Data protection information of Ski-Club Arlberg GmbH

I. Controller

Personal data is collected and processed under the responsibility of:

Ski-Club Arlberg GmbH
Dorfstraße 46
6580 St. Anton am Arlberg
info@sca-shop.at
+43 5446 2796

II. Purposes and legal basis for data processing

     1. Processing of orders in the web shop

If you make purchases in our web shop, the following data entered by you will be processed by Ski-Club Arlberg GmbH: membership number, title, first and last name, date of birth, delivery address, invoice address, e-mail address, telephone number, payment method, delivery method, order details, individual communication (e.g. via a free text field). The personal data mentioned here are processed for the purpose of contract initiation as well as execution (conclusion of contract, verification of the authorisation to make purchases in our web shop, invoicing, order confirmation), for contract performance (payment, delivery), for processing requests, for fulfilling warranty obligations as well as for legal prosecution. This data processing is necessary for contract performance (Art. 6 par. 1 lit. b GDPR) or is carried out subject to a legal obligation of Ski-Club Arlberg GmbH (Art. 6 par. 1 lit. c GDPR).

     2. Registration (member account)

In order to be able to place orders in our web shop, the members of Ski-Club Arlberg have to register in the web shop by entering the following data: membership number, title, first and last name, address, country, e-mail address, password (encrypted transmission). These data are collected and processed by Ski-Club Arlberg GmbH in order to enable the order process (see point 1) on the basis of the applicable General Terms and Conditions (possibility to order only for members). Furthermore, this also gives you a password-protected direct access to your member account, where you will also get an overview on the orders placed by you. This data processing is necessary for contract performance (Art. 6 par. 1 lit. b GDPR) or are in the overriding legitimate interest of Ski-Club Arlberg GmbH (Art. 6 par. 1 lit. f GDPR; customer service, verification of the authorisation to make purchases via our web shop). You may close your member account at any time by sending an e-mail to info@sca-shop.at. In this case, your data recorded will be erased immediately unless they have to be retained subject to other contractual or statutory provisions.

     3. Payments and collection

After the completion of the order, you may pay either via payment in advance (bank transfer) or via PayPal (also without a PayPal account by indicating your credit card details). If you pay via payment in advance, we process your payment details (account holder, IBAN, BIC, payment amount and reference). This data processing is necessary for processing the payment and therefore for performing the contract (Art. 6 par. 1 lit. b GDPR).For payments via PayPal, you transmit your payment data in an encrypted form and immediately to PayPal (Europe) S.à r.l. et Cie, S.C.A., 22-24 Boulevard Royal, L-2449 Luxembourg. Ski-Club Arlberg GmbH has no access at all to your data in this regard. In this case, the respective Privacy Statement of PayPal, as amended from time to time, is applicable (https://www.paypal.com/at/webapps/mpp/ua/privacy-full?locale.x=de_AT).

Should you default in payment, Ski-Club Arlberg GmbH will commission collection service providers (attorneys-at-law, collection agencies, etc.) for collecting the claims. For this, your personal master data (first name, last name, date of birth), your contact details (e-mail address, telephone number) as well as your order data will be disclosed to these service providers having their seat in the EU. This data processing is carried out for the purpose of law enforcement and is therefore in the overriding legitimate interest of Ski-Club Arlberg GmbH (Art. 6 par. 1 lit. f GDPR).

     4. Visiting the website
     4.1 Server log files
When visiting our website, the following data (partly personal data) are collected in order to display our website (technical functionality) to you and to guarantee stability and security: IP address, date and time of the request, time zone, page visited, access status/HTTP status code, data volume transferred, website sending the request, browser, operating system. These data processing processes are carried out based on our legitimate interest (Art. 6 par. 1 lit. f GDPR) in particular for the efficient and secure provision of the website.

     4.2 Cookies
We use so-called cookies on certain pages to make a visit to our website attractive and to enable the use of specific functions (in particular the order process including “shopping cart”). These are small text files which are stored on your end device. Some of the cookies used by us will be erased at the end of the browser session, thus after your browser has been closed (so-called session cookies). Other cookies remain stored on your end device and make it possible for us or our processors to recognise your browser upon your next visit (persistent cookies). You can set up your browser in such a way that it informs you before cookies are stored and you can decide in the individual case whether they are accepted or you can refuse to accept cookies in certain cases or in general. You will be informed on the use of cookies on our website already when accessing our homepage. Cookies are used based on your consent (Art. 6 par. 1 lit. a GDPR) which you have actively granted via the cookies banner. If cookies are not accepted, the functionality of our website may be limited.

     4.3 Web analysis
Different web analysis tools are used on our website to analyse how our visitors use our website. The web analysis and the use of these advertising tools are carried out based on the necessity of contract performance and provision of the website (Art. 6 par. 1 lit. b GDPR) as well as based on our legitimate interest (Art. 6 par. 1 lit. f GDPR), in particular for the purpose of customer service and for the statistical evaluation of the use of the website. If the processing of your personal data is based on our legitimate interest pursuant to Art. 6 par. 1 lit. f GDPR, you have the right to object at any time on grounds relating to your particular situation. In this regard, please refer to office@skiclubarlberg.at.

