Data protection

The controller (as defined in Article 4(7) of the GDPR) responsible for the processing of your personal data (personal data as defined in Article 4(1) of the GDPR) is:

Planai-Hochwurzen-Bahnen Gesellschaft m.b.H.
Coburgstrasse 52
8970 Schladming
Styria - Austria
Phone: +43 3687 22042

Data Protection Officer

Planai is not required to appoint a Data Protection Officer; in this regard, we refer to Article 37, Paragraph 1 of the EU GDPR. Of course, Planai is aware of its responsibility in handling personal data and takes all necessary measures and implements all necessary regulations to fulfill this responsibility. Planai is committed to continuously implementing, reviewing, and improving the established data protection measures. Rights of Data Subjects Any data subject whose personal data is processed by Planai has the right at any time to invoke and exercise their rights as a data subject. To exercise your rights as a data subject, you may contact us at any time in writing via email at datenschutz@planai.at.

Purpose of Data Processing

Planai processes personal data of employees, partners, customers, and suppliers for the purpose of conducting business operations and fulfilling related legal and contractual requirements.

Collection of Customer Data

When you purchase a ticket in our online store or at our ticket counters, we collect and process—depending on the specific product—your first name, last name, address, phone number, email address, date of birth, and photo to complete the booking and payment process.

Access Control

Please note that, for the purpose of access control, a reference photo of the lift ticket holder is taken the first time they pass through a turnstile equipped with a camera. Lift staff will compare this reference photo with the photos taken each time the holder passes through a turnstile equipped with a camera. The reference photo is deleted immediately after the lift ticket expires; the other photos are deleted no later than 30 minutes after each passage through a turnstile. Please note that it is also possible to purchase lift passes that are technically configured so that no photo is taken when passing through the turnstile; however, in such cases, random checks by lift staff should be expected.

Photo Points & Webcams

There are several photo points located throughout the ski resorts that you can use to take photos. When you use a photo point, a current photo is taken and published online. You can have the photos you’ve taken deleted at any time. To do so, simply contact us at datenschutz@planai.at.

Skiline

Through our website, you can access the external Skiline service to view your personal elevation profile. To generate the elevation profile, Skiline receives information about the turnstiles you’ve passed through as well as your ticket number. Therefore, no personal data is shared. When you access the Skiline service via our website, you leave our site, and we cannot assume any liability thereafter.

Principles of Personal Data Processing

The processing of personal data is based on strict principles that regard the protection and security of data, as well as the rights of data subjects, as the highest priorities.

Lawfulness & Transparency

Data processing is carried out lawfully and in good faith. When data is collected, the data subject is informed about the intended processing and handling of the data. Data subjects are thus informed of at least the following points:

• Data Controller
• Purpose of Data Processing
• Legal basis for processing

You will find brief information at all our checkout counters regarding the processing of the data collected from you.

Purpose Limitation

Data is collected and processed for specified, explicit, and legitimate purposes. The data is not processed in a manner incompatible with these purposes.

Data Minimization

Only data that is strictly necessary for the specified purposes is collected and processed. If it is possible to achieve the purpose and the effort involved is reasonable, only anonymized data is processed.

Storage Limitation and Deletion

Personal data is deleted as soon as the purpose for which it was originally collected no longer applies and statutory retention periods do not prevent its deletion.

If, in individual cases, there are legitimate interests in retaining this data, it will continue to be retained until the legitimate interest has been legally clarified.

Data Security

Personal data is subject to data confidentiality. The data must be treated confidentially and is protected by appropriate organizational and technical measures against unauthorized access, unlawful manipulation or disclosure, as well as against loss and destruction.

Accuracy

Personal data must be kept accurate, complete, and up-to-date. Appropriate measures are taken to correct outdated, incorrect, or incomplete data.

Commitment to Data Confidentiality

All Planai employees and the employees of the operating companies are contractually bound to maintain confidentiality and are regularly instructed and trained on the secure handling of personal and other critical data.

Data Security

Protecting the confidentiality, availability, and integrity of data is a key responsibility of Planai. This applies equally to trade secrets, customer data, personal data, and other critical information. To this end, state-of-the-art technical and organizational security measures, based on internationally recognized best practices and security standards, are established and continuously improved.

Information

Data subjects may at any time request information regarding which personal data is being processed about them and the purposes for which such processing is carried out.

Correction

Data subjects have the right to request the immediate rectification of inaccurate personal data concerning them.

Restriction

Data subjects have the right to restrict processing if the accuracy of the data concerning them is disputed, the processing is unlawful, the data is no longer needed for processing, or the data subjects have objected to the processing.

Withdrawal

Data subjects have the right to object at any time to the processing of personal data concerning them.

