Privacy Policy

We are very pleased about your interest in our company. Data protection has a particularly high priority for Schernthaner Touristik GmbH. Using the websites of Schernthaner Touristik GmbH is generally possible without providing any personal data. However, if a data subject wishes to use special services of our company via our website, processing of personal data may become necessary. If the processing of personal data is required and there is no legal basis for such processing, we generally obtain the consent of the data subject.

The processing of personal data, such as the name, address, email address, or telephone number of a data subject, is always carried out in accordance with the General Data Protection Regulation and in compliance with the country-specific data protection regulations applicable to Schernthaner Touristik GmbH.

With this privacy policy, our company intends to inform the public about the nature, scope, and purpose of the personal data we collect, use, and process. Furthermore, data subjects are informed of their rights through this privacy policy.

Schernthaner Touristik GmbH, as the entity responsible for processing, has implemented numerous technical and organizational measures to ensure the most comprehensive protection possible of the personal data processed via this website. Nevertheless, internet-based data transmissions can generally have security vulnerabilities, so absolute protection cannot be guaranteed. For this reason, every data subject is free to transmit personal data to us via alternative means, such as by telephone.


1. Definitions
The privacy policy of Schernthaner Touristik GmbH is based on the terms used by the European legislators when issuing the General Data Protection Regulation (GDPR). Our privacy policy is intended to be easily readable and understandable for both the public and our customers and business partners. To ensure this, we would like to explain the terms used in advance.

In this privacy policy, we use, among others, the following terms:

a) Personal data
Personal data means any information relating to an identified or identifiable natural person (hereinafter "data subject"). An identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, identification number, location data, online identifier, or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural, or social identity of that natural person.

b) Data subject
A data subject is any identified or identifiable natural person whose personal data is processed by the controller.

c) Processing
Processing is any operation or set of operations performed on personal data, whether or not by automated means, such as collection, recording, organization, structuring, storage, adaptation, alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment, combination, restriction, erasure, or destruction.

d) Restriction of processing
Restriction of processing is the marking of stored personal data with the aim of limiting their future processing.

e) Profiling
Profiling is any form of automated processing of personal data consisting of using personal data to evaluate certain personal aspects relating to a natural person, in particular to analyze or predict aspects concerning performance at work, economic situation, health, personal preferences, interests, reliability, behavior, location, or movements of that natural person.

f) Pseudonymization
Pseudonymization is the processing of personal data in such a manner that the personal data can no longer be attributed to a specific data subject without the use of additional information, provided that such additional information is kept separately and subject to technical and organizational measures to ensure that the personal data are not attributed to an identified or identifiable natural person.

g) Controller or data controller
The controller or data controller is the natural or legal person, authority, institution, or other body which, alone or jointly with others, determines the purposes and means of the processing of personal data. Where the purposes and means of such processing are determined by Union or Member State law, the controller or the specific criteria for its nomination may be provided for by Union or Member State law.

h) Processor
Processor is a natural or legal person, authority, institution, or other body which processes personal data on behalf of the controller.

i) Recipient
Recipient is a natural or legal person, public authority, agency, or another body to which personal data are disclosed, whether a third party or not. However, public authorities which may receive personal data in the context of a particular inquiry under Union or Member State law are not considered recipients.

j) Third party
Third party is a natural or legal person, public authority, agency, or body other than the data subject, controller, processor, and persons who, under the direct authority of the controller or processor, are authorized to process personal data.

k) Consent
Consent of the data subject means any freely given, specific, informed, and unambiguous indication of the data subject's wishes by which he or she, by a statement or by a clear affirmative action, signifies agreement to the processing of personal data relating to him or her.


