Data Privacy Statement

The following data protection declaration shall give you an overview about what happens to your personal data and what kind of protection we offer when you use the services of Liftgesellschaften Obergurgl-Hochgurgl. This data protection declaration applies in particular when purchasing of a lift ticket (including online ticket), of any other admission ticket or of a gift voucher (hereinafter simply referred to as “ticket”) as well as, in general, to the use of the lifts and gondolas.

When using our websites (except for the online ticket/gift voucher shop), when contacting us via online contact forms, when participating in prize games as well as in regard to questions on the receipt of our newsletter, please observe the separate “privacy policy – websites”

Websites Privacy Policy gurgl.com

Websites Privacy Policy liftgesellschaft.at

Ötztal Tourismus Privacy Policy

General

For the present data processing, the following persons (together referred to as “Liftgesellschaften Obergurgl-Hochgurgl”) act as data controllers, whereby they partly act as “joint controllers” in the sense of Art. 26 GDPR:

Liftgesellschaft Obergurgl, Gesellschaft m.b.H.

TOP EXPRESS Seilbahnen Gurgl GmbH & Co. KG

Hochgurgler Lift-Gesellschaft m.b.H. & Co. KG.

Gurglerstraße 93
6450 Sölden
+43 (0) 5254 508 0
bergbahnen@soelden.com

Single contact point/contact/data protection officer
Pursuant to Art. 26 GDPR, the single contact point for your questions, complaints regarding Liftgesellschaft Obergurgl, etc. is

Liftgesellschaft Obergurgl, Gesellschaft m.b.H.
Gurglerstraße 93
6456 Obergurgl
T +43 (0) 5256 6260

Data protection officer:
Coach2profit GmbH
Janic Straub
datenschutz@liftgesellschaft.at

Liftgesellschaft Obergurgl are not obliged to designate a data protection officer, we refer in this regard to Art. 37 par. 1 EU GDPR. However, Liftgesellschaften Obergurgl-Hochgurgl are aware of their responsibility when handling personal data and we take all necessary measures and make all necessary regulations in this regard in order to fulfil this responsibility.

Description of the joint processing

• Personal data entered/provided by you are treated by one of the data controllers mentioned above depending on request, place of collection (e.g. depending on the ski pass office, online or on site). The data collected when purchasing a ticket are entered into the joint ticket system and, by doing so, are made available also to the other data controllers. This is necessary for contract performance (Art. 6 par. 1 lit. b GDPR) or is in the overriding interest of the data controllers (data exchange between the associated companies, Art. 6 par. 1 lit. f GDPR).
• Any and all rights of the data subject (see below) are assumed – provided that the data processing is subject to this data protection declaration – by Liftgesellschaft Obergurgl, Gesellschaft m.b.H. Please contact us at .
• The single contact point for your questions, complaints, etc. is, pursuant to Art. 26 GDPR, Liftgesellschaft Obergurgl, Gesellschaft m.b.H.
• The data subjects are informed pursuant to Art. 13 and 14 GDPR jointly by the data controllers, in particular my means of this data protection declaration; in addition, we also separately inform on “online data processing” (see “privacy policy – websites”) together with Ötztal Tourismus.
• The due involvement of processors (evaluation, conclusion of processor agreements, instructions, etc.) is carried out for all data controllers by Liftgesellschaft Obergurgl, Gesellschaft m.b.H.
• All data controllers shall autonomously comply with the following obligations under the GDPR: assessing the necessity of as well as carrying out the data privacy impact assessment, if any; complying with the principles of data processing; keeping processing records; collaborating with supervisory authorities; reporting data protection violations; designating a data protection officer, if any.

Liftgesellschaften Obergurgl-Hochgurgl take the protection of your personal data very seriously. We treat your personal data as confidential and in accordance with the applicable data protection provisions as well as with this data protection declaration. Personal data (e.g. name, e-mail address, telephone number, etc.) are processed and transmitted by the data controller in a lawful manner only. The legal basis is specified in the respective individual processing operations.

