Your personal rights are our highest priority, and we therefore strive to protect these rights with all our strength and the utmost care. We would like to inform you about the nature, purpose, and scope of the processing of your personal data within our online offering (i.e., the website accessible at https://www.ok-bergbahnen.com/ and its integrated services and functions).

When processing and collecting personal data, we strictly adhere to the data protection regulations (GDPR and DSG) in their currently valid versions.

The following privacy policy provides you with detailed information, (in particular) about:

1. which of your personal data is processed, for what purpose, to what extent, in what manner, for what duration, and on what legal basis, as well as the recipients of this data when you use our online offering. Online offering refers to the website (available at https://www.ok-bergbahnen.com/) and its integrated services and functions, i.e., in particular, the online shop, newsletter, MyMountainClub, and OK Bergbahnen APP.

2. What specific rights you have as a data subject.

3. Name and contact details of the responsible party.

4. Contact details of the data protection officer.

Changes in the law or changes to our internal company processes, in particular the further development of our website and the implementation of new technologies, may make it necessary to adapt this privacy policy. We therefore ask you to read our privacy policy regularly. The currently valid version of our privacy policy can be found at https://www.ok-bergbahnen.com/datenschutz/, where it can be accessed, saved, and printed at any time. If you have any questions, please feel free to contact our data protection officer.

What data security measures have been taken to protect your data?
The security of your data is very important to us. Therefore, we have taken all necessary technical and organizational measures to ensure the security of data processing and the confidentiality of your personal data, as well as to protect your personal data as best as possible from access by unauthorized third parties, and we will continue to do so in the future. We regularly review the technical and organizational measures we have implemented to ensure they are always in line with technological advances. All necessary technical and organizational measures, in accordance with the state of the art within the meaning of Articles 25 and 32 of the GDPR, are taken when processing your data.
We achieve this, firstly, by using the latest security software and coding and encryption procedures within our IT infrastructure. Secondly, we promote the security of your data through the use of risk-minimizing measures (data minimization in all areas) and preventative protective measures.

The joint controllers for data processing pursuant to Art. 26 GDPR are:

• Fellhornbahn GmbH
  Faistenoy 10
  87561 Oberstdorf
  Germany

• Kleinwalsertaler Bergbahn AG
  Walserstraße 77
  A 6991 Riezlern
  Austria

• Nebelhornbahn-Aktiengesellschaft
  Nebelhornstraße 67
  87561 Oberstdorf
  Germany

• Oberstdorfer Bergbahn AG
  Kornau-Wanne 7
  87561 Oberstdorf
  Germany

• Skiliftgesellschaft links der Breitach GmbH & Co KG
  Walserstraße 77
  A-6991 Riezlern
  Austria

Tel: +49 (0) 8322-9600-0 / +43 (0) 5517-5274-0
Email: datenschutz@ok-bergbahnen.com

We have appointed a data protection officer. You can contact our data protection officer directly at any time with any questions or suggestions regarding data protection:

Data Protection Officer Fellhornbahn GmbH, Kleinwalsertaler Bergbahn AG & Skiliftgesellschaft links der Breitach GmbH & Co KG, Walserstrasse 77, 6991 (87567) Riezlern

Data Protection Officer Nebelhornbahn AG, Nebelhornstrasse 67, 87561 Oberstdorf

Data Protection Officer Oberstdorfer Bergbahn AG, Kornau-Wanne 7, 87561 Oberstdorf

You can contact the data protection officer via the following email address: datenschutz@ok-bergbahnen.com

Personal data is all information relating to an identified or identifiable natural person. This includes, for example, information such as your name, age, address, telephone number, date of birth, email address, or IP address. Information that we cannot establish a connection to you (or can only establish a connection with disproportionate effort), e.g., by anonymizing the information, is not personal data. The processing of personal data (e.g., the collection, retrieval, use, storage, or transmission) always requires a legal basis or your consent.

