Controller Responsible for Processing Personal Data

Bergbahnen Brandnertal GmbH
Mühledörfle 2
AT-6708 Brand

Phone: +43 (0) 5559 224
Email: station@brandnertal.at

Website: www.brandnertal.at/bergbahnen

Your Rights

You have the right to access the personal data processed about you and to request corrections if necessary. You may also request the deletion of your data if processing is based on your consent and you withdraw that consent or if the data is no longer needed for the specified purpose.

If your data is processed based on our legitimate interest, you have the right to object and request a restriction of processing.

If you feel your rights have been violated, you may file a complaint with:

Austrian Data Protection Authority
Barichgasse 40-42
1030 Vienna
Phone: +43 1 531 15-202525
Email: dsb@dsb.gv.at

Operation of the Website

Webserver Log

Purpose

To analyze potential errors and prevent misuse of our website, access to our site is logged in server-side log files.

Legal Basis

Processing is based on our legitimate interest to secure the website and identify and resolve errors.

Categories of Personal Data

• IP address
• Browser and client operating system
• Access time
• Accessed page
• HTTP method
• Referring URL (if applicable)

Retention Period

Log files are retained for one week.

Data Sharing With Third Parties

No data is shared with third parties.

Profiling

The data is not used to create visitor profiles.

Website Usage Analysis

Purpose

We use Google Analytics, Google Tag Manager (Google Inc., USA), and Microsoft Clarity (Microsoft Ireland Operations Limited) to analyze website usage and optimize our website and advertising measures.

Necessary cookies for website operation are stored via Usercentrics Consent Management Platform (Usercentrics GmbH, Germany).

Legal Basis

Data processing is based on your consent.

Categories of Personal Data

During your website visit, data such as the following is transmitted to Google and Microsoft:

• Accessed pages
• Orders, including revenue and products
• Achieved "website goals" (e.g., contact requests, newsletter signups)
• User behavior (e.g., time spent, clicks, scrolling depth)
• Approximate location (country and city)
• Anonymized IP address
• Technical details (browser, provider, device, screen resolution)
• Source of visit (e.g., referring website or ad)
• Randomly generated user ID

Retention Period

• Google Analytics: Cookies are stored for 1 year and 32 days.
• Microsoft Clarity: Cookies are stored for 1 year.

These cookies contain the randomly generated user ID mentioned above, which allows you to be recognized during future visits to the website.

Data Sharing with Third Parties

Data is transmitted to Google and Microsoft servers in the USA under the EU-US Privacy Shield Agreement.

Profiling

Google and Microsoft use the data to create user profiles.

Embedding Advertising Trackers

Purpose

We integrate the Facebook Pixel from Meta [https://www.facebook.com/business/tools/meta-pixel/] into our website to manage and optimize advertising campaigns on Meta platforms (Meta Platforms Ireland Ltd., 4 Grand Canal Square, Grand Canal Harbour, Dublin, D02, Ireland).

Only non-personal data is used for analysis and reporting purposes. This data is not combined with other personal data by us.

Legal Basis

Data processing is based according to the purpose stated above and on your consent.

Categories of Personal Data

With the help of the Meta Pixel code, the following data is transmitted to Meta:

• Page Views: The Meta Pixel records which pages a user visits, how long they stay on these pages, and the sequence in which they visit them.
• Content Interactions: It captures which content a user views on a website, how long they view it, and whether they interact with it, such as by clicking, scrolling, or sharing.
• Device Information: The Meta Pixel collects information about the user’s device, including the operating system, browser type, and screen resolution.
• Location Data: In some cases, the Meta Pixel may also capture the approximate location of a user based on their IP address.
• Purchase Behavior: It tracks which products a user views, adds to their cart, and ultimately purchases.
• Form Submissions: The Meta Pixel can record when a user fills out a form on a website, such as for sign-ups, registrations, or newsletters.

Data Sharing with Third Parties

The collected data is transmitted to Meta. Meta processes the data globally and shares it partially with its partner companies. For more information, refer to Facebook’s privacy policy at facebook.com/about/privacy.

Profiling

Meta uses the data to create user profiles. We do not provide lists of personal data to Facebook or upload such data to Facebook. The data collected is transmitted to Facebook in encrypted form. Any personal data of individual users is not accessible to us.

Embedding External Content

Purpose

We embed external content, such as videos, JavaScript libraries, and fonts, into our website to make it visually appealing and provide users with these resources directly without linking to an external site.

Legal Basis

Embedding external content is based on our legitimate interest in designing and operating our website, particularly for consent management.

Categories of Personal Data

When you visit our website, external content is loaded, during which the following data is transmitted to the third-party provider:

• Your IP address
• The client browser and operating system
• The time of access
• Our website as the "referrer"

Cookies are also placed in your browser when external content is loaded, enabling recognition upon subsequent visits.

Data Sharing with Third Parties

We embed content from the Usercentrics Consent Management Platform (Usercentrics GmbH, Sendlinger Str. 7, 80331 Munich, Germany) on our website.

Profiling

Usercentrics GmbH does not use the data to create user profiles.

Purchase Data

Purpose

We process your order data to provide the services you have purchased. This includes personal data obtained during the course of our (business) relationship, as well as data lawfully obtained from publicly accessible sources (e.g., commercial register, association register, land register).

Categories of Personal Data

The following personal data may be processed:

• Basic data (e.g., first name, last name, title, gender, date of birth, address, phone number, email address)
• Business contact data (e.g., date, communication method, content)
• Ticket data (e.g., ticket type, number, price, validity)
• Contract data (e.g., service details)
• Event data (e.g., location, date, registration details)
• Billing data (e.g., items, prices, amounts)
• Payment data (e.g., bank details, SEPA mandate, accounting information)

We only collect and process the necessary data. In individual cases, fewer data than described above may be sufficient.

Legal Basis

Data provided during the order process is processed as necessary for fulfilling a contract (GDPR Article 6, paragraph 1(b)).

Retention Period

We store your data in accordance with our legal obligations.

Data Sharing with Third Parties

If you have purchased a Montafon Brandnertal WildPass, all members of the Montafon Brandnertal Card OG pool have access to your data. This is required for utilizing services from other pool members and internal billing. Access by other members is provided through a processor we have appointed.

Additionally, contracted processors (e.g., IT service providers like Team Axess, Pricenow AG, collection agencies, affiliated companies) receive your data if necessary for fulfilling the respective service or processing outlined in this privacy policy. All processors are contractually obligated to treat your data confidentially and process it solely as instructed by us.

If legally required, we transmit personal data to public authorities and institutions (e.g., law enforcement agencies, courts).

Photo capture system

Purpose

For the purpose of access control, a reference photo is taken of you the first time you pass through a turnstile equipped with a camera. Each time you pass through such a turnstile again, a control photo is taken. Our staff compare the reference photo with the control photos to verify the access authorization.

Legal Basis

This data processing is based on the legitimate interests of the controller (Art. 6 para. 1 lit. f GDPR) to prevent the unauthorized transfer of tickets, as this is expressly prohibited by contract.

Retention Period

The reference photo is deleted immediately after the ticket expires, and the control photos are deleted no later than 30 minutes after passing through the respective turnstile. All data is stored in encrypted form.

Last updated: February 2026