Notwithstanding the deletion details indicated in the individual data processing, the deletion is omitted insofar as the personal data are used for other lawful processing (e.g. self-promotion) pursuant to this data protection declaration.

When purchasing a ticket in the online shop or at our ticket offices, we collect and process the following personal data depending on the respective product: first name, last name, address, telephone number, e-mail address, date of birth, photograph, payment/credit card data, confirmation of principal residence, citizenship, employer, disabled identification card. These data are only treated to the extent that is actually necessary for implementing the ticket purchase or for providing the required service. Most of these data are therefore only collected and processed when purchasing a season pass or discounted tickets. Pursuant to Art. 6 par. 1 lit. b GDPR, this data processing is necessary for contract performance or, respectively, for implementing pre-contractual measures. Data are additionally processed within the framework of our legal retention obligation (Art. 6 par. 1 lit. c GDPR). Data processing is partially also based on your (express) consent (Art. 6 par. 1 lit. a., Art. 9 par. 2 lit. a GDPR).

We would like to point out that your address as well as your photographic picture are automatically deleted 300 days after the expiry of the validity of the season pass (etc.) and that the accesses are anonymized. By doing so, the purchasers of a season pass (etc.) can purchase a pass once again in the following year without there being any need to enter these data anew and to provide the photographic picture again or, respectively, to have it taken again. This data processing is carried out in the overriding legitimate interest of Liftgesellschaft Obergurgl, Gesellschaft m.b.H (Art. 6 par. 1 lit. f GDPR), especially as this is ultimately service for usability and customer loyalty purposes.

When refunding tickets based on our Terms and Conditions, health data may be potentially also processed in addition (medical certificate/operation log of the ski patrol). This is exclusively based on your express consent to short-term data processing (Art. 6 par. 1 lit. a, Art. 9 par. 2 lit. a GDPR).

When contacting Liftgesellschaft Obergurgl, Gesellschaft m.b.H., e.g. via e-mail, telephone or on site, the following details are partially processed to deal with the request as well as for answering any follow-up questions: title, first and last name, e-mail address, telephone number, street, zip code, country. Furthermore, other data provided in relation to the request are processed. The collected personal data are deleted by the operator in general within 12 months after the processing of the request has been completed. In case of contract conclusion, the data are deleted after expiry of the relevant periods for warranty, guarantee or damages claims or after expiry of the legal retention periods.

The personal data divulged by the user will only be processed by the operator insofar as this is actually necessary for processing the request and/or for providing the required service. Pursuant to Art. 6 par. 1 lit. b GDPR, this data processing is necessary for contract performance or, respectively, for implementing pre-contractual measures. Data processing is partially also carried out in the overriding legitimate interest of Liftgesellschaft Obergurgl, Gesellschaft m.b.H. (Art. 6 par. 1 lit. f GDPR – in particular customer service, grant of loyalty discounts, defence against liability claims).

We would like to point out that for the purpose of access control, a reference photo of the lift ticket holder is taken when he/she first passes through a turnstile equipped with a camera. This reference photo will be compared by the lift personnel to the photos that are taken each time the lift ticket holder passes through a turnstile equipped with a camera. The reference photo is deleted immediately after expiry of the validity of the lift ticket, the other photos are deleted at the latest 30 minutes after having passed through the respective turnstile. The registered data are stored in encrypted form.

We would like to point out that there is also the possibility to purchase one-day tickets that are technically configured in a special way, whereby no photo is taken when passing through a turnstile, however, in this case, spot-checks carried out by the lift personnel should be expected.

This data processing is carried out for the purpose of access control and is therefore necessary for contract performance (Art. 6 par. 1 lit. b GDPR) or is in the overriding interest of Liftgesellschaft Obergurgl, Gesellschaft m.b.H. (Art. 6 par. 1 lit. f GDPR – in particular prevention of abuse).

In case of an accident in the ski area, the following data might partially be collected by our employees for medical care, documentation and invoicing purposes: name, address, date of birth, contact details, holiday address, initial assessment of the injury, accident site, date, time, ticket number, photographic pictures.

