Data privacy declaration in compliance with Art. 13 and Art. 14 GDPR

When using the functions of our website, shopping in our stores or communicating with us, personal data may be processed in various ways, about which we provide detailed information below.

v 1.34

I. Processing of data for contract execution

The entity responsible for processing your personal data in connection with the purchase or rental of sports equipment is the Bründl Sports company that operates the shop where you bought or rented the goods. These are the following companies:

Sport Bründl Gesellschaft m.b.H. 
Tel: +43 5 08388 13500 
Email: office@bruendl.at

or

Schmittenhöhe-Service GmbH 
Tel: +43 5 08388 13500 
Email: office@bruendl.at

or 
 
Sports & Emotions GmbH 
Tel: +43 5 08388 13500 
Email: office@bruendl.at

or

Planai Sport GmbH 
Tel: +43 5 08388 13500 
Email: office@bruendl.at

The companies all belong to the BRÜNDL SPORTS brand and are each located at the following address: Nikolaus-Gassner-Straße 4, 5710 Kaprun. Hereinafter, they will each be referred to individually as "We," "Us," or the "Controller."

1. Data Processing Related to Purchases in a Shop

1.1. Scope of Processing Personal Data

We may process the following personal data about you when concluding a contract related to a purchase or rental in the shop: first and last name, billing address, shipping address, telephone number, email address, bank account details, identification data in exceptional cases (type of ID, issue date, issuing authority). Additionally, during the payment process, we collect the following data: receipt number, customer number (if available), information about the goods, unit price, total purchase price, payment method.

1.2. Legal Basis for Processing Personal Data

The legal basis for the data processing under section 1.1. is Art 6(1)(b) GDPR, which means the necessity to fulfill a contract or other request. Providing your contact details is voluntary; of course, a purchase can be made without providing personal data. However, if these data are necessary to process the purchase contract in exceptional cases and you do not provide them, we may not be able to process the purchase or rental accordingly.

1.3. Purpose of Data Processing

The system is used for the internal management of customer relationships and the central recording of customer data as necessary for the processing of a purchase or rental. This data processing supports the controller in maintaining customer relationships (contact management), including the prompt and efficient handling of inquiries, and promotes an overview of the status of contract processing and customer inquiries, as well as a systematic recording and management of business cases. This enables structured customer care.

1.4. Duration of Storage

These data are deleted after the contractual relationship with the customer has ended, unless the data are needed beyond this for tax retention purposes or as long as claims from the contractual relationship can still be asserted.

1.5. External Recipients of Data

We use an IT service provider, Sport Management und Consulting GmbH, Kaprun, for the storage and hosting of personal data, who may have access to personal data as instructed by the controller to provide the commissioned IT services.

We share your data with banks for payment processing, legal representatives, courts, and authorities in the event of legal disputes, collection agencies for debt collection, and possibly other third parties involved in providing services to you (e.g., suppliers).

Your data will not be shared with external third parties for their own purposes without your consent. Personal data may be shared within the company for other purposes, such as accounting for billing.

2. Data processing in connection with “EASY RENT-VERLEIHSERVICE”

2.1 Scope of Processing Personal Data

The controller stores and processes the following data of the person with whom the rental contract for the sports equipment is concluded: customer number, first name, last name, address, postcode, city, and country of origin, which you provide to us when requesting the rental of sports equipment via the online form on the BRÜNDL SPORTS website or in a shop. Providing this data is voluntary; however, if you do not provide it, the controller may not be able to process your rental request and lend you the equipment.

Additionally, if a rental contract is concluded in a shop, we also collect information about the type of rented sports equipment (skis, bike), and other details about the rented sports equipment, such as item description, quantity, EAN code, as well as the rental price and any discounts granted.

During the rental process in the shop, in the case of ski rentals, we also collect the date of birth, height, weight, shoe size, sole length, and skier type (skill level) of the user, which we need to correctly adjust the ski binding. If you are renting the equipment for another person, you must provide the first and last name of that person and your relationship with them. Providing this data is necessary to conclude the rental contract. If you do not provide this data, we cannot lend you the skis.

If you express your interest in renting sports equipment at your hotel or travel agency, this hotel or travel agency will, with your consent, provide us with your first and last name, your status as a hotel guest/travel agency customer, and your interest in ski/bike rental. In such cases, we process, in addition to the data provided by the hotel/travel agency, the name of the hotel or travel agency and the name of any tour guide.