Portability

Data subjects have the right to receive the personal data concerning them that they have provided to Planai in a structured, commonly used, and machine-readable format. They also have the right to request the transfer of this data to another controller, provided this is technically feasible. Portability applies only to personal data processed by automated means.

Erasure – Right to be Forgotten

The data subject has the right to request the immediate erasure of personal data concerning them if there is no legal basis for processing the data or if such basis ceases to exist, if the data subject objects to the processing, if the processing is unlawful, and if no statutory retention periods prevent erasure. Data security is also of high importance with regard to data subject rights, which is why data subjects may exercise their rights only after the data subject has been identified beyond a doubt. You also have the right to file a complaint with the data protection authority at any time.

Server Data

For technical reasons, based on the legal basis of Section 165 (3) S 3 of the TKG 2021 (necessary for the operation of our website), the following data—among other things—that your internet browser transmits to us or to our web hosting provider is collected (so-called “server log files”):

• Browser type and version
• Operating system and device type used (e.g., desktop / mobile)
• Website from which you are visiting us (referrer URL)
• Website you are visiting
• Date and time of your visit
• Your Internet Protocol address (IP address)

This data, which is anonymous to us, is stored separately from any personal data you may have provided for 7 days and therefore does not allow us to identify any specific individual. It is analyzed for statistical purposes to help us optimize our website and our offerings.

SSSL or TLS Encryption

For security reasons and to protect the transmission of confidential content—such as orders or inquiries you send to us as the website operator—this site uses SSL or TLS encryption. You can recognize an encrypted connection by the fact that the address bar of your browser changes from “http://” to “https://” or by the lock icon in your browser’s address bar. When SSL or TLS encryption is enabled, the data you transmit to us cannot be read by third parties.

Technical Service Providers

We create and edit the content of our website with the help of the following service providers, whom we have obligated through a corresponding agreement pursuant to Art. 28 of the GDPR to process your data exclusively within the scope of our mandate:

Technical Design:

• Web agency - www.valantic.com (Valantic CX Austria GmbH, Gusswerk Halle 6, Söllheimerstraße 16, A-5020 Salzburg); For more information on data protection, visit: https://www.valantic.com/at/datenschutzhinweis/

Web hosting:

• Hetzner Online GmbH (Industriestr. 25, D-91710 Gunzenhausen). For more information on data protection, visit: https://www.hetzner.com/de/legal/privacy-policy/ 

Cookie Banner - Cookies on Our Website

Our website uses cookies to help us make our website more user-friendly and efficient for you, to conduct statistical analyses of how our website is used, and to display content that may be of interest to you on other websites as well. Cookies are small data files used to store information during or about visits to websites and are stored on the website visitor’s computer. The legal basis for cookies that are strictly necessary for the proper functioning of our website (e.g., shopping cart cookies) is Section 165(3), Sentence 3 of the Telecommunications Act (TKG) 2021. Cookies that are not necessary for the functioning of our website (e.g., analytics or marketing cookies) are disabled by default and are only activated upon your consent pursuant to Article 6(1)(a) of the GDPR via our cookie banner (“Accept”). By clicking “Settings,” you can enable or disable individual cookies or groups of cookies. If you restrict the use of cookies on our website, you may no longer be able to use all of our website’s features to their full extent. Detailed information about the cookies used on our website is available in our cookie banner.

Changing Cookie Settings in Your Web Browser

You can configure how the web browser you use handles cookies—that is, which cookies are accepted or rejected—in your browser’s settings. You can also delete cookies already stored on your computer or device at any time. The exact location of these settings depends on the specific web browser. Detailed information on this can be found in the help section of your web browser.

In addition, you have the option to generally opt out of cookies and similar tracking technologies through the services listed below by setting your individual preferences—specifying which technologies for usage- and interest-based advertising you wish to allow:

• European Interactive Digital Advertising Alliance (EDAA): https://www.youronlinechoices.com/de/praferenzmanagement/ 
• Network Advertising Initiative (NAI): https://optout.networkadvertising.org/?c=1#!%2F 

IP Address

When you visit our website, information is automatically stored on the web server. This includes the browser you are using, the operating system, the page that led you to our website, your IP address, the time of access, and other information. From Planai’s perspective, this data is pseudonymized and cannot be linked to specific individuals without additional data sources. Planai does not analyze this data unless there is evidence of unlawful use of the website.

Google Analytics

This website uses Google Analytics, a web analytics service provided by Google Inc. (“Google”). Google Analytics uses so-called “cookies,” which are text files stored on your computer that enable an analysis of your use of the website. The information generated by the cookie regarding your use of this website (including your IP address) is transmitted to a Google server in the United States and stored there. Google will use this information to evaluate your use of the website, to compile reports on website activity for the website operators, and to provide other services related to website and internet usage. Google may also transfer this information to third parties where required by law or where such third parties process the data on Google’s behalf. Google will never associate your IP address with any other data held by Google. You can prevent the installation of cookies by adjusting your browser settings accordingly; however, please note that in this case you may not be able to use all functions of this website to their full extent. By using this website, you consent to the processing of data collected about you by Google in the manner and for the purposes described above.

