Privacy policy

1. general

The protection of your personal data is of particular concern to us. We therefore process your data exclusively in a lawful manner on the basis of the statutory provisions (in particular GDPR, DSG 2018, TKG 2021). In this data protection information, we inform you about the most important aspects of data processing - type, scope and purposes of the collection and use of personal data - in the context of the use of our website and other services of our company.

1.1 Controller responsible for the processing of your data

is the controller (within the meaning of Art. 4(7) GDPR) for the processing of your personal data (personal data within the meaning of Art. 4(1) GDPR):

Nationalpark Oö Kalkalpen GmbH
Nationalpark Allee 1
A-4591 Molln
Tel. +43 75 84 / 39 51
E-Mail: office@kalkalpen.at

Contact data protection coordinator:
We take the protection of personal data seriously and have created an internal data protection coordination office for this purpose. Any data subject can contact our data protection coordinator directly at any time with any questions or suggestions regarding data protection.
Data protection coordinator: Ms. Isabell Mühlberger, e-mail: edv@kalkalpen.at.

1.2 Purposes, data categories and legal bases for the processing of personal data

Purposes of the processing

The purposes of processing your personal data generally arise from our mandate to manage, support and protect the Kalkalpen National Park: providing our online offers, processing customer inquiries / orders / bookings (participation in national park experiences, educational programs and research projects), accounting, communication with business partners and customers. Detailed information on the purposes of processing and, if applicable, further processing for other compatible purposes as well as the categories of data processed can be found in the detailed descriptions of the individual data processing processes.

General data categories

• Personal master data (e.g. name, date of birth and age, address)
• Contact details (e.g. e-mail address, telephone number, fax number)
• Communication data (time and content of the communication)
• Order or booking data (e.g. goods ordered or services commissioned and invoice data such as performance period, method of payment, invoice date, tax identification number, etc.)
• Payment data (e.g. account number, credit card details)
• Contract data (contents of contracts of any kind)
• Web usage data (e.g. server data, log files and cookies)
• Identification numbers (e.g. vehicle license plates for driving permits)
• Video surveillance images (exclusively wildlife cameras)

 

Special categories of data ("sensitive data") pursuant to Art. 9 GDPR

• We generally do not process sensitive data.

 

Legal basis for the processing

In principle, there is no obligation to provide the data for the data processing described in this privacy policy. The only consequence of not providing this data is that we will not be able to offer these services. The legal basis for the processing of your personal data required to fulfill a contract with you or an order you have placed with us is Art. 6 (1) lit. b GDPR. Insofar as the processing of personal data is necessary to fulfill a legal obligation on our part (accounting obligation, bookkeeping obligation or other legal documentation obligations), Art. 6 (1) lit. c GDPR serves as the legal basis. If the data is processed in your own vital interest, the legal basis for data processing is Art. 6 (1) lit. d GDPR. If we process your data to perform a task assigned to us in the public interest ("sovereign action"), e.g. in the context of nature conservation (Upper Austrian Nature and Landscape Conservation Act), the legal basis is Art. 6 (1) lit. e GDPR. If the processing is necessary to safeguard a legitimate interest of our company or a third party and your interests, fundamental rights and freedoms do not outweigh our interests, Art. 6 (1) lit. f GDPR ("legitimate interest") serves as the legal basis for the processing. In this case, we will also inform you of our legitimate interests. If we have no other legal basis for the processing of personal data as explained above, we will ask you for your consent to data processing, which in these cases is based on Art. 6 (1) lit. a GDPR or, in the case of processing sensitive data, on Art. 9 (2) lit. a GDPR as the legal basis. You can withdraw this consent at any time free of charge without affecting the lawfulness of processing based on consent before its withdrawal.

1.3 Data transfer to processors and third parties

We process your personal data with the support of processors who assist us in providing our services. These processors are bound by a corresponding agreement within the meaning of Art. Art. 28 GDPR with us to strictly protect your personal data and may not process your personal data for any purpose other than to provide our services. You can find out which processors are involved in the detailed descriptions of the individual data processing processes.