If you decide to reserve rental equipment together with other people, their data will be provided to us either directly by you or by a person you have selected as the contact person.

2.2 Legal Basis for Processing Personal Data

The legal basis for processing the data under section 2.1 in connection with the rental contract and use of the sports equipment is Art 6(1)(b) GDPR, thus processing for the fulfillment of a contract. We process data related to the hotel/travel agency based on our legitimate interest under Art 6(1)(f) GDPR to fulfill the contract with the travel agency and/or hotel in connection with the rental of sports equipment. If you rent sports equipment for another person or we receive your data through a contact person, we process your data to fulfill the contract under Art 6(1)(b) GDPR and based on our legitimate interest under Art 6(1)(f) GDPR, after you have disclosed your relationship with this person to us or this contact person has declared to us that they are providing the data on their behalf and with their consent.

2.3 Purpose of Data Processing

The personal data listed under section 2.1 are processed by us for the purpose of fulfilling and processing the rental contract for sports equipment. We process certain data mentioned in section 2.1 about the rental customer, who is the person concluding the contract with us, regardless of the use of the sports equipment, to properly fulfill the respective contractual obligations arising from the rental of sports equipment.

Further information regarding the specific use of the sports equipment is also necessary to fulfill the rental contract. We process the user's date of birth to determine the age group for the binding release setting and also if you simultaneously purchase a lift ticket from us, as different prices apply for certain age groups.

We use the user's body data to properly adjust the ski binding, which we are obligated to do under the rental contract. The scope of the data collected is determined by ÖNORM ISO 11088 (assembly, adjustment, and inspection of the ski-binding-boot (S-B-S) unit for alpine skiing) and ÖNORM ISO 13993 (procedures in ski rental - sampling and testing of complete and incomplete functional units of alpine ski-binding-boot in ski rental) along with the associated adjustment guidelines, which apply to the assembly of special binding-boot combinations, which must always be checked when forming a new combination.

2.4 Duration of Storage

The personal data are stored during the business relationship with you as a rental customer and beyond, as long as legal claims arising from the rental can be asserted and/or statutory retention periods exist.

2.5 Recipients of Data

We use Sport Management und Consulting GmbH, Kaprun, as an IT service provider for recording rental orders and handling the rental service. They have access to personal data to provide the commissioned IT services according to our instructions.

In the event of loss or theft of the sports equipment, we pass on the data related to the rental contract, but not the body data, to the police, the public prosecutor, and/or courts for the investigation and clarification of the facts, as well as to identify the perpetrator. We also report to the insurance company and provide the necessary data for the rental contract.

The data on country of origin, the name of the hotel or travel agency, and the description of the rented sports equipment are anonymized and processed for statistical evaluation and analysis purposes as soon as they no longer need to be retained for the purposes of the rental service.

No personal data is transferred to third parties for their own purposes, including the hotel or travel agency that provided your data, without your consent.

3. Data processing "Electronic Invoicing"

3.1 Scope of Processing Personal Data

We process your first and last name, email address, telephone number, and address if you provide these details when making a purchase. If you do not provide this data, we cannot issue the invoice electronically.

We also automatically store and process the following data for electronic invoicing: customer number (if available), invoice data (date of invoice issuance, date of purchase, description and quantity of goods, unit price, total price).

3.2 Legal Basis for Processing Personal Data

The legal basis for processing the data is Article 6(1)(a) of the GDPR, as by voluntarily providing your data, you consent to the processing, and Article 6(1)(b) of the GDPR, as processing is necessary for the fulfilment of a contract, given that you have requested to receive the invoice electronically.

3.3 Purpose of Data Processing

The personal data listed under Section 3.1 is processed by us for the purpose of issuing an electronic invoice and sending it via email. The contact information is required to enforce claims against the customer if the electronically delivered invoice, due upon receipt, is not paid on time.

3.4 Recipients of Data

Sport Management and Consulting GmbH, Kaprun, is engaged as a technical IT service provider and may have access to the data if required for IT services (such as technical support, applying updates, etc.). An appropriate data processing agreement has been concluded.

Sport Management and Consulting GmbH is authorised to employ additional data processors and has commissioned advarics GmbH, Grabenweg 58, 6020 Innsbruck, and WINTERSTEIGER AG, Dimmelstraße 9, A-4910 Ried im Innkreis, with an appropriate agreement under Article 28 of the GDPR between Sport Management and Consulting GmbH and advarics GmbH, as well as WINTERSTEIGER AG.

