PRIVACY POLICY
LIFTGEMEINSCHAFT OBERTAUERN GMBH
As the data controller, we
Liftgemeinschaft Obertauern GmbH
Seekarstraße 2
A-5562 Obertauern
Tel. Nr.: +43 6456 7554
Fax Nr.: +43 6456 7554 22
Mail: info@ski-obertauern.at
As the data controller, we – Liftgemeinschaft Obertauern GmbH, Seekarstraße 2, A-5562 Obertauern – take the protection of personal data very seriously and therefore process your personal data solely in accordance with the applicable data protection laws (in particular the GDPR, the Austrian Data Protection Act and the Telecommunications Act 2021). This Privacy Policy reflects the current legal framework; we explicitly reserve the right to make future changes or updates. Please visit this section of our website regularly to stay informed about any changes in the processing of personal data. f you have any questions regarding data protection, please contact our Data Protection Officer at info@ski-obertauern.at.
Contacting Us
f you contact us via the contact form on our website, by e-mail, or by telephone, the personal data you provide (title, name, e-mail address, subject, message content, and any technical transmission data) will be stored by us for the purpose of processing your inquiry. The processing of your data is based on our overriding legitimate interests (Art. 6 (1)(f) GDPR) and on the performance of pre-contractual measures or contractual obligations (Art. 6 (1)(b) GDPR). Without your personal data, we cannot process your request. The data collected in this context will be deleted once the purpose for which it was processed no longer applies, but no later than six months, unless statutory or contractual reasons require longer retention. The personal data required for this purpose is collected exclusively from you. No data is transferred to third parties in connection with this processing.
Data Processing in Connection with Contract Conclusion
For the conclusion, execution, or termination of a contract with you, we process the following personal data:
Master data (title, name, date of birth/year, address)
Contact data (e-mail address, telephone number if applicable)
Information about Orders
Payment data
Without the personal data you provide when placing an order or contacting us, we cannot conclude a contract with you. We therefore process this data for the fulfilment of contractual obligations or pre-contractual measures pursuant to Art. 6 (1)(b) GDPR. We are also entitled, insofar as necessary for debt collection or enforcement of claims arising from the contractual relationship, to transmit the master and personal data provided by the customer – in particular name, date of birth, address, information on payment default and outstanding balance – to lawyers and collection agencies. Personal data is stored for as long as necessary to fulfil the purpose of processing, and for as long as a legal obligation or outstanding legal claims require longer retention. To comply with commercial, VAT and tax retention obligations, your data will be stored for a period of seven years. Beyond that, your data will be retained as long as required for the enforcement of legal claims. You have the option to purchase ski tickets and vouchers via our online shop. The data you provide is processed for the handling of your order and for contract fulfilment in accordance with Art. 6 (1)(b) GDPR. To place an order in the online shop, a customer account must be created. To provide this service, we process the personal data you supply (first and last name, date of birth, address, e-mail address). You may delete your customer account at any time. Further information about our online services, pricing regulations and data protection can be found in our Obertauern Webshop: (https://obertauern.skiperformance.com/).
Newsletter Subscription
If you have provided us with your e-mail address when purchasing goods or using our services, we reserve the right to send you regular offers for similar goods or services by e-mail. If you have provided us with your e-mail address when purchasing goods or using our services, we reserve the right to send you regular offers for similar goods or services by e-mail. If you have initially objected to the use of your e-mail address for this purpose, no e-mails will be sent to you. You have the right to object to the use of your e-mail address for marketing purposes at any time with future effect by notifying us or by using the unsubscribe link included in the newsletter. Upon receipt of your objection, the use of your e-mail address for marketing purposes will be stopped immediately.
You also have the option to subscribe to our free newsletter. For this, we require your e-mail address and your explicit consent pursuant to Art. 6 (1)(a) GDPR. Once you register for the newsletter, you will receive a confirmation e-mail containing a link to verify your registration (double opt-in procedure). You will only be subscribed after this confirmation. This process helps prevent unwanted subscriptions. We store your IP address as well as the time of registration and confirmation in order to verify your registration and prevent misuse of your personal data. You may withdraw your consent to receive the newsletter at any time by sending an e-mail to info@ski-obertauern.at or by using the unsubscribe link provided in the newsletter. For the purpose of sending our newsletters, we use the services of a data processor Microsoft 365 (Exchange Online).
