Privacy Policy

Pursuant to Articles 13 and 14 of Regulation (EU) 2016/679 (General Data Protection Regulation; "GDPR"), the controller must inform the data subject about the processing of personal data. With this document, we inform you about the personal data being processed.

‍

Definitions

To make this privacy policy easier to understand, you will find a brief explanation of the terms used below.

Personal data ("data") refers to all information relating to the personal or material circumstances of an identified or identifiable natural person, such as name, address, email address, telephone number, date of birth, age, gender, social security number, video recordings, photos, etc. Data of legal entities are not subject to the provisions of the GDPR.

Processing means any operation or set of operations which is performed on personal data or on sets of personal data, whether or not by automated means, such as collection, recording, organization, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure, or destruction.

The controller is the natural or legal person, public authority, agency, or other body which, alone or jointly with others, determines the purposes and means of the processing of personal data.

A processor is a natural or legal person, public authority, agency, or another body which processes personal data on behalf of the controller.

A recipient is a natural or legal person, public authority, agency, or another body to which personal data are disclosed, whether or not it is a third party.

‍

Our contact details

Should you have any further questions, we, as the controller responsible for the data processing described herein, are happy to assist you via the following contact details:

Skischule Brunner / Sportshop Skirent Lachtal GmbH

Norbert Brunner

8831 Oberwölz, Lachtal 404

+43 660 35 65 65 1

office@ski-lachtal.at

‍

Purposes and legal basis for processing

Data may only be processed for a specific purpose and only if the processing can be based on an appropriate legal ground. Processing may be justified for the following reasons:

‍

‍

We process your data for the following purposes based on the following legal grounds:

‍

‍

Recipients

Recipients assist us in complying with legal or regulatory obligations, in initiating and fulfilling contracts, in providing services that require your consent, or in carrying out processing activities that are in our legitimate interest. We transmit or disclose data, in particular, to the following recipients (processors or controllers):

‍

‍

We only transfer your data to other recipients if you have given your express consent in accordance with Art. 6(1)(a) GDPR, if this is legally permissible and necessary for the performance of a contractual relationship with you in accordance with Art. 6(1)(b) GDPR, if we are subject to a legal obligation to do so in accordance with Art. 6(1)(c) GDPR, or if the disclosure is necessary in accordance with Art. 6(1)(f) GDPR for the protection of our legitimate interests and for the establishment, exercise, or defense of legal claims, and there is no reason to assume that you have an overriding interest in the non-disclosure of your data.

We intend to transfer data to the following third countries: United States of America.

An adequacy decision by the European Commission exists for the United States of America. In its decision of July 10, 2023, C(2023) 4745 final, the European Commission determined that the United States of America provides an adequate level of data protection within the meaning of Art. 45 GDPR, provided that our contractual partner is included in the EU-U.S. Data Privacy Framework list. Information on the registration of individual providers in this list can be found in the respective section of this privacy policy.

In the absence of an adequacy decision, we may only transfer data on the basis of appropriate safeguards, such as standard contractual clauses, binding corporate rules, approved codes of conduct, approved certification mechanisms, etc. Under the conditions of Art. 49 GDPR, a transfer may nevertheless be permissible. You are welcome to request a copy of these safeguards for your specific case from us.

There is no intention to transfer the data to an international organization.

‍

Retention period

Data is generally only stored for as long as is required by statutory retention obligations. Furthermore, data may be stored if this is necessary for the enforcement or defense of third-party claims. Important retention periods can be found below:

‍

‍

World4You

We use the web hosting provider World4You for our website. The service provider is the Austrian company World4You Internet Services GmbH, Hafenstraße 35, 4020 Linz, Austria.

You can find out more about the data processed through the use of World4You in the privacy policy at https://www.world4you.com/en/company/privacy-policy.html.

‍

Webflow

We use Webflow to host our website. The provider is Webflow, Inc., 398 11th Street, 2nd Floor, San Francisco, CA 94103, USA (hereinafter: Webflow).

Type of data: IP address, date and time of access, browser type, operating system, and device data.

Purpose: Provision and error-free delivery of the website as well as ensuring security.

Legal basis: Our legitimate interest in the technically flawless presentation and security of our website (Art. 6(1)(f) GDPR).