3.5 Duration of Data Retention

The personal data is retained for seven years after the end of the fiscal year in which the purchase was made, in compliance with a legal obligation (§ 132 BAO).

4. Data processing "Click & Reserve"

4.1 Scope of Processing Personal Data

We store and process the following data of the person who orders a product online and reserves it for collection at a store: first and last name, telephone number, email address, reserved products, chosen store, and reservation status.

Providing this data is voluntary; however, if you do not provide it, we cannot process your request to reserve an item and will be unable to hold the item for you at the store.

Additionally, we collect the IP address and browser data during the ordering process if you have given your consent in the cookie banner.

4.2 Legal Basis for Processing Personal Data

The legal basis for processing the data under Section 4.1 is Article 6(1)(b) of the GDPR, as processing is necessary for the fulfilment of a contract in connection with the order and reservation in a store.

4.3 Purpose of Data Processing

The personal data listed under Section 4.1 is processed by the responsible entity to reserve an online-ordered item for a customer at a store and to handle the order process.

4.4 Duration of Data Retention

Personal data is stored until the item is collected from the store, after which it is deleted.

Log data automatically collected during the ordering process is deleted after the reservation is completed.

4.5 Recipients of Data

To capture the order process on our website and facilitate the reservation, we use IT service providers, specifically Sport Management and Consulting GmbH, Kaprun, which employs the online reservation system Shopgate GmbH, based in Butzbach, Germany. Shopgate has access to personal data as required to provide the commissioned IT services following our instructions. An appropriate data processing agreement has been concluded under Article 28 of the GDPR.

All reservation data you enter is transmitted in encrypted form. Additionally, Shopgate takes all other necessary organisational and technical measures to protect your data.

For the provision of technical services (such as hosting), where access to personal data cannot be excluded, the following service providers may be used by Shopgate:

<ul>
<li>Amazon Web Services, Inc. (Ireland); standard contractual clauses under Article 46(2)(c) of the GDPR are in place. | Hosting: Ireland | Hosting</li>
<li>Zendesk Inc. (California, USA); standard contractual clauses under Article 46(2)(c) of the GDPR are in place. | Hosting: EU & USA | Customer Support</li>
<li>Google LLC (California, USA); standard contractual clauses under Article 46(2)(c) of the GDPR are in place. | Hosting: EU (Belgium) | Hosting, Mail, Tracking</li>
<li>Hetzner Online GmbH (Germany) | Hosting: Germany | Hosting</li>
<li>Elastic N.V. (Netherlands & California, USA); standard contractual clauses under Article 46(2)(c) of the GDPR are in place. | Hosting: EU (Ireland & Belgium) | Monitoring & Error Analysis</li>
<li>Sentry - Functional Inc. (California, USA); standard contractual clauses under Article 46(2)(c) of the GDPR are in place. | Hosting: USA | Monitoring & Error Analysis</li>
<li>Slack (California, USA); standard contractual clauses under Article 46(2)(c) of the GDPR are in place. | Hosting: USA | Internal Communication</li>
<li>Atlassian Plc. (Sydney, Australia); standard contractual clauses under Article 46(2)(c) of the GDPR are in place. | Hosting: EU (Germany) | Project Management</li>
</ul>

Personal data is not transmitted to any other third parties for their own purposes without your consent.

5. Data processing "Online-Voucher-Shop"

5.1 Scope of Processing Personal Data

We store and process the following data of the individual who orders a voucher online: title, first and last name, address, telephone number, email address, voucher value, validity period of the voucher, quantity of vouchers ordered, payment method, payment data, order date, and order number.

Providing this data is voluntary; however, if you do not provide this data, the responsible entity will not be able to process your online voucher order or issue the voucher accordingly.

Additionally, during the ordering process, we collect technical connection data from server access (IP address, date, time, requested page, browser information) required for order processing by the data processor managing the online voucher shop and by the payment service provider for organising the payment.

5.2 Legal Basis for Processing Personal Data

The legal basis for processing the data under Section 5.1 is, in connection with the order, delivery, and payment of the voucher, Article 6(1)(b) of the GDPR, and is therefore necessary for the fulfilment of a contract.

5.3 Purpose of Data Processing

The personal data listed under Section 5.1 is processed by the responsible entity for the purpose of handling the order of a value voucher, in particular issuing the voucher and sending it to customers as a PDF or by email so that the customer can print it themselves, as well as completing the payment.

