Last updated: October 2026
1. Controller
The controller within the meaning of the General Data Protection Regulation (GDPR) is:
Philip P.M. Jansohn - JustRoom.at | Canettistraße 1/1201, 1100 Vienna, Austria Email: info@justroom.at Website: https://www.justroom.at
Thank you for your interest in our platform. Protecting your personal data is important to us. Below we explain which data we process when you visit justroom.at and justroom.de, for what purposes this is done and what rights you have.
2. Legal bases
We process your personal data exclusively on the basis of the GDPR and the Austrian Data Protection Act (DSG). The following legal bases may apply:
- Consent (Art. 6(1)(a) GDPR): You have consented to the processing, for example via our cookie banner or when signing up for the newsletter. You may withdraw any consent given at any time with effect for the future.
- Contract and pre-contractual steps (Art. 6(1)(b) GDPR): The processing is necessary for the performance of a contract or to take pre-contractual steps, for example for enquiries to venue providers or the registration of a user account.
- Legal obligation (Art. 6(1)(c) GDPR): The processing is necessary to comply with legal obligations, for example retention obligations under tax law.
- Legitimate interest (Art. 6(1)(f) GDPR): The processing is necessary to protect our legitimate interests, for example the secure and economical operation of our website, provided your interests do not override them.
3. Storage period
We store personal data only for as long as is necessary for the respective purposes. Data from enquiries is kept for the duration of processing and any follow-up questions. Contract and invoice data is subject to the statutory retention period of seven years (Section 132 of the Austrian Federal Fiscal Code, BAO). The data is then deleted, unless there is a legal obligation to retain it further or you have consented to longer storage.
4. Your rights
Under the GDPR, you have the following rights:
- Right of access (Art. 15 GDPR): You can request information on whether we process personal data about you and, if so, which data.
- Right to rectification (Art. 16 GDPR)
- Right to erasure (“right to be forgotten”, Art. 17 GDPR)
- Right to restriction of processing (Art. 18 GDPR)
- Right to data portability (Art. 20 GDPR)
- Right to object (Art. 21 GDPR): You can object at any time to the processing of your data carried out on the basis of a legitimate interest.
- Right to withdraw consent given (Art. 7(3) GDPR)
To exercise your rights, an informal email to info@justroom.at is sufficient.
If you believe that the processing of your data violates data protection law, you have the right to lodge a complaint with the supervisory authority. In Austria, this is the Austrian Data Protection Authority (Österreichische Datenschutzbehörde), Barichgasse 40–42, 1030 Vienna, https://www.dsb.gv.at.
5. Hosting and server log files
Our website is hosted by IONOS SE, Elgendorfer Straße 57, 56410 Montabaur, Germany. To deliver content, we also use the IONOS content delivery network (CDN), which serves content faster via distributed servers.
When you visit our website, IONOS, as our processor, automatically collects information transmitted by your browser in so-called server log files: IP address, date and time of access, page accessed, browser type and version, operating system used and referrer URL. This data is technically necessary for the secure and stable operation of the website (Art. 6(1)(f) GDPR) and is not combined with other data sources. A data processing agreement pursuant to Art. 28 GDPR is in place with IONOS.
6. Cookies, local storage and privacy settings
For visitors we only use technically necessary storage: a session cookie so that forms (enquiry, contact, mailing list) can be submitted securely and so that you can log in to the venue or admin area, and your browser's local storage for your shortlist, your language and your privacy settings. This data stays on your device or is deleted at the end of the session. The legal basis is Section 165(3) of the Austrian Telecommunications Act 2021 in conjunction with Art. 6(1)(f) GDPR.
Services that are not strictly necessary (statistics with Umami, videos from YouTube) are only loaded after your consent in the “Privacy settings” banner (Art. 6(1)(a) GDPR). You can change or withdraw your choice at any time via the “Privacy settings” link at the bottom of every page.
7. Web analytics with Umami
If you consent to statistics in the banner, we use Umami (Umami Software, Inc., USA; “Umami Cloud” service) to see which pages are visited and how often. Umami does not set cookies and does not create profiles. It records the pages visited, referrer, browser type, operating system, device category, screen size, language and approximate country of origin. The IP address is only used to determine the country and is not stored; individual visitors cannot be identified.
The legal basis is your consent (Art. 6(1)(a) GDPR), which you can withdraw at any time via the privacy settings. For the transfer of data to the USA, see section 16.
8. Maps (OpenStreetMap)
On venue pages we show the location on a map with map data from OpenStreetMap. Map images and the map software (Leaflet) are served from our own server; no data about you is transferred to OpenStreetMap or other third parties. Only if you click “Plan route” does Google Maps open in a new window – Google's privacy notice then applies.
