Data Privacy Statement - Bergbahnen Sölden

General

For the present data processing, the following persons (together referred to as “Bergbahnen Sölden”) act as data controllers, whereby they partly act as “joint controllers” in the sense of Art. 26 GDPR:

Ötztaler Gletscherbahn Gesellschaft m.b.H. & Co KG. Sölden-Tirol
FN 21369a
Skiliftgesellschaft Sölden-Hochsölden GmbH
FN 37680m
Schilifte Gampe, Ötztaler Gletscherbahn KG
FN 19665w

Dorfstrasse 115
6450 Sölden
+43 (0) 5254 508 0
bergbahnen@soelden.com

Single contact point/contact/data protection officer
Pursuant to Art. 26 GDPR, the single contact point for your questions, complaints, etc. is

Ötztaler Gletscherbahn Gesellschaft m.b.H. & Co KG. Sölden-Tirol Dorfstrasse 115
6450 Sölden
+43 (0) 5254 508 0
datenschutz@soelden.com

Bergbahnen Sölden are not obliged to designate a data protection officer, we refer in this regard to Art. 37 par. 1 EU GDPR. However, Bergbahnen Sölden are aware of their responsibility when handling personal data and we take all necessary measures and make all necessary regulations in this regard in order to fulfil this responsibility.

Description of the joint processing

• Personal data entered/provided by you are treated by one of the data controllers mentioned above depending on request, place of collection (e.g. depending on the ski pass office, online or on site). The data collected when purchasing a ticket are entered into the joint ticket system and, by doing so, are made available also to the other data controllers. This is necessary for contract performance (Art. 6 par. 1 lit. b GDPR) or is in the overriding interest of the data controllers (data exchange between the associated companies, Art. 6 par. 1 lit. f GDPR).
• Any and all rights of the data subject (see below) are assumed – provided that the data processing is subject to this data protection declaration – by Ötztaler Gletscherbahn Gesellschaft m.b.H. & Co KG. Sölden-Tirol. Please contact us at datenschutz@soelden.com.
• The single contact point for your questions, complaints, etc. is, pursuant to Art. 26 GDPR, Ötztaler Gletscherbahn Gesellschaft m.b.H. & Co KG. Sölden-Tirol.
• The data subjects are informed pursuant to Art. 13 and 14 GDPR jointly by the data controllers, in particular my means of this data protection declaration; in addition, we also separately inform on “online data processing” (see “privacy policy – websites”) together with Ötztal Tourismus.
• The due involvement of processors (evaluation, conclusion of processor agreements, instructions, etc.) is carried out for all data controllers by Ötztaler Gletscherbahn Gesellschaft m.b.H. & Co KG Sölden-Tirol.
• All data controllers shall autonomously comply with the following obligations under the GDPR: assessing the necessity of as well as carrying out the data privacy impact assessment, if any; complying with the principles of data processing; keeping processing records; collaborating with supervisory authorities; reporting data protection violations; designating a data protection officer, if any.

Bergbahnen Sölden take the protection of your personal data very seriously. We treat your personal data as confidential and in accordance with the applicable data protection provisions as well as with this data protection declaration. Personal data (e.g. name, e-mail address, telephone number, etc.) are processed and transmitted by the data controller in a lawful manner only. The legal basis is specified in the respective individual processing operations.

Notwithstanding the deletion details indicated in the individual data processing, the deletion is omitted insofar as the personal data are used for other lawful processing (e.g. self-promotion) pursuant to this data protection declaration.

When purchasing a ticket in the online shop or at our ticket offices, we collect and process the following personal data depending on the respective product: first name, last name, address, telephone number, e-mail address, date of birth, photograph, payment/credit card data, confirmation of principal residence, citizenship, employer, disabled identification card. These data are only treated to the extent that is actually necessary for implementing the ticket purchase or for providing the required service. Most of these data are therefore only collected and processed when purchasing a season pass or discounted tickets. Pursuant to Art. 6 par. 1 lit. b GDPR, this data processing is necessary for contract performance or, respectively, for implementing pre-contractual measures. Data are additionally processed within the framework of our legal retention obligation (Art. 6 par. 1 lit. c GDPR). Data processing is partially also based on your (express) consent (Art. 6 par. 1 lit. a., Art. 9 par. 2 lit. a GDPR).

We would like to point out that your address as well as your photographic picture are automatically deleted 300 days after the expiry of the validity of the season pass (etc.) and that the accesses are anonymized. By doing so, the purchasers of a season pass (etc.) can purchase a pass once again in the following year without there being any need to enter these data anew and to provide the photographic picture again or, respectively, to have it taken again. This data processing is carried out in the overriding legitimate interest of Bergbahnen Sölden (Art. 6 par. 1 lit. f GDPR), especially as this is ultimately service for usability and customer loyalty purposes.