During payment processing, payment data is forwarded to the payment service providers commissioned by Bründl. The payment service provider processes the payment data and payment method details (e.g., account details, credit card number) for the purpose of payment processing. The data protection information of the respective providers applies to these transactions.

5.4 Duration of Data Retention

Bründl processes the data from the ordering process until the order is completed and thereafter as long as legal retention periods or warranty and limitation periods are still open.

The log data collected automatically during the ordering process is deleted once the ordering process is completed.

5.5 Recipients of Data

For recording the ordering process in the voucher shop and processing payment, we use IT service providers, specifically Sport Management and Consulting GmbH, Kaprun, which in turn employs INCERT eTourism GmbH & Co KG, Business Park Lederfabrik, Leonfeldnerstraße 328, 4040 Linz, as an additional data processor. This company, on our behalf and following our instructions, has access to personal data in order to provide the commissioned IT services. An appropriate data processing agreement has been concluded in accordance with Article 28 of the GDPR.

All order data you enter is transmitted in encrypted form. Additionally, INCERT eTourism implements all other necessary organisational and technical measures to protect your data.

Personal data is not transferred to other third parties for their own purposes without your consent.

II. Processing of Data in Connection with the Customer Card and for Advertising Purposes

We also process personal data of our customers if they have registered for the Bründl +Card and/or wish to receive marketing communications for products and services under the BRÜNDL SPORTS brand.

The data controller responsible for processing in this context is:

Sport Bründl Gesellschaft m.b.H. 
Tel: +43 5 08388 13500 
Email: office@bruendl.at 
Nikolaus-Gassner-Straße 4, 5710 Kaprun

(hereinafter referred to as "we," "us," or the "controller").

1. Data processing "Customer Card System"

1.1. Scope of Processing Personal Data

We store and process the following data: contact details provided by you during the registration for the Bründl Plus Card, including first name, last name, gender, language, address, telephone number, date of birth, email address, the customer number automatically generated upon registration, a loyalty card number (if available), and communication details with the customer (Transactional Mailings).

With each transaction (purchase or rental) made with your customer card, we also collect the date and time of the purchase, transaction number, branch, amount payable, discounts, item number, item description, brand, item EAN, size, colour, product group, season, list price, discount, amount incl. VAT, discount description.

Additionally, we process the bonus points credited based on the transactions, the vouchers issued for you (value, issue date, validity, redemption status/open, issuing branch), and details on the redemption of the vouchers.

1.2. Legal Basis for Processing Personal Data

The legal basis for processing the data under section 1.1 is Art 6(1)(b) GDPR, thus processing for the fulfillment of a contract. Providing your contact details is voluntary; however, if you do not provide this data, Bründl Sports cannot process your request for issuing a customer card and grant you the benefits of the customer card system.

1.3. Purpose of Data Processing

The personal data listed under section 1.1 are processed by Bründl Sports for the purpose of fulfilling the respective contractual obligations arising from participation in the Bründl +Card, particularly to determine the bonus points and issue the bonus credit.

1.4. Duration of Storage

The personal data are stored and processed for as long as you participate in the Bründl Plus Card and beyond, as long as legal claims arising from participation can be asserted, and statutory retention periods exist.

The transaction data will be anonymised once they are no longer needed for the purposes of the customer card system and processed for statistical evaluation and analysis purposes according to section II.5.

1.5. Recipients

Sport Management und Consulting GmbH, Kaprun, is appointed as the technical IT service provider, who may have access to the data to the extent required for the provision of IT services (particularly technical support, applying updates, etc.). Sport Management und Consulting GmbH has, in turn, commissioned BSI Business Systems Integration AG, Täfernweg 1, 5405 Baden, Switzerland, as an additional processor. Switzerland is a third country with an adequacy decision under Art. 45(1) and (3) GDPR. A corresponding data processing agreement according to Art. 28 GDPR has also been concluded.

BSI Business Systems Integration AG uses the following additional processors:

BSI Business Systems Integration Deutschland GmbH, Rheinstrasse 97, 64295 Darmstadt, for IT services under the SaaS contract.

Amazon Web Services EMEA SARL, 38 avenue John F. Kennedy, L-1855 Luxembourg, for cloud services with a data centre in Frankfurt. Standard contractual clauses have been concluded by BSI with AWS, and a transfer impact assessment has been conducted by BSI.

Mailjet GmbH, Rankestraße 21, 10789 Berlin, is used for sending newsletters and emails.

Personal data is not transferred to third parties without your consent.

