When using the functions of our website, shopping in our stores or communicating with us, personal data may be processed in various ways, about which we provide detailed information below.
The entity responsible for processing your personal data in connection with the purchase or rental of sports equipment is the Bründl Sports company that operates the shop where you bought or rented the goods. These are the following companies:
Sport Bründl Gesellschaft m.b.H.
Tel: +43 6547 83 88-0
Email: office@bruendl.at
or
Schmittenhöhe-Service GmbH
Tel: +43 6547 83 88-0
Email: office@bruendl.at
or
Sports & Emotions GmbH
Tel: +43 6547 83 88-0
Email: office@bruendl.at
or
Planai Sport GmbH
Tel: +43 6547 83 88-0
Email: office@bruendl.at
The companies all belong to the BRÜNDL SPORTS brand and are each located at the following address: Nikolaus-Gassner-Straße 4, 5710 Kaprun. Hereinafter, they will each be referred to individually as "We," "Us," or the "Controller."
1.1. Scope of Processing Personal Data
We may process the following personal data about you when concluding a contract related to a purchase or rental in the shop: first and last name, billing address, shipping address, telephone number, email address, bank account details, identification data in exceptional cases (type of ID, issue date, issuing authority). Additionally, during the payment process, we collect the following data: receipt number, customer number (if available), information about the goods, unit price, total purchase price, payment method.
1.2. Legal Basis for Processing Personal Data
The legal basis for the data processing under section 1.1. is Art 6(1)(b) GDPR, which means the necessity to fulfill a contract or other request. Providing your contact details is voluntary; of course, a purchase can be made without providing personal data. However, if these data are necessary to process the purchase contract in exceptional cases and you do not provide them, we may not be able to process the purchase or rental accordingly.
1.3. Purpose of Data Processing
The system is used for the internal management of customer relationships and the central recording of customer data as necessary for the processing of a purchase or rental. This data processing supports the controller in maintaining customer relationships (contact management), including the prompt and efficient handling of inquiries, and promotes an overview of the status of contract processing and customer inquiries, as well as a systematic recording and management of business cases. This enables structured customer care.
1.4. Duration of Storage
These data are deleted after the contractual relationship with the customer has ended, unless the data are needed beyond this for tax retention purposes or as long as claims from the contractual relationship can still be asserted.
1.5. External Recipients of Data
We use an IT service provider, Sport Management und Consulting GmbH, Kaprun, for the storage and hosting of personal data, who may have access to personal data as instructed by the controller to provide the commissioned IT services.
We share your data with banks for payment processing, legal representatives, courts, and authorities in the event of legal disputes, collection agencies for debt collection, and possibly other third parties involved in providing services to you (e.g., suppliers).
Your data will not be shared with external third parties for their own purposes without your consent. Personal data may be shared within the company for other purposes, such as accounting for billing.
2.1 Scope of Processing Personal Data
The controller stores and processes the following data of the person with whom the rental contract for the sports equipment is concluded: customer number, first name, last name, address, postcode, city, and country of origin, which you provide to us when requesting the rental of sports equipment via the online form on the BRÜNDL SPORTS website or in a shop. Providing this data is voluntary; however, if you do not provide it, the controller may not be able to process your rental request and lend you the equipment.
Additionally, if a rental contract is concluded in a shop, we also collect information about the type of rented sports equipment (skis, bike), and other details about the rented sports equipment, such as item description, quantity, EAN code, as well as the rental price and any discounts granted.
During the rental process in the shop, in the case of ski rentals, we also collect the date of birth, height, weight, shoe size, sole length, and skier type (skill level) of the user, which we need to correctly adjust the ski binding. If you are renting the equipment for another person, you must provide the first and last name of that person and your relationship with them. Providing this data is necessary to conclude the rental contract. If you do not provide this data, we cannot lend you the skis.