The processing of special categories of personal data, i.e. data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, or trade union membership, as well as the processing of genetic data, biometric data for the purpose of uniquely identifying a natural person, data concerning health or data concerning a natural person's sex life or sexual orientation, is generally prohibited and permitted only in special cases; for example, if you have given your explicit consent or if the processing is necessary to assert, exercise or defend legal claims.

Processing is any operation or set of operations which is performed on personal data or on sets of personal data, whether or not by automated means, such as collection, recording, organisation, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure or destruction.

The controller is any person who alone or jointly with others decides on the purposes and means of processing personal data.

A processor is any person who processes data on behalf of the controller.

We only process your personal data (categories listed here) for the purposes specified in this privacy policy and only to the extent absolutely necessary to fulfill these purposes. Therefore, in the interest of your highest data security, we pursue comprehensive purpose limitation of data processing and data minimization in accordance with the GDPR.

• Address details (first and last name, address, telephone number, email)
• Date of birth
• Club card number
• Ski pass number
• Text entries (messages)
• Photographs Identification documents (uploads):
  • Photographs
  • Citizenship
  • Education level/school/university/community service
  • Date of birth
  • Address
  • Student ID number
  • Identification number

• Personal interests (family, skiing, winter hiking, snowboarding, nature lovers, culinary enthusiasts, leisurely hikes, sporty hiking, via ferratas, events)
• Usage data, websites visited, access times
• IP addresses and metadata (device information)
• Location data

• Data processing is carried out in accordance with the legal provisions of Section 165 (3) of the Telecommunications Act (TKG) 2021.
• The data: address details (first and last name, address, telephone number, email address), date of birth, are used for the purpose of processing bookings and orders (purchase of tickets and vouchers), processing contact requests and sent messages, participation in the newsletter, and participation in MyMountainClub.

The legal basis for this data processing is the fulfillment of the contract in accordance with Art. 6 (1) (b) GDPR (e.g., ticket purchase, participation in MyMountainClub, processing contact requests and sent messages, participation in the newsletter) as well as your express consent in accordance with Art. 6 (1) (a) GDPR.

You can revoke your consent at any time informally by email to info@ok-bergbahnen.com or by phone at +49 (0)8322 96000.

• The bank details (credit card number, expiration date, name, and security number) are processed for the purpose of purchasing tickets/vouchers.
  The legal basis for data processing is the necessary fulfillment of the contract in accordance with Art. 6 (1) (b) GDPR.
• The data collected from your uploaded ID cards in the online shop in the "Evidence" field is processed for the purpose of processing the ticket purchase or to prove that you meet the requirements for a discount.
  The legal basis for this data processing is your express consent in accordance with Art. 9 (2) (a) GDPR, as some of the data is "sensitive data" (photographs), i.e., special categories of personal data according to Art. 9 GDPR.
  For data that is not sensitive data, the legal basis for data processing is the fulfillment of the contract in accordance with Art. 6 (1) (b) GDPR (ticket purchase) and, in addition, your express consent in accordance with Art. 6 (1) (a) GDPR.
  You can revoke your consent at any time without any formalities by email to info@ok-bergbahnen.com or by phone at +49 (0)8322 96000.
  At this point, we would like to remind you that you may only upload photographs/copies of your own identification documents to prove that you meet the requirements for the discount (e.g., school ID, student ID, etc.). We have no further control over the documents you actually upload and therefore cannot fully predict or list the types of data contained and processed therein, especially if no such identification documents are uploaded. If you do not upload such an identification document, we will delete it immediately after verification.

• The data: Photographs (uploads), location data, information about personal interests (family, skiing, winter hiking, snowboarding, nature lovers, culinary lovers, leisurely hikes, sporty hiking, via ferratas, events) are processed for the purpose of participation in the MyMountainClub, which serves to provide you with exclusive discounts, special information, particularly by sending newsletters and news about the weather or events, and rewards, including through the collection of points.

