Privacy Policy Online Shop
This privacy policy serves as general information about who processes what data for what purpose and on what legal basis. It is purely informational, does not require a declaration of intent from the data subject, and does not constitute a contract.
1. Registration/Login in the Online Shop
With just one shop user account at "Freunde der Berge" you have access to the ticket shops of "Annaberger Lifte," "Erlebnisalm Mönichkirchen," "Hochkar Bergbahnen," and "Ötscherlifte." To place orders or purchase tickets in the ticket shops, registration or login with customer data is required.
The ticket shops are operated by the respective mountain railway companies as data controllers under the GDPR. Each company has commissioned the operator company of "Freunde der Berge" which is ecoplus Alpin GmbH, Niederösterreich-Ring 2, 3100 St. Pölten, to perform these data processing operations on behalf of the data controllers through a data processing agreement (Art. 28 GDPR).
To provide these services (processing purpose), the personal data you provide during registration or at a later date is processed. This includes your name, email address, date of birth, gender, a self-selected password, your address (possibly a different delivery address), and optionally a telephone number, as well as your license plate when purchasing a parking ticket.
If you only place an order or book a service in one mountain railway's shop, the data will not be shared with the other shops. Only when you place an order or book a service in another shop will the relevant order data be available in that shop as well.
The data is also stored so that you can access past orders. At the same time, the stored master data is automatically used for new orders, so you do not need to manually enter your data again.
To technically carry out the registration, we have engaged the service provider "Auth-Zero" and have concluded a data processing agreement with them.
1. Registration/Login in the Online Shop
With just one shop user account at "Freunde der Berge" you have access to the ticket shops of "Annaberger Lifte," "Erlebnisalm Mönichkirchen," "Hochkar Bergbahnen," and "Ötscherlifte." To place orders or purchase tickets in the ticket shops, registration or login with customer data is required.
The ticket shops are operated by the respective mountain railway companies as data controllers under the GDPR. Each company has commissioned the operator company of "Freunde der Berge" which is ecoplus Alpin GmbH, Niederösterreich-Ring 2, 3100 St. Pölten, to perform these data processing operations on behalf of the data controllers through a data processing agreement (Art. 28 GDPR).
To provide these services (processing purpose), the personal data you provide during registration or at a later date is processed. This includes your name, email address, date of birth, gender, a self-selected password, your address (possibly a different delivery address), and optionally a telephone number, as well as your license plate when purchasing a parking ticket.
If you only place an order or book a service in one mountain railway's shop, the data will not be shared with the other shops. Only when you place an order or book a service in another shop will the relevant order data be available in that shop as well.
The data is also stored so that you can access past orders. At the same time, the stored master data is automatically used for new orders, so you do not need to manually enter your data again.
To technically carry out the registration, we have engaged the service provider "Auth-Zero" and have concluded a data processing agreement with them.
2. Ticket Orders in the Online Shop
For the purpose of providing contractual services, their payment, and execution in the context of online ticket purchases, your personal master data, contract and payment data, as well as communication data (IP address and server log files), are processed based on the legal grounds of contract fulfillment and the legal obligation to invoice and archive.
These data are stored for as long as necessary for the purpose, or as long as legal regulations require (retention of invoices according to § 132 BAO for 7 years), or these data are needed based on the legal grounds of legitimate interest to defend against possible warranty or liability claims. If you cancel the ordering process, the data will be stored for 24 hours to clarify possible, especially technical problems during the ordering process.
You are not obliged to provide your personal data. Non-provision only results in your bookings/orders in the online ticket shop not being processed.
In the online ticket shop, you also have the option to purchase tickets for other individuals by providing their names and birthdates.
For the processing of orders for season passes, multi-day tickets, and daily tickets in the online shops, we use the services of the provider "Pricenow" (Pricenow AG, Ogimatte 7, 3713 Reichenbach im Kandertal – CH). The use of this service provider is based on the legal grounds of contract fulfillment. An order data processing agreement in accordance with Art. 28 GDPR has been concluded with Pricenow.
In order to place orders in the online ticket shops, it is necessary to provide salutation, first and last name, address, email address, date of birth, optionally a portrait photo, optionally a license plate, and information about the desired tickets. The processing and storage of this data are carried out for the purpose of providing contract services or fulfilling pre-contractual obligations based on the legal grounds of Art. 6 (1) lit. b GDPR (ordering of mountain railway tickets and vouchers) and Art. 6 (1) lit. c GDPR (legally required retention periods for accounting records).
The use of appropriate online booking software is based on the legal grounds of our legitimate interest. Our legitimate interest lies in the ability to provide you with transportation tickets quickly and without location constraints.
For the creation of tickets, we have entrusted the technical execution to the company Kubeos, located in Salzburg, Austria, and have concluded an order data processing agreement in accordance with Art. 28 GDPR.
We, as your contracting partner, have a legitimate interest in improving and optimizing our products and services, as they have been acquired by you or similar products and services. In order to achieve this goal, customer feedback is an essential component, as it provides us with a direct impression of the mountain experiences you have had. Therefore, we would like to inform you that we use the email address provided in the online shop for customer surveys regarding our own products and services.
