PRIVACY POLICY

The responsible within the meaning of the General Data Protection Regulation (GDPR) for the processing of personal data in connection with the website is

Tourismusverband Tiroler Zugspitz Arena

Schmiede 15
6632 Ehrwald
Austria
Tel.: +43 5673 20 000
Email: info[at]zugspitzarena.com

The person responsible has appointed Dipl.-Ing. (FH) Anton Greil, M.Sc., who can be contacted by e-mail at anton.greil[at]compliant-it.eu, as data protection officer.

The provision of personal data is generally neither legally nor contractually required for the purely informative use of our website. However, certain data is automatically processed for technical reasons (e.g. server log files) in order to provide the website.
If you contact us via forms, email or telephone or use online services (e.g. newsletters, bookings/enquiries, competitions), the information marked as mandatory is required to process your enquiry or provide the respective service. Without this data, we are generally unable to process your enquiry/service or can only do so incompletely.

We do not use automated decision-making that has legal effects on you or similarly significantly affects you (Art. 22 GDPR).
If you consent to analysis or marketing technologies, usage profiles may be created (e.g. for reach measurement or interest-based advertising/remarketing). This is done exclusively on the basis of your consent and can be revoked at any time via "Cookie settings (or "Select cookies")".

As a data subject, you have the following rights in particular, depending on the legal requirements

• Right to information (Art. 15 GDPR) about whether and which personal data we process about you.
• Right to rectification (Art. 16 GDPR) of inaccurate data or completion of incomplete data.
• Erasure (Art. 17 GDPR) ("right to be forgotten"), unless there are legal retention obligations or other reasons that prevent this.
• Restriction of processing (Art. 18 GDPR).
• Data portability (Art. 20 GDPR), if applicable.
• Objection to processing based on Art. 6(1)(e) or (f) GDPR (Art. 21 GDPR).
• Withdrawal of consent (Art. 7(3) GDPR) with effect for the future if we process data on the basis of your consent (e.g. newsletters, marketing cookies).

To exercise your rights, please contact us at info[at]zugspitzarena.com. To protect your data, we may request suitable proof of identity.

You also have the right to lodge a complaint with the competent supervisory authority. In Austria, this is the

Austrian Data Protection Authority

Barichgasse 40-42
1030 Vienna, Austria

Tel.: +43 1 52 152-0
Email: dsb[at]dsb.gv.at
Website: www.dsb.gv.at

We use service providers (in particular IT, hosting, agency, analysis, newsletter and booking/platform service providers) to provide our website and services. These service providers process personal data on our behalf as processors in accordance with Art. 28 GDPR or as independent controllers (e.g. if you book a service directly via their platform).

Categories of recipients may include, in particular

• IT/hosting and maintenance service providers, web agencies, support service providers
• Providers of analysis/marketing tools
• Providers of booking/agency and ticket systems and affiliated service providers (e.g. accommodation providers, event organisers)
• Shipping/logistics service providers (e.g. brochure dispatch)
• PR/marketing agencies
• Authorities/courts/tax advisors/auditors, if we are legally obliged to do so or to assert/defend legal claims
   

We conclude appropriate data processing agreements (Art. 28 GDPR) with processors before processing begins.

Third country transfers: With certain tools/providers, transfers to third countries (in particular the USA) cannot be ruled out. In such cases, the transfer will only take place if the requirements of Art. 44 et seq. GDPR are met, e.g. on the basis of an adequacy decision (e.g. EU-U.S. Data Privacy Framework) or on the basis of standard contractual clauses and supplementary measures.

Details on the respective service providers used and any transfers to third countries can be found in the respective sections of this privacy policy.

We only store personal data for as long as is necessary for the respective purposes or as we are obliged to do so by law.
Criteria for the storage period are, in particular:

• Duration of the processing of your enquiry or the provision of the requested service
• Contractual or pre-contractual relationships
• Statutory retention obligations (e.g. retention periods under company and tax law; typically 7 years)
• Limitation periods for asserting or defending legal claims (typically 3 years)
• In the case of consent: until revoked, whereby evidence (e.g. double opt-in) may be retained beyond this period if necessary
   

As soon as the data is no longer required for the above-mentioned purposes, it will be deleted or anonymised.
 