Adobe Fonts

Provider: Adobe Systems Software Ireland Limited, 4-6 Riverwalk, Citywest Business Campus, Dublin 24, Ireland; parent company: Adobe Inc. (USA)

Purpose: Integration of fonts, performance measurement

Category: Statistics

Recipients: EU, USA

Data processed: IP address, user data

Data subjects: Users

Technology: JavaScript call

Legal basis: Consent, Data Privacy Framework, https://www.dataprivacyframework.gov/s/participant-search/participant-detail?id=a2zt0000000TNo9AAG&status=Active

Website: https://www.adobe.com/

Further information: https://www.adobe.com/de/privacy.html https://www.adobe.com/privacy/policies/adobe-fonts.html

Our website uses so-called web fonts, provided by Adobe, to ensure consistent font display. 

When you visit our website, your browser loads the necessary fonts directly from Adobe so that they can be displayed correctly on your device. In doing so, your browser establishes a connection to Adobe’s servers in the U.S. As a result, Adobe becomes aware that our website has been accessed via your IP address. According to Adobe, no cookies are used when providing the fonts.

With each font request, in addition to a user’s IP address, additional information is transmitted to Adobe to determine the popularity of fonts.

Google Ads

Provider: Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland; Parent company: Google LLC (U.S.)

Purpose: Personalized advertising, conversion tracking, remarketing, campaign performance measurement

Category: Marketing

Recipients: EU, USA

Data processed: IP address, website visit details, user data

Data subjects: Users

Technology: JavaScript call, cookies

Legal basis: Consent, certification under the EU-U.S. Data Privacy Framework,

Website: https://www.google.com

Additional information:

https://policies.google.com/privacy

https://safety.google/intl/de/principles/

https://business.safety.google/privacy/

https://business.safety.google/adsprocessorterms/

Here you can find out exactly where Google data centers are located: https://www.google.com/about/datacenters/inside/locations/

This website uses Google Ads to promote our products and services. Google Ads is Google’s proprietary online advertising system. 

It is important for us to know whether an interested visitor ultimately becomes our customer. To measure this, we use what is known as “conversion tracking.” Furthermore, we would like to be able to target visitors to our website again in a targeted manner. We achieve this through “remarketing (retargeting).”

Google Ads serves both “conversion tracking” and “remarketing,” meaning we can see what happened after you clicked on one of our ads. To make this service work, cookies are used, and some visitors are added to remarketing lists so they are shown only specific advertising campaigns.

Our goal is to use Google Ads to ensure that our website’s content reaches, in a targeted manner, those visitors who are genuinely interested in what we have to offer. The data from “conversion tracking” allows us to measure the effectiveness of individual advertising measures and optimize our website for our visitors. Conversions can be measured through the use of cookies.

We can also track whether you found our website through a Google Ads campaign. In conjunction with an analytics tool such as Google Analytics, we can further refine how we measure the success of our campaigns. The data is processed by Google. We only receive a report containing statistical analyses. This allows us, for example, to determine the number of users who clicked on our ad and to identify which campaign was well-received.

We have no control over how Google uses the data. According to information from Google, however, the data is stored in encrypted form on secure servers, including those in the U.S.

Google Fonts

Provider: Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland; parent company Google LLC (U.S.); https://www.dataprivacyframework.gov/s/participant-search/participant-detail?id=a2zt000000001L5AAI&status=Active

Purpose: Integration of fonts

Category: Statistics

Recipients: EU, USA (possible)

Data processed: IP address, language settings, screen resolution, browser version and name

Data Subjects: Website visitors

Technology: JavaScript call

Legal basis: Consent, Data Privacy Framework

Website: www.google.com

Further information: https://developers.google.com/fonts/faq https://policies.google.com/privacy https://www.google.com/about/datacenters/inside/locations/

Our website uses so-called web fonts, provided by Google, to ensure consistent font display. 

To display Google web fonts, the browser you are using must connect to Google’s servers. As a result, Google becomes aware that our website has been accessed via your IP address. Google also stores the IP address of the browser on the visitor’s device. If your browser does not support web fonts, a standard font will be used on your device.

With every Google Font request, information such as language settings, screen resolution, and the browser’s version and name is automatically transmitted to Google’s servers along with the IP address. Based on the usage data collected, Google can determine the popularity of fonts. Google publishes the results on internal analytics pages (e.g., Google Analytics).