When refunding tickets based on our Terms and Conditions, health data may be potentially also processed in addition (medical certificate/operation log of the ski patrol). This is exclusively based on your express consent to short-term data processing (Art. 6 par. 1 lit. a, Art. 9 par. 2 lit. a GDPR).

If you additionally register as a user when purchasing a ticket online, clause ### of the “privacy policy – websites” shall also apply.

When contacting Bergbahnen Sölden, e.g. via e-mail, telephone or on site, the following details are partially processed to deal with the request as well as for answering any follow-up questions: title, first and last name, e-mail address, telephone number, street, zip code, country. Furthermore, other data provided in relation to the request are processed. The collected personal data are deleted by the operator in general within 12 months after the processing of the request has been completed. In case of contract conclusion, the data are deleted after expiry of the relevant periods for warranty, guarantee or damages claims or after expiry of the legal retention periods.

The personal data divulged by the user will only be processed by the operator insofar as this is actually necessary for processing the request and/or for providing the required service. Pursuant to Art. 6 par. 1 lit. b GDPR, this data processing is necessary for contract performance or, respectively, for implementing pre-contractual measures. Data processing is partially also carried out in the overriding legitimate interest of Bergbahnen Sölden (Art. 6 par. 1 lit. f GDPR – in particular customer service, grant of loyalty discounts, defence against liability claims).

We would like to point out that for the purpose of access control, a reference photo of the lift ticket holder is taken when he/she first passes through a turnstile equipped with a camera. This reference photo will be compared by the lift personnel to the photos that are taken each time the lift ticket holder passes through a turnstile equipped with a camera. The reference photo is deleted immediately after expiry of the validity of the lift ticket, the other photos are deleted at the latest 30 minutes after having passed through the respective turnstile. The registered data are stored in encrypted form.

We would like to point out that there is also the possibility to purchase one-day tickets that are technically configured in a special way, whereby no photo is taken when passing through a turnstile, however, in this case, spot-checks carried out by the lift personnel should be expected.

This data processing is carried out for the purpose of access control and is therefore necessary for contract performance (Art. 6 par. 1 lit. b GDPR) or is in the overriding interest of Bergbahnen Sölden (Art. 6 par. 1 lit. f GDPR – in particular prevention of abuse).

In several places throughout the ski area, the users have the possibility to have their photo taken or to be filmed at so-called “photopoints”. The photographic pictures are only taken after prior activation of the self-timer mechanism by the user. Any and all photopoints are operated by independent partner companies (in particular Alturos Destinations GmbH, Lakeside B03, A-9020 Klagenfurt [hereinafter: “Skiline”]). Bergbahnen Sölden do not have any access to the data collected and processed which is why these data are not within the responsibility of Bergbahnen Sölden. Bergbahnen Sölden are therefore unable to assume liability for the respective operator’s compliance with the data protection provisions.

If the user gives his/her separate consent for this purpose (Art. 6 par. 1 lit. a GDPR, sec. 12 par. 2 cl. 2 of the Austrian Data Protection Act (Datenschutzgesetz, DSG)) (e.g. when participating in the “Adrenalin Cup”), Bergbahnen Sölden get access to these data and the photographic pictures taken are made available on the internet to the user and also to the public. The user will be separately informed on this data processing when giving his/her consent. The photographic pictures taken and the other data (date when taken, etc.) are published on the internet and therefore worldwide. As a consequence, the data are also transferred to third countries (outside of the EU) and are made available to the public there. In such third countries, the data protection level might possibly not correspond to the one practised in Austria and there might not be an adequacy decision pursuant to Art. 45 GDPR or, respectively, no suitable safeguards pursuant to Art. 46 GDPR might possibly exist. Effective and independent monitoring of data protection as well as enforcing data protection rights of data subjects are potentially not safeguarded there. You may revoke your consent to the respective data processing at any time. For this purpose, please contact us at datenschutz@soelden.com and we will delete the photographic pictures – on which you are depicted – indicated by you from our system as well as from our homepage.

You can reach the external service “Skiline” through our website as well as at own machines in the ski area. With this service, you can get an overview about your skiing or other activity (vertical metres, tracks, kilometres of slopes, etc.). These data are collected by Bergbahnen Sölden based on access control (passing through turnstiles with a lift ticket) and are anonymously transmitted to “Skiline” when the customer logs into the “Skiline” system. For creating the ski profile, “Skiline” only receives the data of the turnstiles passed through as well as the respective ticket number. Therefore, no personal data are disclosed. Insofar as establishing a connection between a person and their data were possible within the sphere of Bergbahnen Sölden, processing is carried out in the overriding interest of Bergbahnen Sölden in providing the activity information solely to the customer having the respective ticket number (Art. 6 par. 1 lit. f GDPR). When accessing the Skiline service, you leave our websites. We cannot assume liability for further data processing.