If you express your interest in renting sports equipment at your hotel or travel agency, this hotel or travel agency will, with your consent, provide us with your first and last name, your status as a hotel guest/travel agency customer, and your interest in ski/bike rental. In such cases, we process, in addition to the data provided by the hotel/travel agency, the name of the hotel or travel agency and the name of any tour guide.
If you decide to reserve rental equipment together with other people, their data will be provided to us either directly by you or by a person you have selected as the contact person.
2.2 Legal Basis for Processing Personal Data
The legal basis for processing the data under section 2.1 in connection with the rental contract and use of the sports equipment is Art 6(1)(b) GDPR, thus processing for the fulfillment of a contract. We process data related to the hotel/travel agency based on our legitimate interest under Art 6(1)(f) GDPR to fulfill the contract with the travel agency and/or hotel in connection with the rental of sports equipment. If you rent sports equipment for another person or we receive your data through a contact person, we process your data to fulfill the contract under Art 6(1)(b) GDPR and based on our legitimate interest under Art 6(1)(f) GDPR, after you have disclosed your relationship with this person to us or this contact person has declared to us that they are providing the data on their behalf and with their consent.
2.3 Purpose of Data Processing
The personal data listed under section 2.1 are processed by us for the purpose of fulfilling and processing the rental contract for sports equipment. We process certain data mentioned in section 2.1 about the rental customer, who is the person concluding the contract with us, regardless of the use of the sports equipment, to properly fulfill the respective contractual obligations arising from the rental of sports equipment.
Further information regarding the specific use of the sports equipment is also necessary to fulfill the rental contract. We process the user's date of birth to determine the age group for the binding release setting and also if you simultaneously purchase a lift ticket from us, as different prices apply for certain age groups.
We use the user's body data to properly adjust the ski binding, which we are obligated to do under the rental contract. The scope of the data collected is determined by ÖNORM ISO 11088 (assembly, adjustment, and inspection of the ski-binding-boot (S-B-S) unit for alpine skiing) and ÖNORM ISO 13993 (procedures in ski rental - sampling and testing of complete and incomplete functional units of alpine ski-binding-boot in ski rental) along with the associated adjustment guidelines, which apply to the assembly of special binding-boot combinations, which must always be checked when forming a new combination.
2.4 Duration of Storage
The personal data are stored during the business relationship with you as a rental customer and beyond, as long as legal claims arising from the rental can be asserted and/or statutory retention periods exist.
2.5 Recipients of Data
We use Sport Management und Consulting GmbH, Kaprun, as an IT service provider for recording rental orders and handling the rental service. They have access to personal data to provide the commissioned IT services according to our instructions.
In the event of loss or theft of the sports equipment, we pass on the data related to the rental contract, but not the body data, to the police, the public prosecutor, and/or courts for the investigation and clarification of the facts, as well as to identify the perpetrator. We also report to the insurance company and provide the necessary data for the rental contract.
The data on country of origin, the name of the hotel or travel agency, and the description of the rented sports equipment are anonymized and processed for statistical evaluation and analysis purposes as soon as they no longer need to be retained for the purposes of the rental service.
No personal data is transferred to third parties for their own purposes, including the hotel or travel agency that provided your data, without your consent.
3.1. Scope of Processing Personal Data
We process your first and last name, email address, telephone number, and address, as provided during your purchase. If you do not provide these data, we cannot provide you with the invoice electronically.
We also automatically store and process the following data for electronic invoicing: customer number (if available), invoice data (date of invoice issuance, date of purchase, description and quantity of goods, unit price, total price).
3.2. Legal Basis for Processing Personal Data
The legal basis for processing the data is Art 6(1)(a) GDPR, as you consent to the processing by voluntarily providing your data, and Art 6(1)(b) GDPR, thus processing for the fulfillment of a contract, since you have indicated that you wish to receive the invoice electronically.
