PRIVACY POLICY

The protection of your personal data is important to us. We process your data exclusively in accordance with the applicable legal provisions, in particular the General Data Protection Regulation (GDPR), the Austrian Data Protection Act (DSG) and the Austrian Telecommunications Act 2021 (TKG 2021). This Privacy Policy explains how we process personal data in connection with our website, enquiries, bookings and the arrangement of mountain and ski guiding services.

1. DATA CONTROLLER

The controller responsible for data processing is:

Piste to Powder
Mag. Florian Kraler
Gilmstraße 12
6700 Bludenz
Austria
Phone: +43 664 1746282
Email: info@pistetopowder.com
Website: www.pistetopowder.com

2. GENERAL INFORMATION ON DATA PROCESSING

We process personal data only to the extent necessary to provide our website, respond to enquiries, arrange and process bookings, communicate with customers or comply with legal obligations. Depending on the circumstances, we may process in particular the following data:

Name and contact details
Email address and telephone number
Address and billing information
Booking and travel information
Information about the requested tour or guiding service
Information about group size, age, skiing or mountaineering ability and participants’ experience, where necessary for arranging or preparing the requested service
Communication content
Payment and billing information
Technical data generated when using our website, in particular IP address, browser and device information and usage data

Processing is carried out in particular on the basis of Art. 6(1)(b) GDPR where it is necessary to take steps prior to entering into a contract, respond to your enquiry or arrange the requested service. Where we are legally required to process or retain certain data, processing is based on Art. 6(1)(c) GDPR. Where processing is based on your consent, the legal basis is Art. 6(1)(a) GDPR. In certain cases, processing is based on our legitimate interests pursuant to Art. 6(1)(f) GDPR, in particular our interests in providing our website securely and efficiently, preventing misuse and establishing, exercising or defending legal claims.

3. WEBSITE AND SERVER LOG FILES

When you visit our website, technically necessary information is automatically processed. This may include in particular:

IP address
Date and time of access
Page or file accessed
Amount of data transferred
Browser type and browser version
Operating system
Referrer URL
Hostname of the accessing device

This data is required to provide the website technically, ensure its stability and security and identify technical errors or abusive access. Processing is based on our legitimate interest pursuant to Art. 6(1)(f) GDPR in providing a secure and functional website.

4. COOKIES AND CONSENT MANAGEMENT

Our website uses cookies and similar technologies. Technically necessary cookies may be used where required for the operation and basic functionality of our website. We use Borlabs Cookie to manage consent. Your cookie and privacy preferences are stored in order to document your choices and apply them during subsequent visits to our website.

Cookies and services used for analytics, statistics, media or marketing purposes that are not technically necessary are generally activated only after you have given your consent through our cookie or consent management tool. The legal basis for processing personal data through services requiring consent is Art. 6(1)(a) GDPR in conjunction with the applicable provisions of the Austrian Telecommunications Act 2021 (TKG 2021). You can change or withdraw your consent at any time with effect for the future through the cookie settings on our website.

5. CONTACTING US

If you contact us by email, telephone, contact form or through other communication channels, we process the information you provide in order to respond to your enquiry and communicate with you. When using our contact and enquiry forms, the information submitted may also be stored in the website and administrative systems used by Piste to Powder. This serves in particular to ensure the reliable processing, allocation and documentation of enquiries.

Processing is based on Art. 6(1)(b) GDPR where your enquiry relates to entering into or arranging a contract. For general enquiries, processing may be based on our legitimate interest in processing, documenting and responding to enquiries pursuant to Art. 6(1)(f) GDPR. Data is retained only for as long as necessary to process the respective enquiry and to comply with statutory retention requirements or establish, exercise or defend legal claims.

6. ENQUIRIES, BOOKINGS AND BOOKING SYSTEM

In connection with enquiries and bookings, we process the personal data required to handle, organise and arrange the requested service. For this purpose, we also use electronic booking and administration systems. The data processed may include in particular:

Name and contact details
Booking date and requested service period
Number and composition of participants
Requested activity
Information about participants’ ability and experience
Meeting point and organisational information
Booking-related communications
Payment and billing information

Processing is generally carried out pursuant to Art. 6(1)(b) GDPR for the purpose of taking pre-contractual steps and handling the respective booking or arrangement of services.

