Privacy policy and data protection

Last updated: 4 October 2026

In this privacy policy we inform you, in accordance with Articles 13 and 14 of the General Data Protection Regulation (GDPR), the Austrian Data Protection Act (DSG) and the Austrian Telecommunications Act 2021 (TKG 2021), which personal data we process, for what purposes, on what legal basis, to whom we disclose it, how long we keep it and what rights you have.

1. Controller

Snowsports Westendorf GmbH (Snowsports Westendorf, Skischule Westendorf, Skischool Westendorf)
Schulgasse 15, 6363 Westendorf, Austria
Phone: +43 5334 20522
Email: info@snowsportswestendorf.com

Further company details can be found in our Imprint (Impressum). For all data protection questions and to exercise your rights, please contact us at the email address above. We are not legally required to appoint a data protection officer and have not done so.

2. Scope

This policy applies to our websites www.skischulewestendorf.com, www.skischoolwestendorf.com, en.skischoolwestendorf.com in all language versions (Dutch, German, English, Danish) and the domains redirecting to them (snowsportswestendorf.com), to our website www.summersportswestendorf.com, to our online shop (shop.skischulewestendorf.com, shop.skischoolwestendorf.com, shop.en.skischoolwestendorf.com) and to the handling of bookings, enquiries and newsletters.

3. Visiting the website (server log files) and hosting

When you visit our websites, your browser sends technically necessary data to our server: IP address, date and time, the page requested, referrer URL, browser type and operating system. We use this data to deliver the website, ensure its stability and security, and prevent misuse.

Legal basis: Art. 6(1)(f) GDPR (legitimate interest in operating the website securely).
Retention: 14 days; longer only where individual entries are needed to investigate a security incident.
Hosting: The websites run on our own server at IONOS SE, Elgendorfer Str. 57, 56410 Montabaur, Germany (data centre in Germany), acting as our processor (Art. 28 GDPR).

4. Contacting us

If you contact us via a contact form, by email, by phone or via WhatsApp or Facebook Messenger, we process the data you provide (e.g. name, email address, phone number, subject and your message) in order to answer your enquiry.

On the pages of our partner hotels you can also request a quote for ski lessons and rental equipment (name, email address, number of people, services required, message). We handle these requests ourselves; they are not passed on to the hotel.

Legal basis: Art. 6(1)(b) GDPR where the enquiry concerns a booking or contract; otherwise Art. 6(1)(f) GDPR (legitimate interest in answering enquiries).

Email: Our mailboxes are hosted on our own mail server at IONOS SE in Germany. To send emails we also use the Brevo service of Sendinblue SAS, 106 boulevard Haussmann, 75008 Paris, France, as our processor. Brevo processes the recipient’s address and name, the content of the message and technical delivery data (e.g. delivery status).

WhatsApp and Facebook Messenger: The buttons for these services on our website are plain links; merely visiting the website does not send any data to Meta. If you message us via these services, Meta Platforms Ireland Ltd., Merrion Road, Dublin 4, Ireland, processes your message and your phone number or profile under its own privacy terms; a transfer to the USA is possible. If you do not want this, please use email, phone or the contact form.

5. Bookings and purchases in the online shop

You can book ski courses, private lessons, rental equipment, packages and ski passes in our online shop. In doing so we process:

• data of the person booking: name, address, email address, phone number, billing details;
• data of the participants: name, age or date of birth, skiing ability, course and group allocation, and the details needed to adjust rental equipment;
• payment and booking data.

We do not ask for health data.

Purpose and legal basis: concluding and performing the contract, including course and group allocation, issuing rental equipment, communication about your booking and invoicing (Art. 6(1)(b) GDPR). We cannot accept a booking without this data.

Booking system: The shop and our booking and course management are operated for us by Waldhart Software GmbH, Unterdorf 1, 6405 Pfaffenhofen, Austria (software “WS Sports”), as our processor. The data is stored in data centres in the EU.

