Data Protection Notice
1. Personal Data
Personal data are all data that contain information about personal or factual circumstances, such as name, address, email address, telephone number, date of birth, age, gender, video recordings and payment information.
We only collect, process and use your personal data if this is necessary for the fulfilment of a contract, due to a legal obligation, or if you provide us with this data voluntarily. We will obtain your consent before processing any data beyond the aforementioned reasons. If our legitimate interest in data processing prevails over your interest in data protection, the processing may also be carried out without your consent.
As a rule, we collect your data directly from you. However, in the course of the conclusion of a contract, it may occur that we collect your data from third parties, for example in the case of bookings by tour operators, booking platforms, online shops and contractual partners in the Tux-Finkenberg tourist region.
We would like to inform you that the provision of personal data is partly required by law (e.g. tax regulations) or may result from contractual regulations (e.g. information on the contractual partner). Failure to provide personal data would mean that the contract could not be concluded.
2. Purpose and Legal Basis
a.) Service Provision:
Name, date of birth, address as well as payment details will be collected for tickets issued for a period of 1 day or more, possibly for the purpose that the person responsible knows with whom the contract was concluded and to whom a service obligation exists. The processing of this data and for this purpose is carried out in accordance with the legal basis that applies to fulfilment of the contract, in accordance with Art. 6 Para. 1 lit. b) of the GDPR.
Tickets can be used in several areas operated by legally independent cable car companies. In order to make this possible and for internal billing between the individual cable car companies, data is transmitted to members of the “IG” syndicate (point 27) for approval purposes and processed by them. The processing of this data is carried out upon the legal basis that applies to the fulfilment of contract, in accordance with Art. 6 Para. 1 lit. b) of the GDPR, as well as the legal basis of legitimate interest, in accordance with Article 6 (1) (f) of the GDPR.
b.) Misuse Control:
In the case of tickets in which Photocompare is active, a reference photo will be created when the ticket is used for the first time, provided that the terminal used has the technical facilities required and the Photocompare process is active. This reference photo will be compared with a control photo at a later date, to check whether the ticket has been passed on without authorisation. The processing of this data and for this purpose is carried out in accordance with the legal basis that applies to legitimate interest, in accordance with Art. 6 Para. 1 lit. b) of the GDPR.
As part of our online offer, we use content or services offered by third-party providers on the basis of our legitimate interests (i.e. interest in the analysis, optimisation and economic operation of our offer, in accordance with Art. 6 Para. 1 lit. f. of the GDPR) in order to integrate their content and services.
This requires that your anonymised IP address is transmitted to the third-party providers, as without the IP address the contents cannot be sent to your browser. The IP address is required to display this content. Third party providers may also use so-called web beacons for statistical or marketing purposes. Web beacons can be used to evaluate information such as visitor traffic to the website. A cookie may also be placed for this purpose, which contains technical information on the browser and operating system, referring websites, visiting time and other information on the use of our website.
3. Data Security
Protection of your personal data is carried out using appropriate technical and organisational measures. These measures relate, in particular, to protection against unauthorised, illegal or even accidental access, loss, processing, use and manipulation.
4. Transmission of Data to Third Parties
We process your personal data with the support of external contract processors, who support us in providing their services (e.g. web hosts, e-mail newsletter dispatch service, booking services). These contractors are strictly obliged to protect your personal data and may not process your personal data for any other purpose than to provide our services. Your personal data will only be passed on to regular business service providers such as banks (in case of money transfers from or to you), tax consultants (if they are part of our accounting department) or public authorities. Our processors are for example external IT service providers. Below you will find a list of processors or recipients of data used by us:
- The administration of ticket data and the transfer of data to members of the syndicate is carried out by SKIDATA AG, FN 59669z, Untersbergstraße 40, 5083 Grödig/Salzburg. SKIDATA also provides the Photocompare procedure described in Section 2.