3.3. Purpose of Data Processing
The personal data listed under section 3.1 are processed by us for the purpose of issuing an electronic invoice and sending it by email. The contact details are necessary to enforce claims against the customer if the electronically sent invoice, which becomes due upon receipt, is not paid on time.
3.4. Recipients of Data
Sport Management und Consulting GmbH, Kaprun, is appointed as the technical IT service provider, who may have access to the data to the extent required for the provision of IT services (particularly technical support, applying updates, etc.). A corresponding data processing agreement has been concluded.
Sport Management und Consulting GmbH is authorized to engage additional processors and has commissioned advarics GmbH, Grabenweg 58, 6020 Innsbruck, and WINTERSTEIGER AG, Dimmelstraße 9, A-4910 Ried im Innkreis. A corresponding agreement according to Art 28 GDPR exists between Sport Management und Consulting GmbH and advarics GmbH as well as WINTERSTEIGER AG.
3.5. Duration of Storage
The personal data will be retained for 7 years after the end of the financial year in which the purchase was made, due to a legal obligation (§ 132 BAO).
4.1 Extent of processing of personal data
We store and process the following data of persons who order items online and reserve said items for pick-up from one of its branches: first and last names, telephone number, email address, the products which have been reserved, the selected branch as well as the status of the reservation.
Data are provided by you purely on a voluntary basis; if, however, you opt not to provide said data, the controller will not be able to appropriately process your request for reservation of an item, nor be able to reserve said item at the shop in question.
Furthermore, in the course of the ordering process we also collect your IP address and browser data pursuant to your having granted your consent thereto.
4.2 Legal foundation for the processing of personal data
The legal foundation for the processing of data as stipulated under Pt. 4.1. within the context of ordering and reserving goods at a branch is Art. 6 (1) (b) GDPR and thus the processing pursuant to fulfilment of a contract.
4.3 Purpose of Data Processing
The personal data as addressed in Pt. 4.1. are processed by the Controller for the purpose of reserving at a branch an item which has been ordered online on behalf of a customer, and for completion of the ordering process associated therewith.
4.4 Duration of Storage
The personal data will be stored until the item is picked up at the shop, after which said data will be deleted.
The log data which are automatically collected in the course of the ordering process will be deleted upon conclusion of the reservation.
4.5 Recipients of Data
In order to record the ordering process on our website and undertake the reservation, we utilize an IT service provider, specifically the online reservation system Shopgate GmbH headquartered in Butzbach/Germany which, on our behalf and consistent with our instructions, also has access to personal data so as to provide contracted IT services. A corresponding agreement for the processing of data under contract has been entered into consistent with Art. 28 GDPR. All of the reservation data entered by you are transmitted in encrypted form. Furthermore, Shopgate takes all other necessary measures, both organizational as well as technical, in order to protect your data.
Pursuant to provision of various technical services (such as webhosting) for which access to personal data cannot be excluded, Shopgate might also avail itself of services provided by the following:
Amazon Web Services, Inc. (Ireland); subject to acceptance of standard data privacy provisions per Art. 46 (2) (c) GDPR. | Ireland | Hosting
Zendesk Inc. (California, USA); subject to acceptance of standard data privacy provisions per Art. 46 (2) (c) GDPR. | EU & USA | Customer support
Google LLC (California, USA); subject to acceptance of standard data privacy provisions per Art. 46 (2) (c) GDPR. | EU (Belgium) | Hosting, email, tracking
Hetzner Online GmbH (Germany) | Germany | Hosting
Elastic N.V. (Netherlands & California, USA); subject to acceptance of standard data privacy provisions per Art. 46 (2) (c) GDPR. | EU (Ireland & Belgium) | Monitoring / Error analytics
Sentry - Functional Inc. (California, USA); subject to acceptance of standard data privacy provisions per Art. 46 (2) (c) GDPR. | USA | Monitoring / Error analytics
Slack (California, USA); subject to acceptance of standard data privacy provisions per Art. 46 (2) (c) GDPR. | USA | Internal communication
Atlassian Plc. (Sydney, Australia); subject to acceptance of standard data privacy provisions per Art. 46 (2) (c) GDPR. | EU (Germany) | Project management
Transmission of personal data to other third parties for purposes of their own will not occur without your expressed consent.
