Privacy policy ARGE Sommercard

In this privacy policy we inform you about the processing of your personal data and your rights in connection with the Schladming-Dachstein Sommercard and Herbstcard (hereinafter: Sommercard). In particular, we inform you about which data is processed, who processes this data or has access to it, which data processing must be carried out, which data processing you can consent to and how this consent can be revoked.

In addition to the Sommercard for guests, the following cards are valid for the entire Sommercard season: Vermietercard, Freizeitcard, Mitarbeitercard and Benefitcard. The cards differ from the Guest Sommercard in terms of their included services and Sommercard-specific conditions. In addition, the season tickets are not issued via the Sommercard host, but directly at the ARGE Schladming-Dachstein Sommercard office, or they can also be purchased online.

The data protection declaration applies to the guest card as well as the season tickets.

This data protection declaration supplements the General Terms and Conditions of the Sommercard, to which we refer in particular with regard to the terms used (e.g. Sommercard host).

The data protection officer for the Sommercard pursuant to Art. 4 (7) GDPR is ARGE Schladming-Dachstein Card, Rohrmoosstraße 234, A-8970 Schladming.

The controller is available to you in any case as a contact point for data protection questions and concerns in connection with the Sommercard. In particular, you can assert your rights under the GDPR (point 7.) against the controller.

You can contact the controller in the following ways

• Phone: +43 (0) 3687 23310-613
• E-mail: sommercard@schladming-dachstein.at
• Post: Rohrmoossraße 234, A-8970 Schladming

A non-binding list of current members of the ARGE Schladming-Dachstein Sommercard can be found on the website . The non-binding list of current Sommercard hosts can be found on the Schladming-Dachstein website.

3.1 Data categories

The following personal data is processed as part of the use of the Sommercard:

3.1.1 Basic data

• • Family name
  • First name
  • Gender (optional)
  • Date of birth
  • Nationality
  • Main residence or habitual residence
  • Date of travel
  • E-mail address (optional)
  • Consent to the GTC

3.1.2 Usage data

• • Identification number (of the Sommercard)
  • Usage data of the Sommercard (Sommercard service provider where it was used, time of use, etc.)
  • Period of use
  • Frequency of use
  • Use of the digital Sommercard

3.2 Purpose and legal basis of data processing

3.2.1 Collection and processing of basic data

When making a booking at an accommodation establishment in the Schladming-Dachstein Holiday Region that is designated as a Sommercard host, your data will be collected according to the guest directory sheet in accordance with the statutory provisions and passed on to the person responsible for issuing the Sommercard.

If you book your accommodation in an accommodation establishment in the Schladming-Dachstein vacation region that issues your Sommercard as a digital Sommercard, you will receive a message to the e-mail address you have provided with a link to download the Schladming-Dachstein Sommercard app (hereinafter: app). With the app you can create the digital Sommercard and use it via your smartphone etc.

The user is also entitled to install the app on their (mobile) device and to create and use a digital Sommercard by scanning their physical Sommercard.

The legal basis for this data processing is the fulfillment of a legal obligation pursuant to Art 6 para 1 lit c GDPR, the fulfillment of the contract pursuant to Art 6 para 1 lit b GDPR, our legitimate interest within the meaning of Art 6 para 1 lit f GDPR in improving the Sommercard by offering a digital version, as well as Art 6 para 1 lit a GDPR (consent for the transmission of guest data to the digital guest card system).

3.2.2 Collection and processing of usage data

When using a Schladming-Dachstein Sommercard service, your usage data will be collected by the respective Sommercard service provider with whom you use the service and passed on to the responsible party.

The legal basis for this data processing is the fulfillment of the contract within the meaning of Art. 6 para. 1 lit. f GDPR, as the usage data is required for billing the individual service partners.

3.2.3 Advertising (without profiling)

The controller processes your basic data to send advertising, information and special offers. No profiling takes place for this type of advertising.

The legal basis for this data processing is our legitimate interest within the meaning of Art. 6 para. 1 lit. f GDPR in the provision of information, special offers and advertising of the Schladming-Dachstein vacation region in order to achieve guest loyalty within the framework of the Sommercard.

The controller, ARGE Schladming-Dachstein Sommercard and the Sommercard hosts use various processors within the meaning of Art. 28 GDPR (e.g. IT service providers for issuing the Sommercard, transmission of data between the controller and ARGE Schladming-Dachstein Sommercard and Sommercard hosts, creation of the digital Sommercard, storage of your data, sending of information, deliverers, market research institutes, etc.) to provide some services as part of the processing of the Sommercard. The controller has concluded data processing agreements with the various data processors. These contracts are monitored on an ongoing basis and their validity under data protection law and compliance with data protection regulations by the processors are checked. The processors process your personal data exclusively on the instructions of the controller and only to the extent that this is absolutely necessary to fulfill their mandate. Your personal data will be deleted by the processor after termination of the cooperation with the respective processor. Any further processing of your personal data by the processor is excluded.

