PRIVACY POLICY
INFORMATION CONCERNING DATA PROTECTION
Privacy policy and information concerning data protection at Skischule Lech GmbH & Co KG in accordance with Articles 13 and 14 of the EU General Data Protection Regulation (GDPR).
As of: June 2026Fundamentals
General
The protection and confidentiality of your data is of utmost importance for the Schischule Lech GmbH & Co KG. Personal data is all information concerning your person or which can be used to identify you personally. This may be for example your name, your e-mail address, your private address or your telephone number.
Who is Responsible for the Processing of Your Personal Data?
The responsible authority (hereafter referred to as “Skischule Lech” or “we”) within the terms of the General Data Protection Regulation (GDPR) and other data protection regulations is
Skischule Lech GmbH & Co KG
Tannberg 185
A-6764 Lech am Arlberg
Telephone
Purpose and Legal Basis for the Data Processing
In the following we would like to inform you about the different purposes for which we will process personal data and on what legal basis this data is processed.
All data provided by you in order to conclude a contract with us or to send us an enquiry (e.g. booking of a ski course, reservations, offers, etc.) will be used by us solely for the purpose of performing a contract or treating your enquiry (Article 6(1b) of the GDPR) – unless you have given your consent for a further processing of your data.
All data which we have received from your accommodation or your travel agency from where you have made an enquiry or booking regarding our services (e.g. booking of a ski course at the reception of your hotel or with your travel agency) will solely be processed for the purpose of performing the contract (Article 6(1b) of the GDPR) – unless you have given your consent for a further processing of your data. This data is usually your name, your address, payment details, information regarding your skiing level, for children we also need information regarding their age, eating habits and contact details of their legal guardian.
In case we are bound by legal regulations to process your data, this data is then processed in accordance with Article 6(1c) of the GDPR. This for example concerns the legal obligation to retain data in accordance with the tax law.
If you have given your consent for certain data processing (e.g. subscription to our newsletter, production of photos during ski races, etc.) in accordance with Article 6(1a) or Article 9(2a) of the GDPR, we will solely process your data on the basis and within the scope of this consent. You have the right to revoke your declaration of consent at any time. Revoking your consent does not affect the lawfulness of the data processing on the basis of your consent given before the revocation.
In cases of our legitimate interest regarding the processing of your data and if there is no reason to believe that an overriding interest from your side regarding the protection of this data exists, we will process this data in accordance with Article 6(1f) of the GDPR. On this basis, we save for example the data of our customers or interested parties for some time after the performance of the contract in order to better advise you in case of further enquiries or bookings and in order to recommend suitable services on the basis of prior enquiries and services. Furthermore, we process your data – in so far as it is legally permissible – for the purposes of direct advertising to existing customers for similar goods or services in accordance with Section 174 of the Austrian Telecommunications Act 2021 (TKG 2021), unless you have objected. Sending our newsletter and other promotional e-mail communications to non-customers is carried out exclusively on the basis of your consent pursuant to Article 6(1)(a) GDPR. Regarding processing based on legitimate interest, you have the right to object to the processing of your data on grounds relating to your particular situation at any time; in this case, we will no longer process your data, unless the processing is necessary due to compelling and legitimate reasons.
Obligation to Provide Data
Providing personal data is required by law in many cases (e.g. tax retention obligations) or necessary for concluding and performing a contract with us (e.g. name, contact details, booking and payment information).
Without the information required for a booking or contract performance, we generally cannot conclude the relevant contract or provide the booked service.
Optional information (e.g. participant notes on allergies, dietary requirements or health-related information) is voluntary. Failure to provide such optional data does not affect contract conclusion, but may limit individual care or coordination (e.g. regarding meals).
Processing When Using Our Services
User Account and Authentication
When you create a customer account on our website or sign in, we process the personal data required to register, authenticate and manage your account.
This may in particular include: salutation, first and last name, e-mail address, date of birth (for natural persons), optionally a title, and – if you agree – your consent to marketing communications.
For sign-in we use a passwordless procedure via e-mail (magic link). We send you a one-time sign-in link by e-mail. For registration, verification, sign-in and password reset e-mails we use Mailgun (EU region).
While you are signed in, we store a session to recognize you as a logged-in user and associate your cart and bookings with your account.
The legal basis for processing is Article 6(1)(b) GDPR (contract performance or pre-contractual measures at your request). Where you optionally enable marketing communications, the legal basis is Article 6(1)(a) GDPR.
Online Bookings and Course Participation
Online Bookings
When you book ski lessons, ski courses, private lessons, race training, childcare services or other services through our website, we process the personal data required to manage and perform the booking.
Depending on the booked service, this may include following personal data.