We also process the personal data of our customers if they have registered for the Bründl +CARD and/or wish to receive advertising for products and services of the BRÜNDL SPORTS brand.
The controller for the data processing in this context is:
Sport Bründl Gesellschaft m.b.H.
Tel: +43 6547 83 88-0
Email: office@bruendl.at
Nikolaus-Gassner-Straße 4, 5710 Kaprun
(hereinafter "we" or "us" or the "Controller").
1.1. Scope of Processing Personal Data
We store and process the following data: contact details provided by you during the registration for the Bründl Plus Card, including first name, last name, gender, language, address, telephone number, date of birth, email address, the customer number automatically generated upon registration, a loyalty card number (if available), and communication details with the customer (Transactional Mailings).
With each transaction (purchase or rental) made with your customer card, we also collect the date and time of the purchase, transaction number, branch, amount payable, discounts, item number, item description, brand, item EAN, size, colour, product group, season, list price, discount, amount incl. VAT, discount description.
Additionally, we process the bonus points credited based on the transactions, the vouchers issued for you (value, issue date, validity, redemption status/open, issuing branch), and details on the redemption of the vouchers.
1.2. Legal Basis for Processing Personal Data
The legal basis for processing the data under section 1.1 is Art 6(1)(b) GDPR, thus processing for the fulfillment of a contract. Providing your contact details is voluntary; however, if you do not provide this data, Bründl Sports cannot process your request for issuing a customer card and grant you the benefits of the customer card system.
1.3. Purpose of Data Processing
The personal data listed under section 1.1 are processed by Bründl Sports for the purpose of fulfilling the respective contractual obligations arising from participation in the Bründl +Card, particularly to determine the bonus points and issue the bonus credit.
1.4. Duration of Storage
The personal data are stored and processed for as long as you participate in the Bründl Plus Card and beyond, as long as legal claims arising from participation can be asserted, and statutory retention periods exist.
The transaction data will be anonymised once they are no longer needed for the purposes of the customer card system and processed for statistical evaluation and analysis purposes according to section II.5.
1.5. Recipients
Sport Management und Consulting GmbH, Kaprun, is appointed as the technical IT service provider, who may have access to the data to the extent required for the provision of IT services (particularly technical support, applying updates, etc.). Sport Management und Consulting GmbH has, in turn, commissioned BSI Business Systems Integration AG, Täfernweg 1, 5405 Baden, Switzerland, as an additional processor. Switzerland is a third country with an adequacy decision under Art. 45(1) and (3) GDPR. A corresponding data processing agreement according to Art. 28 GDPR has also been concluded.
BSI Business Systems Integration AG uses the following additional processors:
Personal data is not transferred to third parties without your consent.
2.1. Scope of Processing Personal Data
Bründl Sports uses your personal data, specifically your first and last name, gender, address, telephone number, date of birth, email address, customer number, as well as the purchase data processed and collected with the Bründl Plus Card in Bründl Sports shops (date and time of purchase, transaction number, branch, amount payable, discounts, item number, item description, brand, item EAN, size, colour, product group, season, list price, discount, amount incl. VAT, discount description) and the response data (data on your reaction to promotions and purchasing behaviour) for advertising purposes, particularly for the creation and sending of personalised, customer-tailored advertising.
2.2. Legal Basis for Processing Personal Data
Bründl Sports processes your data for marketing purposes, to best reach customers and align its marketing strategies accordingly, only with your consent, which you can give when applying for the Bründl Plus Card, subscribing to our newsletter, or concluding a contract with us. The legal basis for processing is therefore Art 6(1)(a) GDPR.