Every time you access our website, your browser automatically transmits information to our server and stores it in so-called server log files. In particular, the following data is processed

• IP address (possibly in abbreviated/anonymised form, depending on the server configuration)
• Date and time of access
• Page/file accessed (URL), amount of data transferred
• Referrer URL (previously visited page)
• Browser type/version, operating system, device type
• Status codes/error messages
   

Purposes: Ensuring technical operation, IT security (e.g. defence against and analysis of attacks), error analysis and optimisation

Legal basis: Art. 6(1)(f) GDPR (legitimate interest in secure and stable operation of the website)

Recipient: Hetzner Online GmbH (DE)

Storage period: 1 week

This website uses SSL/TLS encryption for security reasons and to protect the transmission of confidential content. You can usually recognise an encrypted connection by the "https://" in the address bar of your browser and by the lock symbol (depending on the browser).

Encryption means that data you send to us (e.g. via contact forms) cannot be easily read by third parties.

We use a consent management tool (cookie banner) to obtain, manage and document consent for cookies and similar technologies (e.g. local storage).

The following data, among other things, is processed

• Consent status per category/service (e.g. "analysis", "marketing")
• Time of consent/rejection
• Technical identifier (e.g. consent ID), browser/device information
• (Abbreviated) IP address (if necessary for delivery/security)
   

Purposes: Obtaining and verifying consent; providing consent management; fulfilling legal verification and documentation obligations.

Legal basis:

• Documentation/management of consent: Art. 6(1)(c) GDPR (legal obligation) and/or Art. 6(1)(f) GDPR (legitimate interest in proving lawfulness)
• Setting/reading of non-essential cookies/technologies: Art. 6 (1) (a) GDPR in conjunction with Section 165 (3) TKG 2021 (consent)
• Technically necessary storage of your cookie settings (consent cookie): Section 165 (3) TKG 2021 in conjunction with Art. 6 (1) (f) GDPR
   

Recipient/processor: Usercentrics A/S (consent management), Denmark

Managing/revoking consent: You can change your settings at any time via the cookie statements on the respective website and revoke any consent you have given with future effect.

We use cookies and similar technologies that are necessary for the operation of the website and the provision of desired functions (e.g. page navigation, language selection, shopping basket/session, security functions).

Purposes: Provision of the website and its core functions, IT security, ensuring functionality.

Legal basis:

• Section 165(3) TKG 2021 (exception for technically necessary storage/access)
• Art. 6 (1) (f) GDPR (legitimate interest in technically error-free operation) or Art. 6 (1) (b) GDPR, insofar as the cookies are necessary to provide a service requested by you (e.g. shop, bookings)
   

Storage period: depending on the cookie/storage entry (session until the browser is closed or for a defined period). Details can be found in the cookie declaration.

You can delete or block cookies in your browser settings. If you deactivate cookies, the functionality of the website may be restricted.

When you contact us (e.g. by e-mail, telephone or contact form), we process the data you provide in order to process your enquiry.

Data categories: depending on the enquiry, e.g. name, contact details (e-mail, telephone number), content of the message, booking/travel details if applicable; data that you provide to us

Purposes: processing and responding to enquiries, preparing quotations, general communication, documentation

Legal basis: Art. 6(1)(b) GDPR (pre-contractual measures/contract fulfilment), otherwise Art. 6(1)(f) GDPR (legitimate interest in efficient communication); if legal obligations are involved, Art. 6(1)(c) GDPR

Recipients: IT/email service providers, hosting service providers (see "Recipients/processors")

Storage period: after completion of processing, unless longer storage is required (e.g. contract/legal obligation/legitimate interest)

Recipients/processors

Depending on the nature of your enquiry, we may use service providers who process your data on our behalf (Art. 28 GDPR), e.g. 

