1. GENERAL
The protection of the privacy and personal data of our Friends Club members is of particular concern to us. We therefore process your data exclusively on the basis of the legal provisions (Regulation [EU] 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of individuals with regard to the processing of personal data, on the free movement of such data and repealing Directive 95/46/EC [GDPR], Data Protection Act 2018 [DPR 2018] and Telecommunications Act 2003 [TKG 2003]).
In this privacy policy we inform you about the processing of your personal data as well as your rights in connection with your membership of the my Ski amadé Friends Club. In particular, we inform you about which data is processed, who processes this data or has access to it, which data processing must be carried out, which data processing you can consent to and how this consent can be revoked.
This data protection declaration supplements the General Terms and Conditions of the my Ski amadé Friends Club, to which reference is made in particular with regard to the terms used (e.g. my Ski amadé Friends Club Partner). It concerns the processing of your personal data in the my Ski amadé Friends Club.
2. DATA PROTECTION RESPONSIBILITY
The data protection officer for the my Ski amadé Friends Club pursuant to Art. 4 Z 7 GDPR is Ski amadé GmbH, FN 473327 w, Prehauserplatz 3, 5550 Radstadt (hereinafter: Ski amadé).
In the my Ski amadé Friends Club, your personal data will be collected and processed exclusively by Ski amadé; your personal data will not be passed on to third parties (including the my Ski amadé Friends Club partners).
Within the my Ski amadé Friends Club, Ski amadé and the my Ski amadé Friends Club partners will conclude agreements containing provisions on who (and to what extent) within the my Ski amadé Friends Club is authorised to collect, process and forward your personal data and who is responsible for which obligations under the Data Protection Regulation.
In any case, Ski amadé is available to you as the first point of contact for data protection questions and concerns in connection with the my Ski amadé Friends Club. In particular, you can assert your rights under the Data Protection Regulation (point 8.) against Ski amadé. The possibility of asserting your rights against the my Ski amadé Friends Club partners remains unaffected.
Contacting Ski amadé can be done in the following ways:
Tel. + 43 6452 40333-60
Email my@skiamade.com
Post Ski amadé GmbH, Prehauserplatz 3, 5550 Radstadt
3. DATA PROCESSING
3.1. Data categories
Within the framework of the my Ski amadé Friends Club, Ski amadé processes the following categories of personal data:
3.1.1. Main customer data
- Customer number
- Surname
- First name
- Title
- Date of birth
- Address
- Email address with geolocation (x-coordinate, y-coordinate, meter spacing number of the address, quality of the geocoding).
- Telephone number
- Approved contact types (e.g. email, telephone, post, SMS, MMS, push messages) including any date of modification
- Consent (not) given to profiling including any date of revocation
- Interests (e.g. skiing, snowboarding etc.) (optional)
3.1.2. Friends Club Data
- Main customer data (see point 3.1.1.)
- Number of the membership card
- Registration date
- Registration channel
- IP address for online registration
- Consent for the processing of the IP address
- Permission for email transmissions including status survey Geolocation and date of address check
- Consent to the General Terms and Conditions
- Date of the last amendment to the GTC
- Use of the my Ski amadé Friends Club App
- Available media types (Smartphone, iOS, Android, Print@Home)
3.1.3. Transaction data
- Data processed during transactions in points of sale and other distribution channels (e.g. web shop)#
- Date, time and place of the transaction
- Goods/services purchased
- Transaction frequency
- Transaction category
- Voucher ID
- Turnover of the transaction
- Discounts granted and redeemed or non-discountable turnover
- Transaction ID
- POS ID
- Promotion ID
- Value Added Tax
- Payment method (cash or card)
- Data from the use of the Ski amadé infrastructure (location, date, time of use etc.)
3.1.4. Profiling data
- Data from the merging and analysis of Friends Club data and transaction data (e.g. to create movement profiles).
- Data on customer and transaction profiles (probability of future transactions, offer optimisation, target group selections, matching for individualised information, advertising and offers).
- Data from the Friends Club member's reaction to advertising measures by email (opening of advertising contained therein, clicks on links contained therein, duration of engagement with advertising measures, end device, operating system and browser on which advertising measures were called up, date, time and place of calling up the advertising measure, IP address at the time of calling up the advertising measure and use of social networks, as well as collection of any sharing of the content of the advertising measures on these).