- We use the Tag Manager from Google Inc., 1600 Amphitheater Parkway, Mountain View, CA 94043, USA on our website to integrate tracking codes and code fragments. However, the tag manager does not collect any personal data itself and does not use any cookies. Rather, it serves to insert tags or code fragments on our website in a controlled manner.
- We use the Google Analytics service from Google Inc., 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA, to analyse visitor behaviour on our website.
- We use the service of Matomo (formerly PIWIK) for further analysis of visitor behaviour on our website, which is installed on our own servers by our external processor, Cookis GmbH, Franz-Xaver-Rennstraße 4, 6460 Imst, Austria.
- We use a voucher system from INCERT eTourismus GmbH & Co KG, Leonfelder Straße 328, 4040 Linz, Austria. This collects personal data in the course of voucher sales and, as an order processor, is obligated by us to protect your data.
We only transfer your data to other recipients if you have either given us or the recipient your consent to the data transfer, the data transfer is required to conclude the contract or to fulfil the contract, or we are legally obliged to transfer the data.
We transfer your personal data to recipients within the European Union or to countries for which the EU Commission has decreed they have adequate levels of data protection. If we transfer data to companies in the USA, these companies participate in the EU-US Privacy Shield. By self-certifying under the Privacy Shield, these companies undertake to comply with the provisions of the GDPR. Further information on the Privacy Shield can be found under: https://www.privacyshield.gov/welcome.
5. Data Storage
a.) Storage fo the fulfilment of contractual of legal obligations:
We store your data for as long as necessary to fulfil our contractual or legal obligations. For example, we are obliged to retain our accounting records for a period of 7 years from the end of the calendar year in question.
When storing your data, we will ensure that your data is only used to the extent necessary for the aforementioned purposes.
b.) Storage based on your consent:
Provided that you have given us your consent, we will store your data for as long as this is stipulated in your declaration of consent or other consent, for example within the scope of a contract with you.
c.) Storage based on legitimate interests:
Moreover, we will store your data for as long as this is necessary to defend against liability or other claims within the scope of the statutory limitation periods. According to Austrian law, these are generally 3 years from the date of discovering the damage has occurred and the damaging party.
Reference photos (see points 2 and 5) will be stored for the validity of the respective ticket and deleted afterwards. Control photos (photos used for comparison with the reference photo) are deleted no later than 48 hours after passing through a turnstile. If control photos are required to prove misuse, they will be stored for 14 days.
Video surveillance on or in buildings is stored for a maximum of 72 hours for the purpose of property protection.
Booking enquiries that did not lead to the conclusion of a contract will be stored by us for the purpose of internal analysis, such as the analysis of our offer, for a period of 12 months.
We will store job application documents for a period of 12 months.
d.) Obligations of deletion based on the right erasure:
Our obligations to delete data if you exercise your right to erasure in accordance with Art 17 of the GDPR are not affected by the above paragraphs.
6. Server Log Files
This website processes the following personal data in a server log file, for the purpose of monitoring technical functions and increasing operational security of the web server, on the basis of the overriding legitimate interest of the person responsible in accordance with Art. 6 Par. 1 of the GDPR. (technical security measures):
- IP adress
- Time and date of the server request
- Operating system used
- Retrieved content
- IP adresses are not pseudonymised
The Logfiles are stored for a period of 30 days.
The server location is Austria.
The anonymous data of the server log files are stored separately from all other personal data.
7. SSL Encryption
This site uses SSL encryption for security reasons and to protect the transmission of confidential content, such as enquiries that you send to us as the site operator. You can recognise an encrypted connection in your browser's address line when it changes from "http://" to "https://" and the lock icon is displayed in your browser's address bar. If SSL encryption is activated, the data you transfer to us cannot be read by third parties.
If you do not want this to be the case, simply set up your browser so that it informs you about the placement of cookies and warns you before a cookie is saved. If the cookies we use are subject to approval, we will obtain your consent in advance. Disabling cookies may limit the functionality of our website.