2.3. Purpose of Data Processing
Your personal data will be used to send offers, product catalogues, and other promotional material about BRÜNDL SPORTS products or activities by email, SMS, or post.
The personal data are used for analysis and interpretation for the purposes of personalised advertising. The data described in section 2.1 are evaluated and analysed using various statistical methods (exploratory, descriptive, and inductive) and by enriching the personal data with aggregated sociodemographic data concerning the customer groups to which you belong according to your identification data (e.g., gender, age, marital status, household size, education, professional situation, etc.). Analysis means that probabilities are calculated based on the aggregated data and with the help of automated analysis models, which are used to select suitable recommendations and offers for you. Furthermore, customer profiles are created, which Bründl Sports uses to make statements about the possible future purchasing behaviour of customers and to align its sales strategy accordingly, and in particular, to adapt the product range to customer needs.
2.4. Duration of Storage
Bründl Sports stores your data until the termination of your participation in the Bründl Plus Card and beyond that up to 7 years after your last contact with Bründl Sports, or earlier if you object to the use of your data.
2.5. Recipients of Data
Sport Management und Consulting GmbH, Kaprun, is appointed as the technical IT service provider, who may have access to the data to the extent required for the provision of IT services (particularly technical support, applying updates, etc.). Sport Management und Consulting GmbH has, in turn, commissioned BSI Business Systems Integration AG, Täfernweg 1, 5405 Baden, Switzerland, as an additional processor. Switzerland is a third country with an adequacy decision under Art. 45(1) and (3) GDPR. A corresponding data processing agreement according to Art. 28 GDPR has also been concluded.
BSI Business Systems Integration AG uses the following additional processors:
Personal data is not transferred to third parties without your consent.
2.6. Right of Withdrawal
You can withdraw your consent to the processing of this data at any time without reason with future effect, either by email to datenschutz@bruendl.at or by calling +43 (0)6547 8388-0.
3.1. Scope of Processing Personal Data
On our website https://www.bruendl.at/de, there is the option to subscribe to a free newsletter to continuously receive information about BRÜNDL SPORTS products and activities. When signing up for the newsletter, we ask for your email address, which you can voluntarily provide so that we can send you the newsletter.
Additionally, during the registration process or automatically during the newsletter distribution, we process the following personal data:
3.2. Legal Basis for Processing Personal Data
The subscription to the newsletter is only possible with your consent. The legal basis for processing is Art 6(1)(a) GDPR. The telecommunications regulations under § 174 TKG 2021 are complied with, as electronic contact through the mailing/newsletter distribution only occurs via newsletter registration.
3.3. Purpose of Data Processing
We process the data of visitors to our website who subscribe to the newsletter to fulfill the request for sending the newsletter.
3.4. Recipients of Data
Sport Management und Consulting GmbH, Kaprun, is appointed as the technical IT service provider for the distribution of the newsletter, who may have access to the data to the extent required for providing the services. Sport Management und Consulting GmbH has, in turn, commissioned BSI Business Systems Integration AG, Täfernweg 1, 5405 Baden, Switzerland, as an additional processor. Switzerland is a third country with an adequacy decision under Art. 45(1) and (3) GDPR. A corresponding data processing agreement according to Art. 28 GDPR has also been concluded. BSI Business Systems Integration AG uses Mailjet GmbH, Rankestraße 21, 10789 Berlin, as an additional processor for sending newsletters.
3.5. Duration of Storage
The data may be retained until you object to receiving the newsletter.
4.1. Scope of Processing Personal Data
Bründl Sports collects the following personal data about you when you declare your participation in a competition: first and last name, gender, language, address, email address, date of birth, name of guardian (if applicable), acceptance of the terms and conditions, consent to publication, and consent to receive advertising.
