Privacy Policy for the Aktivpass & arena365 Member Card

Depending on the user group and the transaction, we process the following categories of personal data:

• Identification and contact data, including, in particular, name, user ID, date of birth or age group (if applicable), address, email address, and phone number
• Stay and authorization data, including, in particular, accommodation provider, check-in and check-out dates, user group, and participation requirements
• Card and activation data, in particular card or AktivPass ID, product, rate plan, scope of services, status, and validity period
• Usage and scan data, in particular card or token ID, scan time, service provider or service location, service, authorization status, and scan result
• Contract, payment, and billing data, including, in particular, product, price, payment method, transaction reference, payment status, invoice, and refund
• Support, complaint, suspension, and misuse data, including, in particular, inquiry, correspondence, error or loss report, relevant verification data, reason for suspension, and processing result 
• Technical log data to the extent necessary for operation, troubleshooting, and security

We receive the data directly from you or your representative, from your participating lodging provider, from the respective service provider, or from the scan and AktivPass system, as well as—in the case of direct purchases or refunds—from payment service providers or banks. Data from publicly available sources is generally not collected for the AktivPass.

Personal data is disclosed—to the extent necessary—to the following categories of recipients:

• Authorized internal departments of TVB Tiroler Zugspitz Arena
• Participating lodging establishments and the respective service providers
• Processors for AktivPass, ticketing, scanning, hosting, support, communication, and payment services
• Banks, tax advisors, auditors, and legal counsel
• Government agencies, courts, or other authorities, if required by a legal obligation or a specific legal matter

Transfers to third countries: No transfers to recipients outside the European Union/European Economic Area are planned.

are stored until the end of the AktivPass’s validity period and until the necessary billing, corrections, complaints, or fraud investigations have been completed. Afterward, they are deleted or anonymized, unless a longer statutory obligation or a specific legal case precludes this.

• Active pass and authorization data: for the duration of validity and necessary operational processing
• After expiration: necessary contract and supporting documentation retained as working data for up to 3 years to defend against claims, unless a shorter period is sufficient or longer statutory/procedural requirements apply
• Tax and accounting-related documents: 7 years from the end of the relevant calendar year; longer if required for pending proceedings
• Copies of identification documents: no retention planned; documents submitted temporarily must be returned after verification; only the required verification result is stored
• Backups: Deletion according to a documented backup cycle

are stored in a personally identifiable form for as long as they are necessary for authorization checks, billing, error resolution, complaints, or a specific case of misuse. Afterward, they are deleted or anonymized.

• Online validation response: for the transaction or short-term error handling
• Identifiable raw scan logs: valid until the end of the passport’s validity period plus 90 days; for annual passes, alternatively a maximum of 12 months after expiration
• Case-specific data on open complaints or misuse
• Billing-related statements/receipts: 7 years, insofar as they are part of tax or accounting records
• Anonymized/aggregated statistics: without personal reference, indefinitely

are stored until the transaction is completed and thereafter for the duration of the retention or statute of limitations periods.

• Unconfirmed automated notifications/false alarms: generally 30 days after completion
• Confirmed cases of misuse and account suspensions: until the end of the suspension or the passport’s validity period, and thereafter generally up to 3 years, to the extent necessary for legal claims
• Court/administrative proceedings: until a final and binding decision is reached and the relevant retention/statute of limitations periods have expired

Bookkeeping and accounting records are generally retained for seven years from the end of the calendar year to which they relate. In the case of pending tax proceedings, the retention period is correspondingly longer.

The mandatory information marked for issuance, activation, authorization verification, and use is required for the AktivPass. For a direct purchase, the information required for the contract, payment, and invoice must also be provided. Without this data, the AktivPass cannot be issued, activated, used, replaced, or purchased—or at least not in full.

When scanned, the system automatically checks whether the AktivPass is valid and activated for the service in question. No decision is made solely by automated means within the meaning of Article 22 of the DSGVO. A long-term suspension or exclusion due to misuse is reviewed by an authorized person.

In accordance with legal requirements, you have the right to access, rectification, erasure, restriction of processing, and—to the extent that the processing is based on a contract and is carried out by automated means—data portability.

To the extent that the processing is based on Art. 6 Abs. 1 lit. e DSGVO, you may object at any time on grounds relating to your particular situation. TVB Tiroler Zugspitz Arena will then no longer process the data, unless compelling legitimate grounds or legal claims require further processing.

To exercise your rights, please contact TVB Tiroler Zugspitz Arena or our Data Protection Officer. (Contact information: see above)

In addition, you have the right to lodge a complaint with a data protection supervisory authority. In Austria, this is the Austrian Data Protection Authority, Barichgasse 40–42, 1030 Vienna. The authority can be reached by email at dsb@dsb.gv.at.