2. Data processing "Marketing Bründl Sports"

2.1. Scope of Processing Personal Data

Bründl Sports uses your personal data, specifically your first and last name, gender, address, telephone number, date of birth, email address, customer number, as well as the purchase data processed and collected with the Bründl Plus Card in Bründl Sports shops (date and time of purchase, transaction number, branch, amount payable, discounts, item number, item description, brand, item EAN, size, colour, product group, season, list price, discount, amount incl. VAT, discount description) and the response data (data on your reaction to promotions and purchasing behaviour) for advertising purposes, particularly for the creation and sending of personalised, customer-tailored advertising.

2.2. Legal Basis for Processing Personal Data

Bründl Sports processes your data for marketing purposes, to best reach customers and align its marketing strategies accordingly, only with your consent, which you can give when applying for the Bründl Plus Card, subscribing to our newsletter, or concluding a contract with us. The legal basis for processing is therefore Art 6(1)(a) GDPR.

2.3. Purpose of Data Processing

Your personal data will be used to send offers, product catalogues, and other promotional material about BRÜNDL SPORTS products or activities by email, SMS, or post.

The personal data are used for analysis and interpretation for the purposes of personalised advertising. The data described in section 2.1 are evaluated and analysed using various statistical methods (exploratory, descriptive, and inductive) and by enriching the personal data with aggregated sociodemographic data concerning the customer groups to which you belong according to your identification data (e.g., gender, age, marital status, household size, education, professional situation, etc.). Analysis means that probabilities are calculated based on the aggregated data and with the help of automated analysis models, which are used to select suitable recommendations and offers for you. Furthermore, customer profiles are created, which Bründl Sports uses to make statements about the possible future purchasing behaviour of customers and to align its sales strategy accordingly, and in particular, to adapt the product range to customer needs.

2.4. Duration of Storage

Bründl Sports stores your data until the termination of your participation in the Bründl Plus Card and beyond that up to 7 years after your last contact with Bründl Sports, or earlier if you object to the use of your data.

2.5. Recipients of Data

Sport Management und Consulting GmbH, Kaprun, is appointed as the technical IT service provider, who may have access to the data to the extent required for the provision of IT services (particularly technical support, applying updates, etc.). Sport Management und Consulting GmbH has, in turn, commissioned BSI Business Systems Integration AG, Täfernweg 1, 5405 Baden, Switzerland, as an additional processor. Switzerland is a third country with an adequacy decision under Art. 45(1) and (3) GDPR. A corresponding data processing agreement according to Art. 28 GDPR has also been concluded.

BSI Business Systems Integration AG uses the following additional processors:

<ul>
<li>BSI Business Systems Integration Deutschland GmbH, Rheinstrasse 97, 64295 Darmstadt, for IT services under the SaaS contract.</li>
<li>Amazon Web Services EMEA SARL, 38 avenue John F. Kennedy, L-1855 Luxembourg, for cloud services with a data centre in Frankfurt. Standard contractual clauses have been concluded by BSI with AWS, and a transfer impact assessment has been conducted by BSI.</li>
<li>Mailjet GmbH, Rankestraße 21, 10789 Berlin, is used for sending newsletters and emails.</li>
</ul>

Personal data is not transferred to third parties without your consent.

2.6. Right of Withdrawal

You can withdraw your consent to the processing of this data at any time without reason with future effect, either by email to datenschutz@bruendl.at or by calling +43 5 08388 13500.

3. Data processing "Newsletter Bründl Sports"

3.1. Scope of Processing Personal Data

On our website <a href="https://www.bruendl.at/de" rel="noreferrer" target="_new">https://www.bruendl.at/de</a>, there is the option to subscribe to a free newsletter to continuously receive information about BRÜNDL SPORTS products and activities. When signing up for the newsletter, we ask for your email address, which you can voluntarily provide so that we can send you the newsletter.

Additionally, during the registration process or automatically during the newsletter distribution, we process the following personal data:

<ul>
<li>IP address of the accessing computer</li>
<li>Date and time of registration</li>
<li>Objection to receiving the newsletter (date of objection)</li>
<li>Entry in the Robinson list (Yes/No)</li>
<li>Log data (date of dispatch, read receipt)</li>
</ul>

3.2. Legal Basis for Processing Personal Data

The subscription to the newsletter is only possible with your consent. The legal basis for processing is Art 6(1)(a) GDPR. The telecommunications regulations under § 174 TKG 2021 are complied with, as electronic contact through the mailing/newsletter distribution only occurs via newsletter registration.

