Privacy Policy
As of: 05.10.2026
Controller
The controller within the meaning of the GDPR is:
SK Austria Klagenfurt GmbH, Siebenhügelstraße 107a, 9020 Klagenfurt am Wörthersee, Österreich
Email: support@austriaklagenfurt.at
Data processed and purposes
We process personal data that you provide to us in the course of creating an account and purchasing tickets: name, email address, telephone number, billing address and — for corporate purchases — company name and VAT ID. For discounted season tickets, we additionally process date of birth and ID number to verify eligibility.
Purposes: processing orders, generating and sending e-tickets, invoicing, account management and compliance with statutory retention obligations.
Legal bases
Processing is carried out for the performance of the contract (Art. 6(1)(b) GDPR), for compliance with legal obligations (Art. 6(1)(c) GDPR), on the basis of your consent (Art. 6(1)(a) GDPR) and to safeguard legitimate interests (Art. 6(1)(f) GDPR), as applicable in each case.
Hosting and server log files
This application is hosted by Vercel Inc. (440 N Barranca Ave #4133, Covina, CA 91723, USA); the servers running the application are located in Frankfurt am Main, Germany. When the pages are accessed, server log files are automatically processed (including IP address, date and time of access, the address accessed, volume of data transferred, browser type and operating system).
The data collected during orders is stored in a database operated by our service provider Neon Inc. (USA) on servers in Frankfurt am Main, Germany. The legal basis is our legitimate interest in secure and stable operation (Art. 6(1)(f) GDPR).
Web analytics (Google Analytics 4 and Google Tag Manager)
After you have given your consent, we use Google Analytics 4, a web analytics service provided by Google Ireland Limited (Gordon House, Barrow Street, Dublin 4, Ireland). We use it to analyse the use of the application pseudonymously (e.g. pages accessed, time spent, approximate location based on a truncated IP address, device used). Your full IP address is not stored.
To control the services used, we employ Google Tag Manager (Google Ireland Limited). We use Google Consent Mode: analytics tags are only executed after you have given your consent; no analysis takes place beforehand.
The legal basis is your consent (Art. 6(1)(a) GDPR), which you can withdraw at any time via the cookie settings. The retention period for event data is limited. A transfer of data to Google LLC in the USA is possible; you can find the safeguards for this in the section on data transfers to third countries. Further information: https://policies.google.com/privacy.
Meta Pixel and Conversions API (Meta Platforms)
After you have consented to the "Marketing" category, we use the Meta Pixel of Meta Platforms Ireland Ltd. (Merrion Road, Dublin 4, Ireland). The pixel records page views and events such as viewing a match, adding tickets to the cart and starting checkout, and sets cookies for this purpose (including _fbp). This allows us to measure the effectiveness of our advertising on Facebook and Instagram and to show you content there that matches your interests. The pixel is loaded exclusively via Google Tag Manager and only after consent has been given; Meta's automatic collection of form and button data is disabled.
In addition, we transmit certain completion events (ticket purchase, registration of a 1920 Club ID, confirmed newsletter sign-up) directly from our server via the Meta Conversions API. This involves your e-mail address exclusively in hashed form (SHA-256), IP address, browser identifier and – where available – the click and browser identifiers set by Meta (fbclid, _fbp, _fbc) and the order value. This transmission also takes place only if you have consented to the "Marketing" category.
The legal basis is your consent (Art. 6(1)(a) GDPR), which you can withdraw at any time with effect for the future via the cookie settings. We and Meta are joint controllers within the meaning of Art. 26 GDPR for the collection and transmission of this data; the relevant agreement can be found at https://www.facebook.com/legal/controller_addendum. A transfer of data to Meta Platforms, Inc. in the USA is possible (see the section on data transfers to third countries). Further information: https://www.facebook.com/privacy/policy.
Source measurement (campaign attribution)
To understand which channels (e.g. newsletter, social media, ads) bring visitors to us, when you arrive via a correspondingly tagged link we store the campaign parameters (UTM parameters, fbclid) in our own cookie ("ska_attr", lifetime 90 days) – only if you have consented to the "Analytics" category. This cookie is read only by us and contains no third-party identifiers. If you complete a purchase, a registration or a newsletter sign-up, we assign this source to the transaction.
The legal basis is your consent (Art. 6(1)(a) GDPR), which you can withdraw at any time with effect for the future via the cookie settings. Data is passed on to third parties exclusively within the scope of the consent-based services described above.
Payment processing (Stripe)
Payments are processed by Stripe Payments Europe Ltd. (1 Grand Canal Street Lower, Dublin, Ireland) as a processor; Stripe, Inc. (USA) may be involved in the processing. Payment data is transmitted directly to Stripe; we do not store any complete payment instrument data. The legal basis is the performance of the contract (Art. 6(1)(b) GDPR).
Stripe issues the invoice for the order on our behalf. You can find Stripe's privacy notice at https://stripe.com/at/privacy.
Email delivery
For sending order and ticket confirmations, we use the email service Resend (Plus Five Five, Inc., USA) as a processor. Emails are sent via servers in Ireland; account data and delivery metadata (e.g. recipient address, subject, delivery status) are stored by Resend in the USA. Your email address and the contents of the confirmation are processed for this purpose. The legal basis is the performance of the contract (Art. 6(1)(b) GDPR). Privacy notice: https://resend.com/legal/privacy-policy.