Name
Gender
Relation
Address
E-mail address
Telephone number
Date of birth
Nationality
Language preferences
Skiing ability and experience level
Information regarding children participating in courses
Contact details of legal guardians
Booking details
Payment information
Voluntary participant notes (e.g. regarding allergies, food intolerances or dietary requirements)
The processing is necessary for the performance of a contract or for pre-contractual measures pursuant to Article 6(1)(b) GDPR.
Voluntary participant notes can be provided during booking for each participant. Providing this information is not mandatory. Where you submit health-related information, we process it as special categories of personal data pursuant to Article 9(1) GDPR on the basis of your explicit consent pursuant to Article 9(2)(a) GDPR, which you give by completing the booking and accepting this privacy policy.
Booking confirmations, invoices, reminders and operational information relating to your booking are sent by e-mail.
The online booking system is operated by Skischule Lech. Technical development, maintenance and support are provided by webulos GmbH. Booking data may also be processed in the ERP system provided by RAADE.
Processing of Children’s Data
Many of our services are intended for children and young people.
For the organisation and execution of children’s ski lessons, childcare services, race training and events, we process personal data of participating children and their legal guardians only to the extent necessary for providing the booked services.
Depending on the service, this may include following.
Name
Date of birth
Ski level
Group allocation
Emergency contact details
Voluntary participant notes during booking (e.g. regarding allergies, food intolerances, dietary requirements, religious or cultural dietary needs, or health-related restrictions)
The legal basis for data required for contract performance is Article 6(1)(b) GDPR.
Allergies, dietary requirements and health-related information can be provided voluntarily during booking in the participant notes field. Providing this information is not mandatory. Where you submit such information, we process it as special categories of personal data pursuant to Article 9(1) GDPR on the basis of your explicit consent pursuant to Article 9(2)(a) GDPR, which you give by completing the booking and accepting this privacy policy.
Emergency Situations
In order to protect participants and provide assistance in emergency situations, we may process emergency contact information and other information voluntarily provided by participants or legal guardians.
Health-related information is only processed where voluntarily provided and necessary for the safe provision of the booked service.
In the event of accidents, illness or other emergencies, this information may be shared with following.
Rescue services
Medical personnel
Emergency services
Legal guardians or emergency contacts
The legal basis for this processing is Article 6(1)(d) GDPR. Where health-related data is involved, additionally Article 9(2)(c) GDPR.
Payment Processing
For the processing of online payments and bookings, we use the payment service provider hobex AG.
When making a payment, the payment information required for processing the transaction is transmitted directly to Hobex. We do not store complete payment card information on our own systems.
The processing of payment data is necessary for the performance of a contract pursuant to Article 6(1)(b) GDPR. Further processing may be carried out by Hobex in accordance with their own privacy policy and applicable legal obligations.
Photos and Videos
Photographs and video recordings may be taken during ski lessons, races, events, award ceremonies and other activities organised by Skischule Lech.
These recordings may be used for following.
Documentation of events
Reporting on activities
Website publications
Social media channels
Print publications
Marketing and promotional activities
Where required by law, processing is based on your consent pursuant to Article 6(1)(a) GDPR and, where special categories of personal data are involved, Article 9(2)(a) GDPR.
Photographs and videos of children will only be used in accordance with applicable legal requirements and, where required, based on the consent of their legal guardians.
You may withdraw your consent at any time with effect for the future.
Cookies, Tracking and Website Security
We use cookies and similar technologies on our website. Necessary cookies are required to provide basic functions of the website, particularly to store your cookie preferences. For this purpose, we store your selection in a first-party cookie or, depending on the technical configuration, in the local storage of your browser. The chosen consent category, the version of the consent, and the time of the update are stored. The storage duration is up to 365 days. You can access and adjust your cookie selection at any time via the link "Cookie Settings" in the footer of our website.
The legal basis is our legitimate interest in operating the website in a legally compliant and user-friendly manner in accordance with Art. 6 para. 1 lit. f GDPR and, where necessary, the fulfilment of legal documentation obligations in accordance with Art. 6 para. 1 lit. c GDPR.
Technically Necessary Session Cookies
To operate our online shop, we use technically necessary cookies that are required for basic functions and cannot be disabled.
This includes in particular a session cookie (session-token) used to associate guest sessions with the shopping cart and booking process. This cookie is deleted when it expires or when you clear your browser data.
The legal basis is Article 6(1)(f) GDPR (legitimate interest in operating the online shop) and Article 6(1)(b) GDPR where processing is necessary for pre-contractual measures or contract performance.
Google Analytics
If you have consented, we use Google Analytics 4, a web analytics service from Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. Google Analytics helps us understand how visitors use our website so that we can improve content, structure, and technical quality. Google Analytics is only loaded after your consent. Until then, storage for analytical purposes via Google Consent Mode is disabled.