Google Fonts allows us to use fonts on our own website without having to upload them to our server. Google Fonts is an important component in maintaining the high quality of our website. All Google fonts are automatically optimized for the web, which saves data volume and is a major advantage, especially when using mobile devices. When you visit our site, the small file size ensures fast loading times. Furthermore, Google Fonts are secure web fonts and are supported by all major browsers. 

Google stores requests for CSS assets on its servers for one day. This allows us to use the fonts with the help of a Google stylesheet. The font files are stored by Google for one year. To have the data deleted early, you must contact Google Support (https://support.google.com).

Google Marketing Platform / Google Ad Manager

Provider: Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland; Parent company: Google LLC (USA)

Purpose: Personalized advertising, conversion tracking, remarketing, campaign performance measurement

Category: Marketing

Recipients: EU, USA

Data processed: IP address, website visit information, user data

Data subjects: Users

Technology: JavaScript call, cookies

Legal basis: Consent, Data Privacy Framework, https://www.dataprivacyframework.gov/s/participant-search/participant-detail?id=a2zt000000001L5AAI&status=Active

Website: https://www.google.com

Additional information:

https://policies.google.com/privacy

https://safety.google/intl/de/principles/

https://business.safety.google/adsprocessorterms/

Here you can find out exactly where Google data centers are located: https://www.google.com/about/datacenters/inside/locations/

This website uses Google Ads to promote our products and services. Google Ads is Google’s proprietary online advertising system. 

It is important for us to know whether an interested visitor ultimately becomes our customer. To measure this, we use what is known as conversion tracking. Furthermore, we would like to be able to target and re-engage visitors to our website. We achieve this through what is known as remarketing (retargeting).

Google Ads serves both conversion tracking and remarketing purposes; that is, we can track what happens after you click on one of our ads. To make this service work, cookies are used, and visitors are sometimes added to remarketing lists so that they are shown only specific advertising campaigns.

This is done using a pseudonymous identification number (pID), which is assigned to a user’s browser. Through this pID, the service can recognize which ads have already been displayed to a user and which ones have been clicked. The data is used to serve ads across websites by allowing Google to identify the pages the user has visited. 

Our goal is to use Google Ads to ensure that our website’s content reaches, in a targeted manner, those visitors who are genuinely interested in what we offer. The data from conversion tracking allows us to measure the effectiveness of individual advertising measures and optimize our website for our visitors. Conversions can be measured through the use of cookies.

The information generated is transmitted by Google to a server in the United States for analysis and stored there. Google will only transfer this data to third parties if required by law or within the scope of data processing on its behalf. Under no circumstances will Google link a user’s data with other data collected by Google.

Google Signals for Google Analytics

Provider: Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland; Parent company: Google LLC (U.S.)

Purpose: Additional feature for Google Analytics; cross-device tracking

Category: Statistics

Recipients: EU, USA

Data processed: IP address, user data

Data subjects: Users

Technology: Additional feature for Google Analytics

Legal basis: Consent, Data Privacy Framework, https://www.dataprivacyframework.gov/s/participant-search/participant-detail?id=a2zt000000001L5AAI&status=Active

Website: https://www.google.com

Further information:

Details about Google Analytics in this Privacy Policy

https://policies.google.com/privacy

https://safety.google/intl/de/principles/

https://business.safety.google/adsprocessorterms/

Here you can find out exactly where Google’s data centers are located:

https://www.google.com/about/datacenters/locations/

On our website, we have expanded existing Google Analytics features to include Google Signals. Google Signals is a cross-device user tracking feature that is integrated into Google Analytics.

When you enable Google Signals for Google Analytics, data is processed and associated with your Google account. This allows Google, for example, to recognize if you viewed products on our website using your smartphone and then purchased them later using a different device, such as your computer. Google Signals makes it possible to run cross-device campaigns.

When you enable Google Signals for Google Analytics, user data—such as location, search history, and other information about your use of our website—is collected. This provides us with better insights into user interests and demographic characteristics. This information helps us create specific user segments in Google Analytics so that we can better address individual preferences and interests.

Personalization via Google Signals is only possible if a user is signed in to their Google Account and has enabled personalized ads, and provided the user has consented to the use of Google Analytics on our website. 

The privacy information regarding the use of Google Analytics can also be found here in this Privacy Policy.

Google Tag Manager

Provider: Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland; parent company: Google LLC (USA)

Purpose: Management of tools and plugins

Category: Technically Necessary

Recipients: EU, USA

Data Processed: IP address

Data subjects: Users

Technology: JavaScript call

Legal basis: Legitimate interest, Data Privacy Framework, https://www.dataprivacyframework.gov/s/participant-search/participant-detail?id=a2zt000000001L5AAI&status=Active

Website: https://www.google.com

Additional information:

https://policies.google.com/privacy

https://safety.google/intl/de/principles/

https://business.safety.google/adsprocessorterms/

Here you can find out exactly where Google data centers are located: https://www.google.com/about/datacenters/locations/

Our website uses the Google Tag Manager service.

