Privacy Policy
Under Articles 13 and 14 of Regulation (EU) 2016/679 (General Data Protection Regulation; “GDPR”), the controller must inform data subjects about the processing of personal data. This document informs you about the personal data we process.
This is a courtesy translation. In case of any discrepancy, the German version shall prevail.
This privacy policy applies to our online booking platform for private and group lessons. For our website www.ski-lachtal.at, the privacy policy published there applies.
Definitions
To make this privacy policy easier to understand, a brief explanation of the terms used is provided below.
Personal data (“data”) means any data containing information about the personal or factual circumstances of natural persons, for example name, address, email address, telephone number, date of birth, age, gender, social security number, video recordings, photos, etc. Data relating to legal persons is not subject to the provisions of the GDPR.
Processing means any operation or set of operations which is performed on personal data, whether or not by automated means, such as collection, recording, organisation, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure or destruction.
Controller means the natural or legal person, public authority, agency or other body which, alone or jointly with others, determines the purposes and means of the processing of personal data.
Processor means a natural or legal person, public authority, agency or other body which processes personal data on behalf of the controller.
Recipient means a natural or legal person, public authority, agency or other body to which personal data is disclosed, whether a third party or not.
Our contact details
Should you have any further questions, we, as the controller of the data processing described herein, will be happy to assist you using the following contact details:
Skischule Brunner / Sportshop Skirent Lachtal GmbH
Norbert Brunner
8831 Oberwölz, Lachtal 404
+43 660 35 65 65 1
brunner@ski-lachtal.at
Purposes and legal basis of processing
Data may only be processed for a specified purpose and only where the processing can be based on an appropriate legal basis. Processing may be justified on the following grounds:
| Ground for lawful processing | Legal basis |
|---|---|
| On the basis of your freely given consent for a specific purpose | Art. 6(1)(a) |
| For the performance of a contract to which you are a party, or in order to take steps prior to entering into a contract where the processing is carried out at your request | Art. 6(1)(b) |
| On the basis of a legal obligation to which we are subject | Art. 6(1)(c) |
| To protect your vital interests or those of another person | Art. 6(1)(d) |
| For the performance of a task carried out in the public interest or in the exercise of official authority vested in us | Art. 6(1)(e) |
| On the basis of a balancing of interests between our interest or the interest of a third party in the processing on the one hand and your interests or fundamental rights and freedoms on the other | Art. 6(1)(f) |
We process your data for the following purposes on the basis of the following legal bases:
| Categories of data collected | Purpose of processing | Legal basis |
|---|---|---|
| Booking and contact data of the person making the booking (first and last name, email address, telephone number, comments) | Handling of the course booking, sending of the booking confirmation, queries regarding the booking | Art. 6(1)(b) GDPR |
| Participant data (first and last name, age, experience level), where applicable of minors | Delivery of the course, in particular allocation to suitable groups and verification of age requirements | Art. 6(1)(b) and (f) GDPR |
| Booking details (course, date, time, number of persons, amount, status, payment reference) | Performance of the contract, capacity planning, accounting and compliance with statutory retention obligations | Art. 6(1)(b) and (c) GDPR |
| Payment data (card details or details of the chosen payment method) | Processing of the payment – this data is processed exclusively by our payment service provider Stripe; we do not receive any card details | Art. 6(1)(b) GDPR |
| Security data (IP address in encrypted, non-reversible form) | Protection against misuse, in particular against mass reservations and automated guessing of login credentials | Art. 6(1)(f) GDPR |
| Applicant data (name, date of birth, place of birth, address, email address, telephone number, other data from CVs) | This data is necessary for the use of our services and for initiating a contract and is collected from you. | Art. 6(1)(a) and (b) GDPR |
| Contact data (name, address, email address, telephone number) | This data is necessary for the use of our services or for initiating a contract and is collected from you when you contact us. | Art. 6(1)(a) and (b) GDPR |
| Technical information (IP address, operating system) | This data is required so that the website you have opened on your own initiative can be displayed to you correctly. | Art. 6(1)(f) GDPR |
Online booking of courses
When you book a private or group course via our booking platform, we process the data entered in the booking form: your contact details (first and last name, email address, telephone number and optional comments) and – depending on the course – the first and last name, age and experience level of each participant. In addition, we store the booking details such as course, date, number of persons, amount and payment status.
We use this data to process your booking, to send you the booking confirmation by email, to plan ski instructors and groups, and to deliver the course. Information marked as mandatory is required for the booking; without it, a booking is not possible. The legal basis is the performance of the contract or the taking of steps prior to entering into a contract (Art. 6(1)(b) GDPR). Insofar as participant data is required for the safe and age-appropriate delivery of the course, we additionally rely on our legitimate interests (Art. 6(1)(f) GDPR).