     4.3.1 Use of Google Analytics (with anonymization function)
Our website uses Google Analytics, an analysis service provided by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Irland (“Google”). Google Analytics uses cookies to help analyse how the website is used by you. These usage data will, in general, be transferred to a Google server in the USA and be stored there. Due to to the Privacy Shield certification of Google, it is also safeguarded for data transfers to a server outside of the EU that the European data protection law will be complied with. Our website uses Google Analytics with the extension “_anonymizeIp()”, which is why IP addresses will only be further processed in an anonymized form. Google uses the data transferred in order to analyse the website use and to prepare corresponding reports as well as to provide further services with regard to the website and internet use. Ski-Club Arlberg GmbH concluded a supplementary agreement in the sense of Art. 28 of the GDPR with Google and gave detailed instructions on the handling of personal data therein. Your access data and any personal data jointly processed will be erased after 6 months at the latest. You can prevent the storing of cookies either in the cookie bar or by changing your browser settings accordingly. In addition, you can prevent the transmission of the data generated by the cookie to Google by downloading and installing the browser plug-in available under the following link: http://tools.google.com/dlpage/gaoptout?hl=de

     4.3.2 Use of Google reCAPTCHA
We use the Google service reCAPTCHA to verify whether web forms are completed by a human or by a machine (for preventing misuse). For this, your IP address as well as usage and user data are transmitted to Google (Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland) and evaluated by Google. More information about data processing by YouTube can be found here: https://www.google.de/intl/de/policies/privacy/.

     4.3.3 Embedding YouTube videos
Youtube videos are partially embedded in our website. We use the extended data protection mode to prevent that user data are collected by the Google service “YouTube” (Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland) already when accessing our website. According to YouTube, the usage behaviour of the website visitors will then not be monitored for personalizing the video playback. However, YouTube may also, if any, collect usage data with the help of cookies. You can prevent the storing of cookies either in the cookie bar or by changing your browser settings accordingly. More information about data processing by YouTube can be found here: https://www.google.de/intl/de/policies/privacy/. 

5 Contact requests

Within the framework of contacting us (e.g. by means of a contact form, telephone or e-mail), personal data provided by you or transmitted in any other way (e.g. name, address, e-mail, telephone number) will be collected. These data will solely be stored and used for responding to your request or, respectively, for getting in contact with you and for the technical administration related thereto. This data processing is carried out based on your consent (Art. 6 par. 1 lit. a GDPR) or based on our legitimate interests in replying to your request (Art. 6 par. 1 lit. f GDPR). These data will be erased 6 months after the final processing of your request, unless there are legal retention obligations to the contrary. 

6 Applications

If you send us an application, we process the personal data transmitted by you (name, contact details, CV, photographic pictures, etc.) for evaluating your application and, if any, for enabling recruitment of staff. This processing is carried out based on our overriding legitimate interest in implementing an efficient application process (Art. 6 par. 1 lit. f GDPR) as well as on the basis of a necessity to implement pre-contractual measures (Art. 6 par. 1 lit. b GDPR). Your data are retained by us, in general, for 6 months starting from the date the application process is concluded; with your consent, your data are retained for a longer period.

7 Business correspondence

Our business partners also collect and process different personal data. This concerns, for example, name and contact details of the respective contact person, payment data, other contract data, etc. This data processing is necessary for fulfilling a contractual or legal obligation (Art. 6 par. 1 lit. b or lit. c GDPR).

III. Recipients of your data

Although Ski-Club Arlberg GmbH in general does not disclose personal data to third parties, this may be necessary – amongst other things due to legal obligations. Furthermore, we partly consult processors (exclusively within the EU) with which we concluded a respective agreement on commissioned processing pursuant to Art. 28 GDPR.

The data are disclosed by Ski-Club Arlberg GmbH always by strictly taking into account the lawfulness of data disclosure. Data are disclosed to the following recipients or, respectively, categories of recipients:

• shareholders of Ski-Club Arlberg GmbH;

• computer supervisors, operators of IT infrastructure;

• tax advisers, attorneys-at-law, notaries, collection agencies;

• courts, administrative authorities;

• insurances;

• banks and payment service providers;

• print and online media;

• TV broadcasters;

• social media platforms (partially outside of the EU).

IV. Storage duration

Your personal data are in general stored for the duration of our business relation and, beyond that, until the completion of existing or imminent legal disputes (e.g. expiry of the product liability period: 10 years). In the case the order process is cancelled, your data stored with us will be immediately erased. Beyond that, the data will only be processed in accordance with legal retention and documentation obligations. If further data processing is no longer necessary for fulfilling the purposes of the data collection (and if there is no other legal basis for data processing), your personal data will be erased.

 

V. Your data protection rights

The GDPR grants extensive rights to you as “data subject”: you have the right to obtain information on the respective personal data, to rectification or erasure of your personal data and to the restriction of processing. You may revoke the consent granted for data processing at any time vis-à-vis Ski-Club Arlberg GmbH and you may partially also object to the processing of your personal data. Revoking the consent or, respectively, objecting to the data processing, however, does not eliminate other legal bases of data processing. You have furthermore the right to data portability.

Please contact us if you worry that the data protection regulations are violated by Ski-Club Arlberg GmbH. However, you also have the right to file a complaint with the Austrian data protection authority (Datenschutzbehörde) (Barichgasse 40-42, 1030 Vienna, phone: +43 1 521 52-25 69, e-mail: dsb@dsb.gv.at).

St. Anton am Arlberg, on 18-04-2019