Privacy Policy

Controller

The controller within the meaning of the GDPR is:

SK Austria Klagenfurt GmbH, Siebenhügelstraße 107a, 9020 Klagenfurt am Wörthersee, Österreich

Email: support@austriaklagenfurt.at

Data processed and purposes

We process personal data that you provide to us in the course of creating an account and purchasing tickets: name, email address, telephone number, billing address and — for corporate purchases — company name and VAT ID. For discounted season tickets, we additionally process date of birth and ID number to verify eligibility.

Purposes: processing orders, generating and sending e-tickets, invoicing, account management and compliance with statutory retention obligations.

Legal bases

Processing is carried out for the performance of the contract (Art. 6(1)(b) GDPR), for compliance with legal obligations (Art. 6(1)(c) GDPR), on the basis of your consent (Art. 6(1)(a) GDPR) and to safeguard legitimate interests (Art. 6(1)(f) GDPR), as applicable in each case.

Hosting and server log files

This application is hosted by Vercel Inc. (440 N Barranca Ave #4133, Covina, CA 91723, USA). When the pages are accessed, server log files are automatically processed (including IP address, date and time of access, the address accessed, volume of data transferred, browser type and operating system).

The data collected during orders is stored in a database operated by our service provider Neon Inc. (USA). The legal basis is our legitimate interest in secure and stable operation (Art. 6(1)(f) GDPR).

Cookies and consent management

This application uses cookies and comparable technologies. Technically necessary cookies (e.g. for the shopping cart and secure payment processing) are required for operation. Non-essential cookies — for example for reach measurement — are only set with your consent (Art. 6(1)(a) GDPR).

To obtain and manage your consent, we use the consent management platform of Usercentrics GmbH (Sendlinger Straße 7, 80331 Munich, Germany). Usercentrics documents your consent (including an anonymised key, browser/device information, consent status and timestamp) for the legally required record of evidence. The legal basis is Art. 6(1)(c) and (f) GDPR.

You can withdraw or adjust your consent at any time with effect for the future via the cookie settings. An always up-to-date overview of the cookies used can be found in the cookie declaration.

Web analytics (Google Analytics 4 and Google Tag Manager)

After you have given your consent, we use Google Analytics 4, a web analytics service provided by Google Ireland Limited (Gordon House, Barrow Street, Dublin 4, Ireland). We use it to analyse the use of the application pseudonymously (e.g. pages accessed, time spent, approximate location based on a truncated IP address, device used). Your full IP address is not stored.

To control the services used, we employ Google Tag Manager (Google Ireland Limited). We use Google Consent Mode: analytics tags are only executed after you have given your consent; no analysis takes place beforehand.

The legal basis is your consent (Art. 6(1)(a) GDPR), which you can withdraw at any time via the cookie settings. The retention period for event data is limited. A transfer of data to Google LLC in the USA is possible; you can find the safeguards for this in the section on data transfers to third countries. Further information: https://policies.google.com/privacy.

Payment processing (Stripe)

Payments are processed by Stripe Payments Europe Ltd. (1 Grand Canal Street Lower, Dublin, Ireland) as a processor; Stripe, Inc. (USA) may be involved in the processing. Payment data is transmitted directly to Stripe; we do not store any complete payment instrument data. The legal basis is the performance of the contract (Art. 6(1)(b) GDPR).

Stripe issues the invoice for the order on our behalf. You can find Stripe's privacy notice at https://stripe.com/at/privacy.

Email delivery

For sending order and ticket confirmations, we use the email service Resend (Plus Five Five, Inc., USA) as a processor. Your email address and the contents of the confirmation are processed for this purpose. The legal basis is the performance of the contract (Art. 6(1)(b) GDPR). Privacy notice: https://resend.com/legal/privacy-policy.

Support channels (chat, email, WhatsApp)

For support enquiries we offer a web chat, email support and a WhatsApp channel. Enquiries are initially answered automatically by an AI system; for this we use Anthropic (Anthropic PBC, San Francisco, USA) for text generation and Voyage AI (USA) for semantic search in our knowledge base, both as processors. The contents of your messages and — depending on the channel — your email address or telephone number are processed. Please do not transmit sensitive data (e.g. health or payment data) via these channels.

If you use the WhatsApp channel, your telephone number and message contents are transmitted via the WhatsApp Business Platform of Meta Platforms Ireland Ltd. (Merrion Road, Dublin 4, Ireland); processing by Meta in the USA is possible. WhatsApp's privacy policy applies in addition (https://www.whatsapp.com/legal/privacy-policy).

The legal basis is the performance of the contract or pre-contractual measures (Art. 6(1)(b) GDPR) and our legitimate interest in efficient handling of enquiries (Art. 6(1)(f) GDPR). Support conversations are deleted as soon as they are no longer required for processing.

Newsletter

We use the double opt-in procedure for our newsletter: the registration only becomes effective once you confirm the link sent to you by email. Dispatch and management are handled by our processor Resend (Plus Five Five, Inc., USA).

To improve our newsletter, we measure delivery, opens and clicks. The legal basis is your consent (Art. 6(1)(a) GDPR); you can withdraw it at any time with effect for the future via the unsubscribe link in every email or in your Club ID account.

1920 Club ID and membership

If you create a 1920 Club ID account, we process your registration data (name, email address, password as a cryptographic hash, membership number) to provide the account and its associated functions (tickets, membership, consent management). The legal basis is the performance of the contract (Art. 6(1)(b) GDPR).

If you take out a membership, we additionally process the data required for fee management and collection. Recurring payments are processed via Stripe (see the payment processing section). Files you upload and documents generated for you are stored with our processor Vercel Inc. (USA, Vercel Blob service).

Account data is stored for the duration of the account relationship; after termination or deletion of the account it is deleted, subject to statutory retention obligations.

Data transfers to third countries

Some of the services used may transfer personal data to countries outside the EU/EEA, in particular to the USA (including Google, Stripe Inc., Vercel, Neon, Resend, Anthropic, Voyage AI, Meta).

Where these providers are certified under the EU-US Data Privacy Framework (DPF) (including Google, Stripe), transfers take place on this basis. Otherwise, we base transfers on the European Commission's Standard Contractual Clauses (Art. 46 GDPR) and supplementary protective measures.

Retention period

Personal data is deleted as soon as the purpose of processing ceases to apply and no statutory retention periods (e.g. commercial and tax law periods, generally up to 7 years for invoices) prevent this. Processing based on consent ends upon your withdrawal.

Your rights

You have the right to access, rectification, erasure, restriction of processing, data portability and objection. Insofar as processing is based on your consent, you can withdraw it at any time with effect for the future, without affecting the lawfulness of the processing carried out up to that point.

To exercise your rights, please contact support@austriaklagenfurt.at.

You also have the right to lodge a complaint with the Austrian Data Protection Authority (dsb.gv.at).