7. ARRANGEMENT OF SERVICES AND DISCLOSURE TO INDEPENDENT MOUNTAIN AND SKI GUIDES

Unless expressly stated otherwise in the respective offer or booking process, Piste to Powder arranges services provided by independent mountain and ski guides. For the purpose of arranging the respective guiding service, the personal data required for that service is shared with the selected mountain or ski guide.

This may include in particular:

Name and contact details of the customer or contact person
Date and type of booked guiding service
Meeting point and organisational information
Group size
Information about participants’ ability and experience
Other information necessary for the preparation and safe performance of the booked service

Data is shared only to the extent necessary for arranging, preparing and performing the respective service. The mountain or ski guide providing the service operates independently, in their own name and under their own professional responsibility. Where an independent mountain or ski guide processes personal data for the preparation and performance of their own guiding service, the guide may act as an independent controller within the meaning of the GDPR. The disclosure of data is generally based on Art. 6(1)(b) GDPR.

8. EXTERNAL SERVICES AND SERVICE PROVIDERS

We use various service providers to operate our website, communicate with customers, send newsletters, process payments and display external content. Personal data may be transferred to the respective providers where necessary for the use of the relevant service.

STRIPE

For certain payments, we use Stripe, provided by Stripe Payments Europe, Limited, Dublin, Ireland. Stripe may process in particular name, contact, billing, payment and transaction data. Processing for payment purposes is generally based on Art. 6(1)(b) GDPR. Stripe may also process certain data, for example for fraud prevention or compliance with legal obligations, under its own responsibility as a data controller.

WHATSAPP

We use WhatsApp, provided by WhatsApp Ireland Limited, Dublin, Ireland, for voluntary communication with customers and prospective customers. This may involve the processing of telephone numbers, profile names and communication content. Where communication relates to enquiries or bookings, processing is generally based on Art. 6(1)(b) GDPR. In other cases, processing may be based on our legitimate interest in efficient customer communication pursuant to Art. 6(1)(f) GDPR. You can always contact us by email or telephone instead.

MAILCHIMP

We use Mailchimp, a service of the Intuit group, to send our newsletter. This may involve the processing of your email address, name where applicable, and information about your interaction with our newsletters. Processing is based on your consent pursuant to Art. 6(1)(a) GDPR. You can withdraw your consent at any time, in particular by using the unsubscribe link contained in the newsletter.

GOOGLE AND GOOGLE ANALYTICS

Where you have given your consent, we use Google Analytics, provided by Google Ireland Limited, Dublin, Ireland, to statistically analyse the use of our website and improve our services. This may involve the processing of usage data, device and browser information and technical identifiers. Google Analytics is generally activated only after you have given your consent through our consent management tool. The legal basis is Art. 6(1)(a) GDPR. You can withdraw your consent at any time through the cookie settings on our website.

YOUTUBE

Our website may contain videos from YouTube, a service provided by Google Ireland Limited. YouTube content is generally loaded only after you have given the corresponding consent or expressly activated the content. When YouTube content is loaded, data such as your IP address and device and browser information may be transferred to Google. The legal basis is your consent pursuant to Art. 6(1)(a) GDPR.

TRIPADVISOR

Reviews, images and other content from Tripadvisor may be embedded on our website. When such content is loaded, data such as your IP address and browser and device information may be transferred to Tripadvisor. Where consent is required, processing takes place only after you have given your consent. Otherwise, processing may be based on our legitimate interest pursuant to Art. 6(1)(f) GDPR in displaying current reviews from our guests.

INSTAGRAM / META / SMASH BALLOON

Our website contains links to our Instagram presence and may also contain content from services provided by Meta Platforms Ireland Limited, Dublin, Ireland. When using ordinary links, data is generally transferred to the respective provider only when you click the link. Directly embedded content requiring consent is generally loaded only after you have given your consent.

We integrate content from our Instagram presence using the WordPress plugin Smash Balloon Instagram Feed. The content is provided through interfaces of Instagram or Meta Platforms Ireland Limited. The plugin itself operates on our website, and data retrieved for displaying the feed is generally processed on our website rather than through Smash Balloon servers. Where loading Instagram content requires a connection to Meta and personal data, in particular your IP address, is transferred, this occurs only in accordance with your selected cookie and privacy settings.

