Introduction:
This data protection declaration serves as general information on who processes which data for which purpose and on which legal basis this is done. It is merely information that does not require a declaration of intent by the data subject and does not constitute the content of a contract.
1. registration/login to the online store
With only one store user account at "Friends of the Mountains" you have access to the ticket stores of "Annaberger Lifte", "Erlebnisalm Mönichkirchen", "Hochkar Bergbahnen" and "Ötscherlifte". In order to be able to place orders or buy tickets in the ticket stores, registration or login with customer data is required.
The ticket stores are operated by the respective mountain railroad companies as responsible persons within the meaning of the GDPR. The respective company has commissioned the operating company of the "Friends of the Mountains", which is ecoplus Alpin GmbH, Niederösterreich-Ring 2, 3100 St. Pölten, which carries out this data processing on behalf of the responsible persons, by means of a commissioned data processing agreement (Art 28 GDPR).
In order to provide these services (processing purpose), the personal data disclosed by you in the course of the application/registration or at a later point in time will be processed. This includes the name, e-mail address, your date of birth, gender, a self-selected password and your address (if applicable, a different delivery address) and optionally a telephone number, as well as their license plate number when purchasing a parking ticket.
If you only place an order or book a service in the store of a mountain railroad, the data will not be passed on to the other stores. Only if you also place an order or book a service in another store, the relevant order data is also available in this store.
The data is also stored so that you can access past orders. At the same time, the stored master data is automatically used for new orders and you do not have to enter your data manually again.
In order to be able to carry out the registration technically, we have commissioned the service provider "Auth-Zero" and concluded an order data processing contract.
2. ticket orders in the online store
For the purpose of providing contractual services as well as their payment and execution in the context of online ticket purchases, your personal master data, contractual and payment data as well as communication data (IP address and server log files) will be processed on the basis of the legal basis of contract performance and the legal obligation for invoicing and archiving.
This data is stored for as long as required by the purpose or as long as required by legal regulations (storage of invoices according to § 132 BAO for 7 years) or this data is required on the basis of the legal basis of legitimate interest to defend against possible warranty / or liability claims. If you cancel the order process, the data will be stored for 24 hours to clarify possible problems, especially technical problems, during the order process.
You have no obligation to enter your personal data. Failure to enter your data will only mean that your bookings / orders cannot be processed in the Online Ticket Shop.
In the Online Ticket Shop, you also have the option of purchasing tickets for other persons by entering their name and birth data.
To process orders for season tickets, multi-day and day tickets in the online stores, we use the system of the service provider "Pricenow" (Pricenow AG, Ogimatte 7, 3713 Reichenbach im Kandertal - CH). The use of this service provider is based on the legal basis of contract performance. An order data processing contract has been concluded with Pricenow in accordance with Art 28 GDPR.
In order to be able to place orders in the online ticket stores, title, first and last name, address, e-mail address, date of birth, if applicable a portrait photo, if applicable a license plate number as well as information on the desired tickets are required. The processing and storage of the data is carried out for the purpose of providing contractual services or fulfilling pre-contractual services on the basis of the legal grounds of Art. 6 (1) lit. b DSGVO (ordering of mountain railway tickets and vouchers) and Art. 6 (1) lit. c GDPR (legally required retention periods for accounting documents).
The use of corresponding online booking software is based on the legal basis of our legitimate interest. Our legitimate interest lies in a quick, non-local possibility to provide you with transport tickets.
For the creation of the tickets, we have commissioned the company Kubeos, based in Salzburg (Austria), with the technical implementation and have concluded a commissioned data processing agreement in accordance with Art. 28 GDPR.
As your contractual partner, we have a legitimate interest in improving and optimizing our products and services as purchased by you or similar products and services. In order to achieve this goal, feedback from our customers is an essential part, as this is the only way we can get a direct impression of the mountain experiences we have had. We would therefore like to point out that we use the e-mail address given in the online shop for customer surveys about our own products and services.
If you do not want this use of data, you can object here by sending an email to office@annabergerlifte.at and using the following text:
"I hereby object to the use of my e-mail address and my contract data (including the associated payment data) [please enter the e-mail address here] for the purpose of customer surveys to improve the products and services I have purchased and similar products and services from the Annaberger Liftbetriebs- Gesellschaft m.b.H."
3. external payment service providers
In order to be able to carry out the payment of the order transactions, external payment service providers are used on the basis of the legal basis of the fulfillment of the contract, through whose own platforms you can make your payments. The electronic transmission of the disclosed data takes place via a secure procedure (SSL). Nevertheless, the seller cannot assume any liability for attacks on data or systems. The payment data entered by you in the context of the order, such as account numbers, credit card numbers including check digits, passwords / TANs, etc. are processed exclusively by the payment service providers and are not visible to the store operators. The store operators only receive confirmation from the payment service providers that the payment has been made or information if the payment could not be made.
Further information on data protection and the terms and conditions of the payment service providers can be found at:
https://www.payone.com/AT-de/datenschutz
https://eps-ueberweisung.at/de/datenschutzhinweis
https://www.datatrans.ch/de/datenschutzbestimmungen
4. deletion of the user account
You can delete your user account at any time and we will delete all data that is not subject to a legal obligation to retain. If you delete your user account data, you will no longer be able to access it or make ticket purchases. To delete your user account, please send an e-mail to the mail address displayed in the respective store. Your deletion request will then be processed and the deletion will be carried out, unless there is a valid legal reason against the partial or complete deletion. Note: If you have an active booking or order, deletion is not possible until the booking/order has been consumed.