The data actually required to participate in the respective competition are marked as mandatory fields on the entry form and are obtained directly from you. Providing your data is voluntary; however, if you do not fill in these mandatory fields, we may not be able to allow your participation in the competition or award you any prize.
Additionally, we automatically collect the following data during participation in a competition: type and name of the competition, Facebook or Instagram user ID (if applicable), date of participation, content from the competition (e.g., answers to questions), type of prize.
In individual competition actions, Bründl Sports also takes and processes photographs during the awarding of the prize or during the enjoyment of the prize.
4.2. Legal Basis for Processing Personal Data
The legal basis for processing the data is Art 6(1)(b) GDPR, insofar as it concerns the determination of the winner, notification of the winners, and sending of the prize, and thus processing to fulfill our obligations from your participation in the competition. Additionally, we process the data in our legitimate interest to identify and document multiple winners in a row with their respective prizes and to detect fraudulent means in participating in the competition. We process the information about your age and guardian based on Art 6(1)(f) GDPR and therefore only to the extent legally necessary and for documentation in our legitimate interest, insofar as either participation in the competition itself requires the participant’s legal capacity or data protection regulations bind the processing of minors' data to the consent of their guardians. Your data as a winner will only be published based on your consent under Art 6(1)(a) GDPR (e.g., in a competition on Facebook, Instagram, or our website) or otherwise made public (e.g., mentioned during live draws). The taking and publication of photographs in the case of a public award of the prize is based on our overriding legitimate interest in illustrated event reporting (Art 6(1)(f) GDPR). Furthermore, photographs are only taken and published with your consent (Art 6(1)(a) GDPR).
The legal basis for processing your data for marketing purposes is Art 6(1)(a) GDPR. Processing the data for this purpose only takes place with your consent, which you can voluntarily declare when participating in the competition. The use of data for this purpose complies with the telecommunications regulations, particularly § 174 TKG 2021.
4.3. Purpose of Data Processing
We process the data to manage and organise participation in the competition, determine the winner, and distribute the prizes. The data processing is necessary to ensure that the winner can be determined and the prize awarded to the participants in compliance with the competition terms. We may also pass on your data to cooperation partners so that they can award the prize to the winner. We process the competition participant's age and guardian details if the prize requires a certain legal capacity or if the participant's data is processed via an information society service (e.g., Facebook or Instagram competition, competition on the website, or newsletter distribution).
Additionally, we announce the names of the winners and the prize they received on our website, and we process your data for publicity purposes (mentioning names during prize distribution, press releases, social media) only if you have given your consent. In the case of a public award of the prize, we will use the photographs taken during this event to illustrate our reporting on the event and the competition.
4.4. Duration of Storage
The personal data will be stored and processed for the purpose of fulfilling the contract, thus until the conclusion of the competition, and beyond that, as long as specific claims against us from a competition may arise, and lastly to the extent that statutory retention periods exist.
4.5. Recipients of Data
We may pass on your data to any cooperation partners for a specific competition so that they can award the prize to you. Any other use of your data by them will only take place with your consent.
5.1. Scope of Processing Personal Data
We use the transaction data from the "Customer Card System" data processing anonymised for analysis purposes to generate information for corporate alignment and product development/improvement.
5.2. Legal Basis for Processing Personal Data
The legal basis for processing the data, which is lawfully collected in accordance with the processing described in section 5.1 and anonymised, is Art 6(1)(f) GDPR. The protected interests of the customers are not affected by this.
5.3. Purpose of Data Processing
The personal data mentioned in section 5.1 are anonymised and used for analysis and interpretation in the areas of product development and quality management. The non-personalised results obtained from the analysis are used to create evaluations of the customer structure, as well as to assess customer interests and behaviour. These data generate information that serves to align corporate and sales strategies, assess potential future customer demand, and adapt and improve products and services, as well as develop concepts to better reach customers and meet their needs. We do not establish any personal reference with these evaluation results.
5.4. Duration of Storage
The data is anonymised and therefore retained without time limitation.