Tag Manager is a service that allows us to manage website tags via a user interface. This enables us to embed code snippets—such as tracking codes or conversion pixels—on websites without modifying the source code. Tag Manager only forwards the data; it neither collects nor stores it. Tag Manager itself is a cookie-free domain and does not process any personal data, as it is used solely to manage other services on our website. 

When Google Tag Manager is launched, the browser establishes a connection to Google’s servers, which are primarily located in the United States. As a result, Google becomes aware that our website has been accessed via a user’s IP address. 

Tag Manager handles the resolution of other tags, which may in turn collect data. However, Tag Manager does not access this data. If deactivation has been performed at the domain or cookie level, it remains in effect for all tracking tags implemented via Tag Manager.

Hotjar

Provider: Hotjar Ltd., Level 2, St Julian’s Business Centre, 3, Elia Zammit Street, St Julian’s STJ 1000, Malta, Email: support@hotjar.com

Purpose: Analysis of user behavior, improvement of user-friendliness

Category: Statistics

Recipients: EU

Data Processed: Usage behavior, clicks, mouse movements, scrolling behavior, IP address (anonymized), device information, browser information, location (country only), preferred language, pages visited

Data subjects: Website visitors

Technology: Cookies (details in the cookie list), JavaScript, local storage

Legal basis: Consent (purpose)

Website: https:www.hotjar.com

Additional information:

https://www.hotjar.com/de/legal/policies/privacy/

https://www.hotjar.com/de/legal/policies/terms-of-service/

https://www.hotjar.com/de/legal/support/dpa/

https://www.hotjar.com/legal/policies/acceptable-use/

https://www.hotjar.com/de/engage-tester-terms/

On our website, we use the Hotjar service to analyze user behavior and improve the usability of our website. Hotjar is a tool that combines various analytics techniques to create a comprehensive picture of user behavior.

The tool collects data on users’ interactions with our website, including mouse movements, clicks, scrolling behavior, and form interactions. This data is visualized in the form of heatmaps, session recordings, and conversion funnels. Hotjar uses JavaScript and cookies to collect this information.

All relevant information about the cookies, including their names, purposes, and retention periods, is included in our detailed list of cookies used.

Hotjar anonymizes IP addresses and does not store any personally identifiable information. The tool also collects device information, browser type, operating system, preferred language, and approximate location (at the country level only).

In addition, Hotjar offers features such as feedback surveys and user polls that can be embedded directly on the website to collect qualitative feedback.

The data retention period varies depending on the feature and settings. By default, data is stored for 365 days but can be deleted earlier upon request. Once the retention period expires or the Hotjar account is deleted, the data is automatically deleted.

Additional details can be found in the linked supplementary information. We recommend checking these links regularly for changes, as Hotjar may update its privacy practices. Additional information regarding the rights of data subjects, as well as the corresponding contact information, is listed in the general section of this Privacy Policy.

Meta Pixel

Provider: Meta Platforms Ireland Limited, 4 Grand Canal Square, Grand Canal Harbour, Dublin 2, Ireland, Email: privacy@facebook.com

Parent Company: Meta Platforms, Inc., 1601 Willow Road, Menlo Park, CA 94025, USA

Purpose: Web analytics, tracking (conversion)

Category: Marketing

Recipients: EU, USA

Data Processed: Visitor data (e.g., IP address, location data), behavioral data (e.g., clicks, time spent on site, conversion data), device data (e.g., browser type, operating system), e-commerce data (e.g., order ID, product information)

Data subjects: Website visitors

Technology: JavaScript, cookies (details in the cookie list), tracking pixels

Legal basis: Consent (purpose)

Certifications: EU-U.S. Data Privacy Framework, Swiss-U.S. Data Privacy Framework, UK Extension to the EU-U.S. Data Privacy Framework

Website: https:www.facebook.com/business/tools/meta-pixel

Additional information:

https://www.facebook.com/privacy/policy/

https://www.facebook.com/legal/terms

Our website uses the Meta Pixel service from the social network Facebook for the analysis, optimization, and efficient operation of our online offerings.

With the help of Meta Pixel, Meta is able, on the one hand, to identify visitors to our website as a target audience for the display of personalized ads. Accordingly, we use Meta Pixel to display the ads we place only to users who have shown an interest in our online offerings or who exhibit certain characteristics (e.g., interests in specific topics or products, determined based on the websites they have visited), which we transmit to Meta (so-called “Custom Audiences”). With the help of Meta Pixel, we also aim to ensure that our Meta ads align with users’ potential interests and do not come across as intrusive. Additionally, Meta Pixels allow us to track the effectiveness of Meta ads for statistical and market research purposes by determining whether users were redirected to our website after clicking on a Meta ad (so-called “conversion”).