These data might also be disclosed to other persons involved in the medical care (emergency doctor, hospital, etc.). The accident report drawn up might possibly be disclosed to the competent authorities and, if need be, also to insurances (exclusively for claims adjustment) or to our legal advisers. In the event of accidents and disruptions in connection with lift systems, the cable car operators must, under certain conditions, immediately report such to the respectively competent authority depending on the type of cable car (sec. 104 par. 2 of the Austrian Cable Car Act (Seilbahngesetz, SeilbG) 2003 in connection with the Austrian Reporting Ordinance Regarding Cable Car Accidents and Disruptions (Meldeverordnung, Melde-VO) 2006. In this case too, personal data might possibly be transmitted to the authorities.

These processing operations are carried out based on your consent (Art. 6 par. 1 lit. a GDPR) or are necessary for contract performance (Art. 6 par. 1 lit. b GDPR) or for safeguarding vital interests of a natural person (Art. 6 par. 1 lit. d, Art. 9 par. 2 lit. c GDPR). Data processing is partially also carried out based on a legal obligation (Art. 6 par. 1 lit. c GDPR) or on overriding interests (Art. 6 par. 1 lit. f GDPR) of Bergbahnen Sölden (e.g. defence against liability claims, recital 52).

In the ski area of Liftgesellschaften Obergurgl-Hochgurgl there is the possibility to connect to the internet with mobile end devices via free Wi-Fi hot spots. To use this service it is necessary to register with your name, your e-mail address as well as your telephone number. These Wi-Fi hot spots are operated by independent partner companies (in particular LOOP21 Mobile Net GmbH). Liftgesellschaften Obergurgl-Hochgurgl do not have any access to the data collected and processed which is why these data are not within the responsibility of Liftgesellschaften Obergurgl-Hochgurgl. Liftgesellschaften Obergurgl-Hochgurgl are therefore unable to assume liability for the respective operator’s compliance with the data protection provisions.

If the user gives his/her separate consent for this purpose (Art. 6 par. 1 lit. a GDPR),Liftgesellschaften Obergurgl-Hochgurgl get access to the name indicated by you and to the e-mail address provided. These data are then processed for direct marketing measures. The user will be separately informed on this data processing when giving his/her consent.

Together with your consent to be given separately (Art. 6 par. 1 lit. a GDPR), a personal user account is also created and your data are also used for purposes of direct marketing and transmitted to our partners and processors.

Liftgesellschaften Obergurgl-Hochgurgl also act as organisers of different events (e.g. sporting events). If you register for such an event, we process the personal data provided by you as well as any personal data which might be obtained during the event. Data processing is carried out for processing your registration, for holding the event as well as for documentation and public communication of the event including the respective results. This processing is carried out based on your consent (Art. 6 par. 1 lit. a GDPR), the necessity for contract performance (Art. 6 par. 1 lit. b GDPR) or based on our legitimate interests in holding the event and in its public communication (Art. 6 par. 1 lit. f GDPR).

Photos and videos on which the participants, assistants and the audience are depicted might partially be shot during our events. These photographic pictures are processed together with information regarding the image (e.g. event, place, date, name and contact details of the persons depicted) on the one hand for internal documentation and on the other hand for the public communication of the event. For this purpose, photographic pictures might be made available to the public (also outside of the EU where a lower data protection level might exist) in print and online media, in TV formats and on social media. This data processing is carried out based on our legitimate interests in holding the events and in their public communication (Art. 6 par. 1 lit. f GDPR, sec. 12 par. 2 cl. 4 of the Austrian Data Protection Act (DSG)) or based on any consent given (Art. 6 par. 1 lit. a GDPR, sec. 12 par. 2 cl. 2 of the Austrian Data Protection Act (DSG)). You are not obliged to have yourself photographed. If possible, please tell the photographers and videographers that you do not wish to have yourself photographed or filmed already before the photographic pictures are taken. In the sense of Art. 21 par. 1 GDPR, you may at any time object (on particular grounds) to the processing of the photographic pictures on which you can be recognised and appear in a prominent way. Liftgesellschaften Obergurgl-Hochgurgl will work towards getting the photographic pictures concerned erased/anonymized, if possible.