Access Control via Photocompare
For the purpose of access control, to prevent misuse of lift tickets, and to ensure compliance with tariff regulations, a reference photo of the lift ticket holder is taken the first time they pass through a camera-equipped turnstile, based on our legitimate interest pursuant to Art. 6 (1)(f) GDPR. This reference photo is compared by lift personnel with the photos taken each time the person passes through a camera-equipped turnstile. No automated image comparison takes place. The reference photo is deleted immediately after the ski pass expires, and the additional photos (control photos) are deleted no later than 30 minutes after each passage through a turnstile. Only in specific cases (if our staff has doubts about the match between the control photo and the reference photo) is the automatic deletion of the control photo suspended. In such cases, for the purpose of clarifying criminal acts or enforcing civil claims, we are entitled—to the extent necessary for the enforcement of our rights—to transfer your master data and information related to the incident to security authorities, courts, insurance companies, and legal representatives (Art. 6 (1)(f) GDPR, Art. 10 GDPR in conjunction with § 149 of the Austrian Penal Code – obtaining services by deception). If the suspicion of unlawful use of the ski pass is not confirmed, the control photo is deleted immediately. In connection with access control via Photocompare, we also process your name, address, date of birth, and the number and type of your ski pass. All data is stored in encrypted form. Furthermore, for billing purposes with other lift operators, we process the access times and locations of the lift ticket in accordance with Art. 6 (1)(b) GDPR. For this purpose, the data is stored for three years. No movement profiles of lift ticket users are created from the image data generated by the Photocompare system. No audio recordings are made. Please note that our ski passes are non-transferable. Photocompare is not used at all lift facilities but only at selected, clearly marked access points. There is also the option to purchase lift tickets configured so that no photo is taken when passing through the turnstile; however, in such cases, random manual checks by lift personnel must be expected. Our data processor for this system is Skidata AG, Untersbergstraße 40, 5083 Grödig/Salzburg, Austria.
Wi-Fi
We do not operate any Wi-Fi network within the ski area. If Wi-Fi is offered within the Obertauern ski area, responsibility for its operation (including compliance with the GDPR) lies with the respective Wi-Fi provider.
Job Applications
We process the personal data you provide for the purpose of conducting the application process pursuant to Art. 6 (1)(b) GDPR (initiation or performance of contractual relationships) or to comply with our legal obligations pursuant to Art. 6 (1)(c) GDPR. In addition, we may retain your application data if you have given your explicit consent for us to do so. If you have not given consent to retain your application, we will delete your personal data seven months after receipt of your application. Without your personal data, it is not possible for us to process your application.
Data Collection When Visiting Our Website
To improve the operation of our website, we use so-called “cookies.” Cookies are small text files that may be stored on your computer when you visit a website. Cookies generally serve to provide users with additional functionality on a website. They cannot access, read, or modify any other data on your computer.
Website Functionality
When you visit our website, certain personal data that your browser transmits to our servers is collected. This data is technically necessary to display the website to you and to ensure its stability and security. This enables error tracking and sustainable troubleshooting, helps prevent and address unlawful use of website content, and improves website quality. The IP address is only evaluated in the event of attacks on our network infrastructure. The data is automatically deleted as soon as it is no longer required for our recording purposes, but no later than after 30 days. The processing of this data is based on Art. 6 (1)(f) GDPR in conjunction with § 165 (3) of the Austrian Telecommunications Act 2021.
The following data is collected:
IP address of the requesting computerDatum und Uhrzeit des Zugriffs
Date and time of access
Name and URL of the retrieved data
Amount of data transmitted
Message indicating whether the request was successful
Identification data of the browser and operating system used
Website from which access occurs
Name of your Internet service provider
Google Analytics
We use Google Analytics on our website, a web analysis service provided by Google Ireland Ltd., Gordon House, Barrow Street, Dublin 4, Ireland. Acting on our behalf, Google uses the information collected to evaluate your use of the website, compile reports on website activity, and provide other services relating to website and Internet usage to the website operator. This information is also used to display personalized advertising on other websites, selected through real-time bidding. For this purpose, Google processes—by means of cookies—information about the use of the website, including browser type and version, operating system used, previously visited website, IP address, date/time, and the geographic region of the server request. We use Google Analytics only with active IP anonymization. This means that IP addresses are processed in a shortened form to exclude direct personal identification. According to Google, the IP address transmitted by your browser will not be merged with other Google data. Together with other processed information, this data is also used for selecting personalized advertising through real-time bidding and remarketing/retargeting. When using Google Analytics, your data may be transferred to a third country (USA). For this transfer, there is currently an adequacy decision (EU-US Data Privacy Framework). However, it cannot be ruled out that US authorities may access your data for monitoring and surveillance purposes. Please note that you may have no effective legal remedies or enforceable rights against such access by US authorities. The processing of this data or disclosure to Google takes place only on the basis of your consent (Art. 6 (1)(a) GDPR in conjunction with § 165 (3) Austrian Telecommunications Act 2021), which you expressly give via the cookie settings (“opt-in”). You may withdraw your consent at any time; such withdrawal will not affect the lawfulness of processing carried out before the withdrawal. We retain data on website usage for a period of 14 months. Further information about how Google uses data, and about your settings and opt-out options, can be found in Google’s Privacy Policy at http://www.google.com/analytics/terms/en.html and https://policies.google.com/privacy . You can also prevent Google from collecting and processing data generated by cookies (including your IP address) by downloading and installing the browser plug-in available at https://tools.google.com/dlpage/gaoptout .