2. Name & Address of the Controller
Controller in accordance with the General Data Protection Regulation, other data protection laws of the Member States of the European Union, and other provisions with data protection character is:
Schernthaner Touristik GmbH
Bergstraße 1
5603 Kleinarl
Austria
Tel.: 0043 6418 332 and 431
E-Mail: info@sport-kleinarl.at
Web: www.sport-kleinarl.at

3. Cookies


4. Website Analysis
This website uses Google Analytics, a web analysis service provided by Google Inc. ("Google"). Google Analytics uses "cookies", text files stored on your computer, to allow the analysis of your use of the website. The information generated by the cookie about your use of this website is generally transmitted to and stored by Google on servers in the USA. If IP anonymization is activated on this website, your IP address is truncated within member states of the European Union or other parties to the Agreement on the European Economic Area before transmission. Only in exceptional cases will the full IP address be sent to a Google server in the USA and truncated there. On behalf of the website operator, Google will use this information to evaluate your use of the website, compile reports on website activity, and provide other services related to website and internet usage to the website operator. The IP address transmitted by your browser as part of Google Analytics will not be merged with other data held by Google. You can prevent the storage of cookies by adjusting your browser software accordingly; however, you may not be able to use all functions of this website fully. You can also prevent the collection of data generated by the cookie about your use of the website (including your IP address) and the processing of this data by Google by downloading and installing the browser plugin available at: https://tools.google.com/dlpage/gaoptout?hl=de-DE.
You can prevent Google Analytics from collecting your user data only on this website by clicking the following link. An opt-out cookie is set that prevents the future collection of your data when you visit this website: Disable Google Analytics.
If you delete the cookies in this browser, you must set the opt-out cookie again.
Further information on Google Analytics terms and privacy can also be found at https://www.google.com/analytics/terms/de.html.

5. Collection of General Data and Information
The website of Schernthaner Touristik GmbH collects a series of general data and information with each visit by a data subject or an automated system. These general data and information are stored in the server log files. Collected data may include: (1) the type and version of the browser used, (2) the operating system used by the accessing system, (3) the website from which an accessing system reaches our website (so-called referrers), (4) the sub-websites accessed via an accessing system, (5) the date and time of access to the website, (6) an Internet Protocol address (IP address), (7) the Internet service provider of the accessing system, and (8) other similar data and information that serve to prevent danger in the event of attacks on our information technology systems.

Schernthaner Touristik GmbH does not draw conclusions about the data subject from the use of this general data and information. Rather, this information is needed to: (1) correctly deliver the content of our website, (2) optimize the content of our website and the advertising for it, (3) ensure the permanent functionality of our information technology systems and website technology, and (4) provide law enforcement authorities with the necessary information in the event of a cyberattack. These anonymized data and information are therefore evaluated statistically and with the aim of increasing data protection and data security in our company, in order to ultimately ensure an optimal level of protection for the personal data we process. The anonymous server log data is stored separately from all personal data provided by a data subject.

6. Contact Possibility via the Website
The website of Schernthaner Touristik GmbH contains information that allows rapid electronic contact with our company and direct communication with us, including a general electronic mail (email) address. If a data subject contacts the controller by email or via a contact form, the personal data transmitted by the data subject are automatically stored. Personal data provided voluntarily by a data subject to the controller are stored for the purpose of processing or contacting the data subject. There is no transfer of this personal data to third parties.

7. Routine Deletion and Blocking of Personal Data
The controller processes and stores personal data of the data subject only for the period necessary to achieve the storage purpose or as required by European or other applicable laws. Once the storage purpose ceases or a legal retention period expires, the personal data are routinely blocked or deleted in accordance with statutory provisions.

8. Rights of the Data Subject

a) Right to Confirmation
Every data subject has the right to obtain confirmation from the controller as to whether personal data concerning them is being processed. To exercise this right, the data subject may contact our data protection officer at any time.

b) Right of Access
Every data subject has the right to obtain from the controller free information about their stored personal data and a copy of this information. The data subject is also entitled to information on:

• the purposes of processing
• the categories of personal data processed
• the recipients or categories of recipients to whom personal data have been disclosed, including recipients in third countries or international organizations
• the planned duration of storage, or, if not possible, the criteria for determining this period
• the existence of a right to rectification, erasure, or restriction of processing or to object to such processing
• the existence of a right to lodge a complaint with a supervisory authority
• if the personal data were not collected from the data subject: all available information about the source of the data
• the existence of automated decision-making, including profiling, and, at least in these cases, meaningful information about the logic involved, as well as the significance and consequences for the data subject