Your personal data will be passed on to companies other than our processors to typical commercial service providers such as banks, tax consultants or auditors. Personal data will only be transferred to state institutions and authorities within the framework of mandatory national legislation.

Depending on your order (e.g. bookings and inquiries), your personal data will only be transmitted to hotel partners or other tourism service providers to the extent necessary to fulfill your order. The personal data transmitted varies depending on the service.

1.4 Transfers to third countries

In principle, we process your personal data within the EU. If we process data in a third country (i.e. outside the European Union (EU) or the European Economic Area (EEA)) or if this is done in the context of using the services of our processors or third parties, this will only take place if the requirements of Art. 44 et seq. GDPR for the transfer to third countries are met: i.e. on the basis of special guarantees, such as the officially recognized determination of a level of data protection corresponding to the EU or in compliance with officially recognized contractual obligations, the so-called "EU standard contractual clauses". If we refer to the EU standard contractual clauses as the legal basis for the transfer of your personal data, we will also check the permissibility of this data transfer as part of a comprehensive risk assessment. If we come to a negative conclusion, we will not transfer this data to a third country without your express consent in accordance with Art. 49 (1) lit. a GDPR.

1.5 Data erasure and storage duration

Your personal data will be deleted by us as soon as the purpose for which we collected your data no longer applies. Data may also be stored if we continue to process the data for a purpose compatible with the original purpose. It may also be stored if this is provided for by laws, regulations or other provisions to which our company is subject.

1.6 Data sources

We collect your personal data exclusively from you and do not use any other data sources.

1.7 Profiling

We do not use any procedures for automated decision-making or profiling that have a legal effect on you or significantly affect you in a similar way. However, with your consent, we will use your usage data to get to know your interests better and thus be able to show you information of interest to you or make you customized offers or show you corresponding information on third-party websites or social media platforms.

1.8 Safeguarding your data protection rights

In accordance with the GDPR, you have the right to information, correction, deletion and restriction of the processing of your personal data. If the legal basis for the processing of your personal data is your consent or a contract concluded with you, you also have the right to data portability. You have the right to withdraw any consent you may have given to the processing of your personal data. This does not affect the lawfulness of the processing of your personal data up to the time of withdrawal. You have the right to object to the processing of your personal data for the purpose of direct marketing. If you object, your personal data will no longer be processed for the purpose of direct marketing. A detailed explanation of these rights can be found here in Chapter III.

Right to complain

If you believe that the processing of your data violates data protection law or that your data protection rights have been violated in any other way, you can lodge a complaint with the competent supervisory authority. In Austria, this is the data protection authority (Barichgasse 40-42, A-1030 Vienna, e-mail: dsb@dsb.gv.at).

 

2. visit our website

In this section, we inform you how we process your personal data when you visit our website.

2.1 Presentation of the website

Server data

For technical reasons, the following data, which your Internet browser transmits to us or to our web space provider (so-called "server log files"), is collected on the legal basis of § 165 (3) S 3 TKG 2021 (required for the operation of our website):

• Browser type and version
• Operating system and device type used (e.g. desktop / mobile)
• Website from which you visit us (referrer URL)
• Website you visit
• Date and time of your access
• Your Internet Protocol address (IP address)

This data, which is anonymous for us, is stored separately from any personal data you may have provided for 7 days and therefore does not allow us to draw any conclusions about a specific person. They are evaluated for statistical purposes in order to optimize our website and our offers.

SSL or TLS encryption

This site uses SSL or TLS encryption for security reasons and to protect the transmission of confidential content, such as orders or inquiries that you send to us as the site operator. You can recognize an encrypted connection by the fact that the address line of the browser changes from "http://" to "https://" or by the lock symbol in your browser line. If SSL or TLS encryption is activated, the data you transmit to us cannot be read by third parties.