• Feratel Media Technologies AG (AT)
• FareHarbor B.V. (NL)
• Hocom (AT)
• Diewebsigner.com/Silberleithen GmbH (AT)
• EvoNET (AT)
• Seitwerk GmbH (DE)
• Numbirds CRM GmbH (AT)
   

If your request concerns a specific booking/agency service, companies/service providers in the booking portal may also be independent controllers of your data (e.g. accommodation providers).

When you subscribe to our newsletter, we process your data in order to send you regular information about offers, events and holiday information from the Tiroler Zugspitz Arena.

Double opt-in: After registering, you will receive an email in which you can verify your registration by clicking on a confirmation link. This ensures that no one can misuse your email address.

Data categories: Email address/name/title/country; language (DE/EN), registration/confirmation time; IP address and log data to prove consent (double opt-in)

Purposes: Sending the newsletter, proof of consent, managing subscriptions

Legal basis: Art. 6(1)(a) GDPR (consent)

Recipient/processor: NumBirds CRM GmbH (AT)

Storage period: until unsubscription/revocation. After unsubscribing, proof of consent may be stored for 3 years (proof/limitation period) from revocation.

Unsubscription/revocation: You can unsubscribe from the newsletter at any time via the unsubscribe link in every newsletter email.

When sending newsletters, we evaluate whether newsletters are opened and which links are clicked. For this purpose, newsletters contain technically necessary tracking pixels or individual links.

Data categories: Information about opening (time/frequency), clicks on content/links, technical information (e.g. device/browser), assignment to a newsletter ID if applicable

Purposes: Statistical evaluation and optimisation of the newsletter, performance measurement, personalisation/segmentation if applicable (e.g. according to interests)

Legal basis: Art. 6(1)(a) GDPR (consent)

Recipient/processor: NumBirds CRM GmbH (AT)

Storage period: as long as the newsletter subscription is active or until revoked

You can revoke your consent at any time (e.g. by unsubscribing from the newsletter).

We occasionally offer surveys, feedback forms or evaluation queries in order to improve our services.

Data categories: depending on the design, e.g. answers/comments/suggestions, name/e-mail (if provided), technical metadata (time, IP address for online forms, if applicable)

Purposes: evaluation of feedback, quality management, improvement of offers and service.

Legal basis: depending on the design, Art. 6(1)(f) GDPR (legitimate interest in improvement) or Art. 6(1)(a) GDPR (consent), in particular if your person is identified

Recipient/processor: Microsoft Ireland Operations Limited, Dublin [Ireland]
 

When you submit an accommodation request via our website, we process the data you enter in order to forward your request to suitable accommodation providers or to send you offers.

Data categories: Name, contact details, travel dates (arrival/departure, number of persons), requests/comments, other voluntary information if applicable

Purposes: Forwarding your enquiry, communication between you and accommodation providers, sending offers

Legal basis: Art. 6(1)(b) GDPR (pre-contractual measures/contract fulfilment at the request of the data subject)

Recipients:

• Landlords
• Feratel [AT]

Our website includes booking and reservation functions (e.g. via widgets or redirects) for booking accommodation, tickets or offers online.

Data categories: depending on the booking, e.g. contact details, booking/travel details, communication details; payment details if applicable (see payment module)

Purposes: Processing of bookings/reservations, preparation of offers, communication, customer service.

Legal basis: Art. 6 (1) (b) GDPR (contract/pre-contractual measures).

Recipients/processors:

• Feratel Media Technologies AG [AT]
• Any booked service providers (accommodation providers, event organisers).
• FareHarbor B.V. (NL)
   

Cookies/tracking: Depending on the technical implementation, the booking system may use cookies or similar technologies. Unless these are technically necessary, this will only take place after consent has been given via consent management (Art. 6(1)(a) GDPR in conjunction with Section 165(3) TKG 2021).