3.3. Purpose of Data Processing

We process the data of visitors to our website who subscribe to the newsletter to fulfill the request for sending the newsletter.

3.4. Recipients of Data

Sport Management und Consulting GmbH, Kaprun, is appointed as the technical IT service provider for the distribution of the newsletter, who may have access to the data to the extent required for providing the services. Sport Management und Consulting GmbH has, in turn, commissioned BSI Business Systems Integration AG, Täfernweg 1, 5405 Baden, Switzerland, as an additional processor. Switzerland is a third country with an adequacy decision under Art. 45(1) and (3) GDPR. A corresponding data processing agreement according to Art. 28 GDPR has also been concluded. BSI Business Systems Integration AG uses Mailjet GmbH, Rankestraße 21, 10789 Berlin, as an additional processor for sending newsletters.

3.5. Duration of Storage

The data may be retained until you object to receiving the newsletter.

4. Data processing "Participation in Competition"

4.1. Scope of Processing Personal Data

Bründl Sports collects the following personal data about you when you declare your participation in a competition: first and last name, gender, language, address, email address, date of birth, name of guardian (if applicable), acceptance of the terms and conditions, consent to publication, and consent to receive advertising.

The data actually required to participate in the respective competition are marked as mandatory fields on the entry form and are obtained directly from you. Providing your data is voluntary; however, if you do not fill in these mandatory fields, we may not be able to allow your participation in the competition or award you any prize.

Additionally, we automatically collect the following data during participation in a competition: type and name of the competition, Facebook or Instagram user ID (if applicable), date of participation, content from the competition (e.g., answers to questions), type of prize.

In individual competition actions, Bründl Sports also takes and processes photographs during the awarding of the prize or during the enjoyment of the prize.

4.2. Legal Basis for Processing Personal Data

The legal basis for processing the data is Art 6(1)(b) GDPR, insofar as it concerns the determination of the winner, notification of the winners, and sending of the prize, and thus processing to fulfill our obligations from your participation in the competition. Additionally, we process the data in our legitimate interest to identify and document multiple winners in a row with their respective prizes and to detect fraudulent means in participating in the competition. We process the information about your age and guardian based on Art 6(1)(f) GDPR and therefore only to the extent legally necessary and for documentation in our legitimate interest, insofar as either participation in the competition itself requires the participant’s legal capacity or data protection regulations bind the processing of minors' data to the consent of their guardians. Your data as a winner will only be published based on your consent under Art 6(1)(a) GDPR (e.g., in a competition on Facebook, Instagram, or our website) or otherwise made public (e.g., mentioned during live draws). The taking and publication of photographs in the case of a public award of the prize is based on our overriding legitimate interest in illustrated event reporting (Art 6(1)(f) GDPR). Furthermore, photographs are only taken and published with your consent (Art 6(1)(a) GDPR).

The legal basis for processing your data for marketing purposes is Art 6(1)(a) GDPR. Processing the data for this purpose only takes place with your consent, which you can voluntarily declare when participating in the competition. The use of data for this purpose complies with the telecommunications regulations, particularly § 174 TKG 2021.

4.3. Purpose of Data Processing

We process the data to manage and organise participation in the competition, determine the winner, and distribute the prizes. The data processing is necessary to ensure that the winner can be determined and the prize awarded to the participants in compliance with the competition terms. We may also pass on your data to cooperation partners so that they can award the prize to the winner. We process the competition participant's age and guardian details if the prize requires a certain legal capacity or if the participant's data is processed via an information society service (e.g., Facebook or Instagram competition, competition on the website, or newsletter distribution).

Additionally, we announce the names of the winners and the prize they received on our website, and we process your data for publicity purposes (mentioning names during prize distribution, press releases, social media) only if you have given your consent. In the case of a public award of the prize, we will use the photographs taken during this event to illustrate our reporting on the event and the competition.

4.4. Duration of Storage

The personal data will be stored and processed for the purpose of fulfilling the contract, thus until the conclusion of the competition, and beyond that, as long as specific claims against us from a competition may arise, and lastly to the extent that statutory retention periods exist.

4.5. Recipients of Data

We may pass on your data to any cooperation partners for a specific competition so that they can award the prize to you. Any other use of your data by them will only take place with your consent.

5. Data processing "Analysis for product development and quality management"

5.1. Scope of Processing Personal Data

We use the transaction data from the "Customer Card System" data processing anonymised for analysis purposes to generate information for corporate alignment and product development/improvement.