Payment: Online payments are handled by TrekkSoft AG (Payyo), Baarerstrasse 52, 6300 Zug, Switzerland, via its payment service Payyo. TrekkSoft receives the data needed for the payment (name, amount, payment method, transaction data) and processes it as our processor and, where it fulfils its own legal obligations (e.g. fraud and anti-money-laundering checks), as an independent controller. We do not store card data. Switzerland is covered by an adequacy decision of the European Commission (Art. 45 GDPR).

Accounting: We keep invoices and booking records as required by law (including § 132 of the Austrian Federal Fiscal Code, BAO) (Art. 6(1)(c) GDPR) and pass them on to our tax advisers for this purpose.

6. Bookings via partner platforms

You can also book our services via partners’ booking platforms, e.g. CheckYeti. The partner is responsible for the processing on its own platform – the booking process, payment and its own communication with you – and its privacy policy applies to that. We receive the booking data from the partner (e.g. name, contact details, participants, age, ability, service booked) in order to provide the lesson or rental (Art. 6(1)(b) GDPR).

7. Ski lessons and ski passes

Ski lessons: Lessons are given by our own ski school; the ski school management and the instructors are employed by us. Snowsports Westendorf GmbH is therefore also the controller for the processing involved in running the lessons; no data is passed to third parties for this. Details of the ski school can be found in the Imprint.

Ski passes: Ski passes booked in our shop are not personalised. We issue them via Bergbahnen Westendorf and its ticketing software, passing on only the type, number and validity of the passes and no personal data.

8. Photos and videos during lessons

Photos and videos may be taken during our lessons and used on our website, our social media channels and in our advertising. The details and the legal basis are set out in our General Terms and Conditions (AGB).

• You can object in advance – when booking, by email to info@snowsportswestendorf.com or on site with your instructor. We will then not take or use any footage of you or your child.
• You can ask us at any time later to delete footage; we will then remove published footage from our own channels.
• We use footage of children with particular restraint and never with their names.

9. Newsletter

Newsletter: If you subscribe to our newsletter, we process your email address and, where provided, your name and language in order to send you information about our offers. Subscription uses a double opt-in; we store the time and IP address of the sign-up and confirmation as proof. Sign-up and sending are handled by WS Sports of Waldhart Software GmbH (Austria) as our processor.
Legal basis: your consent (Art. 6(1)(a) GDPR, § 174 TKG 2021). You can withdraw it at any time via the unsubscribe link in every newsletter or by emailing us.

Newsletter sign-up when booking: When booking in our online shop, you can use an optional checkbox under “Marketing Agreement” to sign up for our newsletter (“Yes, I don’t want to miss any more news in the future and would like to subscribe to the newsletter.”). Only if you tick this box will we send the newsletter to the email address given when booking; your booking does not depend on it. The legal basis is your consent (Art. 6(1)(a) GDPR, § 174 TKG 2021), which you can withdraw at any time via the unsubscribe link or by emailing us.

10. Cookies and consent management

We set technically necessary cookies (e.g. for language selection and storing your cookie choice) on the basis of § 165(3) of the Austrian Telecommunications Act 2021 (TKG 2021) and Art. 6(1)(f) GDPR. All other cookies and tracking technologies (statistics and marketing) are only set if you have consented via our cookie banner (§ 165(3) TKG 2021, Art. 6(1)(a) GDPR).

To manage your consent we use CookieScript of Objectis Ltd. (Objectis UAB), Lithuania, as our processor. It stores your choice, a timestamp and a pseudonymous identifier.

The full, up-to-date list of cookies with provider, purpose and duration can be found in our cookie policy. There you can change your settings or withdraw your consent at any time; this does not affect the lawfulness of processing before the withdrawal.