The legal basis for processing this data is the fulfillment of the contract (Art. 6 (1) (b) GDPR) and your express consent (Art. 6 (1) (a) GDPR). You can revoke your consent at any time informally by email to info@ok-bergbahnen.com or by phone at +49 (0)8322 96000.

• The data: title, name, email address, and interests (family, skiing, winter hiking, snowboarding, nature lovers, culinary lovers, leisurely hikes, athletic hiking, via ferratas, events) will be processed for the purpose of subscribing to the newsletter.
  The legal basis for processing this data is the fulfillment of the contract (Art. 6 (1) (b) GDPR) and your express consent (Art. 6 (1) (a) GDPR). You can revoke your consent at any time informally by email to info@ok-bergbahnen.com or by phone at +49 (0)8322 96000.

• Cookies: Use of cookies
  Our website uses cookies. Cookies are small text files that are stored on your computer system via your internet browser. A specific internet browser can be recognized and identified via the unique cookie ID. The purpose of this recognition is to make it easier for users to use our website. In detail, we use cookies as follows:
  We assign the contents of your shopping cart to your browser so that you can continue a booking or order you've started at a later time.
  If you make settings on our website (e.g., the travel period in the booking form), we assign these settings to your browser so that you don't have to enter them again the next time you visit.
  If you access our website via a link from another site, we assign the previous address to your cookie and read this information in the event of a booking, order, or inquiry in order to statistically determine how our customers became aware of us.
  If you use a login function, you don't have to re-enter your access data every time you visit our website.
  You can prevent our website from setting cookies at any time by making the appropriate settings in your internet browser, thereby permanently denying the setting of cookies. Furthermore, cookies that have already been set can be deleted from your internet browser at any time. If you permanently deactivate cookies, not all functions of our website may be available.
  The following data is collected as part of the technically necessary cookies: storage of the shopping cart, likes, storage of a user session, and storage of your decision regarding the use of cookies.
  The legal basis for this processing is the fulfillment of the contract (Art. 6 (1) (b) GDPR) and your express consent (Art. 6 (1) (a) GDPR).
  If you agree to the use of additional cookies, the following data will be processed:
  Usage data, websites visited, access times,
  IP addresses, and metadata (device information).
  The legal basis for this data processing is your express consent (Art. 6 (1) (a) GDPR).

We use the following processors: Tramino

This processor is located exclusively in the EU.

Data is not transferred to third parties, with the exception of the credit card number being transferred to the processing bank/payment service provider for the purpose of debiting the purchase price.

Your personal data will be deleted immediately as soon as the purpose for which it was originally collected no longer exists and there is no statutory retention period for this data or a legitimate interest on our part to assert, exercise, or defend legal claims. We therefore store and process your personal data for the duration of the contract/ongoing business relationship or until you revoke your consent or object in accordance with Art. 21 GDPR.

As a data subject, you have the following rights at any time:

• Access, correction, deletion, or restriction of the processing of your stored data
• Objection to processing
• Data portability, right to withdraw consent

To assert your data subject rights, as well as for any information regarding the processing of your personal data, please contact us at: datenschutz@ok-bergbahnen.com

As a data subject, you have the right to obtain information about the following from us at any time and free of charge:

• the purposes of the processing
• the categories of personal data we process
• the recipients or categories of recipients to whom the personal data have been or will be disclosed
• if possible, the planned duration for which your personal data will be stored, or, if this is not possible, the criteria used to determine this duration
• the existence of your right to rectification or erasure of personal data concerning you or to restriction of processing by us as the controller or your right to object to such processing
• the existence of a right to lodge a complaint with the competent supervisory authority; in Austria, this is the Data Protection Authority
• all available information about the origin of your data, unless your personal data was collected from you as the data subject
  Furthermore, as a data subject, you have the right to information about whether your personal data has been transferred to a third country or to an international organization. If this is the case, you as the data subject have the right to receive information about the appropriate safeguards in connection with the transfer.
  Furthermore, you as the data subject have the right to information about the existence of automated decision-making, including profiling, and, where appropriate, meaningful information about its details.
  You have the right to receive a copy of the personal data being processed. For any additional copies you request, we may charge a reasonable fee based on the administrative costs. If you submit the request electronically, the information must be provided in a commonly used electronic format, unless you specify otherwise.
  Please contact us at any time!