The provider of the following services is Facebook Ireland Ltd, 4 Grand Canal Square, Grand Canal Harbour, Dublin 2, Ireland.
a.) Link to our Facebook page:
When you visit our site, no automatic connection to Facebook is established. However, we do refer to our company Facebook fan page on different pages via texts, competitions or social media icons. If you are logged in to Facebook and access our page via the links on this website, Facebook will gain knowledge of your previously visited page. If you do not want this to happen, please log out of Facebook before clicking on any of the links.
For more information, please visit: https://de-de.facebook.com/privacy/explanation.
Google Ireland Limited, Reg# 368047, Gordon House, Barrow Street, Dublin, D04 E5W5, Dublin is the provider of the following services:
a.) Google Analytics:
Google Analytics is a service for collecting, collecting and evaluating data on the behaviour of visitors to websites. Google uses the data and information obtained to evaluate the use of our website and to provide further services in connection with the use of our website.
Google Analytics places a cookie on the device that you use to access our website. By placing this cookie, Google can analyse the use of our website. This cookie causes the internet browser to transmit data to Google for the purpose of online analysis. As part of this technical process, Google receives personal data information, such as the IP address of the person concerned, which Google uses, among other things, to trace the origin of visitors and clicks and subsequently to enable commission calculations.
We use the "_gat._anonymizeIp" addition for web analysis via Google Analytics. With this addition, the IP address is shortened and anonymised by Google.
For more information, please visit: https://www.google.com/intl/de_de/analytics/ and https://www.google.de/intl/de/policies/privacy/. If you wish to object to this data processing, please contact us for further information. An opt-out is possible by installing the following plugin: https://tools.google.com/dlpage/gaoptout?hl=de
Google Remarketing is a function of Google AdWords, which enables us to show you advertisements if you have previously visited our website.
Google Remarketing places a cookie, which enables you to be recognised when you subsequently visit websites that are also members of the Google advertising network. Cookies are used to store personal information, such as the websites you visit. Every time you visit a website on which the Google Remarketing service has been integrated, your internet browser automatically identifies with Google. As part of this technical process, Google receives personal data information, such as the IP address or surfing behaviour of the user.
An opt-out is possible under the following link: https://adssettings.google.com/authenticated?hl=de You can also set your browser up in such a manner that third-party cookies cannot be placed.
c.) Google AdWords:
Google AdWords is an internet advertising service that allows advertisers to display ads in Google's search engine results, as well as in the Google advertising network.
If you landed on our website via a Google ad, a so-called conversion cookie will be stored on your system. The conversion cookie is used to store personal information, such as websites visited. A conversion cookie loses its validity after thirty days and is not used for your identification. The conversion cookie is used to track whether you have accessed certain sub-pages of our website, for example an online shop. The conversion cookie enables both us and Google to track whether a sale was generated by your use. The data and information collected is used by Google to generate visitor statistics for our website. Neither we nor other advertising customers of Google AdWords receive information that could be used to identify you.
d.) Double Click:
By deactivating the interest-based ads of the providers who are part of the self-regulation campaign "About Ads" via the link http://www.aboutads.info/choices, whereby this setting is deleted when you delete your cookies;
Further information can be found under: https://www.google.de/doubleclick.
We use video services of the YouTube Company, LLC, 901 Cherry Ave, San Bruno, CA 94066, USA on this website.
By calling up pages on our website that have integrated YouTube videos, data is transmitted to YouTube, stored and evaluated.
If you have a YouTube account and are logged in, this data will be assigned to your personal account and the data stored in it. You can prevent this by logging out of your YouTube account.
Functions of the Instagram service are integrated on our website. These functions are offered by Instagram Inc., 1601 Willow Road, Menlo Park, CA, 94025, USA. If you are logged into your Instagram account, you can link the content of our pages with your Instagram profile by clicking the Instagram button. This allows Instagram to associate your visit to our pages with your user account. As the provider of the pages, we would like to point out that we do not have any knowledge of the content of the transmitted data or its use by Instagram.