Data of participants and minors
As a rule, we do not obtain participants’ data from the participants themselves but from the person making the booking (Art. 14 GDPR). Please only provide data of other persons if you are entitled to do so, and inform them about this privacy policy. Data of children and adolescents is provided by their parents or legal guardians as part of the booking and is used exclusively for delivering the course. We do not request special categories of personal data (such as health data); please do not provide such information in the comments field either, unless it is necessary for the safe delivery of the course.
Booking confirmation by email
After successful payment, you will receive a booking confirmation at the email address provided. A copy containing the booking and contact details is sent to our ski school office so that we can prepare the courses and contact you if we have any queries.
Recipients
Recipients support us in complying with statutory or legal obligations, in initiating and performing contracts, in services that require your consent, or in carrying out processing that lies in our legitimate interests. We transfer or disclose some of the data in particular to the following recipients (processors or controllers):
| Recipient | Description |
|---|---|
| IT service providers | Operation of our IT system, in particular hosting of the booking platform (Vercel), database (Supabase) and email delivery (Resend) |
| Payment service provider | Processing of the payment for your booking (Stripe) |
| Subcontractors | If and insofar as services are not provided by us and a legal ground for processing exists |
| Tax advisers, accountants | Processing of data for tax or accounting purposes |
| Lawyers, courts, debt collection agencies | Where applicable, for the enforcement or defence of claims |
We only transfer your data to other recipients if you have given your express consent to this pursuant to Art. 6(1)(a) GDPR, if this is legally permissible and necessary for the performance of a contractual relationship with you pursuant to Art. 6(1)(b) GDPR, if we are under a legal obligation to do so pursuant to Art. 6(1)(c) GDPR, or if the disclosure is necessary pursuant to Art. 6(1)(f) GDPR to safeguard our legitimate interests and for the establishment, exercise or defence of legal claims and there is no reason to assume that you have an overriding interest worthy of protection in your data not being disclosed.
We intend to transfer the data to the following third countries: the United States of America and Singapore.
An adequacy decision of the European Commission exists for the United States of America. By decision of 10 July 2023, C(2023) 4745 final, the European Commission determined that the United States of America ensures an adequate level of data protection within the meaning of Art. 45 GDPR where our contractual partner is included in the list of the EU-U.S. Data Privacy Framework. Information on whether the individual providers are included in this list can be found in the respective section of this privacy policy.
Where no adequacy decision exists, we may only transfer data on the basis of appropriate safeguards, such as standard contractual clauses, binding corporate rules, approved codes of conduct, approved certification mechanisms, etc. Under the conditions of Art. 49 GDPR, a transfer may nevertheless be permissible. We will gladly provide you with a copy of these safeguards for your particular case upon request.
We do not intend to transfer the data to an international organisation.
Storage period
As a rule, data is only stored for as long as is required by statutory retention obligations. Beyond that, data may be stored if this is necessary for the enforcement or defence of third-party claims. Important retention periods are listed below:
| Retention obligation | Expected storage period |
|---|---|
| Retention obligation under company law pursuant to §§ 190, 212 of the Austrian Commercial Code (UGB) | 7 years |
| VAT retention obligation for invoices pursuant to § 11(2), third subparagraph, of the Austrian VAT Act (UStG) | 7 years |
| VAT retention obligations for export documents pursuant to § 7(7) of the Austrian VAT Act (UStG) | 7 years |
| Warranty pursuant to § 933 of the Austrian Civil Code (ABGB) | 2 years |
| Claims for the purchase price of movable goods pursuant to § 1062 in conjunction with § 1486 ABGB | 3 years |
| Claims arising from a contract for work and services pursuant to § 1486 ABGB (where the service was provided in the course of a commercial or other business operation) | 3 years |
| General damages pursuant to § 1489 ABGB (actions for compensation) | 3 years/30 years |
| Liability claims pursuant to § 13 of the Austrian Product Liability Act (PHG) | 10 years |
The following periods additionally apply to the data on our booking platform:
| Data | Storage period |
|---|---|
| Paid bookings including contact and participant data (basis for accounting and records) | 7 years from the end of the calendar year of the booking |
| Incomplete reservations (cancelled or unpaid booking processes) | 6 months, then automatically deleted |
| Security data for protection against misuse (encrypted IP address) | generally 24 hours, then automatically deleted |
| Technical access data (server log files at the hosting provider) | short-term, automatically deleted in accordance with the hosting provider’s specifications |
Hosting: Vercel
- Provider
- Vercel Inc., 440 N Barranca Avenue #4133, Covina, CA 91723, USA
- Types of data
- IP address, date and time of access, page accessed, browser type, operating system and device data, as well as the data transmitted as part of a booking
- Purpose
- Provision and error-free delivery of the booking platform and ensuring security
- Legal basis
- Our legitimate interest in the technically flawless presentation and security of our website (Art. 6(1)(f) GDPR); for bookings, additionally the performance of the contract (Art. 6(1)(b) GDPR)
- Data transfer
- Vercel Inc. is certified under the EU-U.S. Data Privacy Framework. Standard contractual clauses are also used.