Meta Pixel
On our website we use the “Meta Pixel” service, provided by the social network “Meta” (Meta Platforms Technologies Ireland Limited, Grand Canal Square, Grand Canal Harbour, Dublin 2, Ireland), for the purpose of analysing and optimising our online presence. Please note that Meta may transfer your data to the United States. For this data transfer there is currently an adequacy decision (EU-US Data Privacy Framework). However, it cannot be ruled out that US authorities may access your data for control or monitoring purposes. Please note that you may have no effective legal remedies or enforceable rights against such access. The processing of this data takes place only on the basis of your consent (Art. 6 (1)(a) GDPR in conjunction with § 165 (3) Austrian Telecommunications Act 2021), which you give expressly via the cookie settings (“opt-in”). You may withdraw your consent at any time; such withdrawal does not affect the lawfulness of processing carried out before the withdrawal. Meta Pixel enables us to show our advertisements on Meta specifically to those audiences that have shown interest in our or similar offerings. It also allows us to statistically measure the success of our advertising campaigns on Meta. Actions you take on our website are stored in cookies. Meta matches this information with your Meta account data to provide advertisements tailored to your interests. You can prevent linkage to your Meta account by logging out of your Meta account before using our website. We cannot view the data collected by Meta.
Social Media (Facebook and Instagram)
We operate our own pages on Facebook and Instagram and share responsibility for data processing with Meta Platforms Ireland Ltd., 4 Grand Canal Square, Grand Canal Harbour, Dublin 2, Ireland (ECJ judgment 05 June 2018, C-210/16). The relevant joint-controller agreement can be found at https://www.facebook.com/legal/terms/page_controller_addendum . Our Facebook and Instagram pages serve to represent our ski-lift company and to provide information about the summer and winter seasons, projects, and events. In doing so, personal data of users are processed – e.g. profile name, posted content, comments, likes, and messages. Page operators can use the Meta Insights function to access anonymised statistical data about users. These statistics are created and provided by Meta; we have no influence over their generation or processing. For a selectable period, we are shown anonymised data such as page views, reach, interactions, “likes,” age and gender distribution, and users’ countries and locations. We use this information to make our posts and activities more appealing and to document marketing efforts. Operation of our fan pages and the associated processing of personal data is based on the consent given by each user to Meta (Art. 6 (1)(a) GDPR). Again, Meta may transfer data to the United States; the EU-US Data Privacy Framework applies. Further details on data processing can be found in Meta’s / Facebook’s Privacy Policy: https://facebook.com/about/privacy .
Skiline
You can access the external service Skiline via our website. If you register for this service and give your consent pursuant to Art. 6 (1)(a) GDPR, the Skiline provider receives information about your lift entries in our ski areas and your card number and can calculate the altitude and distance you have skied. The company Alturos Destinations GmbH (Lakeside B03, 9020 Klagenfurt, Austria) is solely responsible for Skiline and all data processing related to it under data protection law. Further information about the Skiline service can be found at https://www.skiline.cc/privacy_policy/en . When registering with Skiline, you may also consent to receiving our newsletter. More information can be found in the “Newsletter” section of this Privacy Policy.
ISKI Tracker
You can also access the external service ISKI Tracker via our website. If you register for this service and give your consent pursuant to Art. 6 (1)(a) GDPR, the ISKI Tracker provider receives information about your lift entries in our ski areas and your card number. ISKI Tracker is a service for recording and analysing your ski days (“ski diary”) and can calculate, for example, your vertical metres and kilometres skied. The company intermaps AG (Untere Paulistrasse 6b, CH-8834 Schindellegi, Switzerland) is solely responsible for ISKI Tracker and all data processing related to it. Further information about the ISKI Tracker service can be found at https://iski.cc/en/privacy-iski.html
Rights of Data Subjects
You have the right at any time to access, rectify, erase, or restrict the processing of your stored personal data, the right to object to processing, and the right to data portability, in accordance with the provisions of data protection law (Articles 15–22 GDPR). If you believe that the processing of your personal data is unlawful, you have the right to lodge a complaint with the Data Protection Authority.
The competent supervisory authority is the:
Austrian Data Protection Authority (DSB)
Barichgasse 40–42, 1030 Vienna
E-Mail: dasb@dsb.gv.at
Website: www.dsb.gv.at
If you have further questions about how we process your data, please feel free to contact us directly:
Liftgemeinschaft Obertauern GmbH
Seekarstraße 2, 5562 Obertauern, Austria
E-Mail: info@ski-obertauern.at
Ticket Print Information
Further information on the Photocompare access system as well as on data protection can be found at https://www.ski-obertauern.at/skipass/tarifbestimmungen-skipassverkauf .