On our site we use social plugins from the Pinterest social network, which is operated by Pinterest Inc., 635 High Street, Palo Alto, CA, 94301, USA ("Pinterest"). When you call up a web page on our Internet site that includes a plugin of this type, your browser establishes a direct connection with Pinterest servers. The plugin transfers log data to the Pinterest server in the USA. This log data may include your IP address, the address of the websites visited that also contain Pinterest functions, the type and settings of the browser, the date and time of the request, your use of Pinterest and cookies.
You can change your privacy settings on Twitter in the account settings at http://twitter.com/account/settings
The newsletter will only be sent with your consent or legal permission. If you would like to receive our newsletter, we only require your e-mail address, otherwise no newsletter can be sent. The provision of information beyond your e-mail address is optional and serves only to personalise the offer (e.g. by selecting a topic area to be informed about with the newsletter). The data is used for the purpose of sending advertising. The data will be deleted as soon as you withdraw your consent to receive the newsletter. You can send us your revocation using the contact details below. Alternatively, you can unsubscribe directly in the newsletter.
To send the newsletter, we need your confirmation that you are the owner of the email address (the so-called double opt-in). This confirmation is necessary to ensure that you have subscribed to the newsletter. Registrations for the newsletter will be logged in order to prove the registration process. This includes storage of subscription details and the time of confirmation, as well as the IP address. Similarly, any changes to your stored data are also logged. You can unsubscribe at any time by using the unsubscribe option provided in the newsletter.
When retrieving the newsletter, technical information, such as information on the browser and your system, as well as your IP address and time of retrieval are collected by a web beacon. This information is used for technical improvement of the services based on the technical data or target groups and reading behaviour or access times. Also included in the statistical survey is information regarding whether the newsletters are opened, when they are opened, and which links are clicked on. For technical reasons, this information can be assigned to the individual newsletter recipients.
This website uses Hotjar, a web analysis tool. The provider is Hotjar Ltd. at 2, St Julian's Business Center, 3, Elia Zammit Street, St Julian's STJ 1000 in Malta. Interactions of randomly selected, individual visitors with the website are recorded anonymously with Hotjar. This creates a log of e.g. mouse movements and clicks with the aim of showing possible improvements to the respective website. In addition, information on the operating system, browser, incoming and outgoing links, geographical origin, as well as resolution and type of device are evaluated for statistical purposes. This information is not personal and will not be passed on to third parties by Hotjar.
If you contact us via the form on the website or by e-mail, your data will be stored for six months for the purpose of processing your enquiry and deal with potential follow-up questions. We will not share this information without your consent.
After submission of the contact form, the data referred to above will be processed by the data protection officer for the purpose of processing your request, on the basis of your consent being given by submitting the form.
There is no legal or contractual obligation to provide personal information. Failure to provide the requested personal data means that we will be unable to forward your request and that we are unable to process it.
You have the right to revoke your consent at any time by giving written notice without affecting the legality of the processing already carried out on the basis of consent until revocation.
18. Notes on our Facebook page
If you participate in one of our competitions, the following data is collected: first name, last name, date of birth, email address and address. This data is required to carry out the competition and will only be used for this purpose. In this respect, we rely on the legal basis that applies to fulfilment of the contract, in accordance with Art. 6 Para. 1 lit. b) of the GDPR for data processing.
If you have given your consent in the course of the competition, your name will be published on our social media channels and on our website. You can revoke this consent at any time. In this case we will delete the social media post.
You can find more information on our competitions and terms of participation at https://www.hintertuxergletscher.at/de/service3/gewinnspielhinweis/
20. Data storage in the web shop (Incert voucher and ticket sales)
Based on a separate agreement on the processing of personal data, your data will be collected and processed by Firma INCERT eTourismus GmbH & Co KG, Leonfelder Straße 328, 4040 Linz on our behalf, as part of order data processing in accordance with Art. 28 of the GDPR. As an order processor for support operations, Incert eTourismus also has access to your data, but may only use it for support operations and not for their own purposes.
