Data privacy
Privacy policy of Bergbahnen Stuhleck GmbH, hereinafter referred to as "Bergbahnen Stuhleck".
1. Scope
This privacy policy applies to Bergbahnen Stuhleck GmbH.
2. Purpose of data processing
Bergbahnen Stuhleck processes personal data of employees, partners, customers and suppliers for the purpose of conducting business activities and fulfilling related legal and contractual requirements.
2.1 Collection of customer data When purchasing a ticket in the online shop or at our cash desks, we collect and process - depending on the product - first name, last name, address, telephone number, e-mail address, date of birth and photo for the booking and payment process. The same applies, correspondingly, for data that we receive in the context of e-mail inquiries, applications or through one of our contact forms.
2.2 Access Control Please note that for access control purposes, a reference photo of the lift ticket holder is taken the first time they pass through a turnstile equipped with a camera. This reference photo is compared by lift staff with those photos taken each time the holder passes through a turnstile equipped with a camera.
The reference photo is deleted immediately after the lift ticket's validity expires, other photos are deleted no later than 30 minutes after passing through a turnstile.
Please be aware that it is also possible to purchase lift tickets which are technically configured in such a way that no photo is taken when passing through the turnstile. However, random checks by the lift staff should be expected in this case.
2.3 Online Shop Registration As part of an online order, individuals create a user account in the Stuhleck webshop. This allows them to access their past orders. At the same time, the stored data is automatically used for new orders and users do not have to manually re-enter their data. Alternatively, "guest orders" are also possible - in this case, the data necessary for the order must be re-entered for each order.
To provide these services, we process the personal data that you provide during registration or at a later date. This includes your name, email address, date of birth, a self-chosen password, and your address.
You can delete your Stuhleck webshop user account at any time, and we will delete all data that is not subject to a legal retention obligation.
When placing an order through the Bergbahnen Stuhleck webshop, we process the personal data you provide during the order for invoice preparation. This includes your name, email address and your address.
When placing an order through the order form on the Bergbahnen Stuhleck homepage, we process the personal data you provide during the order for processing and invoice preparation. This includes your name, email address, date of birth, and your address.
2.4 Photopoints, Skimovie and Speedcheck In the ski area, there is a Photopoint, a Skimovie trail, and a Speedcheck trail that you can use to create recordings. By using these facilities, a current recording is made and, with your consent, published online on the Bergbahnen Stuhleck homepage.
The photo points are operated by Alturos Destinations GmbH (Skiline). These are not covered in this privacy policy and are not the responsibility of Bergbahnen Stuhleck. Therefore, Bergbahnen Stuhleck cannot accept liability for the privacy policies of the operator.
You can have the photos you have taken deleted at any time. Please contact Alturos Destinations GmbH (Skiline) at support@skiline.cc for this.
2.5 Skiline Through the website, you can access the external Skiline service to view your personal altitude profile. Skiline receives the turnstiles you have passed through and your card number, to create the altitude profile. As such, no personal data is passed on.
When you access the Skiline service through our website, you leave our web presence and we can't assume any further liability.
2.6 Applicants The contact data and application documents submitted in the course of an application will be processed electronically by us for the purpose of selecting suitable candidates for employment.
In the event of a rejection, the application documents will only be kept on record if you consent to this.
2.7 Website & Cookies
2.7.1 IP Address When you visit our website, information is automatically stored on the web server. This includes the browser used, the operating system in use, which page brought you to our web presence, the IP address, the time of access, and other information. This data is anonymized in the view of Bergbahnen Stuhleck and cannot be uniquely attributed to any individuals without additional data sources.
Bergbahnen Stuhleck does not evaluate this data unless there is unlawful use of the website.
2.7.2 Google Analytics This website uses Google Analytics, a web analysis service provided by Google Inc. ("Google"). Google Analytics uses so-called "cookies", text files that are stored on your computer and that allow an analysis of your use of the website. The information generated by the cookie about your use of this website (including your IP address) is transmitted to a Google server in the USA and stored there. Google will use this information to evaluate your use of the website, to compile reports on website activity for website operators, and to provide other services related to website and internet use. Google may also transfer this information to third parties if required by law or if third parties process this data on behalf of Google. Under no circumstances will Google associate your IP address with other Google data. You can prevent the installation of cookies by adjusting your browser software accordingly; however, we would like to point out that in this case you may not be able to use all functions of this website to their full extent. By using this website, you agree to the processing of data collected about you by Google in the manner and for the purposes set out above.
2.8 Accommodation Referral The data provided during an accommodation/vacation request will be forwarded to the accommodation providers for the purpose of arranging accommodations.
A complete list of the recipients can be found in the list of providers: http://www.stuhleck.at/go/unterkuenfte
2.9 Newsletter With your consent to receive the newsletter, we will use the data you have specified such as first name, last name, email address, and country of origin to keep you regularly informed about news from Stuhleck Cableways and current offers.
For the processing of the newsletter dispatch, the above mentioned data will be exclusively passed on to the companies "grafik.at" (Linzer Straße 16/1, 3100 St. Pölten) and "NumBirds CRM GmbH".
If you no longer wish to receive the newsletter, you can object to this at any time and unsubscribe from this service by clicking on the unsubscribe link in our newsletters.