Technical service providers

We create and edit the content of our website with the help of the following service providers, whom we have obliged by a corresponding agreement within the meaning of Art. 28 GDPR to process your data exclusively within the scope of our order. Art. 28 GDPR to process your data exclusively within the scope of our order:

Technical concept:

• HI1 digital marketing (Gurkgasse 43, Top 1-2, 1140 Vienna); Further information on data protection at: https://hi1.at/datenschutzerklaerung

Webhosting:

• Hetzner Online GmbH (Industriestr. 25, D-91710 Gunzenhausen). Further information on data protection can be found at: https://www.hetzner.com/de/legal/privacy-policy/

2.2 Cookies

Cookie Banner - Cookies on our website - Consent Management System

Our website uses cookies to help us make our website more user-friendly and efficient for you, to carry out statistical analyses of the use of our website and to display content that may be of interest to you on other websites. Cookies are small data records that are used to store information during or about visits to websites and are stored on the website visitor's computer. The legal basis for cookies that are absolutely necessary for the proper operation of our website (e.g. shopping cart cookie) is § 165 (3) S 3 TKG 2021. Cookies that are not necessary for the function of our website (e.g. analysis or marketing cookies) are deactivated and are only activated by your consent in accordance with Art. 6 (1) lit. a GDPR in our cookie banner ("Accept"). You can activate or deactivate individual cookies or cookie groups by clicking on "Settings". If you restrict the use of cookies on our website, you may no longer be able to use all the functions of our website to their full extent. Detailed information about the cookies used on our website can be found in our cookie banner.

The legal basis for the use of this cookie banner (consent management platform) to control and document your consent or settings regarding cookies and other tools requiring consent to access our website is our legal obligation pursuant to Art. 6 (1) lit. c GDPR. When you access our website, a connection is established with the server of the provider of our cookie banner and a cookie is subsequently stored in your browser to save your cookie settings. The processed data is stored until the specified storage period expires or you delete these cookies.

We use the following cookie banner / provider:

• Contao cookie bar (open source software - hosted on our website server) from Contao Association (3250 Lyss, Switzerland). More information on data protection at: https://contao.org/de/datenschutzerklaerung

ATTENTION: INSERT A LINK TO THE COOKIE BANNER (setting options) HERE IF POSSIBLE

Changing the cookie settings in your web browser

How the web browser you are using handles cookies, i.e. which cookies are accepted or rejected, can be determined by you in the settings of your web browser. You can also delete cookies already stored on your computer/device yourself at any time. Where exactly these settings are located depends on the respective web browser. Detailed information on this can be accessed via the help function of the respective web browser.

In addition, you have the option of generally objecting to cookies and similar tracking technologies via the services listed below by setting your individual preferences - which technologies you want to allow for usage and interest-based advertising:

• European Interactive Digital Advertising Alliance (EDAA): https://www.youronlinechoices.com/de/praferenzmanagement/
• Network Advertising Initiative (NAI): https://optout.networkadvertising.org/?c=1#!%2F

2.3 Communication with us

Contact form and e-mail

On our website, we offer you the opportunity to contact us by email and/or via a contact form. In this case, the information you provide will be processed for the purpose of processing your contact on the legal basis of contract fulfillment pursuant to Art. 6 (1) lit. b GDPR. We have a legitimate interest pursuant to Art. 6 (1) lit. f GDPR in the use of a contact form. The legitimate interest lies in offering our website visitors a way to contact us that does not require them to access their own email client. There is no legal or contractual obligation to provide this personal data. The only consequence of not providing this data is that you will not be able to submit your request and we will not be able to process it. Your data will only be passed on to third parties if this is stated on the website or in this data protection declaration or is necessary for the fulfillment of the contract or is required by law. We only store your data for as long as is necessary to process your inquiries or for any queries you may have.