Data transfer: Webflow is certified under the EU-U.S. Data Privacy Framework. In addition, standard contractual clauses have been concluded to ensure an adequate level of data protection.

Further information: https://webflow.com/legal/privacy

‍

Fonts

We use Google Fonts and other fonts on our website for the visually appealing presentation of our content. These fonts are hosted locally on our server (provided via Webflow). This avoids a direct connection to Google's servers or other external providers, and no IP address or other data is transmitted to these providers. The use of these locally hosted fonts serves our legitimate interest in an appealing and user-friendly website design (Art. 6(1)(f) GDPR).

‍

Google Services

General

The provider of the following services is Google Ireland Limited, Gordon House, Barrow Street, Dublin, D04 E5W5, Ireland. You can find Google's privacy policy here https://policies.google.com/privacy?hl=en 

However, some services (such as Google Search or Google Maps) are provided by or transmitted to the following company: Google LLC, 1600 Amphitheatre Pkwy, Mountain View, California 94043-1351, USA. Google LLC is based in a third country. Google LLC is included in the list, meaning that data transfer to the USA is compliant with data protection regulations under Art. 45 GDPR. Further information on Google LLC's certification can be found here https://www.dataprivacyframework.gov/s/participant-search/participant-detail?id=a2zt000000001L5AAI&status=Active 

Some Google services use cookies. An overview of the cookies used, their purpose, and their storage duration can be found in the cookie section of this privacy policy. For the use of Google services and the setting of the necessary cookies, your consent is obtained prior to processing in accordance with Art. 6(1)(a) GDPR or § 165(3) TKG. You may withdraw your consent at any time.

Prior consent for cookies is only waived if the sole purpose is the transmission of a message or if it is strictly necessary for us to provide a service that you have explicitly requested.

‍

Google Ads

We use Google Ads (formerly Google AdWords) as an online marketing tool to promote our products and services.

Google Ads is used to better analyze user actions. When you click on one of our Google Ads, a "conversion" cookie is stored on your device by a Google domain.

We also use Google Ad Remarketing on our website.

The most important cookies used in this context are:

‍

‍

Google Tag Manager

We use Google Tag Manager as an organizational tool that allows us to manage website tags centrally via a user interface. Tags are used, for example, to record your activities on our website. The tags mostly originate from Google products such as Google Ads or Google Analytics.

No cookies are set and no data is stored by Google Tag Manager. Rather, it acts as a manager for the tags implemented in the system. The data is captured by the tags of the web analysis tools. In this sense, the data is passed through to the individual tracking tools and is not stored.

‍

Meta Services

‍

Meta Business Tools

Within our online services, we use Meta Business Tools, which are operated and provided by Meta Platforms Ireland Limited, 4 Grand Canal Square, Grand Canal Harbour, Dublin 2, Ireland ("Meta").

The following processing operations are carried out exclusively on the basis of your explicit consent in accordance with Art. 6(1)(a) GDPR.

‍

Meta Pixel

The Meta Pixel is a code that loads a collection of functions with which Meta can track your user actions on our website. The Meta Pixel can store your actions on our website in one or more cookies. Further information on the Meta Pixel can be found at Link. We also use Custom Audiences. Further information on this can be found here.

The pixel collects information such as your IP address and user ID and compares this with the data in your Facebook account.

Meta uses different cookies depending on interaction and user behavior. The following cookies are used as examples:

‍

‍

Cookies

Cookies are text files that are stored on your device to recognize it. Cookies may contain information about the use of our offers and services. Based on the Planet49 GmbH ruling by the ECJ, consent is obtained for cookies even if they are not personal in nature.

Some of the cookies used are stored only until you close our website (session cookies), whereas certain cookies are stored for a longer period and allow you to be recognized (persistent cookies). Some cookies are strictly necessary for the website to function (essential cookies), while others record visits and the visitor's origin and measure this data without the cookies being able to identify you personally (performance cookies). Certain cookies are used for marketing purposes (marketing cookies).

Insofar as personal data is also processed by individual cookies we use, the processing is carried out in accordance with Art. 6(1)(b) GDPR for the performance of a contract, in accordance with Art. 6(1)(a) GDPR in the event of consent having been given, or in accordance with Art. 6(1)(f) GDPR to safeguard our legitimate interests in the best possible functionality of the website and a customer-friendly and effective user experience.