In the case of a separate consent given to “Skiline” (Art. 6 par. 1 lit. a GDPR), your data collected with “Skiline” are also transmitted to Bergbahnen Sölden and are processed there for direct marketing measures. The user will be separately informed on this data processing when giving his/her consent.

In case of an accident in the ski area, the following data might partially be collected by our employees for medical care, documentation and invoicing purposes: name, address, date of birth, contact details, holiday address, initial assessment of the injury, accident site, date, time, ticket number, photographic pictures.

These data might also be disclosed to other persons involved in the medical care (emergency doctor, hospital, etc.). The accident report drawn up might possibly be disclosed to the competent authorities and, if need be, also to insurances (exclusively for claims adjustment) or to our legal advisers. In the event of accidents and disruptions in connection with lift systems, the cable car operators must, under certain conditions, immediately report such to the respectively competent authority depending on the type of cable car (sec. 104 par. 2 of the Austrian Cable Car Act (Seilbahngesetz, SeilbG) 2003 in connection with the Austrian Reporting Ordinance Regarding Cable Car Accidents and Disruptions (Meldeverordnung, Melde-VO) 2006. In this case too, personal data might possibly be transmitted to the authorities.

These processing operations are carried out based on your consent (Art. 6 par. 1 lit. a GDPR) or are necessary for contract performance (Art. 6 par. 1 lit. b GDPR) or for safeguarding vital interests of a natural person (Art. 6 par. 1 lit. d, Art. 9 par. 2 lit. c GDPR). Data processing is partially also carried out based on a legal obligation (Art. 6 par. 1 lit. c GDPR) or on overriding interests (Art. 6 par. 1 lit. f GDPR) of Bergbahnen Sölden (e.g. defence against liability claims, recital 52).

In the ski area of Bergbahnen Sölden there is the possibility to connect to the internet with mobile end devices via free Wi-Fi hot spots. To use this service it is necessary to register with your name, your e-mail address as well as your telephone number. These Wi-Fi hot spots are operated by independent partner companies (in particular LOOP21 Mobile Net GmbH). Bergbahnen Sölden do not have any access to the data collected and processed which is why these data are not within the responsibility of Bergbahnen Sölden. Bergbahnen Sölden are therefore unable to assume liability for the respective operator’s compliance with the data protection provisions.

If the user gives his/her separate consent for this purpose (Art. 6 par. 1 lit. a GDPR), Bergbahnen Sölden get access to the name indicated by you and to the e-mail address provided. These data are then processed for direct marketing measures. The user will be separately informed on this data processing when giving his/her consent.

Together with your consent to be given separately (Art. 6 par. 1 lit. a GDPR), a personal user account is also created and your data are also used for purposes of direct marketing and transmitted to our partners and processors (for more information thereon, please refer to “privacy policy – websites”).

For the purpose of protecting the integrity of employees and users of Bergbahnen Sölden as well as of own and third-party property and for documenting potential liability cases, sections in the vicinity of Bergbahnen Sölden are under video surveillance. In this regard, photographic pictures as well as the place and time of image are recorded. The data are in general deleted after 72 hours at the latest, when needed for the duration of the procedure is conducted. When needed, the data are transmitted to competent authorities or, respectively, courts, insurances (exclusively for the handling of insurance claims) or to other bodies for the purpose of law enforcement (e.g. attorney-at-law). This data processing is carried out based on our legitimate interest in the protection of our property and for the safety of the users (Art. 6 par. 1 lit. f GDPR, sec. 12 par. 2 cl. 4 of the Austrian Data Protection Act (DSG)).

Bergbahnen Sölden also act as organisers of different events (e.g. sporting events). If you register for such an event, we process the personal data provided by you as well as any personal data which might be obtained during the event. Data processing is carried out for processing your registration, for holding the event as well as for documentation and public communication of the event including the respective results. This processing is carried out based on your consent (Art. 6 par. 1 lit. a GDPR), the necessity for contract performance (Art. 6 par. 1 lit. b GDPR) or based on our legitimate interests in holding the event and in its public communication (Art. 6 par. 1 lit. f GDPR).