11. Web analytics and online marketing (only with consent)

We use Google Consent Mode in basic mode: Google Analytics, Google Ads and the Meta Pixel are only loaded after you have consented in the relevant category (Art. 6(1)(a) GDPR, § 165(3) TKG 2021). Before that, no data is sent to these services. This is controlled via Google Tag Manager (Google Ireland Limited), which is loaded when the page opens – technically this sends your IP address to Google – but sets no cookies itself (Art. 6(1)(f) GDPR).

Google Analytics 4

Google Analytics helps us understand how our website is used (e.g. pages viewed, clicks on phone, email and WhatsApp links, clicks through to the shop) so that we can improve it. Provider: Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. Google Analytics 4 does not store full IP addresses. Analytics data is deleted after 14 months.

Google Ads

We measure whether a visit from an ad led to an enquiry or booking, and may show ads to visitors of our website later (remarketing). When you submit the contact form, your email address or phone number is sent to Google in encrypted (hashed) form to improve measurement (“enhanced conversions”). Provider: Google Ireland Limited.

Meta Pixel (Facebook/Instagram)

The Meta Pixel lets us measure the effect of our ads on Facebook and Instagram and show ads there to people who have visited our website. When you submit the contact form, your email address and phone number are sent to Meta in hashed form (“advanced matching”). We are joint controllers with Meta for this collection and transfer (Art. 26 GDPR); the agreement is available at facebook.com/legal/controller_addendum. Provider: Meta Platforms Ireland Ltd., Merrion Road, Dublin 4, Ireland.

12. Google reCAPTCHA

On pages with a form we use Google reCAPTCHA (Google Ireland Limited) to block spam and automated submissions. reCAPTCHA is not loaded on any other page. It sends data such as your IP address, browser information and your behaviour on the page to Google; a transfer to Google LLC in the USA is possible.
Legal basis: Art. 6(1)(f) GDPR (legitimate interest in preventing spam and misuse of our forms).

13. Links to social media

We link to our Facebook and Instagram profiles with plain links. Only when you click one do you go to the provider’s platform, where its privacy terms apply.

14. Recipients

We only pass on personal data where this is necessary for the purposes described, where there is a legal basis or where you have consented. Processors are contractually bound by our instructions (Art. 28 GDPR).

15. Transfers outside the EU

With Google and Meta, data may be transferred to the USA. Google LLC and Meta Platforms, Inc. are certified under the EU-US Data Privacy Framework; transfers are based on the European Commission’s adequacy decision of 10 July 2023 (Art. 45 GDPR). TrekkSoft (Payyo) processes payment data in Switzerland, which is also covered by an adequacy decision. All other recipients process data within the EU.

16. Retention periods

17. Children

Many of our course participants are children. Bookings for children are made by parents or guardians, who provide the child’s data (e.g. name, age, ability). In Austria, children under 14 cannot themselves consent to the processing of their data in connection with online services (§ 4(4) of the Austrian Data Protection Act, DSG); consent, for example for the newsletter, must then be given by a parent or guardian.

18. Mandatory data, no automated decision-making

The details marked as mandatory in the booking process are required to conclude the contract; all other details are voluntary. No solely automated decision-making, including profiling, within the meaning of Art. 22 GDPR takes place.

19. Your rights

You have the right of access (Art. 15 GDPR), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20) and to object to processing based on Art. 6(1)(f) GDPR and, at any time, to direct marketing (Art. 21). You can withdraw any consent at any time with effect for the future (Art. 7(3) GDPR). Please contact info@snowsportswestendorf.com; we will reply within one month.

20. Right to lodge a complaint

If you believe that the processing of your data infringes data protection law, you can lodge a complaint with our competent supervisory authority:
Österreichische Datenschutzbehörde (Austrian Data Protection Authority), Barichgasse 40–42, 1030 Vienna, Austria, phone +43 1 52 152-0, email dsb@dsb.gv.at, www.dsb.gv.at.
You can also complain to the supervisory authority in the EU country where you live or work (Art. 77 GDPR).

21. Changes

We update this privacy policy when our data processing or the law changes. The version published on this page applies.

Last updated: 4 October 2026