I have written this privacy policy to explain to you, in accordance with the requirements of the General Data Protection Regulation (EU) 2016/679 and applicable national laws, what personal data I, as the controller, and the data processors commissioned by me process, and what options you as a visitor to this website have.
Privacy policies often sound very technical. I want to describe the most important things to you as clearly and transparently as possible. Where appropriate, you will find short summaries in plain language.
This privacy policy applies to all personal data processed by me and to all personal data processed by companies commissioned by me (data processors). Personal data means information within the meaning of Art. 4 No. 1 GDPR, such as a person's name, email address and postal address.
The scope includes:
I only process your data if at least one of the following conditions applies:
In addition to the EU regulation, the Austrian Data Protection Act (DSG) and the Telecommunications Act (TKG 2021) apply in Austria.
If you have any questions about data protection or the processing of your personal data, please contact:
alongside. e.U. (FN 678081 d, Commercial Court Vienna)
Business area: alongside.outdoor
Owner: Manuela-Michaela Lorenz
Ketzergasse 49
1230 Vienna, Austria
Email: manuelalorenz@alongside.at
Full address and further details can be found in the imprint.
I only store personal data for as long as is strictly necessary to provide my services. As soon as the reason for the processing no longer applies, the data is deleted.
In some cases, I am legally obliged to store data for longer, for example for accounting purposes (in Austria, seven years pursuant to § 132 of the Federal Fiscal Code, BAO). If you wish to have your data deleted or to revoke a consent, the data will be deleted as soon as possible, provided there is no statutory retention obligation.
Pursuant to Articles 13 and 14 GDPR, you are entitled to the following rights:
The competent supervisory authority in Austria is the Data Protection Authority:
Barichgasse 40-42, 1030 Vienna
Phone: +43 1 52 152-0
Email: dsb@dsb.gv.at
Website: www.dsb.gv.at
Data is only transferred to or processed in countries outside the EU (third countries) if you consent, if it is required by law, or if it is contractually necessary.
For services with a registered office or servers outside the EU (relevant in this privacy policy: Adobe Lightroom Web for photo delivery), data processing takes place on the basis of Standard Contractual Clauses pursuant to Art. 46(2) and (3) GDPR and within the framework of the EU-US Data Privacy Framework.
To protect personal data, I have implemented technical and organisational measures. Where possible, data is encrypted or pseudonymised.
This website uses HTTPS to transmit data securely over the internet. The complete transmission of all data between your browser and the web server is encrypted. You can recognise the encryption by the padlock icon in the address bar of your browser and by the "https" in the web address.
Summary — Communication
When you write to me by email, your data is stored on my email server at netcup GmbH (hosting provider, based in Germany). The email address manuelalorenz@alongside.at is managed via netcup mail servers; the emails are retrieved locally using the Thunderbird program.
On the Contact page you will find an online form through which you can send me an inquiry or booking. Details on the processing can be found in the section "Booking and inquiry form".
If you write to me via Instagram, your message is also processed by Meta Platforms Ireland Limited under their own privacy terms. For the booking itself we then switch to e-mail.
I have concluded corresponding contracts pursuant to Art. 28 GDPR with all data processors that process personal data on my behalf. This concerns in particular:
Summary — Cookies
This website uses only technically necessary cookies. No consent is required for them under § 165(3) TKG 2021:
For non-essential services such as marketing, a consent banner is used that only loads such services once you have explicitly agreed in the banner. You can change or withdraw your choice at any time via the “Cookie settings” link in the footer.
Currently no tracking, marketing or analytics cookies are active.
How to delete or manage cookies in your browser can be found in the help sections of the individual browsers:
Summary — Web hosting
This website is hosted by netcup GmbH, Daimlerstraße 25, 76185 Karlsruhe, Germany. The servers are located exclusively in Germany.
When the website is accessed, data is automatically stored in server log files (IP address, date and time, browser, operating system, page accessed). This data is used for the technical operation of the site and is generally deleted automatically after 14 days.
A Data Processing Agreement pursuant to Art. 28 GDPR is in place with netcup.
More information on data processing at netcup: netcup privacy policy
The fonts League Spartan and DM Sans are used on this website. Both fonts are stored locally on our own server and are not loaded from third-party providers such as Google Fonts.
This website uses the open-source framework Bootstrap (version 5.3) for the responsive design as well as Bootstrap Icons for the icons on the page. Both libraries are stored locally on our own server and are not loaded from external content delivery networks. No data is transmitted to third-party providers.
Summary — Forms
On the Contact page you will find an online form through which you can send me an inquiry or booking. The following data is requested:
The phone number is required so that I can reliably reach you in the event of short-term changes due to weather or safety conditions.
The data is processed via a PHP script on my own server at netcup and forwarded directly to my email address. In addition, you will receive an automatic inquiry confirmation at the email address you provided after submitting the form. There is NO storage in a database and NO transfer to external service providers.
Important: Submitting the form is a non-binding inquiry, not a contractual agreement. A binding booking is only concluded once I confirm it in writing by email.
To protect the form against automated abuse, several technical measures are used: a time-limited security token (CSRF protection), a field invisible to humans for bot detection (honeypot), a minimum time between page load and submission, and a limit of a maximum of three inquiries per hour. For this purpose, a technically necessary session cookie is set (see the Cookies section).