5.2. Legal Basis for Processing Personal Data

The legal basis for processing the data, which is lawfully collected in accordance with the processing described in section 5.1 and anonymised, is Art 6(1)(f) GDPR. The protected interests of the customers are not affected by this.

5.3. Purpose of Data Processing

The personal data mentioned in section 5.1 are anonymised and used for analysis and interpretation in the areas of product development and quality management. The non-personalised results obtained from the analysis are used to create evaluations of the customer structure, as well as to assess customer interests and behaviour. These data generate information that serves to align corporate and sales strategies, assess potential future customer demand, and adapt and improve products and services, as well as develop concepts to better reach customers and meet their needs. We do not establish any personal reference with these evaluation results.

5.4. Duration of Storage

The data is anonymised and therefore retained without time limitation.

6. Data processing "General contact inquiries"

6.1. Scope of Processing Personal Data

You can contact us in writing via an online form or otherwise if you are interested in our concerns and activities. When you contact us, the data you voluntarily provide (first and last name; title; telephone number or email address; subject; content of your inquiry) is processed to answer your questions and handle your concerns. You are free to decide whether to provide us with your data for your inquiry. However, if you do not provide certain data, the online form cannot be sent as we would then be unable to properly handle your concern. We also process the date of the inquiry; content of the information/response, and the course of communication (log data) through automatic collection for documentation purposes.

6.2. Legal Basis for Processing Personal Data

We base the processing on Art 6(1)(a) GDPR, insofar as you have voluntarily provided us with the data and the inquiry does not constitute a pre-contractual measure; furthermore, we base the processing on Art 6(1)(f) GDPR to appropriately manage inquiries and organise responses.

6.3. Purpose of Data Processing

The purpose of storing and processing the data is to ensure that inquiries and responses are handled uniformly and promptly, and that the necessary data for contacting and communicating with you is available. Additionally, we process the data to manage these messages, particularly to assign them to the respective responsible employees and document the handling of the inquiry. If your inquiry pertains to a contractual obligation, we will further process your data internally within the processing activity "Processing of Data for Contract Execution."

6.4. Recipients of Data

Sport Management und Consulting GmbH, Kaprun, is appointed as the technical IT service provider for the operation of the online contact form, who may have access to the data to the extent required for providing IT services (particularly technical support, applying updates, etc.).

6.5. Duration of Storage

The data will be retained as long as there is contact with the data subject or until the consent is revoked, but no longer than one year after your last contact with us.

III. Skywalk

1.1. Scope of Processing Personal Data

At the glass bridge at our flagship store in Kaprun, we offer a photo point where each visitor can voluntarily take a souvenir photo. By pressing the release button, a photo is automatically taken within the capture radius and stored on a website managed on our behalf by Panomax GmbH (at <a href="https://photopoint.visit.at/view/bruendl/flagshipstore" rel="noreferrer" target="_new">https://photopoint.visit.at/view/bruendl/flagshipstore</a>) for 24 hours for download. The following data are therefore automatically collected when the release button is pressed: image data of the subject, time and location of the photo.

1.2. Legal Basis for Processing Personal Data

By pressing the release button, you consent to the recording of the image data, its storage for 24 hours, and its sharing with third parties who have also used the photo point within these 24 hours by uploading it to the website (Art 6(1)(a) GDPR).

As far as it concerns uninvolved persons who are accidentally visible in the capture area, we rely on our legitimate interest, which is to provide customers with a souvenir photo of their visit to the flagship store (Art 6(1)(f) GDPR).

1.3. Purpose of Data Processing

We operate a photo point to enable visitors to the flagship store in Kaprun to take photos on the glass bridge as a souvenir of their visit. Every visitor should have the opportunity to take a photo of themselves in the designated capture area on the glass bridge by pressing the release button at the photo point. Upon pressing the release button, a QR code is provided to the visitor, which allows access to a website where the image data are available for download at any time for 24 hours after the photo is taken. The capture area may also be entered by uninvolved persons, so the camera is set to a blur level that generally makes it impossible to identify such uninvolved persons. Only in certain cases (e.g., particularly distinctive features despite the blur) may persons in the background be identifiable in the captured photo. The web server on which the photos are stored for 24 hours is operated by Panomax GmbH, based in Henndorf/Salzburg, which we have commissioned for this purpose. The website can be accessed by anyone who has pressed the release button and received a QR code, thus having the opportunity to download the photos uploaded there for their own purposes free of charge.