- More information
- https://vercel.com/legal/privacy-notice
Database: Supabase
- Provider
- Supabase Pte. Ltd., 65 Chulia Street #38-02/03, OCBC Centre, Singapore 049513
- Types of data
- Booking, contact and participant data, booking details, capacity data and encrypted IP addresses for protection against misuse
- Purpose
- Storage and management of bookings and available course places
- Legal basis
- Performance of the contract (Art. 6(1)(b) GDPR) and our legitimate interest in secure operation (Art. 6(1)(f) GDPR)
- Storage location
- The database is operated in a data centre in Ireland (European Union, region eu-west-1).
- Data transfer
- Access by Supabase from third countries (in particular the USA and Singapore), for example in the context of maintenance and support, cannot be ruled out; any such transfer is safeguarded by the European Commission’s standard contractual clauses in the data processing agreement.
- More information
- https://supabase.com/privacy
Payment processing: Stripe
- Provider
- Stripe Payments Europe, Limited, One Wilton Park, Wilton Place, Dublin 2, D02 FX04, Ireland
- Types of data
- Name, email address, amount and description of the booking, payment data of the chosen payment method, and device and connection data (e.g. IP address) for fraud prevention
- Purpose
- Secure processing of the payment. Payment details are entered directly on Stripe’s payment page; we do not receive any card details, only the payment status and a payment reference.
- Legal basis
- Performance of the contract (Art. 6(1)(b) GDPR); insofar as Stripe processes data for fraud prevention and to comply with its own legal obligations, Stripe acts as an independent controller (Art. 6(1)(c) and (f) GDPR)
- Data transfer
- Stripe, Inc. (USA) is certified under the EU-U.S. Data Privacy Framework. Standard contractual clauses are also used.
- More information
- https://stripe.com/at/privacy
Email delivery: Resend
- Provider
- Plus Five Five, Inc. (Resend), 2261 Market Street #5039, San Francisco, CA 94114, USA
- Types of data
- Name and email address of the person making the booking and the content of the booking confirmation (course, date, participant data, amount); in the copy sent to the ski school office, additionally telephone number and comments
- Purpose
- Delivery of the booking confirmation to you and of the booking copy to our ski school office
- Legal basis
- Performance of the contract (Art. 6(1)(b) GDPR)
- Data transfer
- Plus Five Five, Inc. is certified under the EU-U.S. Data Privacy Framework. Standard contractual clauses are also used.
- More information
- https://resend.com/legal/privacy-policy
Protection against misuse
To protect our booking platform against misuse – for example against mass automated reservations that would block course places, or against the guessing of login credentials for our internal administration area – we limit the number of certain requests per sender. For this purpose, your IP address is immediately converted into an encrypted, non-reversible check value (hash); we do not store the IP address itself. The check values are generally deleted automatically after 24 hours. The legal basis is our legitimate interest in providing a secure service that is available to all customers (Art. 6(1)(f) GDPR).
Fonts
On our booking platform we use fonts from Google Fonts to present our content in a visually appealing manner. These fonts are hosted locally on our server (provided via Vercel). This avoids a direct connection to the servers of Google or other external providers, and no IP address or other data is transmitted to these providers. The use of these locally hosted fonts serves our legitimate interest in an appealing and user-friendly website design (Art. 6(1)(f) GDPR).
Cookies
Cookies are text files that are stored on your device in order to recognise it. Cookies may contain information about the use of our offerings and services.
On your first visit, we use a cookie banner to ask which categories of cookies you wish to allow: Essential (always active), Statistics and Marketing. Statistics and marketing cookies are only set with your consent (Art. 6(1)(a) GDPR in conjunction with § 165(3) of the Austrian Telecommunications Act 2021 (TKG 2021)). We currently do not use any statistics, tracking or marketing services on our booking platform.