Job applications

The contact details and application documents sent to us in the course of a job application via the job portal on our website are processed by us exclusively internally for the purpose of selecting suitable candidates for an employment relationship. The legal basis for the processing of your personal data is the fulfillment of the contract / order fulfillment pursuant to Art. 6 (1) lit. b GDPR. We have a legitimate interest pursuant to Art. 6 (1) lit. f GDPR in the use of web-based, automated processing of data via our online form. The legitimate interest lies in offering our website visitors the opportunity to submit a quick, online application. There is no legal or contractual obligation to provide personal data. The only consequence of not providing it is that you will not be able to submit your request and we will not be able to process it. The personal data transmitted to us will be stored by us in accordance with the statutory provisions for a maximum of 6 months, or for a maximum of 2 years if the applicant has expressly consented to the documents being kept on file.

2.4 Online store(s) / booking portal(s)

We process your personal master data, contract and payment data as well as communication data (IP address and server log files) for the purpose of providing contractual services as well as their payment and execution in the context of experience bookings on the basis of the legal bases of Art. 6 (1) lit. b GDPR (contract fulfillment) and Art. 6 (1) lit. c GDPR (legal obligation for invoicing and archiving).

We store this data as long as the purpose requires it, legal regulations provide for this (retention period of invoices according to § 132 BAO for 7 years; voucher orders until the expiry of the redemption period for 30 years) or we need this data on the legal basis of Art. 6 (1) lit. f GDPR (legitimate interest) to defend against possible liability claims. If you cancel the order process, we store the data for 14 days to clarify possible problems during the order process.

There is no legal or contractual obligation to provide personal data. The only consequence of not providing this data is that we will not be able to process your bookings/orders.

External payment service providers

With the exception of our bank, we do not currently use any external payment service providers for the payment of order transactions / bookings. Payment for services is made by invoice and bank transfer.

2.5 E-mail newsletter

E-mail newsletter rapidmail

You can register for our newsletter on our website. The legal basis for sending the newsletter is your consent within the meaning of Art. Art. 6 (1) lit. a GDPR. Registration for our newsletter takes place using the double opt-in procedure. In this way, we ensure that no one can register with third-party email addresses (e.g. with your email address). Your consent can be revoked at any time free of charge by clicking on the "Unsubscribe link" at the end of each mailing. The legality of the data processing operations that have already taken place up to that point remains unaffected by the revocation. After you unsubscribe from our newsletter, we will continue to store your e-mail address for 3 years on the basis of our legitimate interest (Art. 6 (1) lit. f GDPR) in order to be able to prove your originally given consent if necessary. We use "rapidmail", a service provided by rapidmail GmbH
(Wentzingerstraße 21, 79106 Freiburg im Breisgau, Germany), to send our newsletter. With the help of rapidmail, we can analyze our newsletter campaigns. When an email sent with rapidmail is opened, a connection is established with the rapidmail servers (server location Germany, data centers ISO-27001 certified). This enables us to determine whether a newsletter message has been opened and which links, if any, have been clicked on. The purpose of these analyses is to better adapt future newsletters to the interests of the recipients. In addition, technical information such as the time of retrieval, IP address, browser type and operating system of the recipient are registered. We have concluded a processor agreement with rapidmail within the meaning of Art. Art. 28 GDPR to ensure that your data is only processed to the extent desired by us and permitted by you. Further information on rapidmail and GDPR at: https://www.rapidmail.at/dsgvo-konformes-email-marketing. General data protection information from rapidmail at: https://www.rapidmail.at/datenschutz.

2.6 Web analysis - Statistical analysis of our website

Google Tag Manager

We use the service of the provider Google Ireland Limited ("Google") (Gordon House, Barrow Street, Dublin 4, Ireland) to manage website tags via a common tool. The Google Tag Manager tool itself (which implements the tags) is a domain that does not set cookies or collect any other personal data. The tool triggers other tags, which in turn may collect data. Google Tag Manager does not access this data. If deactivation has been carried out at domain or cookie level, this remains in place for all tracking tags that are implemented with Google Tag Manager. Google is a certified partner of the EU-US Data Privacy Framework. The legal basis for (at least occasional) data transfers to the USA is therefore an adequacy decision by the European Commission within the meaning of Art. 45 (3) GDPR. Art. 45 (3) GDPR, with which the European Commission certifies that the USA has an adequate level of data protection. Further information on Google's data protection at: https://www.google.com/policies/privacy/. More information on how Google uses personal data: https://business.safety.google/privacy/.

