The controller (as defined in Art. 4(7) of the GDPR) responsible for the processing of your personal data (personal data as defined in Art. 4(1) of the GDPR) is:

Hinterstoder-Wurzeralm Bergbahnen AG

Hinterstoder 21
A-4573 Hinterstoder
Tel. +43 7564 5275
Fax +43 (0)7564 5275 130
Email: info@hiwu.at
Website: www.hiwu.at

Commercial Register No. 184867 p, VAT ID ATU 47573807

Data Protection Officer:
Hinterstoder-Wurzeralm Bergbahnen AG is not required to appoint a data protection officer; in this regard, we refer to Article 37, Paragraph 1 of the EU GDPR. Of course, Hinterstoder-Wurzeralm Bergbahnen AG is aware of its responsibility in handling personal data and takes all necessary measures and implements all necessary regulations to fulfill this responsibility. Hinterstoder-Wurzeralm Bergbahnen AG is committed to continuously implementing, reviewing, and improving the established data protection measures.
Rights of Data Subjects: Any data subject whose personal data is processed by Vereinigte Bergbahnen Gesellschaft mbH has the right at any time to invoke and exercise their rights as a data subject. To exercise your rights as a data subject, you may contact us at any time in writing via email at info@hiwu.at.

Purposes of Processing
The purposes of processing your personal data generally stem from our business activities as a mountain railway: providing our online services, processing inquiries, orders, and reservations, accounting, and communicating with business partners and customers. For detailed information on the purposes of processing and, where applicable, on further processing for other compatible purposes, as well as on the categories of data processed, please refer to the detailed descriptions of the individual data processing procedures.

General Categories of Data

• Personal Master Data (e.g., name, date of birth and age, address)
• Contact data (e.g., email address, phone number, fax number)
• Communication data (time and content of communication)
• Order or booking data (e.g., goods ordered or services requested, and billing data such as service period, payment method, invoice date, tax identification number, etc.)
• Payment data (e.g., account number, credit card information)
• Contract data (contents of contracts of any kind)
• Web usage data (e.g., server data, log files, and cookies)

Special categories of data (“sensitive data”) pursuant to Art. 9 GDPR

• Health data (only if you provide this to us through your explicit consent to process your request (e.g., arranging a hotel specializing in guests with food intolerances or allergies))

Legal Basis for Processing
In general, there is no obligation to provide the data described in this Privacy Policy. Failure to provide this data simply means that we cannot offer these services. The legal basis for processing your personal data, which is necessary to fulfill a contract with you or an order you have placed with us, is Article 6(1)(b) of the GDPR. To the extent that the processing of personal data is necessary for us to comply with a legal obligation (accounting obligations, bookkeeping obligations, or other statutory documentation requirements), Article 6(1)(c) of the GDPR serves as the legal basis. If we process your data to perform tasks entrusted to us in the public interest (“official acts”), the legal basis is Article 6(1)(e) of the GDPR. If the processing is necessary to protect a legitimate interest of our company or a third party, and your interests, fundamental rights, and fundamental freedoms do not override our interest, Article 6(1)(f) of the GDPR (“legitimate interest”) serves as the legal basis for the processing. In this case, we will also inform you of our legitimate interests. To the extent that we have no other legal basis for the processing of personal data as explained above, we will ask for your consent to the data processing.

We process your personal data with the assistance of data processors who help us provide our services. These data processors are bound by a corresponding agreement with us, in accordance with Article 28 of the GDPR, to strictly protect your personal data and may not process your personal data for any purpose other than to provide our services. Please refer to the detailed descriptions of the individual data processing operations to identify which data processors are involved. Your personal data may be disclosed to service providers typical in our industry—such as banks, tax advisors, or auditors—other than our data processors. Personal data is transferred to government agencies and authorities only as required by mandatory national laws. Depending on your request (e.g., for bookings and inquiries), your personal data will be transferred—exclusively to the extent necessary—to hotel partners or other tourism service providers (members of our organization) that are required to fulfill your request. The personal data transferred varies depending on the service.

As a general rule, we process your personal data within the EU. If we process data in a third country (i.e., outside the European Union (EU) or the European Economic Area (EEA)), or if this occurs in connection with the use of services provided by our processors or third parties, we do so only if the requirements of Art. 44 et seq. of the GDPR for transfers to third countries are met: that is, on the basis of specific safeguards, such as an officially recognized determination that a level of data protection equivalent to that of the EU exists, or in compliance with officially recognized contractual obligations, the so-called “EU Standard Contractual Clauses.” If we rely on the EU Standard Contractual Clauses as the legal basis for the transfer of your personal data, we will additionally assess the permissibility of this data transfer as part of a comprehensive risk assessment. Should we reach a negative conclusion in this assessment, we will not transfer this data to a third country without your explicit consent pursuant to Article 49(1)(a) of the GDPR.