As part of the usage, information about visited pages, usage times, technical browser and device information, shortened or anonymised IP addresses, and interactions with the website may be processed. Cookies such as _ga and _ga_* may be set. The storage duration of these cookies can be up to 2 years, depending on Google's configuration; the retention period of analytical data in Google Analytics is determined by the settings made there.
The legal basis is your consent in accordance with Art. 6 para. 1 lit. a GDPR. You can change or withdraw your consent at any time with effect for the future. To do this, use the link "Cookie Settings" in the footer of our website. Upon withdrawal, we will attempt to technically delete any already set Google Analytics cookies, as far as this is possible via the browser.
For more information on data processing by Google, please visit: https://policies.google.com/privacy
Google reCAPTCHA
To protect our contact form against spam, abuse and automated attacks, we use Google reCAPTCHA provided by Google Ireland Limited. reCAPTCHA is only loaded after you have consented to the "Marketing and Analytics" category in the cookie settings. Without this consent, the contact form cannot be used.
Google reCAPTCHA may process information such as IP address, browser and device information and user interactions to determine whether an action is performed by a human user.
The legal basis is your consent pursuant to Article 6(1)(a) GDPR. You can withdraw your consent at any time via the "Cookie Settings" link in the footer of our website.
Communication and Other Online Features
Below we inform you about the processing of personal data when using further online features of our website.
Contact Form
When you use our contact form, we process the email address and message you provide in order to respond to your inquiry. The processing is carried out to perform pre-contractual measures or to handle your request in accordance with Art. 6 para. 1 lit. b GDPR or based on our legitimate interest in efficient communication in accordance with Art. 6 para. 1 lit. f GDPR.
For the sending and delivery of contact form messages, we use the email service Mailgun (EU region). The data you enter and technical dispatch information are transmitted to Mailgun. The processing is carried out solely for the purpose of delivering and handling your request.
To protect against abuse, we use Google reCAPTCHA (see section "Cookies, Tracking and Website Security").
External Links to Google Maps and LinkedIn
Our website contains links to external services, particularly Google Maps and LinkedIn. These services are not directly embedded in the website. Data transmission to the respective providers only occurs when you click the corresponding link. The respective provider is responsible for the subsequent processing of personal data.
Application Form
If we provide an application form on our website for job advertisements and you submit an application via this form, the personal data you enter will be transmitted to us and processed for the purpose of handling your application and carrying out pre-contractual measures.
The legal basis for this processing is Article 6(1)(b) GDPR, as the processing is necessary in order to take steps prior to entering into an employment contract at your request.
Applications are sent by e-mail via Mailgun (EU region). Your application data will only be retained for as long as necessary to complete the recruitment process and to comply with applicable legal retention obligations.
Newsletter
If you subscribe to our newsletter, we use your e-mail address, first and last name to regularly provide you with information about our offers, services, events and other topics related to the activities of Skischule Lech.
Before signing up, you must explicitly agree to receive e-mails from Skischule Lech and accept the privacy policy. Registration is not possible without this consent.
To ensure that no third party subscribes using your e-mail address without authorization, we use a double opt-in procedure. After subscribing, you will receive a confirmation e-mail containing a link that you must click to complete your registration.
The legal basis for processing your data in connection with the newsletter is your consent pursuant to Article 6(1)(a) GDPR.
We store your e-mail address until you unsubscribe from the newsletter or until the newsletter service is discontinued. You may withdraw your consent and unsubscribe at any time with effect for the future.
For documentation purposes, we also store the IP address used during registration as well as the date and time of subscription and confirmation. The legal basis for this storage is our legitimate interest pursuant to Article 6(1)(f) GDPR in proving that consent was validly obtained.
Our newsletters may contain tracking technologies (e.g. tracking pixels) that allow us to determine whether newsletters have been opened and which links have been clicked. These analyses are carried out only within the scope of your consent to receive the newsletter pursuant to Article 6(1)(a) GDPR and serve to improve the relevance of our communications.
For the delivery and management of our newsletters, we use the services of Mailchimp. In this context, your e-mail address and, where applicable, additional information required for newsletter delivery are processed by Mailchimp on our behalf.
Mailchimp may process data on servers located outside the European Economic Area. Appropriate safeguards are implemented to ensure an adequate level of data protection in accordance with the GDPR.
Race Results and Competition Management
For the administration of races, competitions and the publication of race results, we use the platform Lympik.
Depending on the event, participant information such as name, age category, start number, race times, rankings and related competition data may be processed and published through this platform.
The legal basis for this processing is Article 6(1)(b) GDPR where necessary for participation in an event, and Article 6(1)(f) GDPR based on our legitimate interest in the organization and documentation of sporting events.