6.1. Scope of Processing Personal Data
You can contact us in writing via an online form or otherwise if you are interested in our concerns and activities. When you contact us, the data you voluntarily provide (first and last name; title; telephone number or email address; subject; content of your inquiry) is processed to answer your questions and handle your concerns. You are free to decide whether to provide us with your data for your inquiry. However, if you do not provide certain data, the online form cannot be sent as we would then be unable to properly handle your concern. We also process the date of the inquiry; content of the information/response, and the course of communication (log data) through automatic collection for documentation purposes.
6.2. Legal Basis for Processing Personal Data
We base the processing on Art 6(1)(a) GDPR, insofar as you have voluntarily provided us with the data and the inquiry does not constitute a pre-contractual measure; furthermore, we base the processing on Art 6(1)(f) GDPR to appropriately manage inquiries and organise responses.
6.3. Purpose of Data Processing
The purpose of storing and processing the data is to ensure that inquiries and responses are handled uniformly and promptly, and that the necessary data for contacting and communicating with you is available. Additionally, we process the data to manage these messages, particularly to assign them to the respective responsible employees and document the handling of the inquiry. If your inquiry pertains to a contractual obligation, we will further process your data internally within the processing activity "Processing of Data for Contract Execution."
6.4. Recipients of Data
Sport Management und Consulting GmbH, Kaprun, is appointed as the technical IT service provider for the operation of the online contact form, who may have access to the data to the extent required for providing IT services (particularly technical support, applying updates, etc.).
6.5. Duration of Storage
The data will be retained as long as there is contact with the data subject or until the consent is revoked, but no longer than one year after your last contact with us.
1.1. Scope of Processing Personal Data
At the glass bridge at our flagship store in Kaprun, we offer a photo point where each visitor can voluntarily take a souvenir photo. By pressing the release button, a photo is automatically taken within the capture radius and stored on a website managed on our behalf by Panomax GmbH (at https://photopoint.visit.at/view/bruendl/flagshipstore) for 24 hours for download. The following data are therefore automatically collected when the release button is pressed: image data of the subject, time and location of the photo.
1.2. Legal Basis for Processing Personal Data
By pressing the release button, you consent to the recording of the image data, its storage for 24 hours, and its sharing with third parties who have also used the photo point within these 24 hours by uploading it to the website (Art 6(1)(a) GDPR).
As far as it concerns uninvolved persons who are accidentally visible in the capture area, we rely on our legitimate interest, which is to provide customers with a souvenir photo of their visit to the flagship store (Art 6(1)(f) GDPR).
1.3. Purpose of Data Processing
We operate a photo point to enable visitors to the flagship store in Kaprun to take photos on the glass bridge as a souvenir of their visit. Every visitor should have the opportunity to take a photo of themselves in the designated capture area on the glass bridge by pressing the release button at the photo point. Upon pressing the release button, a QR code is provided to the visitor, which allows access to a website where the image data are available for download at any time for 24 hours after the photo is taken. The capture area may also be entered by uninvolved persons, so the camera is set to a blur level that generally makes it impossible to identify such uninvolved persons. Only in certain cases (e.g., particularly distinctive features despite the blur) may persons in the background be identifiable in the captured photo. The web server on which the photos are stored for 24 hours is operated by Panomax GmbH, based in Henndorf/Salzburg, which we have commissioned for this purpose. The website can be accessed by anyone who has pressed the release button and received a QR code, thus having the opportunity to download the photos uploaded there for their own purposes free of charge.
The temporary storage of these data is necessary to allow you to download the souvenir photos afterward.
1.4. Recipients of Data
The image data stored at https://photopoint.visit.at/view/bruendl/flagshipstore can also be viewed by other people who have entered the glass bridge and used the photo point within the last 24 hours. By using the photo point, you consent to this sharing.
