Privacy Policy

Controller

The controller within the meaning of the GDPR is:

SK Austria Klagenfurt GmbH, Siebenhügelstraße 107a, 9020 Klagenfurt am Wörthersee, Österreich

Email: office@skaustriaklagenfurt.at

Data processed and purposes

We process personal data that you provide to us in the course of creating an account and purchasing tickets: name, email address, telephone number, billing address and — for corporate purchases — company name and VAT ID. For discounted season tickets, we additionally process date of birth and ID number to verify eligibility.

Purposes: processing orders, generating and sending e-tickets, invoicing, account management and compliance with statutory retention obligations.

Legal bases

Processing is carried out for the performance of the contract (Art. 6(1)(b) GDPR), for compliance with legal obligations (Art. 6(1)(c) GDPR), on the basis of your consent (Art. 6(1)(a) GDPR) and to safeguard legitimate interests (Art. 6(1)(f) GDPR), as applicable in each case.

Hosting and server log files

This application is hosted by Vercel Inc. (440 N Barranca Ave #4133, Covina, CA 91723, USA). When the pages are accessed, server log files are automatically processed (including IP address, date and time of access, the address accessed, volume of data transferred, browser type and operating system).

The data collected during orders is stored in a database operated by our service provider Neon Inc. (USA). The legal basis is our legitimate interest in secure and stable operation (Art. 6(1)(f) GDPR).

Cookies and consent management

This application uses cookies and comparable technologies. Technically necessary cookies (e.g. for the shopping cart and secure payment processing) are required for operation. Non-essential cookies — for example for reach measurement — are only set with your consent (Art. 6(1)(a) GDPR).

To obtain and manage your consent, we use the consent management tool Cookiebot provided by Usercentrics A/S (Havnegade 39, 1058 Copenhagen, Denmark). Cookiebot documents your consent (including an anonymised key, IP address, browser/device information, consent status and timestamp) for the legally required record of evidence. The legal basis is Art. 6(1)(c) and (f) GDPR.

You can withdraw or adjust your consent at any time with effect for the future via the cookie settings. An always up-to-date overview of the cookies used can be found in the cookie declaration.

Web analytics (Google Analytics 4 and Google Tag Manager)

After you have given your consent, we use Google Analytics 4, a web analytics service provided by Google Ireland Limited (Gordon House, Barrow Street, Dublin 4, Ireland). We use it to analyse the use of the application pseudonymously (e.g. pages accessed, time spent, approximate location based on a truncated IP address, device used). Your full IP address is not stored.

To control the services used, we employ Google Tag Manager (Google Ireland Limited). We use Google Consent Mode: analytics tags are only executed after you have given your consent; no analysis takes place beforehand.

The legal basis is your consent (Art. 6(1)(a) GDPR), which you can withdraw at any time via the cookie settings. The retention period for event data is limited. A transfer of data to Google LLC in the USA is possible; you can find the safeguards for this in the section on data transfers to third countries. Further information: https://policies.google.com/privacy.

Payment processing (Stripe)

Payments are processed by Stripe Payments Europe Ltd. (1 Grand Canal Street Lower, Dublin, Ireland) as a processor; Stripe, Inc. (USA) may be involved in the processing. Payment data is transmitted directly to Stripe; we do not store any complete payment instrument data. The legal basis is the performance of the contract (Art. 6(1)(b) GDPR).

Stripe issues the invoice for the order on our behalf. You can find Stripe's privacy notice at https://stripe.com/at/privacy.

Email delivery

For sending order and ticket confirmations, we use the email service Resend (Plus Five Five, Inc., USA) as a processor. Your email address and the contents of the confirmation are processed for this purpose. The legal basis is the performance of the contract (Art. 6(1)(b) GDPR). Privacy notice: https://resend.com/legal/privacy-policy.

Data transfers to third countries

Some of the services used may transfer personal data to countries outside the EU/EEA, in particular to the USA (including Google, Stripe Inc., Vercel, Neon, Resend).

Where these providers are certified under the EU-US Data Privacy Framework (DPF) (including Google, Stripe), transfers take place on this basis. Otherwise, we base transfers on the European Commission's Standard Contractual Clauses (Art. 46 GDPR) and supplementary protective measures.

Retention period

Personal data is deleted as soon as the purpose of processing ceases to apply and no statutory retention periods (e.g. commercial and tax law periods, generally up to 7 years for invoices) prevent this. Processing based on consent ends upon your withdrawal.

Your rights

You have the right to access, rectification, erasure, restriction of processing, data portability and objection. Insofar as processing is based on your consent, you can withdraw it at any time with effect for the future, without affecting the lawfulness of the processing carried out up to that point.

To exercise your rights, please contact office@skaustriaklagenfurt.at.

You also have the right to lodge a complaint with the Austrian Data Protection Authority (dsb.gv.at).