Google Analytics

This website uses functions of the web analysis service Google Analytics. The provider of this service is Google Ireland Limited ("Google") (Gordon House, Barrow Street, Dublin 4, Ireland). The legal basis for the use of this service is your consent in accordance with Art. 6 (1) lit. a GDPR. Google Analytics uses cookies that are stored on the website visitor's computer and that enable an analysis of the use of our website by the website visitor. The information generated by the cookie about your use of our website is usually stored on European servers and only in exceptional cases transferred to a Google server in the USA and stored there. We use Google Analytics with activated IP anonymization. This means that your IP address is generally truncated by Google within the European Union and only in exceptional cases is the full IP address transmitted to a Google server in the USA and only truncated there. Google is a certified partner of the EU-US Data Privacy Framework. The legal basis for (at least occasional) data transfers to the USA is therefore an adequacy decision of the European Commission within the meaning of Art. 45 (3) GDPR. Art. 45 (3) GDPR, with which the European Commission certifies that the USA has an adequate level of data protection. The IP address transmitted by the corresponding browser as part of Google Analytics is not merged with other Google data. On our behalf, Google will use the information collected to evaluate the use of the website in order to compile reports on website activity. The collection by Google Analytics can be prevented by the site visitor adjusting the cookie settings for this website. The collection and storage of the IP address and the data generated by cookies can also be objected to at any time with effect for the future. The corresponding browser plugin can be downloaded and installed at the following link: https://tools.google.com/dlpage/gaoptout. User data is stored for 14 months. Further information on the use of data by Google, setting and objection options, can be found in Google's privacy policy(https://policies.google.com/privacy) and in the settings for the display of advertisements by Google(https://adssettings.google.com/authenticated). More information on how Google uses personal data: https://business.safety.google/privacy/.

2.7 Web marketing

Facebook pixel

In order to place targeted advertisements on Facebook and to be able to track the actions of users after they have seen or clicked on a Facebook advertisement, we use the Facebook Pixel of Meta Platforms Ireland Ltd (4 Grand Canal Square, Grand Canal Harbour, Dublin 2, Ireland) on the legal basis of your consent in accordance with Art. 6 (1) lit. a GDPR within our website. This enables us to display information of interest to you on Facebook and to evaluate and optimize our Facebook ads with the anonymous data collected in this way (we do not see any personal data of individual users, only the overall effect). Storage period max. 12 months. Facebook links this data to the Facebook account of Facebook users according to their data protection information and can thus show them content that matches their interests. Meta is a certified partner of the EU-US Data Privacy Framework. The legal basis for (at least occasional) data transfers to the USA is therefore an adequacy decision of the European Commission within the meaning of Art. 45 (3) GDPR. Art. 45 (3) GDPR, with which the European Commission certifies that the USA has an adequate level of data protection. You can find specific information on how the Facebook Pixel works in the Facebook help section at: https://de-de.facebook.com/business/help/651294705016616. You can make settings regarding usage-based advertising on Facebook yourself in your Facebook account: https://www.facebook.com/settings?tab=ads. Further information can be found in Facebook's privacy policy at: https://www.facebook.com/privacy/explanation.