You can select which cookies you wish to allow via the cookie declaration when you first visit the website. Your consent is required for marketing cookies. If you wish to withdraw your consent or change your cookie settings, you can make these changes directly in your browser.

‍

Legal notice

‍

Right of access

You have the right to request confirmation as to whether personal data is being processed; if this is the case, you have the right to access this personal data. This includes the following information: the purposes of the processing; the categories of personal data concerned; the recipients or categories of recipients; where possible, the envisaged period for which the personal data will be stored, or, if not possible, the criteria used to determine that period; the existence of the right to request rectification or erasure of personal data or restriction of processing by the controller or to object to such processing; the right to lodge a complaint with a supervisory authority; any available information as to the source of the data; and the existence of automated decision-making, including profiling.

‍

Right to rectification

You have the right to obtain from the controller the rectification of inaccurate personal data and the completion of incomplete personal data.

‍

Right to erasure

You have the right to obtain from the controller the erasure of personal data without undue delay where one of the following grounds applies: The personal data are no longer necessary in relation to the purposes for which they were collected. You withdraw your consent on which the processing is based and there is no other legal ground for the processing. You object to the processing (Art 21(1) GDPR) and there are no overriding legitimate grounds for the processing, or you object to the processing pursuant to Art 21(2) GDPR. The personal data have been unlawfully processed. The erasure of the personal data is required for compliance with a legal obligation. The personal data have been collected in relation to the offer of information society services referred to in Article 8(1). The right to erasure does not apply to the extent that processing is necessary for exercising the right of freedom of expression and information; for compliance with a legal obligation; for the performance of a task carried out in the public interest; for reasons of public interest in the area of public health; for archiving purposes in the public interest, scientific or historical research purposes, or for the establishment, exercise, or defense of legal claims.

‍

Right to restriction of processing

You have the right to obtain restriction of processing if one of the following applies: the accuracy of the personal data is contested, for a period enabling the controller to verify the accuracy of the personal data; the processing is unlawful and you oppose the erasure of the personal data and request the restriction of their use instead; the controller no longer needs the personal data, but you require them for the establishment, exercise, or defense of legal claims; you have objected to processing pursuant to Article 21(1), pending the verification whether the legitimate grounds of the controller override yours.

Where processing has been restricted, such personal data shall, with the exception of storage, only be processed with your consent or for the establishment, exercise, or defense of legal claims or for the protection of the rights of another natural or legal person or for reasons of important public interest.

‍

Right to data portability

You have the right to receive the personal data you have provided to a controller in a structured, commonly used, and machine-readable format, and you have the right to transmit those data to another controller without hindrance from the controller to whom the personal data have been provided, provided that the processing is based on consent or a contract and the processing is carried out by automated means.

In exercising your right to data portability, you have the right to have the personal data transmitted directly from one controller to another, where technically feasible.

‍

Right to object

You have the right to object, on grounds relating to your particular situation, at any time to the processing of personal data which is based on Article 6(1)(e) or (f) GDPR; this also applies to profiling based on these provisions. The controller shall no longer process the personal data unless the controller demonstrates compelling legitimate grounds for the processing which override your interests, rights, and freedoms, or for the establishment, exercise, or defense of legal claims.

Where personal data are processed for direct marketing purposes, you have the right to object at any time to the processing of personal data for such marketing; this also applies to profiling to the extent that it is related to such direct marketing.

‍

Right to withdraw consent

You have the right to withdraw your consent based on Article 6(1)(a) or Article 9(2)(a) at any time, without affecting the lawfulness of processing based on consent before its withdrawal.

‍

Right to lodge a complaint

You have the right to lodge a complaint with the Austrian Data Protection Authority (Österreichische Datenschutzbehörde), Barichgasse 40-42, 1030 Vienna, T.: 00431521522569, E.: dsb@gsb.gv.at, if you believe that the processing violates applicable data protection law.

‍

Other information

The provision of personal data is partly required by law or necessary for the conclusion of a contract. You are generally not obliged to provide the data. If you do not provide the data, it will not be possible to conclude a contract.

There is no automated decision-making, including profiling, in accordance with Article 22(1) and (4).

+43 664 1354070