As a data subject, you have the right to request that we immediately correct any inaccurate personal data concerning you and immediately complete the personal data we have stored about you. You can contact us at any time to do so.

As a data subject, you have the right to request that we delete your personal data immediately, provided that one of the following reasons applies and unless the processing is necessary to exercise the right to freedom of expression and information, to fulfill a legal obligation, for reasons of public interest, or to assert, exercise, or defend legal claims:

• Your personal data were collected or otherwise processed for purposes for which they are no longer necessary.
• As a data subject, you withdraw your consent on which the processing was based pursuant to Art. 6 (1) (a) GDPR or Art. 9 (2) (a) GDPR, and there is no other legal basis for the processing.
• As a data subject, you object to the processing pursuant to Art. 21 (1) GDPR and there are no overriding legitimate grounds for the processing, or as a data subject, you object to the processing pursuant to Art. 21 (2) GDPR.
• Your personal data has been processed unlawfully.
• The deletion of your personal data is necessary to fulfill a legal obligation under Union law or the law of the Republic of Austria to which we are subject as the controller.

As a data subject, you have the right to request that we, as the controller, restrict processing if one of the following conditions applies:

• You, as the data subject, contest the accuracy of the personal data for a period enabling us, as the controller, to verify the accuracy of your personal data.
• The processing is unlawful, and you, as the data subject, oppose the erasure of your personal data and instead request the restriction of the use of your personal data.
• We, as the controller, no longer need your personal data for the purposes of the processing, but you, as the data subject, need it to assert, exercise, or defend legal claims.
• You, as the data subject, have objected to processing pursuant to Art. 21 (1) GDPR and it has not yet been determined whether the legitimate reasons of the controller outweigh those of the data subject.

As a data subject, you have the right to receive the personal data concerning you, which you have provided to us as the controller, in a structured, common, and machine-readable format.

You also have the right to transmit this data to another controller without hindrance from us, provided that:

1. the processing is based on consent pursuant to Art. 6 (1) (a) GDPR or Art. 9 (2) (a) GDPR or on a contract pursuant to Art. 6 (1) (b) GDPR
2. and the processing is carried out using automated procedures, unless the processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller.

Furthermore, when exercising your right to data portability pursuant to Art. 20 (1) GDPR, you as the data subject have the right to have your personal data transmitted directly from us as the controller to another controller, where technically feasible and provided that this does not adversely affect the rights and freedoms of others.

As a data subject, you have the right to object at any time to the processing of personal data concerning you which is based on Article 6 (1) (e) (processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller) or (f) (processing is necessary to safeguard the legitimate interests of the controller or a third party) GDPR, for reasons related to your particular situation. You can contact us at any time to do so. We as the controller will then no longer process your personal data unless we can demonstrate compelling legitimate grounds for the processing which override your interests, rights and freedoms, or the processing serves to assert, exercise or defend legal claims.

You have the right to lodge a complaint with a supervisory authority, in particular in the Member State of your residence, place of work, or place of the alleged infringement, if you believe that the processing of personal data concerning you violates the GDPR or (in Austria) the Data Protection Act. In Austria, this supervisory authority is the Data Protection Authority. In Germany, the competent data protection authority at federal level is the Federal Commissioner for Data Protection and Freedom of Information, and for the individual federal states, the respective state commissioners, or in Bavaria, the Bavarian State Office for Data Protection Supervision.

You have the right to revoke your consent at any time. Revoking your consent does not affect the legality of the processing carried out on the basis of your consent until the revocation. You can revoke your consent at any time, as you see fit, by sending an informal email to info@ok-bergbahnen.com. You can also notify us of your revocation by mail or in person at our office at Walserstr. 77, 6991 Riezlern (Austria).