Ochrana osobných údajov
Privacy Policy of Bergbahnen Stuhleck GmbH, hereinafter referred to as "Bergbahnen Stuhleck".
1. Scope of application
This privacy policy applies to Bergbahnen Stuhleck GmbH.
2. Purpose of data processing
Bergbahnen Stuhleck processes personal data of employees, partners, customers and suppliers for the purpose of providing business services and fulfilling related legal and contractual requirements.
2.1 Collection of customer data
When purchasing a ticket in the online shop or at our ticket offices, we collect and process - depending on the product - first name, last name, address, telephone number, e-mail address, date of birth and photo for the purpose of processing the booking and payment. The same applies mutatis mutandis to data that we receive in connection with e-mail enquiries, job applications or via one of our contact forms.
2.2 Access control
Please note that for access control purposes, a reference photo of the lift pass holder is taken the first time he/she passes through a turnstile equipped with a camera. This reference photo is compared by the lift personnel with the photos taken each time the lift card holder passes through a turnstile equipped with a camera.
The reference photo is deleted immediately after the lift card expires and the other photos are deleted no later than 30 minutes after each trip through a turnstile.
Please note that it is also possible to purchase lift tickets that are technically configured in such a way that no photo is taken when passing through the turnstile, but that random checks by lift staff must be expected.
2.3 Registration in the Online Shop
When placing an online order, persons create a user account in the Stuhleck Webshop. This also allows access to previous orders. At the same time, the stored data is automatically used for new orders and users do not have to enter their data manually again.
In order to provide these services, we process the personal data that you provide to us during registration or at a later point in time. This includes your name, email address, date of birth, a password of your choice and your address.
You can delete your Stuhleck Webshop user account at any time and we will delete all data that is not subject to a legal obligation to retain.
When you place an order via the Stuhleck Bergbahnen web shop, we process the personal data you provide in the course of the order for invoicing purposes. This includes your name, e-mail address and postal address.
If you place an order via the order form on the Bergbahnen Stuhleck homepage, we process the personal data you provide in the course of placing the order for processing and invoicing purposes. This includes your name, e-mail address, date of birth and address.
2.4 PhotoPoints, SkiMovie and SpeedCheck
There is a PhotoPoint, a SkiMovie track and a SpeedCheck track in the ski area where you can take pictures. When you use these facilities, an up-to-date photo will be taken and, with your permission, published online on the Bergbahnen Stuhleck website.
The PhotoPoints are operated by Alturos Destinations GmbH (Skiline). They are not covered by this privacy statement and are not the responsibility of Bergbahnen Stuhleck. Therefore, Bergbahnen Stuhleck cannot be held liable for the privacy policy of the operator.
You can have your photos deleted at any time. Simply contact Alturos Destinations GmbH (Skiline) at support@skiline.cc.
2.5 Skiline
You can access the external service Skiline via the Website to view your personal height profile. Skiline receives the turnstiles you pass through and your card number in order to create the elevation profile. This means that no personal data is passed on.
When you access the Skiline service via our website, you leave our website and we cannot accept any further liability.
2.6 Applicants
The contact details and application documents submitted as part of an application are processed electronically by us for the purpose of selecting suitable candidates for employment.
If your application is unsuccessful, your details will not be kept on file unless you have consented to this.
2.7 Website & Cookies
2.7.1 IP Address When you visit our website, information is automatically stored on the web server. This includes the browser used, the operating system used, the page from which you accessed our website, the IP address, the time of access and other information. From the perspective of Bergbahnen Stuhleck, this data is anonymous and cannot be attributed to a specific person without further data sources.
Bergbahnen Stuhleck does not evaluate this data, as long as there is no illegal use of the website.
2.7.2 Google Analytics This website uses Google Analytics, a web analytics service provided by Google, Inc. ("Google"). Google Analytics uses "cookies", which are text files placed on your computer, to help the website analyse how users use the site. The information generated by the cookie about your use of this website (including your IP address) will be transmitted to and stored by Google on servers in the United States. Google will use this information for the purpose of evaluating your use of the website, compiling reports on website activity for website operators and providing other services relating to website activity and internet usage. Google may also transfer this information to third parties where required to do so by law, or where such third parties process the information on Google's behalf. Google will not associate your IP address with any other data held by Google. You may refuse the use of cookies by selecting the appropriate settings on your browser, however please note that if you do this you may not be able to use the full functionality of this website. By using this website, you consent to the processing of data about you by Google in the manner and for the purposes set out above.
2.8 Accommodation Brokerage
The data provided in the course of an accommodation/holiday enquiry will be passed on to accommodation providers for the purpose of arranging accommodation.
A full list of recipients can be found in the list of providers: https://www.stuhleck.at/en/skiregion/regionales/unterkuenfte
2.9 Newsletter
If you agree to receive the newsletter, we will use the data provided by you, such as first name, surname, e-mail address and country of origin, to inform you regularly about news from Bergbahnen Stuhleck and current offers.
In order to process the newsletter, the above-mentioned data will be forwarded exclusively to the companies "grafik.at" (Linzer Straße 16/1, 3100 St. Pölten) and "NumBirds CRM GmbH".
If you no longer wish to receive the newsletter, you can unsubscribe at any time. To do so, please use the unsubscribe link contained in each email or contact office@stuhleck.at directly.
2.10 Sweepstakes
From time to time, you may have the opportunity to participate in sweepstakes organised by Bergbahnen Stuhleck. Personal data (e-mail address, name, address) will also be collected and processed for the purposes of these competitions.