Storage period: in accordance with the respective contractual/retention obligations (typically: processing + statutory periods); usually 3 years
 

If we act as the operator of a booking and agency platform, we may be obliged under Section 18(11) and (12) of the German Value Added Tax Act (UStG) to keep records of booking transactions arranged via the platform and, depending on legal requirements (e.g. turnover thresholds), to transmit these to the tax authorities.

In particular, the following data may be recorded

1. Name, postal address and e-mail/website or other electronic address of the landlord/service provider
2. VAT identification number or national tax number
3. Bank details or virtual account number
4. Booking/transaction data (e.g. description of the service, remuneration/turnover, location of the business, booking period or booking date, transaction number)
    

Storage: in accordance with legal requirements (up to 10 years from the end of the year in which the transaction took place)

Legal basis: Art. 6(1)(c) GDPR (compliance with a legal obligation)

If you order brochures or information material via our website, we will process the data you provide for the purpose of handling the shipment.
 

Data categories: Name, postal address, optional email/telephone number, desired brochures, shipping/logistics data

Purposes: Order processing, shipping and delivery, queries

Legal basis: Art. 6 (1) (b) GDPR (contract/pre-contractual measures)

Storage period: Until completion of shipping and beyond only if there are legal obligations or documentation requirements

Recipient

• Feratel Media Technologies AG [AT]

If you participate in a competition, we process your data for the purpose of conducting the competition (participation management, draw, notification and delivery of the prize).

Data categories: Name, contact details (e-mail/address), response/contribution if applicable, time of participation; shipping details if applicable in the event of a win
 

Purposes: running the competition, determining and notifying the winners, delivery/shipping

Legal basis: generally Art. 6(1)(b) GDPR (contract – terms and conditions of participation) or Art. 6(1)(a) GDPR (consent), depending on the design

Publication of winners (optional): Publication (e.g. name/photo) will only take place if this is provided for in the conditions of participation and/or you have given your consent

Recipients:

• Shipping service providers, if applicable
• Sponsors/partners, if applicable, if the competition is being run jointly
   

Storage period: 3 years after completion of the competition; beyond that, only to the extent that legal obligations exist

If you apply via our website (e.g. using a form or by email), we will process your application data for the purpose of carrying out the application process.

Data categories: Master data (name), contact details, application documents (CV, references), qualification data, correspondence, other voluntary information if applicable

Purposes: Review and processing of the application process, establishing contact, decision on the establishment of an employment relationship

Legal basis: Art. 6(1)(b) GDPR (pre-contractual measures) and, where applicable, Art. 6(1)(f) GDPR (legitimate interest in efficient application processes)

Recipients/processors

• Hetzner Online GmbH (DE)
• Seitwerk GmbH [DE]
   

Storage period: 180 days

Our website contains links to external websites and, depending on the page/function, embedded external content (e.g. booking portal, maps/POI displays, webcams, weather or route widgets). When you access embedded content, a connection is established to the servers of the respective provider; in particular, your IP address may be processed and cookies/similar technologies may be used.

Where possible, we use consent solutions so that embedded content is only loaded after you have given your consent. The data processing by the respective third-party provider is subject to their privacy policy.

Map/GIS services are integrated to display maps and points of interest (POI). When the map is loaded, a connection is established to the servers of the respective provider. Your IP address is processed and cookies may be set.

Purposes: Display of maps, routes, POIs and planning of journeys/excursions

Legal basis: generally Art. 6(1)(a) GDPR in conjunction with Section 165(3) TKG 2021 (consent), in particular for Google Maps or comparable third-party services with cookies/tracking

Provider/recipient:

• General Solutions Steiner GmbH (Contwise Maps) [AT]
• Intermaps Software AG+GmbH [AT]

Our website contains links to social media platforms (e.g. Facebook/Instagram) and embedded content/plugins (e.g. feeds, "share" buttons).

Pure links: When you click on a social media link, you leave our website. From this point on, the respective provider is responsible for data processing.