Users’ actions are stored in one or more cookies. These cookies enable Meta to match user data (such as IP address and user ID) with data from a Facebook account. The data collected is anonymous to us and cannot be viewed by us; it is used solely for advertising purposes. Users can prevent this link to their Facebook account by logging out before performing any action. 

To control which types of ads are displayed on Facebook, users can visit the page set up by Meta and follow the instructions there regarding usage-based advertising settings: https://www.facebook.com/settings?tab=ads 

These settings apply across all platforms, meaning they are applied to all devices, such as desktop computers or mobile devices.

Additional details can be found in the linked supplementary information. It is recommended that you check these links regularly for changes, as Meta may update its features and privacy policies. Further information on your rights and contact details can be found in the general section of this privacy policy.

Pinterest Tag

Provider: Pinterest Europe Ltd., Waterloo Exchange, 3rd Floor, Waterloo Road, Dublin 4, Ireland; Pinterest, Inc., 651 Brannan St., San Francisco, CA 94107, USA

Category: Marketing

Purpose: Web analytics, ad performance measurement, remarketing, and personalized advertising

Recipients: Pinterest Europe Ltd. (Ireland), Pinterest, Inc. (USA)

Data Processed: Usage and behavioral data (e.g., pages viewed and clicks), technical data (e.g., IP address, URL, referrer URL, browser and

device information, screen size, timestamps), online identifiers, and cookie IDs

Data subjects: Website visitors

Technology: JavaScript, cookies, Pinterest Tag

Retention period: see cookie list

Legal basis: Consent pursuant to Art. 6(1)(a) of the GDPR and § 165(3) of the TKG 2021.

Further information:
https://policy.pinterest.com/de/privacy-policy
https://policy.pinterest.com/de/ad-data-terms
https://help.pinterest.com/de/business/article/pinterest-tag-parameters-and-cookies

We use the Pinterest Tag on our website. It is used to analyze and optimize our online offerings, as well as to measure and optimize our advertising campaigns on Pinterest.

With the help of the Pinterest tag, we can track whether users visit our website after clicking on or viewing a Pinterest ad. This allows us to measure the effectiveness of our Pinterest ads and evaluate them for statistical and market research purposes.

In addition, the data collected via the Pinterest tag can be used to assign visitors to our website to specific target groups and to display interest-based or personalized ads to them on Pinterest. This allows us, in particular, to target people who have already shown interest in our online offerings (so-called “remarketing” or “retargeting”).

We use the Pinterest Tag in its standard configuration. In particular, page views and the technical data mentioned above are transmitted to Pinterest. We do not transmit any additional events of our own (e.g., purchases or shopping cart actions).

Pinterest uses cookies and similar technologies to recognize users and their activities and to track visits to our website. The specific cookies used and their storage periods are listed in our cookie list.

The Pinterest Tag is loaded only after you have given your consent. Processing is based on your consent. You can revoke or modify your consent at any time with future effect via the cookie settings on our website. The lawfulness of the processing carried out up until the revocation remains unaffected.

The data collected via the Pinterest tag is shared with Pinterest for behavioral-based online advertising. You can disable behavioral-based advertising on Pinterest in your personalization settings on Pinterest or via the website optout.aboutads.info.

When using the Pinterest Tag, personal data may be transferred to Pinterest, Inc. in the United States. This transfer is based on the EU-U.S. Data Privacy Framework (European Commission Adequacy Decision); Pinterest, Inc. is certified under this framework.

We are jointly responsible with Pinterest Europe Ltd. for the collection and transfer of data to Pinterest Europe Ltd. via the Pinterest Tag, in accordance with Article 26 of the GDPR. The division of responsibilities is governed by an agreement with Pinterest (Joint Controller Addendum to the Pinterest Advertising Services Agreement). We are responsible for informing visitors about the processing; Pinterest Europe Ltd. enables data subjects to exercise their rights. To exercise your rights, you can contact us or Pinterest Europe Ltd. Pinterest is solely responsible for the further processing of the data by Pinterest. You can find information on this, as well as on how to manage personalized advertising, in Pinterest’s Privacy Policy and settings.

Pinterest may update its features and privacy notices; the most current information from Pinterest is authoritative. For more information about your rights and our contact information, please see the general section of this Privacy Policy.