- Data from the use of the Ski amadé website
- Data from the use of the Ski amadé app
3.2 Purpose and legal basis of data processing
3.2.1 Administration of the Ski amadé Friends Club memberships
Ski amadé processes your main customer data and Friends Club data to manage your Ski amadé Friends Club membership. For this purpose, your main customer data is first collected and you are assigned a Friends Club number, which entitles you to participate in the Ski amadé Friends Club. You will also be given access to your personal Ski amadé Friends Club account via the login area of the Ski amadé Friends Club website. Here you can manage your membership and, for example, give and revoke your consent to the processing of your transaction data and profiling data. Your Friends Club data is also processed by Ski amadé to communicate changes to the Ski amadé Friends Club and to prevent misuse of your Ski amadé Friends Club membership (see point 4.4 of the GTC).
The legal basis for this data processing is the fulfilment of the contract in accordance with Art 6 Para 1 lit b GDPR as well as our legitimate interest in preventing misuse in accordance with Art 6 Para 1 lit f GDPR.
3.2.2. Execution and recording of transactions
Ski amadé processes your main customer data, Friends Club data and transaction data in individual processing operations when using the Ski amadé infrastructure and transactions carried out by you within the framework of the Ski amadé customer club.
The legal basis for this data processing is the fulfilment of the contract in accordance with Art 6 Para 1 lit b DSGVO or our legitimate interest in accordance with Art 6 Para 1 lit f DSGVO, as the operation of the my Ski amadé Friends Club is not expedient without this data processing.
3.2.3. Advertising (without profiling)
Ski amadé processes your main customer data to send advertising, information and special offers from Ski amadé and my Ski amadé Friends Club partners. The mailing takes place via a contact method approved by you. This type of advertising does not involve profiling.
The legal basis for this data processing is our legitimate interest within the meaning of Art 6 Para 1 lit f GDPR in providing information, special offers and advertising from Ski amadé in order to achieve customer loyalty within the framework of the my Ski amadé Friends Club.
3.2.4. Profiling
If you give your consent, Ski amadé will process your main customer data, Friends Club data, transaction data and profiling data by means of automated processing and analysis for the purpose of personalising advertising measures, discounts and similar offers as well as carrying out market research measures and obtaining new profiling data. In the process, your data collected in the course of using the Ski amadé infrastructure or a transaction is merged with your main customer data and Friends Club data and analysed.
This type of data processing is profiling as defined in Art. 4 Z 4 GDPR. Ski amadé uses the processed data to create a profile of the Friends Club member, which allows conclusions to be drawn about the likelihood of future use and transactions, optimisation of offers, selection of target groups, coordination for individualised information, advertising and offers and the creation of a movement profile of the Friends Club member (within the Ski amadé region).
Through this type of data processing, you will receive information from Ski amadé tailored to your usage and transaction behaviour about special offers, discounts or similar offers from Ski amadé as well as individual advertising measures for the type of contact you have approved.
The legal basis for this data processing is your consent pursuant to Art 6 Para 1 lit a GDPR. Consent is given in your Ski amadé Friends Club account on the Ski amadé Friends Club website or in writing using a contact method approved by you. It also includes the collection and processing of data from the response to advertising measures by email. Consent can be revoked at any time (in the same way) without affecting the lawfulness of the data processing carried out on the basis of the consent until revocation. Ski amadé does not carry out any profiling without your consent or after revoking it. Of course, (further) participation in the Ski amadé Friends Club is open to you even without consent to profiling.
4. PROCESSOR
In order to provide certain services within the framework of the Ski amadé Friends Club, Ski amadé uses various processors within the meaning of Section 28 GDPR (e.g. IT service providers for the operation of the website https://www.skiamade.com/de, transmission of data between Ski amadé and the Ski amadé Friends Club partners, storage of your data, sending of information, delivery companies, payment service providers, market research institutes). Ski amadé has concluded processing contracts with the various processors. These contracts are monitored on an ongoing basis and their up-to-datedness in terms of data protection law as well as compliance with data protection regulations by the processors is checked. The processors process your personal data exclusively on the instructions of Ski amadé and only to the extent that this is absolutely necessary for the fulfilment of their mandate. Your personal data will be deleted after completion of the order by the order processor. Any further processing of your personal data by the order processors is excluded.
Ski amadé (as far as possible) only uses processors that are based within the European Union and are subject to the provisions of the GDPR. Should Ski amadé exceptionally use a processor from a third country (as defined by the GDPR), less strict data protection rules may apply to this processor. Insofar as your personal data is processed in a country that does not have a level of data protection comparable to that of the European Union, Ski amadé will ensure that your personal data is adequately protected through corresponding contractual provisions or other legally binding instruments.