Embeddings/plugins: When embedded content is actively loaded, a connection to the servers of the respective provider is established. Your IP address and other technical information may be transmitted to the provider; the provider may set cookies or read existing cookies.

Data-saving implementation: Where possible, we use consent solutions so that embedded content is only loaded after you have given your consent. The data processing by the respective third-party provider is subject to their privacy policy.

Purposes: Display of social media content, interaction options, reach/marketing

Legal basis: generally Art. 6(1)(a) GDPR in conjunction with Section 165(3) TKG 2021 (consent), insofar as embeddings/plugins set or read cookies or transmit data to the provider. Pure linking is based on our legitimate interest (Art. 6(1)(f) GDPR) in making our offering findable via social media channels.

Third-country transfer: possible depending on the provider (especially the USA). For details, please refer to the data protection information of the respective platform.

Consent/revocation: via "Cookie settings (or "Select cookies")"

We embed some videos via external platforms (YouTube, Vimeo). When loading or playing the video, a connection to the servers of the respective provider is established. Technical data (including IP address) is transmitted in the process; the provider can set cookies or read existing cookies.

Purpose: Display of video content

Data-saving implementation: Where possible, we use data-saving embedding options (e.g. "extended data protection mode" on YouTube) and only load videos after you have given your consent.

Legal basis: generally Art. 6(1)(a) GDPR in conjunction with Section 165(3) TKG 2021 (consent), insofar as cookies/similar technologies are used or data is transmitted to the provider.

Provider/recipient

• YouTube: Google Ireland Limited (processing also possible by Google LLC, USA)
• Vimeo: Vimeo.com, Inc. (transfer to the USA possible)
   

Revocation: via "Cookie settings (or "Select cookies")"

If you have given your consent, we use Google Analytics, a web analytics service provided by Google, to evaluate the use of our website and improve our offering.

Provider: Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland ("Google")

Note: It cannot be ruled out that data may also be processed by Google LLC (USA).

Data categories: Usage/interaction data (e.g. page views, clicks, events), technical information (browser, operating system, device/client identifiers), approximate location data; online identifiers (e.g. cookie IDs). The IP address is processed technically; we use data protection-friendly settings (e.g. IP truncation/anonymisation) where supported by Google.

Purposes: Reach measurement, analysis of user behaviour, website optimisation, creation of reports.

Legal basis: Art. 6(1)(a) GDPR in conjunction with Section 165(3) TKG 2021 (consent).

Third country transfer: Possible (especially to the USA). Google LLC is certified under the EU-U.S. Data Privacy Framework.

Storage period: 14 months.

Revocation: You can revoke your consent at any time via "Cookie settings (or "Select cookies")". In addition, Google offers a browser add-on to deactivate Google Analytics.

If you have given your consent, we use Google Ads conversion tracking to measure the effectiveness of our advertisements and optimise campaigns (e.g. whether a specific action is taken after clicking on an advertisement). Cookies/online identifiers may be used and information about your use of our website may be transmitted to Google. A remarketing/retargeting strategy (interest-based advertising based on previous website visits) is not currently used. Should we use remarketing functions in the future, this will only be done with your consent; we will inform you about this in this privacy policy.

In particular, the following services/functions may be used:
Google Ads Conversion Tracking (measurement of conversions/campaign optimisation)

Provider: Google Ireland Limited, Ireland; processing by Google LLC (USA) is possible

Legal basis: Art. 6(1)(a) GDPR in conjunction with Section 165(3) TKG 2021 (consent)

Third country transfer: possible (USA); Google LLC is certified under the EU-U.S. Data Privacy Framework

Revocation/opt-out: You can revoke your consent at any time via the cookie management tool. You can also deactivate personalised advertising in your Google account settings.

We reserve the right to change this privacy policy. We therefore recommend that you read this statement at regular intervals. The changes will not come into effect retroactively and we will not change the way in which previously collected data is treated.

This privacy policy in English is provided as an additional service only. Only the German language version of this privacy policy shall apply and in no event shall the English language version of this privacy policy be construed to modify the German language version of this declaration.