OpenAI Pixel

Provider: OpenAI, Inc., USA

Category: Marketing

Purpose: Web analytics, conversion tracking, performance measurement, and optimization of ChatGPT ads, as well as attributing website events to ad clicks

Recipient: OpenAI, Inc. (USA)

Data Processed: Usage and behavioral data (e.g., page views, completed purchases, submitted contact forms, clicks on email addresses and phone numbers, and file and brochure downloads), technical data (e.g., IP address, user agent, URL, and timestamp), online identifiers (e.g., ChatGPT ad click reference “oppref,” pixel ID, and event ID), and, where applicable, location data (e.g., country, city, region, and ZIP code)

Data Subjects: Website visitors

Technology: JavaScript, tracking pixels, integration via Google Tag Manager

Retention period: In accordance with OpenAI’s specifications and applicable contractual agreements
Legal basis: Consent pursuant to Art. 6(1)(a) GDPR and, to the extent that information is stored on or read from the end device, § 165(3) TKG 2021

Further information:

https://openai.com/policies/row-privacy-policy/

https://help.openai.com/de-de/articles/20001409-conversion-measurement

https://developers.openai.com/ads/conversion-tracking

We use the ChatGPT Pixel (OpenAI Pixel) from OpenAI on our website. This is used to analyze and optimize our advertising efforts within ChatGPT.

With the help of the ChatGPT Pixel, we can track whether users perform certain actions on our website after clicking on an ad in ChatGPT. These include, in particular, completed purchases, submissions of contact forms, clicks on email addresses and phone numbers, as well as file and brochure downloads. This allows us to measure the effectiveness of our ChatGPT ads and evaluate them statistically.

To associate these website events with ChatGPT ads, the ChatGPT ad click reference (“oppref”), the accessed URL, timestamps, event data, as well as technical information and identifiers may be transmitted to OpenAI. The specific information transmitted depends on the actual technical implementation.

The ChatGPT pixel is integrated into our website via Google Tag Manager. It is activated only after you have given your consent to the corresponding marketing category. Processing is based on your consent. You can revoke or modify your consent at any time with future effect via the cookie settings on our website. The lawfulness of the processing carried out up until the time of revocation remains unaffected.

When using the ChatGPT Pixel, personal data may be transferred to OpenAI, Inc. in the United States. Information regarding the processing of personal data and international data transfers can be found in OpenAI’s privacy policy.

OpenAI may update its features and privacy policy. For more information about your rights and our contact information, please see the general section of this privacy policy.

Vimeo

Provider: Vimeo Inc., 555 West 18th Street, New York, New York 10011, USA

Purpose: Embedding video content

Category: External media

Recipients: United States

Data processed: IP address, information about the website visit

Data subjects: Website visitors

Technology: JavaScript call, cookies

Legal basis: Consent

Website: https://www.vimeo.com

Further information: https://vimeo.com/privacy (in English)

ATTENTION! As part of this service, data is transferred to the U.S., or such a transfer cannot be ruled out. Please note that on July 10, 2023, the European Commission adopted an adequacy decision pursuant to Article 45(1) of the GDPR regarding the EU-U.S. Data Privacy Framework. Consequently, organizations or companies (as data importers) in the United States that are registered on a public list under the Data Privacy Framework’s self-certification option provide an adequate level of protection for data transfers. You can check whether the specific provider of this service is already certified here: https://www.dataprivacyframework.gov/s/participant-search 

Videos from the Vimeo platform are embedded on our website.

When you visit the pages of our website that include a Vimeo plugin, a connection is established with the Vimeo servers, and the plugin is displayed. As a result, your IP address is transmitted to the Vimeo server, along with information about which of our web pages you have visited. If you are logged in as a Vimeo member at that time, Vimeo associates this information with your personal user account. When you use the plugin—for example, by clicking the play button on a video—this information is also associated with your user account. You can prevent this association by logging out of your Vimeo user account before using our website.

If you wish to prevent Vimeo from transmitting and storing data about you and your behavior on our website, you must log out of Vimeo before visiting our site.

Retargeting

Display of interest-based advertising using “retargeting” This website uses so-called “retargeting tags.” A “retargeting tag” refers to a JavaScript element that is placed in the website’s source code. When a user visits a page on this website that contains a “retargeting tag,” an online advertising provider (e.g., Google) places a cookie on that user’s computer and adds it to the corresponding retargeting audience lists. This cookie is subsequently used to display retargeting campaigns (“interest-based advertising”) on other websites. Studies have shown that interest-based advertising is more engaging for internet users than advertising that has no direct connection to their interests or previously visited websites.

Settings and Opt-Out Options

Third-party vendors, including Google, use these cookies to serve ads based on a user’s previous visits to our website. No personal data is stored in the process. Users of this website can disable the use of cookies by Google by visiting the “Google Ads Preferences” page. Furthermore, users can disable the use of cookies by third-party providers by visiting the “Network Advertising Initiative” opt-out page and adjusting the settings there.