5. parking management GDPR notes
These notes describe how we Annaberger Liftbetriebs-Gesellschaft m.b.H., Annarotte 126, 3222 Annaberg process your personal data in connection with our parking management (pursuant to Art. 13 para. 1 GDPR)
5.1 Purposes of data processing
We will process your personal data for the following purposes:
(a) parking management, including automating and expediting the service for vehicles for which a parking ticket has been booked).
c) control of parking regulations (e.g. parking over two spaces)
d) control of legally compliant use of the parking ticket (e.g. exceeding the allowed parking time)
e) Protection of the facilities (e.g. vandalism)
f) documentation, investigation and prosecution (law enforcement) of improper use of parking spaces (e.g. use of parking spaces without payment)
g) re-parking of motor vehicles
We collect this data by means of:
5.2 Legal basis of the processing
For the billing of parking fees in connection with the parking ticket, the legal basis is the fulfillment of the contract (Art. 6 para. 1 lit. b GDPR).
For the registration of license plates in connection with our parking management, the legal basis is the legitimate interest of the controller (Art. 6 (1) (f) GDPR), which is to achieve the purposes stated above under point 1 (a to g). You have the right to object to this data processing in accordance with Art. 21 (1) GDPR if you have reasons arising from your particular situation.
For the recognition of individual license plates to automate and accelerate the service for whitelisted vehicles, the legal basis is the legitimate interest of the controller (Art. 6 (1) (f) GDPR), which is to efficiently implement our parking management.
5.3 Transfer of your personal data.
For the above-mentioned purposes, your personal data will be processed or transmitted to the following recipients - if the occasion arises:
5.4 Storage period
a) Customer data:
Your personal data will only be stored by us for as long as is necessary for the fulfillment of the contract in order to achieve the purposes stated under point 1:
- See Data Protection Shop
b) Image processing ("video surveillance"):
Recorded data (license plates) are deleted after 48h at the latest, unless they are needed for a specific reason to achieve the underlying protection or preservation of evidence purposes.
In principle, we try to store as little as possible. Normally only for the time that a license plate is present. I.e. capture entry -> capture exit -> then the license plate is deleted.
In control cases, this is buffered to 24, so that the movements can also be traced. So -> Entry capture -> Exit capture + 24 hours -> then the license plate is deleted.
For the case that a license plate does not leave, there is a definable maximum parking time. Here 48 hours are stored. I.e. a license plate that has not moved out by then or where perhaps the exit was not recognized, remains only 48 hours in the system.
The only exceptions are "registered" license plates (long-term parkers, employees) and license plates with a still valid ticket (see Privacy Shop). Permanent parkers remain stored indefinitely until revoked, those with ticket of course as long as the ticket goes, including the above rules.
5.5 Your rights in connection with personal data You have the rights to information, correction, deletion, restriction, data portability and objection. To do so, please contact us. If you believe that the processing of your data violates data protection law or your data protection rights have otherwise been violated in any way, you can complain to the data protection authority. If the processing is based on your consent, you can revoke it at any time.
Privacy Policy Newsletter
If you agree to receive the newsletter from "Friends of the Mountains", we will use the data you provide, such as title, first name, last name and e-mail address, to keep you regularly informed about news from the region and current offers. The legal basis for this processing of your personal data is your express consent, which we obtain in the "double opt in procedure". In order to process the newsletter dispatch, the data listed above is passed on exclusively to the company starmate solutions GmbHHörvelsinger Weg 29-31, 8c9081 Ulm, Germany, which operates the e-marketing suite on our behalf. With the help of starmate solutions GmbH, we can analyze our newsletter campaigns. When a sent newsletter email is opened, a connection is established with the servers. This allows us to determine whether a newsletter message has been opened and which links, if any, have been clicked. The purpose of these analyses is to better adapt future newsletters to the interests of the recipients, especially to determine which ski resorts are of particular interest. In addition, technical information such as the time of the retrieval, the IP address, browser type and operating system of the recipient are registered. We have concluded a processor agreement with starmate solutions GmbH iSd. Art. 28 GDPR to ensure that your data is only processed to the extent desired by us and permitted by you. If you no longer wish to receive the newsletter, you can object to this at any time. To do so, you can use the unsubscribe link included in every email or contact us directly at info@freundederberge.at.
Data protection information (freundederberge.at)
6. external links
For your optimal information, you will find links on our pages that refer to pages of third parties. As far as such links are not obviously recognizable, we point out that it is an external link. As the responsible party, we have no influence whatsoever on the content and design of these pages of other providers and therefore accept no liability for the content of the websites or URLs of other operators linked to this website. Likewise, we are not liable for the functioning of links of any kind.
In the case of links to other online offers, we assume no liability for the content, functionality and availability of the linked website(s). This also applies to all other direct or indirect references or links to external Internet offers.
7. your rights under the GDPR and the DPA
Pursuant to the General Data Protection Regulation and the Data Protection Act, you as a data subject of data processing have the following rights and remedies:
Right to information
As a data subject of data processing, you have the right to request information as to whether and, if so, which personal data about you are being processed. For your own protection - to ensure that no third party receives information about your data - it may be necessary for us to verify their identity in an appropriate form.
Right to rectification and deletion
You have the right to request without undue delay the rectification of any inaccurate personal data concerning you or - taking into account the purposes of the data processing - the completion of any incomplete personal data, as well as the deletion of your data.
Right to restriction of processing
You have the right to restrict the processing of all personal data collected. As of the restriction request, this data will only be processed with individual consent or to assert and enforce legal claims.
Right to data portability
You may request the transfer of personal data collected by us to a third party.
Right to object
You may object at any time, on grounds relating to your particular situation, to the processing of personal data concerning you which is necessary for the purposes of protecting the legitimate interests of the controller or of a third party. After the objection, your data will no longer be processed unless there are compelling legitimate grounds for the processing which override your interests, rights and freedoms, or the processing serves to assert, exercise or defend legal claims.
Status 06.02.2025