The personal data collected in the context of such a competition will be used exclusively for the purpose of carrying out the campaign (in the case of a competition, for example, for determining the prize, notifying the winner and sending the prize). At the end of the campaign, participants' data will be deleted.
Your data collected during the contest will only be used to send you newsletters if you have expressly consented to this.
3. Principles governing the processing of personal data
The processing of personal data is based on strict principles that place the protection and security of the data and the rights of the data subjects at the forefront.
Lawfulness & Transparency Data processing is carried out in a lawful manner and in good faith. The data subject is informed of the intended processing and handling of the data when the data is collected. Data subjects will be informed of at least the following
- Responsible for data processing
- Purpose of data processing
- Legal basis of the processing
You will therefore find brief information on the processing of your data at all our cash desks.
Earmarking
Data will be collected and processed for specified, explicit and legitimate purposes. The data will not be processed in a way that is incompatible with these purposes.
Data minimisation
Only the data that is absolutely necessary for the stated purposes will be collected and processed. Where it is possible to achieve the purpose and the effort is reasonable, only anonymous data will be processed.
Storage limit and deletion
Personal data will be deleted as soon as the purpose for which it was originally collected no longer applies, unless legal retention periods prevent deletion.
If, in individual cases, there are legitimate interests in this data, it will be retained until such time as the legitimate interests have been met.
Data security
Data secrecy applies to personal data. The data will be treated confidentially and protected by appropriate organisational and technical measures against unauthorised access, unlawful manipulation or disclosure, loss and destruction.
Accuracy Personal data shall be kept accurate, complete and up to date. Reasonable steps must be taken to correct outdated, inaccurate or incomplete data.
4. The storage and processing of health data in connection with the demonstration of a low epidemiological risk in accordance with Covid-19-MV.
If, at the time of purchase of the lift pass, it cannot be demonstrated that the conditions for access are fulfilled for the entire period of validity of the lift pass, the guest has the option of either
- Activate the lift pass individually for each day of use by presenting the appropriate proof, in which case the expiry date of the proof of validity will not be stored, or
- agree to the processing and storage of the validity period of the proof, in which case the lift pass can be activated until the expiry date of the proof.
5. Obligation of confidentiality
All employees of Bergbahnen Stuhleck are contractually bound to secrecy and are regularly instructed and trained in the safe handling of personal and other critical data.
6. Data security
The protection of confidentiality, availability and integrity of data is an essential task of Bergbahnen Stuhleck. This applies equally to company secrets, customer data, personal data and other critical information.
To this end, technical and organisational security measures are implemented and continuously improved in accordance with the state of the art and internationally recognised best practices and security standards.
7. Data protection officer
Bergbahnen Stuhleck is not required to appoint a data protection officer, we refer to article 37 paragraph 1 of the EU-DSGVO.
Of course, Bergbahnen Stuhleck is aware of its responsibility in dealing with personal data and takes all necessary measures and regulations to meet this responsibility. Bergbahnen Stuhleck has set itself the task of continuously implementing, checking and improving the defined data protection measures.
8. Rights of data subjects
Every data subject whose personal data is processed by Bergbahnen Stuhleck has the opportunity to invoke and assert his or her own data subject rights at any time.
In order to exercise your rights as a data subject, you can contact us at any time by sending an e-mail to office@stuhleck.at.
Information Data subjects may at any time request to be informed of the personal data relating to them which is being processed and the purposes for which such processing is being carried out.
Correction Data subjects have the right to request that inaccurate personal data concerning them be corrected without delay.
Restriction Data subjects have the right to restrict processing where the accuracy of the data concerning them is contested, the processing is unlawful, the data are no longer needed for processing or the data subjects have objected to the processing.
Data subjects have the right to object at any time to the processing of personal data concerning them.
Data subjects have the right to obtain the personal data concerning them which they have provided to Bergbahnen Stuhleck in a structured, commonly used and machine-readable format. They also have the right to request the transfer of such data to another controller, if technically feasible.
The transferability only applies to personal data processed by automated means.
Erasure - Right to be forgotten
The data subject has the right to request the immediate erasure of personal data concerning him or her if the legal basis for the processing of the data is missing or has ceased to exist, if he or she objects to the processing, if the processing is unlawful, and if no legal retention period prevents erasure.
Data security is also a high priority with regard to the rights of data subjects, which is why the exercise of data subject rights is only possible after the data subject has been unambiguously identified.
You also have the right to complain to the data protection authority at any time.
9. Transfer of data
Personal data will only be transferred in accordance with applicable laws, on a lawful basis and in compliance with the highest standards of confidentiality and data security.
As part of the joint processing of personal data in the cashier and access system, data is exchanged between all the operators of the ski resorts for which the ski pass is valid. The purpose of this data exchange is the joint access control and the management of a comprehensive ski operation.
Bergbahnen Stuhleck uses various order processors. All processors are contractually bound by a processor agreement to comply with the statutory data protection provisions.
Processors involved:
- Skidata Austria GmbH, Hochthronstraße 1-7, 5083 Grödig;
- Alturos Destinations GmbH, Lakeside B03, 9020 Klagenfurt;
- E-Liberty GmbH, Siezenheimer Straße 35, 5020 Salzburg;
- NumBirds CRM GmbH, Brixnerstraße 3/3, 6020 Innsbruck;
- grafik.at, Linzer Straße 16/1, 3100 St. Pölten.
10. Continuous control and improvement
Bergbahnen Stuhleck attaches great importance to the continuous improvement of quality and processes.
Compliance with data protection guidelines and applicable legislation, as well as the effectiveness of data protection and data security measures, are continuously measured and improved in order to guarantee an optimal process of data protection measures.