We store your choice in the technically necessary cookie “cc_cookie” (storage period 6 months). It contains the selected categories, a random identifier and the time of your decision so that we can demonstrate your consent. You can change or withdraw your choice at any time via the cookie icon at the bottom left of every page or via the “Cookie settings” link in the footer; cookies of withdrawn categories are deleted in the process. The withdrawal does not affect the lawfulness of processing carried out before the withdrawal.
Only for the password-protected administration area, which is used exclusively by our staff, do we set a strictly necessary session cookie after login (“ski_admin_session”, valid for 12 hours). No consent is required for this pursuant to § 165(3) TKG 2021.
On the payment page of our payment service provider Stripe (checkout.stripe.com), Stripe sets its own cookies, in particular for fraud prevention and for the secure processing of the payment. Stripe’s privacy policy applies to these.
Your rights
Right of access
You have the right to obtain confirmation as to whether or not personal data is being processed; where that is the case, you have the right of access to that personal data. This covers the following information: the purposes of the processing; the categories of personal data concerned; the recipients or categories of recipients; where possible, the envisaged period for which the personal data will be stored, or, if not possible, the criteria used to determine that period; the existence of the right to request rectification or erasure of the personal data concerned or restriction of processing by the controller, or to object to such processing; the right to lodge a complaint with a supervisory authority; any available information as to the source of the data; the existence of automated decision-making, including profiling.
Right to rectification
You have the right to obtain from the controller the rectification of inaccurate personal data and the completion of incomplete personal data.
Right to erasure
You have the right to obtain from the controller the erasure of personal data without undue delay where one of the following grounds applies: The personal data is no longer necessary in relation to the purposes for which it was collected. You withdraw the consent on which the processing is based according to Art. 6(1)(a) or Art. 9(2)(a) GDPR, and there is no other legal ground for the processing. You object to the processing (Art. 21(1) GDPR) and there are no overriding legitimate grounds for the processing, or you object to the processing pursuant to Art. 21(2) GDPR. The personal data has been unlawfully processed. The personal data has to be erased for compliance with a legal obligation. The personal data has been collected in relation to the offer of information society services referred to in Article 8(1).
The right to erasure does not apply to the extent that processing is necessary for exercising the right of freedom of expression and information; for compliance with a legal obligation, for the performance of a task carried out in the public interest; for reasons of public interest in the area of public health; for archiving purposes in the public interest, scientific or historical research purposes or statistical purposes for the establishment, exercise or defence of legal claims.
Right to restriction of processing
You have the right to obtain restriction of processing where one of the following applies: the accuracy of the personal data is contested, for a period enabling the controller to verify the accuracy of the personal data; the processing is unlawful and you oppose the erasure of the personal data and request the restriction of its use instead; the controller no longer needs the personal data, but you require it for the establishment, exercise or defence of legal claims; you have objected to processing pursuant to Article 21(1), pending the verification whether the legitimate grounds of the controller override.
Where processing has been restricted, such personal data shall, with the exception of storage, only be processed with your consent or for the establishment, exercise or defence of legal claims or for the protection of the rights of another natural or legal person or for reasons of important public interest.
Right to data portability
You have the right to receive the personal data which you have provided to a controller in a structured, commonly used and machine-readable format, and you have the right to transmit that data to another controller without hindrance from the controller to which the personal data has been provided, where the processing is based on consent or on a contract and the processing is carried out by automated means.
In exercising your right to data portability, you have the right to have the personal data transmitted directly from one controller to another, where technically feasible.
Right to object
You have the right to object, on grounds relating to your particular situation, at any time to the processing of personal data based on Art. 6(1)(e) or (f) GDPR, including profiling based on those provisions. The controller shall no longer process the personal data unless it demonstrates compelling legitimate grounds for the processing which override your interests, rights and freedoms, or the processing serves the establishment, exercise or defence of legal claims.
Where personal data is processed for direct marketing purposes, you have the right to object at any time to the processing of personal data for such marketing, which includes profiling to the extent that it is related to such direct marketing.
Right to withdraw consent
You have the right to withdraw consent given pursuant to Art. 6(1)(a) or Art. 9(2)(a) at any time, without affecting the lawfulness of processing based on consent before its withdrawal.
Right to lodge a complaint
You have the right to lodge a complaint with the Austrian Data Protection Authority (Datenschutzbehörde), Barichgasse 40-42, 1030 Vienna, T.: +43 1 52 152-0, E.: dsb@dsb.gv.at, if you consider that the processing infringes applicable data protection law.
Other information
The provision of personal data is in part required by law or necessary for entering into a contract. In principle, you are not obliged to provide the data. If you do not provide the data, it is not possible to enter into a contract.
There is no automated decision-making, including profiling, pursuant to Article 22(1) and (4).
Last updated: October 2026