9. Videos (YouTube)
Some venue pages contain videos from YouTube (Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland). We embed them in privacy-enhanced mode (youtube-nocookie.com) and only load them once you click the video or have consented to external media in the privacy settings. From then on, your IP address and information about your device, among other data, are transferred to Google, including to the USA. The legal basis is your consent (Art. 6(1)(a) GDPR).
10. Spam protection
We do not use external services to protect our forms against automated abuse. We use a check field that is invisible to people and limit the number of submissions per IP address and hour. For this purpose, the IP address is stored together with the submission (Art. 6(1)(f) GDPR; legitimate interest in preventing abuse).
11. Fonts
The fonts used on this website (Inter and Inter Tight) are stored locally on our server. Visiting the website does not create a connection to Google or any other font provider.
12. Enquiry and contact forms
Via our platform, you can send non-binding enquiries directly to venue providers and contact us via contact forms. In doing so, we process the data you provide, in particular your name, email address, phone number, company name and your event details (e.g. date, number of participants, type of event, seating, message).
Important: If you send an enquiry to a specific venue, we pass your enquiry data on to the respective venue provider (e.g. the seminar hotel you enquired with) so that they can send you a quote directly. The venue provider then processes your data as an independent controller under data protection law.
The legal basis for processing is the taking of pre-contractual steps at your request (Art. 6(1)(b) GDPR) and our legitimate interest in handling your enquiry (Art. 6(1)(f) GDPR). Your data remains with us until the purpose of processing no longer applies and no statutory retention obligations prevent deletion.
After sending, you receive a personal link to check the status of your enquiry; for this we store when the venue opened, processed or answered your enquiry, and we notify you by email of offers or declines. We keep your enquiry data for a maximum of 24 months. After that, your name, contact details and message are deleted automatically; only anonymous information (occasion, date, number of guests) remains for statistical purposes. On request we will delete your enquiry earlier at any time – an email to info@justroom.at is all it takes.
13. User accounts and favourites
You can create a user account on our platform, for example to save favourites, send group enquiries or – as a venue provider – manage your listing. In doing so, we process the data provided during registration (name, email address, company details if applicable) and the content stored in your account. The legal basis is the performance of a contract (Art. 6(1)(b) GDPR). You can have your account deleted at any time; an email to info@justroom.at is sufficient.
14. Mailing list for event planners (newsletter)
On the page “For event planners” you can sign up for our mailing list. We will then inform you by email about new venues as well as news and offers from the venues on JustRoom.
Data we process: first name, last name, email address, optionally your company, your answer to “I am …” (e.g. corporate client, agency, HR department) and the language of the website. As proof of your consent, we also store the time and IP address of your sign-up and of your confirmation.
Double opt-in: after signing up, you receive an email with a confirmation link. You are only added to the list once you click it and confirm your sign-up. Unconfirmed sign-ups are deleted automatically after 30 days.
The legal basis is your consent (Art. 6(1)(a) GDPR, Section 174 Austrian Telecommunications Act 2021). You can withdraw your consent at any time with effect for the future: via the unsubscribe link in every email or by email to info@justroom.at.
Storage period: your data is stored for as long as you are subscribed. After you unsubscribe, we keep your email address marked as “unsubscribed” so that we can prove that we respect your withdrawal and do not send you any further emails. On request, we delete your data completely.
Sending and recipients: the mailing list is kept on our own web server, and the emails are sent from it. Your data is not passed on to external newsletter providers or to the venues.
15. Social Media
We maintain company profiles on Facebook and Instagram (Meta Platforms Ireland Limited, Merrion Road, Dublin 4, Ireland) and LinkedIn (LinkedIn Ireland Unlimited Company, Wilton Place, Dublin 2, Ireland). When you visit our profiles, the respective provider processes your data under its own responsibility; the providers' privacy notices apply to this processing. For Facebook pages, we and Meta are joint controllers for the so-called Page Insights (aggregated statistics).
On our website itself, we do not embed any active social media plugins, only links to our profiles. When you click such a link, you leave our website; only then is data transferred to the respective provider.
16. Data transfers to third countries
Where we use services whose providers process data in the USA or other third countries (in particular Google), we base the transfer on adequacy decisions of the European Commission – in particular the EU-U.S. Data Privacy Framework, provided the provider is certified under it – and additionally on standard contractual clauses pursuant to Art. 46 GDPR.
17. Data security
Our website uses TLS encryption (recognisable by the “https://” and the padlock symbol in your browser's address bar). This protects data you transmit to us – for example via enquiry forms – from being read by third parties. In addition, we use technical and organisational measures to protect your data against loss, misuse and unauthorised access.
18. Changes to this privacy policy
We will update this privacy policy whenever the legal situation or the services used on our website change. The current version published here applies.