The data subject also has the right to know whether personal data have been transmitted to a third country or an international organization, and if so, the right to be informed of suitable safeguards. To exercise this right, the data subject may contact our data protection officer.

c) Right to Rectification
The data subject has the right to request the immediate correction of inaccurate personal data concerning them and to complete incomplete personal data. To exercise this right, the data subject may contact our data protection officer.

d) Right to Erasure (Right to be Forgotten)
The data subject has the right to request the deletion of personal data if one of the following applies, and the processing is not required:

• The personal data are no longer necessary for the purposes they were collected or processed for.
• The data subject withdraws consent under Art. 6(1)(a) or Art. 9(2)(a) GDPR and no other legal basis exists.
• The data subject objects to processing under Art. 21(1) or 21(2) GDPR and no overriding legitimate grounds exist.
• The personal data have been unlawfully processed.
• Erasure is required to comply with a legal obligation under EU or member state law.
• Personal data were collected in relation to online services offered to a child under Art. 8(1) GDPR.

If one of these applies, the data subject may request deletion by contacting our data protection officer. The officer will ensure that the deletion request is promptly fulfilled.

e) Right to Restrict Processing
The data subject has the right to request restriction of processing if:

• The accuracy of the personal data is contested.
• Processing is unlawful, and the data subject requests restriction instead of deletion.
• The controller no longer needs the data, but the data subject needs them for legal claims.
• The data subject has objected under Art. 21(1) GDPR and it is not yet determined whose interests prevail.

To exercise this right, the data subject may contact our data protection officer.

f) Right to Data Portability
The data subject has the right to receive personal data in a structured, commonly used, and machine-readable format and to transmit these to another controller. This applies if processing is based on consent or contract and uses automated means. To exercise this right, the data subject may contact our data protection officer.

g) Right to Object
The data subject has the right to object at any time to processing based on Art. 6(1)(e) or (f) GDPR, including profiling. The controller will stop processing unless legitimate grounds override. The data subject can also object to processing for direct marketing purposes, including profiling.

h) Automated Decisions in Individual Cases Including Profiling
The data subject has the right not to be subject to decisions based solely on automated processing, including profiling, that significantly affects them, except under certain conditions (contract, consent, or legal provisions). The controller ensures safeguards, such as human intervention and the right to challenge the decision. The data subject may contact our data protection officer.

i) Right to Withdraw Consent
The data subject has the right to withdraw consent to processing of personal data at any time. To do so, they may contact our data protection officer.

9. Data Protection for Job Applications
The controller collects and processes personal data of applicants for the purpose of managing the application process. If no employment contract is concluded, applications are deleted two months after notification of rejection, unless other legitimate interests exist, e.g., proof obligations under AGG.

10. Legal Basis of Processing
Processing based on consent uses Art. 6(1)(a) GDPR. Contractual necessity uses Art. 6(1)(b). Legal obligation uses Art. 6(1)(c). Protection of vital interests uses Art. 6(1)(d). Legitimate interests use Art. 6(1)(f).

11. Legitimate Interests Pursued
Legitimate interests include the conduct of our business for the welfare of employees and shareholders.

12. Storage Duration
Data is stored for the duration required by statutory retention periods or contractual necessity.

13. Provision of Personal Data
Providing personal data may be legally or contractually required. Failure to provide data may prevent contract conclusion. Data subjects are informed by our data protection officer.

14. Automated Decision-Making
Our company refrains from automated decision-making or profiling.

15. Competent Authority
Austrian Data Protection Authority
Wickenburggasse 8
1080 Vienna
Austria
dsb@dsb.gv.at

This privacy policy was generated, excluding cookie information, using the privacy policy generator of DGD Deutsche Gesellschaft für Datenschutz GmbH, acting as an external data protection officer, in cooperation with lawyer Christian Solmecke.