Surveys and Prize Drawings
From time to time, Skischule Lech may conduct customer satisfaction surveys or market research activities. Participation in such surveys is generally anonymous and does not require the collection of personal data.
If a prize draw is offered in connection with a survey, participants may voluntarily provide their e-mail address in order to participate. This e-mail address will be used exclusively for administering the prize draw and notifying winners.
The legal basis for this processing is Article 6(1)(a) GDPR based on your consent.
The data collected for a prize draw will be deleted after the completion of the draw and any associated legal obligations have been fulfilled.
Objecting to Advertising Communications
If you object to the use of your personal data for advertising purposes, we will add your contact details (such as your name, address, telephone number and e-mail address) to a suppression list (blacklist). This ensures that you will no longer receive advertising communications from us in the future.
The legal basis for maintaining this suppression list is our legitimate interest pursuant to Article 6(1)(f) GDPR in ensuring compliance with your objection.
Sharing, Security and Retention
Data Recipients
We will not transfer your data to third parties except where this is necessary for the performance of a contract, required by law, or where you have given your consent.
Processors commissioned by us may receive your data where necessary for the provision of their services. All processors are contractually obliged to treat your data confidentially and to process it only within the scope of their services.
We currently use the following categories of service providers.
Hetzner Online GmbH (Germany) – Hosting and server infrastructure
webulos GmbH (Austria) – Development, maintenance and technical support of the website and online booking platform
RAADE GmbH (Austria) – ERP and business administration system
hobex AG (Austria) – Payment processing
Mailchimp – Newsletter management and distribution
Mailgun – Transactional e-mail delivery
Google Ireland Limited – Google Analytics and Google reCAPTCHA
Lympik – Race management and publication of race results
Accommodation providers and travel agencies where bookings are arranged through them
Tax advisors, auditors and authorities where required by law
Transfers to Third Countries
Where we transfer personal data to recipients in countries outside the European Economic Area (EEA), we ensure that an adequate level of data protection is maintained.
For service providers based in the USA or processing data in the USA (in particular Google Ireland Limited and Mailchimp), transfers are based on appropriate safeguards pursuant to Article 46 GDPR, in particular the European Commission's Standard Contractual Clauses, and – where applicable – the EU-US Data Privacy Framework.
Transactional e-mails (e.g. booking confirmations, contact enquiries, login links) are sent via Mailgun with processing in the EU (api.eu.mailgun.net). Where transfers to third countries nevertheless occur, appropriate safeguards pursuant to Articles 44 et seq. GDPR are agreed.
Hosting Infrastructure
Our website and related services are hosted on servers operated by Hetzner Online GmbH in Germany. Hetzner acts as a hosting provider and may process personal data to the extent necessary for providing infrastructure and hosting services.
The legal basis for this processing is Article 6(1)(f) GDPR. Our legitimate interest is the secure and reliable operation of our website and online services.
Data Security
Our website is provided over an encrypted HTTPS connection (TLS). You can tell whether a page is transmitted in encrypted form from the lock symbol in your browser's address bar. We also use appropriate technical and organizational security measures to protect your data against accidental or intentional manipulation, partial or complete loss, destruction or unauthorized access by third parties.
Data Retention Period
We only keep your data as long as needed to achieve the purposes stated above (e.g. performance of a contract) or as long as permitted by applicable law. In any case, we will save your data as long as the retention periods of the legislator demand or as long as limitation periods of potential legal claims have not yet expired.
Your Rights and Updates
Automated Decision-Making and Profiling
We do not use automated decision-making, including profiling, within the meaning of Article 22 GDPR that produces legal effects concerning you or similarly significantly affects you.
Your Rights
Under the applicable legal provisions, you have the following rights at any time.
Obtain information about your personal data stored by us (Art. 15 GDPR)
Request correction of incorrect data (Art. 16 GDPR)
Request deletion of your data stored by us (Art. 17 GDPR)
Request restriction of data processing, insofar as we are not yet allowed to delete your data due to legal obligations (Art. 18 GDPR)
Object to the processing of your data by us (Art. 21 GDPR)
Request data portability, insofar as you have consented to the data processing or have concluded a contract with us (Art. 20 GDPR)
Withdraw your consent at any time with effect for the future, insofar as processing is based on your consent (Art. 7(3) GDPR)
Lodge a complaint with a data protection supervisory authority if you believe that the processing of your personal data violates the GDPR (Art. 77 GDPR)
The competent supervisory authority in Austria is the Austrian Data Protection Authority, Barichgasse 40-42, 1030 Vienna, e-mail: dsb@dsb.gv.at, website: https://www.dsb.gv.at
Changes to our privacy policy
We reserve the right to adapt this privacy policy so that it always complies with current legal requirements or to implement changes to our services in the privacy policy, e.g. when introducing new services. For your next visit, the new privacy policy will then apply.