Summary: Newsletter
On several pages of this website you can sign up for my newsletter. For this I use the e-mail marketing service Brevo, provider: Brevo GmbH, Köpenicker Str. 126, 10179 Berlin, Germany.
Sign-up uses the double opt-in procedure: after you submit the form, you receive an e-mail with a confirmation link. Only after you click this link are you added to the recipient list. This allows me to prove, in case of dispute, that and when you consented to the sign-up.
You can withdraw your consent at any time by using the unsubscribe link at the end of every newsletter e-mail or by contacting me informally by e-mail. This does not affect the lawfulness of the processing carried out up to the withdrawal.
A data processing agreement pursuant to Art. 28 GDPR is in place with Brevo. Further information can be found in the privacy policy of Brevo.
Summary: reCAPTCHA
To protect the newsletter sign-up form against automated access, I use the reCAPTCHA service of Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. Data may be transferred to Google servers, including servers in the USA. Google is certified under the EU-US Data Privacy Framework, which recognises an adequate level of data protection. Further information can be found in the privacy policy of Google.
Summary: Tour participation
Before each tour, I fill out a participation form together with you, on which I record your name, your phone number, and an emergency contact for the duration of the tour. This information serves exclusively the safe execution of the tour and reachability in case of emergency.
Health-related information: If you share relevant health-related information with me before the tour begins, such as pre-existing conditions that may affect walking pace, breaks, or route choice, this serves exclusively to adapt the tour to your individual needs. Such information is discussed orally only and is not recorded or stored in writing. If you nevertheless send me health-related information in writing, for example by e-mail, I use it exclusively for the safe execution of the tour and delete it immediately after the tour ends. In this case the legal basis is your explicit consent through voluntary transmission (Art. 9 (2) (a) GDPR), which you can withdraw at any time by e-mail.
Emergency contact: By providing an emergency contact, you confirm that you have informed the named person of this data sharing.
Minors: For participants under 14 years of age, all entries on the participation form, as well as any photo marketing consent, are provided by the legal guardian. Participation is not possible without the corresponding consent. Legal basis: Art. 6 (1) (a) in conjunction with Art. 8 GDPR.
The participation forms are carried only for the duration of the tour and are destroyed immediately after the tour ends. No further storage takes place.
Summary: Hut reservations
For multi-day tours, I reserve the sleeping places in the mountain huts for you. For this purpose, I pass on to the respective hut only the data it needs for the reservation, usually the names and number of people as well as the nights.
Some huts accept reservations exclusively via the online reservation system hut-reservation.org. In this case, the reservation data is entered there. The privacy policy of hut-reservation.org applies to the processing there. Other huts I reserve by phone or by e-mail.
You pay for your accommodation and meals directly on site at the hut. The privacy policy of the respective hut applies in this case.
Summary: Photo delivery
On tours with professional photography (Guided Hike with Photography and Guided Full-Day Hike with Photography) I take photos of the participants during the tour. The editing is done with Adobe Lightroom Classic on my computer. For delivery, I upload the edited photos to an online gallery on Adobe Lightroom Web.
The provider is Adobe Inc., 345 Park Avenue, San Jose, CA 95110-2704, USA. Adobe Inc. is certified under the EU-US Data Privacy Framework (adequacy decision of the European Commission dated 10 July 2023). Standard Contractual Clauses pursuant to Art. 46(2) and (3) GDPR are applied as an additional safeguard.
A Data Processing Agreement pursuant to Art. 28 GDPR is in place with Adobe.
The gallery link is sent exclusively to the participating persons by email. The gallery is not password-protected and can only be accessed via the secret, non-publicly listed link. Publication of the photos only takes place if you have given a separate consent (see section "Photo consent for tours with photography").
All files stored during editing and delivery (locally on my computer and within Adobe services) are deleted at the latest 30 days after the gallery is made available, unless a longer retention has been agreed or is required by law.
More information on data processing at Adobe: Adobe Privacy Policy
Summary — Photo consent
By booking a package with photography, you consent to the creation, editing and digital delivery of the photos for your private use. This consent is a prerequisite for booking a photo package (see Terms and Conditions § 9 (3)).
Use of the photos for marketing purposes (e.g. website, Instagram, flyers, platforms) only takes place if you expressly consent to this before the start of the tour. The marketing consent is obtained via a separate form and is voluntary.
You can revoke the marketing consent at any time with effect for the future by sending me an email to manuelalorenz@alongside.at. Already published content will be removed promptly where possible. Complete removal from already shared or external channels cannot always be technically guaranteed.
Summary: Provision of meditations
After booked forest bathing tours, you receive an e-mail from me with a link to two audio files containing meditations to listen to again. The audio files are stored on my web hosting at netcup (see section „Web hosting (netcup)“) and can only be accessed via the link communicated to you, which is not publicly listed.
The audio files themselves contain no personal data. Access is directly on my web server without the involvement of third parties. There is no data transfer to third countries and no transmission to external providers.
On this website you will find a link to my Instagram profile. This is a simple hyperlink. NO social media plug-ins, like buttons or embedded content (e.g. Instagram posts) are used on the website.
Only when you click on the Instagram link and switch to the platform do the data protection provisions of the provider apply there:
The following explains some terms used in this privacy policy:
Last updated: 22 September 2026
Version: 2.3