The data provided by you is necessary for the fulfilment of the contract or for the implementation of pre-contractual measures. (Art. 6 Para. 1 b of the GDPR). Without this data we cannot conclude the contract with you. No data will be transferred to third parties, with the exception of the transfer of credit card details to the processing bank / payment service provider for the purpose of debiting the purchase price, as well as to our tax advisor to fulfil our tax obligations.
21. Data storage on the Web Shop (Starjack)
22. Storage and deletion of data in the web shop
If the purchase or order process is terminated, the data stored by us will be deleted after 14 days in order to support any problems that may arise during the order process.
In the event of a contract being concluded, all data from the contractual relationship will be stored until the tax retention period of 7 years has expired.
After a declared objection, the Zillertaler Gletscherbahn GmbH & Co. KG will arrange for the deletion of the data on its own premises and those of any third parties to whom the data has been transmitted. Data processing is based on the statutory provisions of § 96 (3) TKG (Austrian Telecommunications Act) and Art. 6 para. 1 a) (consent) and/or b) (necessary for fulfilment of the contract) of the GDPR (General Data Protection Regulation).
23. Reservation of Training Slopes
By signing the agreement for the reservation of a training slope, the reserving party agrees that the name of the trainer, the name of the training team and other personal information may be published in publicly accessible places in the ski area (e.g. Gletscherbus 2 cable car station) for the purpose of organising training activities. Data processing is based on the statutory provisions of Art. 6 para. 1 b (necessary for fulfilment of the contract) of the GDPR.
24. Job Applications
You will find information about vacancies in our company on our website. As part of the application process, you have the option of sending us your application documents electronically by e-mail or by post. Your data will be used and stored for the purpose of evaluation in the application process, for contacting you in the application process and, if applicable, for the establishment of an employment relationship.
25. Your rights
In principle, you have the right to information, correction, deletion, restriction, data portability, revocation and objection.
You have the right to revoke a given consent at any time. In case of revocation, the data processing carried out up to this point in time remains lawful.
If you believe that the processing of your personal data by us violates applicable data protection law, you have the option of complaining to a competent supervisory authority. In Austria, the Data Protection Authority is responsible for this (https://www.dsb.gv.at/).
26. Photo References of Zillertaler Gletscherbahn Events
During Zillertaler Gletscherbahn events, photo and video recordings are made and published on our website, on our social media channels [Facebook and Instagram] and in printed media. The legal basis for this is in accordance with Art 6 Para 1 lit f of the GDPR and Sections 12, 13 DSG: Public relations and presentation of Zillertaler Gletscherbahn activities, in order to increase awareness levels about the Hintertux Glacier, Ski and Glacier World Zillertal 3000 and the region.
You can lodge your right to object to the processing under email@example.com
However, it can be assumed that the interest of the person responsible for the production and use of the photos does not interfere excessively with the rights and liberties of natural persons, especially since they have entered public space, the production and use of the photos has been emphasised in advance and during the event, and care is taken both in the production of photos and in their publication to ensure that no legitimate interests of the persons depicted are violated. If the rights and liberties of a person depicted are infringed for reasons worthy of special consideration, we will take appropriate measures to prevent further processing. It is not possible to make them unrecognizable in print media that have already been published. Deletion on the website or in social media channels will take place within the scope of technical possibilities.
27. Contact details
Responsible for the following companies:
- Zillertaler Gletscherbahn GmbH & CoKG
- Tuxer Bergbahnen GmbH
- Finkenberger Almbahnen GmbH
ZILLERTALER GLETSCHERBAHN GmbH & Co KG
Company registration number: FN 18574s Innsbruck Regional Court
27. Zillertal Cable Car Syndicate ("IG")
The person responsible is a member of the Zillertal Cable Car Syndicate (“IG”), a company subject to civil law. The cable car companies have joined to form this syndicate for marketing and accounting purposes. Due to the lack of legal entity, the syndicate consists of the legally independent operating companies. The “IG” syndicate comprises of the following members:
28. Amendment of this privacy statement