Panomax GmbH, Salzburg, is commissioned as the IT service provider to organise the recording and storage, and may have access to the data to provide the technical services. A corresponding data processing agreement has been concluded.
1.5. Duration of Storage
The data are automatically deleted 24 hours after the upload.
Automated decision-making, including profiling as per Art 22(1) and (4) GDPR, is not carried out by us and therefore does not exist.
1. Right to Access
You have the right to obtain from SPORT BRÜNDL confirmation as to whether or not personal data concerning you are being processed, and, where that is the case, access to the personal data and the following information:
(1) the purposes of the processing;
(2) the categories of personal data concerned;
(3) the recipients or categories of recipients to whom the personal data have been or will be disclosed;
(4) the envisaged period for which the personal data will be stored, or, if not possible, the criteria used to determine that period;
(5) the existence of the right to request rectification or erasure of personal data or restriction of processing of personal data concerning you or to object to such processing;
(6) the right to lodge a complaint with a supervisory authority;
(7) where the personal data are not collected from you, any available information as to their source;
(8) the existence of automated decision-making, including profiling, referred to in Article 22(1) and (4) GDPR and, at least in those cases, meaningful information about the logic involved, as well as the significance and the envisaged consequences of such processing for you. You have the right to request information as to whether personal data concerning you are transferred to a third country or to an international organisation. In this context, you can request to be informed of the appropriate safeguards pursuant to Article 46 GDPR relating to the transfer.
2. Right to Rectification and Right to Restriction of Processing
You have the right to obtain from SPORT BRÜNDL without undue delay the rectification of inaccurate or incomplete personal data concerning you. Under certain circumstances, for example, if the accuracy of the data is contested, you may request the restriction of processing of your data such that they may only be processed with your consent or for the establishment, exercise, or defence of legal claims or for the protection of the rights of another natural or legal person or for reasons of important public interest.
3. Right to Data Portability
You have the right to receive the personal data concerning you, which you have provided to SPORT BRÜNDL, in a structured, commonly used, and machine-readable format and have the right to transmit those data to another controller without hindrance from the controller to which the personal data have been provided, where: (1) the processing is based on consent pursuant to Article 6(1)(a) GDPR or Article 9(2)(a) GDPR or on a contract pursuant to Article 6(1)(b) GDPR; and (2) the processing is carried out by automated means. In exercising this right, you also have the right to have the personal data transmitted directly from SPORT BRÜNDL to another controller, where technically feasible. This shall not adversely affect the rights and freedoms of others.
4. Right to Erasure
You have the right to obtain from SPORT BRÜNDL the erasure of personal data concerning you under certain circumstances, such as when the data are not processed in accordance with data protection requirements. The so-called “right to be forgotten” does not apply to you because SPORT BRÜNDL does not make your personal data public under any circumstances. If you have exercised your right to rectification, erasure, or restriction of processing with SPORT BRÜNDL, we are obliged to communicate any rectification or erasure of personal data or restriction of processing to each recipient to whom the personal data have been disclosed unless this proves impossible or involves disproportionate effort.
5. Right to Object
You have the right to object, on grounds relating to your particular situation, at any time to processing of personal data concerning you which is based on Article 6(1)(e) or (f) GDPR, including profiling based on those provisions. SPORT BRÜNDL shall no longer process the personal data unless we can demonstrate compelling legitimate grounds for the processing which override your interests, rights, and freedoms or for the establishment, exercise, or defence of legal claims.
6. Right to Withdraw Data Protection Consent
You have the right to withdraw your data protection consent declaration at any time. The withdrawal of consent does not affect the lawfulness of processing based on consent before its withdrawal.
7. Supervisory Authority
Without prejudice to any other administrative or judicial remedy, you have the right to lodge a complaint with the national supervisory authority of your place of residence if you consider that the processing of personal data relating to you infringes GDPR. In Austria, the competent authority is the Austrian Data Protection Authority in Vienna.