If you send us an application, we process the personal data transmitted by you (name, contact details, CV, photographic pictures, etc.) for evaluating your application and, if any, for enabling recruitment of staff. This processing is carried out based on our overriding legitimate interest in implementing an efficient application process (Art. 6 par. 1 lit. f GDPR) as well as on the basis of a necessity to implement pre-contractual measures (Art. 6 par. 1 lit. b GDPR). Your data are retained by us in general for 6 months starting from the date the application process is concluded; with your consent, your data are retained for a longer period (your application will then be kept on record).

Our business partners also collect and process different personal data. This concerns, for example, name and contact details of the respective contact person, payment data, other contractual data, etc. This data processing is necessary for fulfilling a contractual or legal obligation (Art. 6 par. 1 lit. b or lit. c GDPR).

Provided that the lawfulness for concrete data processing is based on the data subject’s consent, this consent may at any time be revoked (also partially) by sending an e-mail to datenschutz@liftgesellschaft.at. This might make the further use of our services impossible.

Furthermore, each data subject has the right to obtain information on personal data concerning him/her, the right to data portability, the right to have personal data rectified or deleted as well as the right to have the processing of his/her personal data restricted or to object to such processing (Art. 21 GDPR). The data subject may exercise these rights by sending a written request including a respective proof of identity (photographic picture) to the single contact point mentioned above.

Please contact us if you worry that the data protection regulations are violated by the operators. However, you also have the right to lodge a complaint with our data protection officer Janic Straub (datenschutz@liftgesellschaft.at) or with the Austrian Data Protection Authority (Barichgasse 40-42, 1080 Vienna).

Your personal data are stored until the expiry of the legal retention periods respectively applicable and, beyond that, until the expiry of the relevant periods for warranty, guarantee or damages. After the expiry of these periods, your data are deleted as a matter of routine, unless another legal basis for the further processing exists (e.g. your consent pursuant to Art. 6 par. 1 lit. a GDPR).

Personal data are only transmitted in accordance with applicable laws and on a lawful basis as well as in compliance with the strictest confidentiality and data protection.

Within the framework of the joint processing of personal data concerning the general business object of Liftgesellschaften Obergurgl-Hochgurgl, data are exchanged between the data controllers mentioned above.

Within the framework of the joint processing of personal data concerning the operation of our websites as well as the implementation of marketing measures, data are exchanged between Liftgesellschaften Obergurgl-Hochgurgl and Ötztal Tourismus. For further details thereon, please refer to the “privacy policy – websites”.

Furthermore, when purchasing a ticket which is valid for several ski areas, the data necessary for using the ticket and for preventing abuse are transmitted to the operating companies of those ski areas where the ticket is valid. This exchange of data serves the purpose of joint access control and the implementation of a comprehensive skiing operation; data processing is therefore necessary for contract performance and is in the overriding interest of Liftgesellschaften Obergurgl-Hochgurgl (Art. 6 par. 1 lit. b as well as lit. f GDPR).

In the course of data processing, Liftgesellschaften Obergurgl-Hochgurgl might forward the personal data also to the processors which should possibly be consulted within the EU. In order to safeguard your data protection rights, a processor agreement pursuant to Art. 28 GDPR was concluded with the processors.

On a case-by-case basis, personal data are transmitted to the following categories of recipients:

• administrative bodies, authorities (including customs, interest representatives)
• banks
• IT service providers (e.g. “Skidata”)
• business partners, distribution partners (e.g. “OPOS-Betriebe”), suppliers
• collection, attorneys-at-law, courts, public accountants
• customers
• leasing companies
• travel service providers (hotels, etc.)
• funding bodies
• insurances (only when needed)