Support channels (chat, email, WhatsApp)
For support enquiries we offer a web chat on our website and email support (support@ and ticketing@). Chat enquiries are first answered by an AI assistant, which is labelled as such in the chat window. If it cannot help or you ask for it, our service team takes over. Incoming emails are handled by our team; an AI system assigns them to a topic and, on request, suggests a reply, which a staff member reviews before it is sent.
For the AI functions we use the AI Gateway of Vercel Inc. (USA) as a processor. Texts are generated by language models (Claude by Anthropic) operated in EU data centres of Amazon Web Services and Google Cloud. The providers do not store the contents and do not use them for training (zero data retention). For searching our knowledge base we use Mistral AI SAS (Paris, France). The contents of your messages and, where needed for the reply, your first name and details of your orders are processed. Please do not transmit sensitive data (e.g. health or payment data) via these channels.
So that the chat recognises your conversation, it stores a random identifier in your browser's local storage; the conversation is no longer shown in the chat window after 24 hours. To protect against misuse, we briefly count requests per identifier and IP address with the service Upstash, Inc. (USA) on servers in Frankfurt am Main, Germany.
Emails to our domain are received by Google Workspace of Google Ireland Limited (Gordon House, Barrow Street, Dublin 4, Ireland), which forwards support enquiries to our support system; they are received there via Resend (see the email delivery section). Attachments are stored with Vercel Inc. on servers in Frankfurt am Main, Germany. You receive an automatic acknowledgement for a new enquiry to support@.
If you contact us via WhatsApp, your telephone number and message contents are transmitted via the WhatsApp Business Platform of Meta Platforms Ireland Ltd. (Merrion Road, Dublin 4, Ireland); processing by Meta in the USA is possible. WhatsApp's privacy policy applies in addition (https://www.whatsapp.com/legal/privacy-policy).
The legal basis is the performance of the contract or pre-contractual measures (Art. 6(1)(b) GDPR) and our legitimate interest in handling your enquiries quickly and efficiently and in protecting against misuse (Art. 6(1)(f) GDPR). Support conversations are deleted automatically 12 months after the case is closed.
Newsletter
We use the double opt-in procedure for our newsletter: the registration only becomes effective once you confirm the link sent to you by email. Dispatch and management are handled by our processor Resend (Plus Five Five, Inc., USA).
To improve our newsletter, we measure delivery, opens and clicks. The legal basis is your consent (Art. 6(1)(a) GDPR); you can withdraw it at any time with effect for the future via the unsubscribe link in every email or in your Club ID account.
1920 Club ID and membership
If you create a 1920 Club ID account, we process your registration data (name, email address, password as a cryptographic hash, membership number) to provide the account and its associated functions (tickets, membership, consent management). The legal basis is the performance of the contract (Art. 6(1)(b) GDPR).
If you take out a membership, we additionally process the data required for fee management and collection. Recurring payments are processed via Stripe (see the payment processing section). Files you upload and documents generated for you are stored with our processor Vercel Inc. (USA, Vercel Blob service).
Account data is stored for the duration of the account relationship; after termination or deletion of the account it is deleted, subject to statutory retention obligations.
Address suggestions and address validation
When you enter your address during checkout and registration, we suggest matching addresses and check whether the address exists. For this, our server sends the text you enter to the Google Maps Platform of Google Ireland Limited (Gordon House, Barrow Street, Dublin 4, Ireland). Your browser does not connect to Google and your IP address is not transmitted. The legal basis is the performance of the contract (Art. 6(1)(b) GDPR) and our legitimate interest in correct delivery addresses (Art. 6(1)(f) GDPR).
Error monitoring
To detect technical errors quickly, we use Sentry by Functional Software, Inc. (USA) with storage in Germany. When an error occurs, the error message, technical details about the browser and the page accessed (without additional parameters) are transmitted; for around 10% of page views, loading times are also transmitted. Transmission from your browser runs via our own domain, Sentry does not store IP addresses, no cookies are set and no entries or names are transmitted. The legal basis is our legitimate interest in error-free operation (Art. 6(1)(f) GDPR).
In the internal administration area, used only by club staff, we measure with consent which areas are used, using PostHog (PostHog Inc., USA, storage in the EU). Only an internal user identifier, the area opened and technical details about the device are recorded.
Data transfers to third countries
Some of the services used may transfer personal data to countries outside the EU/EEA, in particular to the USA (including Google, Stripe Inc., Vercel, Neon, Resend, Upstash, Functional Software (Sentry), PostHog, Meta). Where we have chosen storage in the EU, this is stated in the relevant sections; access from the USA cannot be ruled out for these providers.
Where these providers are certified under the EU-US Data Privacy Framework (DPF) (including Google, Stripe), transfers take place on this basis. Otherwise, we base transfers on the European Commission's Standard Contractual Clauses (Art. 46 GDPR) and supplementary protective measures.
Retention period
Personal data is deleted as soon as the purpose of processing ceases to apply and no statutory retention periods (e.g. commercial and tax law periods, generally up to 7 years for invoices) prevent this. Processing based on consent ends upon your withdrawal. Support conversations are deleted automatically 12 months after the case is closed.
Your rights
You have the right to access, rectification, erasure, restriction of processing, data portability and objection. Insofar as processing is based on your consent, you can withdraw it at any time with effect for the future, without affecting the lawfulness of the processing carried out up to that point.
To exercise your rights, please contact support@austriaklagenfurt.at.
You also have the right to lodge a complaint with the Austrian Data Protection Authority (dsb.gv.at).