We will delete your personal data as soon as the purpose for which we collected it no longer applies. Data may also be retained if we continue to process it for a purpose compatible with the original one. It may also be retained if required by laws, regulations, or other rules to which our company is subject.

We collect your personal data exclusively from you and do not use any other data sources.

We do not use any automated decision-making or profiling processes that have legal effects on you or similarly significantly affect you. However, with your consent, we will use your usage data to better understand your interests and thereby display information that may be of interest to you, provide you with personalized offers, or display relevant information to you on third-party websites or social media platforms.

Under the GDPR, you generally have the right to access, rectify, erase, and restrict the processing of your personal data. If the legal basis for the processing of your personal data is your consent or a contract concluded with you, you also have the right to data portability. You have the right to withdraw any consent you may have given for the processing of your personal data. The lawfulness of the processing of your personal data up to the time of withdrawal remains unaffected. You have the right to object to the processing of your personal data for the purpose of direct marketing. If you object, your personal data will no longer be processed for the purpose of direct marketing. A detailed explanation of these rights can be found in Chapter III of the GDPR. Right to lodge a complaint. If you believe that the processing of your data violates data protection law or that your data protection rights have otherwise been infringed, you may file a complaint with the competent supervisory authority. In Austria, this is the Data Protection Authority (Wickenburggasse 8, 1080 Vienna, email: dsb@dsb.gv.at).

Right to File a Complaint
If you believe that the processing of your data violates data protection law or that your data protection rights have otherwise been infringed, you may file a complaint with the competent supervisory authority. In Austria, this is the Data Protection Authority (Barichgasse 40-42, A-1030 Vienna, email: dsb@dsb.gv.at).

In addition to our website, we maintain an online presence on social networks and platforms. The legal basis for using these services is our legitimate interest pursuant to Article 6(1)(f) of the GDPR. Our legitimate interest lies in communicating with customers and business partners who are active on these platforms and in informing them about our services via these networks. When accessing the respective networks and platforms, the terms of service and privacy policies of the respective operators of these networks apply. Further information regarding the processing of your personal data by the respective providers of these services (which personal data is processed for what purposes and on what legal basis, how long this data is stored by the respective provider, and, where applicable, details regarding profiling and transfers to third countries) can be found below in the descriptions of the individual services or via the information links provided there.

Facebook Fan Page
We operate a Facebook Fan Page on the “Facebook” platform operated by Meta Platforms Ireland Ltd. (4 Grand Canal Square, Grand Canal Harbor, Dublin 2, Ireland). The legal basis for processing the associated personal data is our legitimate interest within the meaning of Article 6(1)(f) of the GDPR. Our legitimate interest lies in providing customers and potential new customers with information about us and our offerings through this information channel. Please note that you use this Facebook page and its features at your own risk. This applies in particular to the use of interactive features (e.g., commenting, sharing, rating). When you visit our Facebook page, Facebook collects, among other things, your IP address as well as additional information gathered via cookies or other tracking technologies. The data collected about you in this context is processed by Facebook and may be transferred (at least in part) to the United States. Facebook / Meta is a certified partner of the EU-U.S. Data Privacy Framework. The legal basis for data transfers to the United States (at least in some cases) is thus an adequacy decision by the European Commission within the meaning of Article 45(3) of the GDPR, by which the European Commission certifies that the United States provides an adequate level of data protection. The Court of Justice of the European Union (CJEU) has ruled that “Facebook” and the operators of a Facebook fan page process this personal data as joint controllers within the meaning of Article 26 of the GDPR. Facebook makes the joint data processing agreement available at the following link: www.facebook.com/legal/terms/page_controller_addendum. As the operators of our fan page, we have no influence over the specific terms of the agreement. Facebook describes in general terms in its Data Use Policies what information Facebook receives and how it is used (including how Facebook uses data from visits to Facebook pages for its own purposes, to what extent activities on the Facebook page are attributed to individual users to personalize content or advertising, how long Facebook stores this data, whether data from a visit to the Facebook page is shared with third parties, and much more). There you will also find information on how to contact Facebook and on the settings options for advertisements. The Privacy Policy is available at the following link: https://www.facebook.com/privacy/policy/. As fan page administrators, we do not receive any additional (non-public) information about individual Facebook users from Facebook’s analytics; rather, we receive only statistically processed information (e.g., total number of page views, page activity, post reach, etc.) that helps us make our posts more engaging.