Photos and videos on which the participants, assistants and the audience are depicted might partially be shot during our events. These photographic pictures are processed together with information regarding the image (e.g. event, place, date, name and contact details of the persons depicted) on the one hand for internal documentation and on the other hand for the public communication of the event. For this purpose, photographic pictures might be made available to the public (also outside of the EU where a lower data protection level might exist) in print and online media, in TV formats and on social media. This data processing is carried out based on our legitimate interests in holding the events and in their public communication (Art. 6 par. 1 lit. f GDPR, sec. 12 par. 2 cl. 4 of the Austrian Data Protection Act (DSG)) or based on any consent given (Art. 6 par. 1 lit. a GDPR, sec. 12 par. 2 cl. 2 of the Austrian Data Protection Act (DSG)). You are not obliged to have yourself photographed. If possible, please tell the photographers and videographers that you do not wish to have yourself photographed or filmed already before the photographic pictures are taken. In the sense of Art. 21 par. 1 GDPR, you may at any time object (on particular grounds) to the processing of the photographic pictures on which you can be recognised and appear in a prominent way. Bergbahnen Sölden will work towards getting the photographic pictures concerned erased/anonymized, if possible.

If you send us an application, we process the personal data transmitted by you (name, contact details, CV, photographic pictures, etc.) for evaluating your application and, if any, for enabling recruitment of staff. This processing is carried out based on our overriding legitimate interest in implementing an efficient application process (Art. 6 par. 1 lit. f GDPR) as well as on the basis of a necessity to implement pre-contractual measures (Art. 6 par. 1 lit. b GDPR). Your data are retained by us in general for 6 months starting from the date the application process is concluded; with your consent, your data are retained for a longer period (your application will then be kept on record).

Our business partners also collect and process different personal data. This concerns, for example, name and contact details of the respective contact person, payment data, other contractual data, etc. This data processing is necessary for fulfilling a contractual or legal obligation (Art. 6 par. 1 lit. b or lit. c GDPR).

Provided that the lawfulness for concrete data processing is based on the data subject’s consent, this consent may at any time be revoked (also partially) by sending an e-mail to datenschutz@soelden.com. This might make the further use of our services impossible.

Furthermore, each data subject has the right to obtain information on personal data concerning him/her, the right to data portability, the right to have personal data rectified or deleted as well as the right to have the processing of his/her personal data restricted or to object to such processing (Art. 21 GDPR). The data subject may exercise these rights by sending a written request including a respective proof of identity (photographic picture) to the single contact point mentioned above.

Please contact us if you worry that the data protection regulations are violated by the operators. However, you also have the right to lodge a complaint with the Austrian Data Protection Authority (Barichgasse 40-42, 1080 Vienna, dsb@dsb.gv.at, www.dsb.gv.at).

Your personal data are stored until the expiry of the legal retention periods respectively applicable and, beyond that, until the expiry of the relevant periods for warranty, guarantee or damages. After the expiry of these periods, your data are deleted as a matter of routine, unless another legal basis for the further processing exists (e.g. your consent pursuant to Art. 6 par. 1 lit. a GDPR).

Personal data are only transmitted in accordance with applicable laws and on a lawful basis as well as in compliance with the strictest confidentiality and data protection.

Within the framework of the joint processing of personal data concerning the general business object of Bergbahnen Sölden, data are exchanged between the data controllers mentioned above.

Within the framework of the joint processing of personal data concerning the operation of our websites as well as the implementation of marketing measures, data are exchanged between Bergbahnen Sölden and Ötztal Tourismus. For further details thereon, please refer to the “privacy policy – websites”.

Furthermore, when purchasing a ticket which is valid for several ski areas, the data necessary for using the ticket and for preventing abuse are transmitted to the operating companies of those ski areas where the ticket is valid. This exchange of data serves the purpose of joint access control and the implementation of a comprehensive skiing operation; data processing is therefore necessary for contract performance and is in the overriding interest of Bergbahnen Sölden (Art. 6 par. 1 lit. b as well as lit. f GDPR).

In the course of data processing, Bergbahnen Sölden might forward the personal data also to the processors which should possibly be consulted within the EU. In order to safeguard your data protection rights, a processor agreement pursuant to Art. 28 GDPR was concluded with the processors.

On a case-by-case basis, personal data are transmitted to the following categories of recipients:

• administrative bodies, authorities (including customs, interest representatives)
• banks
• IT service providers (e.g. “Skidata”)
• business partners, distribution partners (e.g. “OPOS-Betriebe”), suppliers
• collection, attorneys-at-law, courts, public accountants
• customers
• leasing companies
• travel service providers (hotels, etc.)
• funding bodies
• insurances (only when needed)

Sölden, on 04.09.2018