WORDFENCE

We use Wordfence to protect our WordPress website. In particular, IP addresses and technical access data may be processed in order to identify and prevent attacks and other malicious activity. Processing is based on our legitimate interest in protecting the security of our website pursuant to Art. 6(1)(f) GDPR.

SENDGRID

We use SendGrid, an email delivery service provided by Twilio, for the technical delivery of certain emails from our website. This may involve the processing of email addresses, names, message content and technical delivery data. Depending on the type of message, processing is carried out in particular for handling enquiries and bookings pursuant to Art. 6(1)(b) GDPR or on the basis of our legitimate interest in reliable email communication pursuant to Art. 6(1)(f) GDPR. The use of SendGrid may involve the processing of personal data outside the European Economic Area.

9. HOSTING AND TECHNICAL SERVICE PROVIDERS

We use external service providers for the operation, maintenance and technical provision of our website and IT systems. These service providers may have access in particular to server log files, IP addresses, technical usage data and, where necessary for their activities, other personal data. Where these providers process personal data exclusively on our behalf and according to our instructions, they are engaged as processors in accordance with Art. 28 GDPR.

10. OTHER RECIPIENTS OF PERSONAL DATA

We disclose personal data only where this is necessary for the respective purpose, where we are legally required to do so or where another appropriate legal basis applies. Recipients may include in particular:

Independent mountain and ski guides
Hosting, IT and website service providers
Payment service providers and banks
Newsletter and communication service providers
Accounting and tax advisers
Authorities and public bodies where disclosure is legally required

Processing on behalf of the controller pursuant to Art. 28 GDPR applies only where a service provider actually processes personal data on our behalf and according to our instructions. Independent service providers, in particular the independent mountain and ski guides whose services we arrange, may act as independent data controllers in relation to their own services.

11. TRANSFERS OF DATA TO THIRD COUNTRIES

The use of certain internationally operating service providers may involve the processing of personal data outside the European Union or European Economic Area. Any such transfer takes place only in accordance with the requirements of Art. 44 et seq. GDPR. This may include, in particular, an adequacy decision of the European Commission, participation of a US company in the EU-US Data Privacy Framework or appropriate safeguards such as the European Commission’s Standard Contractual Clauses.

12. DATA RETENTION

We generally retain personal data only for as long as necessary for the respective processing purpose. Data may also be retained where statutory retention periods apply or where storage is necessary for the establishment, exercise or defence of legal claims. In particular, documents relevant for tax and corporate law purposes are retained in accordance with the applicable statutory retention periods. Once the relevant purpose no longer applies and any statutory retention periods have expired, the data is deleted or anonymised.

13. DATA SECURITY

We implement appropriate technical and organisational measures to protect personal data against loss, unauthorised access, alteration or unlawful disclosure. In particular, our website uses an encrypted HTTPS connection for the secure transmission of data.

14. YOUR RIGHTS

Subject to the applicable legal requirements, you have in particular the following rights:

Right of access pursuant to Art. 15 GDPR
Right to rectification pursuant to Art. 16 GDPR
Right to erasure pursuant to Art. 17 GDPR
Right to restriction of processing pursuant to Art. 18 GDPR
Right to data portability pursuant to Art. 20 GDPR
Right to object pursuant to Art. 21 GDPR
Right to withdraw consent pursuant to Art. 7(3) GDPR

If you wish to exercise any of these rights, please contact:

Piste to Powder
Mag. Florian Kraler
Email: info@pistetopowder.com

15. RIGHT TO LODGE A COMPLAINT

If you believe that the processing of your personal data infringes applicable data protection law, you have the right to lodge a complaint with a data protection supervisory authority. In Austria, the competent authority is:

Austrian Data Protection Authority (Österreichische Datenschutzbehörde)
Barichgasse 40–42
1030 Vienna
Austria

16. CHANGES TO THIS PRIVACY POLICY

We reserve the right to amend this Privacy Policy where our data processing activities, the services we use or the applicable legal framework change.