Instagram
Instagram is an online service for sharing photos and videos. We have a profile (account) on Instagram. The provider is Meta Platforms Ireland Ltd. (4 Grand Canal Square, Grand Canal Harbour, Dublin 2, Ireland). For more information about the processing of your personal data when using Instagram, as well as contact information, please visit: privacycenter.instagram.com/policy/

Pinterest
Pinterest is a combination of a social network and a search engine that focuses on visual content, namely images and videos. We use this service to generate interest in other content of ours on the Internet (particularly our website) through so-called “Pins.” The provider of this service is Pinterest Europe Ltd. (Palmerston House, 2nd Floor, Fenian Street, Dublin 2, Ireland). For more information about the processing of your personal data through the use of Pinterest, as well as contact information, please visit: policy.pinterest.com/de/terms-of-service.

TikTok
TikTok is a video platform for short videos that also offers social networking features. We use this service to generate interest in our offerings through short videos. The provider is TikTok Technology Ltd. (10 Earlsfort Terrace, Dublin, D02 T380, Ireland). For more information on the processing of your personal data through the use of TikTok, as well as contact information, please visit: www.tiktok.com/legal/privacy-policy-eea.

LinkedIn
We use the web-based social networking service LinkedIn primarily to stay in touch with business partners. The provider is LinkedIn Ireland Unlimited Company (Wilton Place, Dublin 2, Ireland). For more information about the processing of your personal data through the use of LinkedIn, as well as contact information, please visit: de.linkedin.com/legal/privacy-policy.

YouTube
We use a YouTube channel on the “YouTube” video portal to publish our videos. The service provider is Google Ireland Limited (Gordon House, Barrow Street, Dublin 4, Ireland). For more information about the processing of your personal data through the use of YouTube, as well as contact information, please visit: www.google.com/policies/privacy/.

The contact information and application documents you submit to us as part of a job application are processed by us exclusively internally for the purpose of selecting suitable candidates for employment. There is no legal or contractual obligation to provide personal data. Failure to provide this information simply means that you will not be able to submit your application and we will not be able to process it. The personal data provided in this context will be stored by us in accordance with legal requirements for a maximum of 6 months; if the applicant expressly consents to having their documents retained on file, the documents will be stored for a maximum of 2 years.

The personal data you provide to participate in our sweepstakes (email address, name, mailing address) will be used by us solely to determine a winner, notify the winner of the prize, and send the prize. Your data will not be shared with third parties. The legal basis for processing your personal data is the performance of a contract pursuant to Article 6(1)(b) of the GDPR. There is no legal or contractual obligation to provide personal data. Failure to provide the data will simply result in your inability to participate in the sweepstakes. Your data will be stored for the duration of the sweepstakes and—for the purpose of processing any claims for prizes or damages—for a maximum of 3 years thereafter, after which it will be deleted.

At events, we may take photos and videos of the event—or have them taken by photographers we hire—in which you, as a participant, are recognizable. We need these photos and videos to document and promote our events and will therefore publish them in our media (e.g., print brochures, website, and social media) and make them available to other media outlets (print and online) for the purpose of promoting our events. You are under no legal or contractual obligation to provide this data. The legal basis for processing your personal data (images and videos in which you are recognizable) is our legitimate interest pursuant to Art. 6(1)(f) of the GDPR.  Our legitimate interest lies in our right to conduct public relations activities (presenting our activities) and to promote our events. You have the right to object to this processing. Please send your objection to the email address provided in this Privacy Policy. However, it can be assumed that our aforementioned interest in using the photos does not unduly infringe upon your rights as the person depicted. This is particularly true since we take these photos/videos in public spaces and provide advance notice of the creation and use of the photos/videos prior to each event. We also always take care to ensure that no legitimate interests of the individuals depicted are infringed upon. Should your personal rights and freedoms be infringed upon by an image or video we have created for reasons warranting special consideration, we will refrain from further processing or publication. Removal from print media that has already been distributed is not possible. In this case, however, we will delete the content from our website or our social media channels. We generally delete photos and videos from events when we no longer need them for documenting and promoting those events.

feratel Guest Card System
To enable you to use our AlpineCard, we process your personal data (first name, last name, date of birth, and country of origin/zip code) with the assistance of our service provider, feratel Media Technologies AG (Maria-Theresien-Straße 8, A-6020 Innsbruck), for the purpose of providing you with the benefits of the card. Furthermore, it is necessary to store your usage data for billing purposes and to make this data available to our service providers for the purpose of verifying internal billing. The legal basis for this processing is your consent pursuant to Art. 6(1)(a), which you provide to us when purchasing the Card. You may revoke this consent at any time free of charge. Usage data already collected will remain stored for billing purposes and will not be affected by this revocation. There is no legal or contractual obligation to provide personal data. Failure to provide this data simply means that we cannot issue the AlpineCard to you. We have entered into a corresponding agreement with feratel as a data processor pursuant to Article 28 of the GDPR, which ensures that your data is processed exclusively within the scope of our mandate. For more information on feratel’s data protection practices, please visit: www.feratel.com/datenschutz.html.