Where possible, the controller only uses processors that are based within the European Union and are subject to the provisions of the GDPR. Should the controller exceptionally use a processor from a third country (within the meaning of the GDPR), less strict data protection rules may apply to this processor. If your personal data is processed in a country that does not have a level of data protection comparable to that of the European Union, the controller will ensure that your personal data is adequately protected by means of appropriate contractual provisions or other legally binding instruments.

The following processors are currently used to collect and process personal data as part of the processing of the analog and digital Sommercard:

• Feratel media technologies AG, FN 72841w, Laubichl 60, 5452 Pfarrwerfen, CardSystem for operating the Sommercard and recording usage, basic data and usage data
• Grizzly Creative GmbH, FN 281913 d, Mondscheingasse 6, 8010 Graz, provision of the app for use of the digital Sommercard, basic data and usage data

The security of your personal data is particularly important to us. The controller, the members of ARGE Schladming-Dachstein Sommercard and the Sommercard hosts therefore take the following appropriate technical and organizational measures within the meaning of Art 32 GDPR to protect your data against loss, destruction, access, modification and processing by unauthorized persons, taking into account the state of the art, the implementation costs and the nature, scope, circumstances and purposes of the processing as well as the probability of occurrence and severity of the risk to the rights and freedoms of natural persons:

• Encryption of personal data or anonymization of data after the preset storage period has expired;
• Ensuring the confidentiality, integrity, availability and resilience of systems and services in connection with processing;
• Ensuring rapid restoration of the availability of personal data in the event of a physical or technical incident;
• Use of a procedure to regularly review, assess and evaluate the effectiveness of the technical and organizational measures to ensure the security of the processing.

Please note that the controller, the members of ARGE Schladming-Dachstein Sommercard and the Sommercard hosts assume no liability for the disclosure of information due to errors in data transmission not caused by them or not attributable to them and/or unauthorized access by third parties, e.g. hacker attacks.

6.1 Basic data

The responsible party and your accommodation provider in the Schladming-Dachstein vacation region, which is designated as a Sommercard host, will only store your basic data for the duration of your stay or the submission of the guest sheet collection to the responsible authority. In addition, this data remains stored if this is necessary due to statutory retention obligations (e.g. § 212 UGB and § 132 BAO) or for the conduct of any legal proceedings. For the purpose of providing evidence, your personal data may be processed until the expiry of the statutory limitation periods if this is necessary for the potential conduct of proceedings. The applicable statutory limitation period is generally three years.

6.2 Usage data

The controller only stores your usage data and customer profile data for as long as your customer profile exists. In addition, this data will remain stored if this is necessary due to statutory retention obligations (e.g. § 212 UGB and § 132 BAO) or for the conduct of any legal proceedings. For the purpose of providing evidence, your personal data may be processed until the expiry of the statutory limitation periods if this is necessary for the potential conduct of proceedings. The applicable statutory limitation period is generally three years.

According to the GDPR, you have the following rights, which you can assert at any time against the controller (or, if applicable, the joint controllers)

7.1 Right of access (Art. 15 GDPR)

You have the right to request confirmation from the controller (or, if applicable, the joint controllers) as to whether your personal data is being processed. In addition, you have the right to request further information about specific processing purposes, categories of personal data, recipients or categories of recipients of personal data, storage duration, the existence of a right to erasure or rectification of your personal data or to restriction of processing and the right to object, the existence of a right to lodge a complaint and all available information about the origin of your data.

7.2 Right to rectification (Art. 16 GDPR)

You have the right to obtain from the controller (or, where applicable, the joint controllers) without undue delay the rectification of your personal data. This right includes the rectification of inaccurate data and the completion of incomplete personal data.

7.3 Right to erasure (Art. 17 GDPR)

You have the right to obtain from the controller (or, where applicable, the joint controllers) the erasure of your personal data without undue delay where the grounds set out in Art. 17 (1) (a) to (f) GDPR apply and the processing of your personal data is not (or no longer) necessary.

7.4 Right to restriction of processing (Art. 18 GDPR)

Under the conditions set out in Art. 18 GDPR, you also have the right to request the controller to restrict the processing of your personal data.

7.5 Right to data portability (Art. 20 GDPR)

You have the right to receive the personal data concerning you, which you have provided, in a structured, commonly used format and to require the controller to transmit those data to another controller.

7.6 Right to object (Art. 21 GDPR)

In principle, you have the right to object to the processing of your personal data if we process it on the basis of our legitimate interest in accordance with Art. 6 (1) lit. f GDPR and the requirements of Art. 21 GDPR are met.

7.7 Revocation of declarations of consent (Art. 7 GDPR)

You have the option of revoking any consent you have given to the controller at any time. The withdrawal of your consent does not affect the lawfulness of processing based on consent before its withdrawal.

7.8 Right to lodge a complaint

In addition, you can lodge a complaint at any time with the Austrian Data Protection Authority, Barichgasse 40-42, 1030 Vienna, Tel: +43 1 52 152-0, e-mail: dsb@dsb.gv.at.

You can exercise your rights against the controller using the following contact methods:

ARGE Schladming Dachstein Card

• Phone: +43 (0) 3687 23310-613
• E-mail: info@sommercard.info
• Post: Rohrmoosstraße 234, A-8970 Schladming