Google Ads Preferences: http://www.google.com/ads/preferences/?hl=de

"Network Advertising Initiative" settings and opt-out options: http://www.networkadvertising.org/managing/opt_out.asp

YouTube

Provider: Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland; Parent company: Google LLC (USA)

Purpose: Embedding video content, collecting statistical data

Category: Statistics

Recipients: EU, USA

Data processed: IP address, information about website visits, user data

Data subjects: Users

Technology: JavaScript calls, cookies, device fingerprinting, local storage

Legal basis: Consent, Data Privacy Framework, https://www.dataprivacyframework.gov/s/participant-search/participant-detail?id=a2zt000000001L5AAI&status=Active

Website: https://www.youtube.com

Further information: https://www.youtube.com/intl/ALL_at/howyoutubeworks/user-settings/privacy/

https://policies.google.com/privacy

https://safety.google/intl/de/principles/

https://support.google.com/youtube/answer/10364219?hl=de

We use the YouTube service on our website to embed external videos.

We have enabled YouTube’s enhanced privacy mode. According to YouTube, this mode ensures that YouTube does not store any information about visitors to this website before they watch a video. However, the enhanced privacy mode does not prevent the sharing of data with YouTube partners.

As soon as a YouTube video is played on our website, a connection is established with YouTube’s servers. This allows YouTube to track which of our pages you have visited. If you are logged into your YouTube account, this allows YouTube to directly associate your browsing behavior with your personal profile. You can prevent this by logging out of your account.

Furthermore, after a video is played, YouTube may store various cookies on your device or use comparable technologies (e.g., device fingerprinting). YouTube also uses local storage on your device. This allows YouTube to collect information about visitors to this website. This information is used, among other things, to track video statistics, improve the user experience, and prevent fraud.

Contact Form

On the Planai websites, you have the option to send your inquiries to Planai via the contact form. As part of this contact request, personal data (email address, name, address) is also collected and processed for the purpose of handling your inquiry.

Job Applicants

We electronically process the contact information and application documents submitted as part of a job application for the purpose of selecting suitable candidates for employment. In the event of a rejection, the application documents will only be retained on file if you give your consent.

For the purpose of providing contractual services, as well as their payment and fulfillment in connection with online purchases, reservations, and brochure orders, we process your personal master data, contractual and payment data, as well as communication data (IP address and server log files) based on the legal grounds set forth in Art. 6(1)(b) of the GDPR (performance of a contract) and Art. 6(1)(c) of the GDPR (legal obligation to maintain records and archive data). 

We store this data for as long as the purpose requires, as required by law (retention period for invoices pursuant to § 132 BAO for 7 years; voucher orders for 30 years until the expiration of the redemption period) or we require this data based on the legal basis of Article 6(1)(f) of the GDPR (legitimate interest) to defend against potential liability claims. If you cancel the ordering process, we will store the data for 14 days to resolve any issues that may have arisen during the ordering process.

There is no legal or contractual obligation to provide personal data. Failure to provide such data simply means that we cannot process your bookings or orders.

INCERT Voucher System and Merchandise

To process orders for vacation gift certificates and merchandising items, we use the system provided by INCERT eTourismus GmbH & Co KG (Leonfeldner Strasse 328, A-4040 Linz) as our data processor. This system enables the automated sale of gift certificates via “print@home” as well as the individual personalization of gift certificates with dedications, designs, and barcodes. The following information is required to process orders: title, first and last name, address, and email address. This data is processed for the purpose of providing contractual services or fulfilling pre-contractual obligations based on the legal basis of Article 6(1)(b) of the GDPR. We have entered into a corresponding agreement with INCERT as a data processor in accordance with Article 28 of the GDPR, which ensures that your data is processed exclusively within the scope of our contract. For more information on INCERT’s data protection practices, please visit: https://www.incert.at/datenschutz/. 

If you agree to receive the newsletter, we will use the information you provide—such as your name, email address, and other contact details—to keep you regularly updated on news from the ski region, local businesses, and current offers. If you no longer wish to receive the newsletter, you can unsubscribe at any time. To do so, you can use the unsubscribe link included in every email or send an email to web@planai.at.

In addition to our website, we maintain an online presence on social media networks and platforms (Facebook, Twitter, Pinterest, Instagram, LinkedIn, TikTok, Flickr, and YouTube) to communicate with customers and business partners who are active there and to inform them about our services on these networks. You can find additional privacy information when you access our content on these platforms.

From time to time, you will have the opportunity to participate in Planai’s sweepstakes. As part of these promotions, personal data (email address, name, mailing address) is also collected and processed for the purpose of administering the promotion. The personal data collected as part of such a sweepstakes is used exclusively for the administration of the promotion (in the case of a sweepstakes, for example, to determine the winner, notify the winner, and send the prize). After the promotion ends, but no later than 3 months thereafter, participants’ data will be deleted. Your data collected during the sweepstakes will only be used to send you newsletters if you have explicitly consented to this.