If you do not wish to have your data used for this purpose, you can object to it by sending an email to info@hochkar.com and using the following text:
"I hereby object to the use of my email address and my contract data (including related payment data) [please specify the email address] for the purpose of customer surveys to improve the products and services I have acquired, as well as similar products and services of Hochkar & Ötscher Tourismus GmbH."
3. External Payment Service Providers:
For order payments, external payment service providers are used under the legal basis of contract fulfillment. Payments are made through their platforms, using a secure SSL process. However, the seller does not assume liability for data or system attacks. Payment details entered, such as account numbers, credit card numbers with verification codes, passwords/TANs, etc., are processed exclusively by these providers and are not visible to shop operators. Shop operators only receive confirmation of payment or notification of payment failure from these providers. Links to the privacy policies and terms of service of the payment providers are also provided.
https://cdn.klarna.com/1.0/shared/content/legal/terms/en/bt_payment_data_privacy
https://www.payone.com/DE-de/datenschutz
https://www.datatrans.ch/de/datenschutzbestimmungen/
4. Deletion of User Account
You have the option to delete your user account at any time, and we will delete all data that is not subject to a legal retention obligation. If you delete the data of your user account, you will no longer have access to it, and you will not be able to make ticket purchases. To delete your user account, please send an email to the email address displayed in the respective shop. Your deletion request will then be processed, and deletion will be carried out unless there is a valid legal reason against partial or complete deletion. Please note: If you have an active booking or order, deletion is not possible until the booking/order has been consumed.
These guidelines describe how we, Hochkar & Ötscher Tourismus GmbH - Address: Göstling 46, 3345 Göstling/Ybbs, process your personal data in connection with our parking space management (in accordance with Article 13(1) GDPR).
1. Purposes of Data Processing
We will process your personal data for the following purposes:
a) Parking space management, including the automation and acceleration of services for vehicles for which a parking ticket has been booked.
c) Monitoring compliance with usage regulations (e.g., parking across two parking spaces).
d) Monitoring the lawful use of parking tickets (e.g., exceeding the parking time).
e) Protection of facilities (e.g., vandalism).
f) Tracking misuse (e.g., unauthorized parking without payment).
We collect this data through:
We inform you about the image recording and license plate data capture in accordance with legal requirements.
2. Legal Basis for Data Processing
For billing parking fees related to the parking ticket, the legal basis for processing is contract fulfillment (Art. 6(1)(b) GDPR).
For license plate recognition related to our parking management, the legal basis is the legitimate interests of the controller (Art. 6(1)(f) GDPR), which include achieving the purposes mentioned in point 1 (a to f) above. You have the right to object to this data processing under Art. 21(1) GDPR if you have reasons arising from your particular situation.
For the recognition of individual license plates to automate and expedite the service for vehicles on the whitelist.
3. Transmission of Your Personal Data:
For the purposes mentioned above, your personal data may be processed or transmitted to the following recipients, as needed:
Data processors
4. Data Retention
a) Customer Data:
We retain your personal data for as long as necessary to fulfill the purposes mentioned in point 1:
• See Data Protection Shop (not specified in the provided text)
b) Image Processing ("Video Surveillance"):
Recorded data is deleted, unless needed for specific protection or evidence purposes, no later than 48 hours after recording.
Generally, we aim to store data for the minimum required time. Normally, data is retained for the duration that a license plate is present. This means from the time of entry, through the time of exit, and then the license plate data is deleted.
In cases of inspection, data is buffered for 24 hours to enable tracking of movements. This means from the time of entry, through the time of exit, plus an additional 24 hours, and then the license plate data is deleted.
In the event that a license plate does not exit within a definable maximum parking duration, which is set at 48 hours, the data for that license plate is retained. However, there are exceptions for "registered" license plates (such as permanent parkers or employees) and license plates with valid tickets (please refer to the Data Protection Shop). Permanent parkers' data is retained indefinitely unless revoked, while license plates with valid tickets are retained as long as the ticket is valid, following the rules mentioned above.
5. Your Rights Regarding Personal Data
You have the following rights regarding your personal data:
If you believe that the processing of your data violates data protection laws or your data protection rights have been violated in any way, you can file a complaint with the data protection authority.
To exercise your rights or if you have any questions or concerns about your personal data, please contact us.
6. External Links
On our website, you may find links that lead to third-party websites. Unless such links are clearly identified as external, we want to inform you that they are indeed external links. As the responsible party, we have no control over the content and design of these websites provided by other providers. Therefore, we do not assume any liability for the content of websites linked to our website or for the URLs of other operators. Furthermore, we do not accept any liability for the functioning of linked connections of any kind.
For links to other online offerings, we do not assume any liability for the content, functionality, and availability of the linked website(s). This also applies to all other direct or indirect references or links to external Internet offerings.
7. Your Rights under GDPR and the Data Protection Act
According to the General Data Protection Regulation (GDPR) and the Data Protection Act, you, as the data subject, have the following rights and remedies related to data processing:
You have the right to request the immediate correction of any incorrect personal data concerning you or the completion of incomplete personal data, taking into account the purposes of data processing. You also have the right to request the deletion of your data.
The privacy policy for the newsletter from "Freunde der Berge" provides information about the processing of personal data related to the newsletter subscription. Here are the key points summarized in English:
The privacy policy ensures that your data is protected and processed in accordance with data protection regulations.
