR for performance of the contract, Art. 6(1)(c) GDPR for statutory retention obligations, and Art. 6(1)(f) GDPR for the assertion and defence of claims.
Books, receipts and tax-relevant documents are retained for seven years under § 132 BAO and § 212 UGB, and longer only insofar as they are required for pending proceedings.
6. Support and support assistant
For support requests, Nextpulse processes contact data, the content of the request, the affected operation and technical details. For the first response, an AI-supported support assistant may be used; its replies are generated by an AI system. The assistant processes requests via Anthropic as main provider and, if Anthropic is unreachable, via OpenAI as fallback provider; data may be processed in the USA in that case. On request, a Nextpulse employee takes over.
The legal basis is Art. 6(1)(b) GDPR, and towards the customer’s employees Art. 6(1)(f) GDPR; the legitimate interest lies in efficient support. Closed support cases are deleted when no longer needed for support. Evidence of contracts or claims is retained only until the applicable legal periods expire or pending proceedings conclude.
7. Platform usage and security logs
Nextpulse logs sign-ins, security-relevant events, errors, platform administration access and technical operating data in order to operate STRYK securely, detect misuse and remedy faults. The legal basis is Art. 6(1)(f) GDPR. Security logs are deleted after the necessary security review is complete. Evidence of a specific incident is retained only while needed for investigation or legal claims.
Nextpulse prepares statistics on the use of STRYK only in anonymised or aggregated form.
8. Service e-mails and newsletter
Contract-related communications, such as changes to contract documents, security notices and maintenance announcements, are sent by Nextpulse on the basis of Art. 6(1)(b) and (f) GDPR. Nextpulse sends a newsletter or other marketing e-mails only with consent (Art. 6(1)(a) GDPR); consent may be withdrawn at any time.
9. Partner programme
For the partner programme, Nextpulse processes data of partners and their contact persons, as well as the hotel contact details transmitted by partners, in order to review, assign and settle referrals. The legal bases are Art. 6(1)(b) GDPR towards partners and Art. 6(1)(f) GDPR towards referred hotels. Partners and Nextpulse are each independently responsible.
10. Recipients
Only responsible employees of Nextpulse and service providers that Nextpulse engages as processors receive access: Cloudflare (delivery and protection of the website), the hosting provider of STRYK and Nextpulse ID, Hetzner Online GmbH (encrypted backup), Odoo S.A. (customer management and billing), IONOS SE (e-mail), Anthropic (support assistant) and, only as fallback provider if Anthropic is unreachable, OpenAI. Details are set out in the list of sub-processors.
Authorities, courts, tax advisers, auditors and legal representatives receive data only where legally required or insofar as necessary to assert or defend claims. Nextpulse does not sell personal data.
11. Transfers to third countries
Cloudflare, Anthropic and OpenAI may process data in the USA. The basis is the European Commission’s adequacy decision on the EU-US Data Privacy Framework for companies certified there, and additionally the European Commission’s standard contractual clauses. A copy of the safeguards can be requested via the contact address stated above.
12. Rights of data subjects
Subject to the GDPR, data subjects have the right of access, rectification, erasure, restriction of processing and data portability. Consent may be withdrawn at any time with effect for the future.
Data subjects may object at any time, on grounds relating to their particular situation, to processing based on legitimate interests. They may object to processing for direct marketing purposes at any time without giving reasons.
Complaints may be lodged with the Austrian Data Protection Authority (Österreichische Datenschutzbehörde), Barichgasse 40–42, 1030 Vienna, dsb@dsb.gv.at, or with another competent supervisory authority.
13. Obligation to provide data and automated decisions
The information marked as mandatory is required to process an enquiry, set up access or conclude a contract. Without it, the service in question is not possible. Provision is legally mandatory only for information required for invoices.
Nextpulse does not take decisions based solely on automated processing within the meaning of Art. 22 GDPR.
14. Data in STRYK, Booking Engine and guest websites
The respective hotel is responsible for guest, employee and business data that a hotel processes in STRYK, in its Booking Engine or on its guest website. Information on this is contained in the hotel’s privacy notice; enquiries are to be addressed to the hotel. Nextpulse processes this data as processor for the hotel.