The temporary storage of these data is necessary to allow you to download the souvenir photos afterward.

1.4. Recipients of Data

The image data stored at <a href="https://photopoint.visit.at/view/bruendl/flagshipstore" rel="noreferrer" target="_new">https://photopoint.visit.at/view/bruendl/flagshipstore</a> can also be viewed by other people who have entered the glass bridge and used the photo point within the last 24 hours. By using the photo point, you consent to this sharing.

Panomax GmbH, Salzburg, is commissioned as the IT service provider to organise the recording and storage, and may have access to the data to provide the technical services. A corresponding data processing agreement has been concluded.

1.5. Duration of Storage

The data are automatically deleted 24 hours after the upload.

IV. Information about the existence of automated decision-making

Automated decision-making, including profiling as per Art 22(1) and (4) GDPR, is not carried out by us and therefore does not exist.

V. Rights of the data subject

1. Right to Access 
You have the right to obtain from SPORT BRÜNDL confirmation as to whether or not personal data concerning you are being processed, and, where that is the case, access to the personal data and the following information:

(1) the purposes of the processing; 
(2) the categories of personal data concerned; 
(3) the recipients or categories of recipients to whom the personal data have been or will be disclosed; 
(4) the envisaged period for which the personal data will be stored, or, if not possible, the criteria used to determine that period; 
(5) the existence of the right to request rectification or erasure of personal data or restriction of processing of personal data concerning you or to object to such processing; 
(6) the right to lodge a complaint with a supervisory authority; 
(7) where the personal data are not collected from you, any available information as to their source; 
(8) the existence of automated decision-making, including profiling, referred to in Article 22(1) and (4) GDPR and, at least in those cases, meaningful information about the logic involved, as well as the significance and the envisaged consequences of such processing for you. You have the right to request information as to whether personal data concerning you are transferred to a third country or to an international organisation. In this context, you can request to be informed of the appropriate safeguards pursuant to Article 46 GDPR relating to the transfer.

2. Right to Rectification and Right to Restriction of Processing 
You have the right to obtain from SPORT BRÜNDL without undue delay the rectification of inaccurate or incomplete personal data concerning you. Under certain circumstances, for example, if the accuracy of the data is contested, you may request the restriction of processing of your data such that they may only be processed with your consent or for the establishment, exercise, or defence of legal claims or for the protection of the rights of another natural or legal person or for reasons of important public interest.

3. Right to Data Portability 
You have the right to receive the personal data concerning you, which you have provided to SPORT BRÜNDL, in a structured, commonly used, and machine-readable format and have the right to transmit those data to another controller without hindrance from the controller to which the personal data have been provided, where: (1) the processing is based on consent pursuant to Article 6(1)(a) GDPR or Article 9(2)(a) GDPR or on a contract pursuant to Article 6(1)(b) GDPR; and (2) the processing is carried out by automated means. In exercising this right, you also have the right to have the personal data transmitted directly from SPORT BRÜNDL to another controller, where technically feasible. This shall not adversely affect the rights and freedoms of others.

4. Right to Erasure 
You have the right to obtain from SPORT BRÜNDL the erasure of personal data concerning you under certain circumstances, such as when the data are not processed in accordance with data protection requirements. The so-called “right to be forgotten” does not apply to you because SPORT BRÜNDL does not make your personal data public under any circumstances. If you have exercised your right to rectification, erasure, or restriction of processing with SPORT BRÜNDL, we are obliged to communicate any rectification or erasure of personal data or restriction of processing to each recipient to whom the personal data have been disclosed unless this proves impossible or involves disproportionate effort.

5. Right to Object 
You have the right to object, on grounds relating to your particular situation, at any time to processing of personal data concerning you which is based on Article 6(1)(e) or (f) GDPR, including profiling based on those provisions. SPORT BRÜNDL shall no longer process the personal data unless we can demonstrate compelling legitimate grounds for the processing which override your interests, rights, and freedoms or for the establishment, exercise, or defence of legal claims.

6. Right to Withdraw Data Protection Consent 
You have the right to withdraw your data protection consent declaration at any time. The withdrawal of consent does not affect the lawfulness of processing based on consent before its withdrawal.

7. Supervisory Authority 
Without prejudice to any other administrative or judicial remedy, you have the right to lodge a complaint with the national supervisory authority of your place of residence if you consider that the processing of personal data relating to you infringes GDPR. In Austria, the competent authority is the Austrian Data Protection Authority in Vienna.