5. DATA SECURITY
The security of your personal data is particularly important to us. Ski amadé therefore takes the following appropriate technical and organisational measures within the meaning of Article 32 of the GDPR to protect your data against loss, destruction, access, alteration and processing by unauthorised persons, considering the state of the art, the cost of implementation and the nature, scope, circumstances and purposes of the processing, as well as the likelihood and severity of the risk to the rights and freedoms of natural persons:
- Pseudonymisation and encryption of personal data;
- Ensuring the confidentiality, integrity, availability and resilience of the systems and services related to the processing;
- Ensure rapid restoration of availability of personal data in the event of a physical or technical incident;
- Use of a procedure to regularly review, assess and evaluate the effectiveness of technical and organisational measures to ensure the security of processing.
Please note that Ski amadé accepts no liability for the disclosure of information due to errors in data transmission not caused by Ski amadé or not attributable to Ski amadé and/or unauthorised access by third parties, e.g. hacker attacks.
6. STORAGE DURATION
6.1. Main customer data, Friends Club data, transaction data
Ski amadé stores your main customer data, Friends Club data and transaction data only for as long as you participate in the my Ski amadé Friends Club. In addition, this data remains stored by Ski amadé if this is necessary due to legal storage obligations (e.g. § 212 UGB and § 132 BAO) or for the conduct of any legal proceedings. For the purpose of providing evidence, your personal data may be processed until the expiry of the statutory limitation periods, insofar as this is necessary for the potential conduct of proceedings. The applicable statutory limitation period is generally three years.
6.2. Profiling data
Ski amadé deletes the profiling data after revocation of consent, otherwise at the latest after the end of your membership in the Ski amadé Friends Club. Ski amadé deletes your annual sales in accordance with the legal provisions (e.g. § 212 UGB and § 132 BAO) after seven years.
6.3. The principle of storage limitation
In order to comply with the principle of storage limitation, Ski amadé will delete your personal data - insofar as this does not conflict with any mandatory legal provisions - if you do not make any use of or transactions within the framework of the my Ski amadé Friends Club for a period of more than five years and do not expressly maintain your membership of the my Ski amadé Friends Club.
7. THIRD PARTY
The my Ski amadé Friends Club website contains links to other websites, advertising measures etc. over whose content Ski amadé has no influence. Ski amadé accepts no liability whatsoever for the content of these websites, advertising measures etc. The respective provider is solely responsible for the content and accuracy of the information provided there.
8. RIGHTS OF SKI AMADÉ FRIENDS CLUB MEMBERS
According to the GDPR, you have the following rights, which you can assert against Ski amadé at any time:
8.1. Right of access (Art 15 GDPR)
You have the right to request confirmation from Ski amadé as to whether your personal data is being processed. In addition, you have the right to request further information about specific processing purposes, categories of personal data, recipients or categories of recipients of personal data, storage periods, the existence of a right to deletion or rectification of your personal data or to restriction of processing and the right to object, the existence of a right to lodge a complaint and all available information about the origin of your data.
8.2. Right of rectification (Art 16 GDPR)
You have the right to request Ski amadé to correct your personal data without delay. This right includes the correction of incorrect data and the completion of incomplete personal data.
8.3. Right to delete (Art 17 GDPR)
You have the right to demand that Ski amadé delete your personal data without delay, provided that the reasons set out in Art 17 (1) lit a to f of the GDPR apply and the processing of your personal data is not (or is no longer) necessary.
8.4. Right to restriction of processing (Art 18 GDPR)
Under the conditions set out in Art. 18 GDPR, you also have the right to request Ski amadé to restrict the processing of your personal data.
8.5. Right to data portability (Art 20 GDPR)
You have the right to receive personal data relating to you that you have provided to Ski amadé in a structured, commonly used format and to request Ski amadé to transfer this data to another person responsible.
8.6. Right to object (Art 21 GDPR)
You have the right to object at any time to the processing of your personal data processed within the Ski amadé Friends Club.
8.7. Revocation of declarations of consent (Art 7 GDPR)
You have the option of revoking any consent you have given to Ski amadé at any time. The revocation of your consent does not affect the lawfulness of the processing carried out on the basis of this consent until revocation.
8.8. Right of appeal
In addition, you can lodge a complaint at any time with the Austrian Data Protection Authority, Barichgasse 40-42, 1030 Vienna, Tel. +43 1 52152-0, email: dsb@dsb.gv.at.
You can exercise your rights vis-à-vis Ski amadé in the following ways:
Tel. + 43 6452 40333-60
Email my@skiamade.com
Post Ski amadé GmbH, Prehauserplatz 3, 5550 Radstadt