2.10 Competitions From time to time, you have the opportunity to participate in competitions from Stuhleck Cableways. As part of these actions, personal data (email address, name, address) will also be collected and processed for the purpose of handling the competition.
The personal data collected in the course of a competition is used exclusively for the execution of the action (in the case of a competition, for example, for determining the winner, notifying the winner, and sending the prize). After the end of the action, the participant's data will be deleted.
Your data collected during the competition will only be used for receiving newsletters if you have explicitly consented to this.
3. Principles of Personal Data Processing
The processing of personal data is based on strict principles, which regard the protection and security of data and the rights of the data subjects as the highest goods.
Legality & Transparency Data processing takes place in a legal manner, in good faith. The data subject will be informed about the planned processing and the handling of data when the data is collected. This way, data subjects are informed about at least the following points:
- The controller of data processing
- The purpose of data processing
- The legal basis for processing
At all of our checkouts, you will find brief information on the processing of the data collected from you.
Purpose limitation The data is collected and processed for specified, explicit and legitimate purposes. The data is not processed in a manner inconsistent with these purposes.
Data Minimisation Only data that is strictly necessary for the stated purposes is collected and processed. If it is possible to achieve the purpose and the effort is reasonable, only anonymised data is processed.
Storage Limitation and Deletion Personal data is deleted as soon as the purpose for which it was originally collected expires and legal retention periods do not prevent deletion.
If, in individual cases, there are legitimate interests in this data, it will continue to be stored until the legitimate interest has been legally clarified.
Data Security Data secrecy applies to personal data. The data must be handled confidentially and is protected by appropriate organisational and technical measures against unauthorised access, unlawful manipulation or disclosure, as well as from loss and destruction.
Accurate Data Personal data must be kept accurate, complete and up-to-date. Appropriate measures are taken to correct outdated, incorrect or incomplete data.
4. Commitment to Data Secrecy
All employees of Stuhleck Mountain Railways are contractually obliged to maintain confidentiality and are regularly trained and reminded of the secure handling of personal and other critical data.
5. Data Security
The protection of confidentiality, availability, and integrity of data is an essential task of Stuhleck Mountain Railways. This applies equally to trade secrets, customer data, personal data, and other critical information.
For this purpose, technical and organizational security measures are established and continuously improved using the latest technology and internationally recognized best practices, as well as security standards.
6. Data Protection Officer
Stuhleck Mountain Railways is not under the necessity to designate a data protection officer, in this regard we refer to Article 37, paragraph 1 of the EU-GDPR.
Of course, Stuhleck Mountain Railways is aware of its responsibility in handling personal data and takes all necessary measures and regulations to meet this. Stuhleck Mountain Railways has taken it upon itself to continuously implement, check, and improve the established data protection measures.
7. Rights of the Data Subjects
Every person concerned, whose personal data is processed by Bergbahnen Stuhleck, has the ability to invoke and enforce their own rights of the data subjects at any time.
You can exercise your data subject rights at any time by emailing office@stuhleck.at.
Information Affected individuals can ask at any time what personal data is processed about them and what the purpose of this processing is.
Correction Affected individuals have the right to request the immediate correction of incorrect personal data about them.
Restriction Affected persons have the right to the restriction of processing if the accuracy of the data concerning them is disputed, the processing is unlawful, the data is no longer needed for processing or the persons concerned have objected to the processing.
Revocation Affected persons have the right to object at any time to the processing of personal data concerning them.
Transferability Data subjects have the right to receive the personal data concerning them, which they have provided to Bergbahnen Stuhleck, in a structured, commonly used, and machine-readable format. They also have the right to request the transfer of this data to another controller, if technically feasible.
Transferability only applies to personal data processed using automated procedures.
Deletion - Right to be Forgotten The data subject has the right to request the immediate deletion of personal data concerning them if the legal basis for processing the data is lacking or is withdrawn, if the processing of data is objected to, if the processing of data is unlawful and no legal retention periods make deletion impossible.
Data security also has a high priority in relation to the rights of data subjects, so the enforcement of data subject rights is only possible after a doubtless identification of the data subject.
You also have the right to complain to the data protection authority at any time.
8. Data Transmission
The transmission of personal data only takes place in accordance with applicable laws and on a lawful basis, while maintaining the highest confidentiality and data security.
As part of the joint processing of personal data in the cash desk and access system, a data exchange takes place between all operator companies of the ski regions in which the ski card is valid. This data exchange serves the purpose of joint access control and the handling of an overarching ski operation.
Bergbahnen Stuhleck uses various processors. All processors are contractually obligated to comply with the legally applicable data protection regulations by a processor agreement.
Involved processors:
Skidata Austria GmbH, Hochthronstraße 1-7, 5083 Grödig
Alturos Destinations GmbH, Lakeside B03, 9020 Klagenfurt
E-Liberty GmbH, Siezenheimer Straße 35, 5020 Salzburg
Numbirds CRM GmbH, Brixnerstraße 3/3, 6020 Innsbruck
grafik.at, Linzer Straße 16/1, 3100 St. Pölten
Intermaps Software AG, Schönbrunner Str. 80/6m 1050 Wien
9. Continuous control and improvement
The continuous improvement of quality and processes is of very high importance at Bergbahnen Stuhleck.
Compliance with data protection guidelines as well as current legislation and the effectiveness of data protection and data security measures are continuously monitored and enhanced to ensure optimal implementation of data protection measures.