2.8 Integration of other third-party services and content

We integrate third-party content and functions within our website. This always presupposes that the providers of this content or functions are aware of the IP address of the user. Without the IP address, they would not be able to send the content to the respective user's browser. The IP address is therefore required to display this content. We endeavor to only use content whose respective providers only use the IP address to deliver the content. However, we have no influence over whether the third-party providers store the IP address for statistical purposes, for example. The legal basis for the use of these services, insofar as they are necessary for the function of our website, is our legitimate interest pursuant to Art. 6 (1) lit. f GDPR, otherwise your consent pursuant to Art. 6 (1) lit. a GDPR. Information on the purpose and scope of further processing and use of the data by the providers of the embedded services/content as well as further information within the meaning of Art. Art. 13 and 14 GDPR can be found under the information links below. The following services/content are embedded in our website

Weglot translation program

Our website uses the "Weglot" service provided by Weglot SAS (Rue Pierre Joigneaux 138, 92270 Bois-Colombes, France). This function enables you to view our website in other languages. To use the Weglot functions, your IP address is recorded and transmitted to a Weglot server (Weglot's servers are located in the European Union, according to its own information) and stored there. If you change the language setting of our website, Weglot will store a cookie in your browser to save your language selection. Weglot states that it does not pass on user data to third parties. Weglot is used in the interest of easy accessibility and usability of our online services for international visitors. The legal basis for this is our legitimate interest within the meaning of Art. 6 (1) lit. f GDPR. You can find further information on data protection at Weglot at: https://www.weglot.com/privacy. More information on Weglot's GDPR compliance can be found at: https://de.support.weglot.com/article/312-is-weglot-gdpr-compliant.

Outdoor Active

For the cartographic representation of tours (e.g. hiking tours, ski tours, cycling and bike tours etc.) we use the "Outdoor Active" service of Outdooractive GmbH & Co. KG (Missener Straße 18, D-87509 Immenstadt). For this purpose, the map material is loaded from the Outdoor Active server. The following data is transmitted to Outdoor Active: the page visited on our website, the IP address of your device, the content of the request, location data, operating system and the language and version of the browser software. Outdoor Active uses cookies that are stored on your browser to analyze your request. The legal basis for the processing of your data is Art. 6 (1) lit. f GDPR (legitimate interest). Our legitimate interest lies in an appealing presentation of our online offer and the geographical presentation of the offers in our region. In the case of location data from mobile devices, the legal basis is your consent in accordance with Art. 6 (1) lit. a GDPR, in that you authorize the transfer of location data on your mobile device. Further information on data protection from Outdoor Active at: https://corporate.outdooractive.com/de/datenschutzrichtlinien/ or https://www.outdooractive.com/de/datenschutz.html.

Interactive map National Parks Austria

We use the interactive map of the umbrella organization of Austrian national parks (Nationalparks Austria) (Schloss Orth, A-2304 Orth an der Donau) for the cartographic representation (interactive map) of our national park. The map material is loaded from the Nationalparks Austria server for this purpose. The following data is transmitted to Nationalparks Austria: the page visited on our website, the IP address of your end device, the content of the request, location data, operating system and the language and version of the browser software. Nationalparks Austria uses cookies that are stored on your browser to analyze your request. The legal basis for the processing of your data is Art. 6 (1) lit. f GDPR (legitimate interest). Our legitimate interest consists in an appealing presentation of our online offer and the geographical presentation of the offers of our national park. In the case of location data from mobile devices, the legal basis is your consent in accordance with Art. 6 (1) lit. a GDPR, in that you authorize the transfer of location data on your mobile device. Further information on data protection from Nationalparks Austria at: https://www.nationalparksaustria.at/de/datenschutzerklaerung.html.

YouTube

We integrate videos from the "YouTube" platform of the provider Google Ireland Ltd (Gordon House, Barrow Street, Dublin 4, Ireland) in extended data protection mode. The implementation is based on Art. 6 (1) lit. f GDPR, whereby our interest lies in the smooth integration of the videos and the appealing design of our website. However, we only use YouTube if you have consented to this. The legal basis for the processing of your data is therefore your consent in accordance with Art. 6 (1) lit. a GDPR, which you can revoke at any time for the future. When you visit a page in which we have embedded a YouTube video, a connection to the Google servers is established and the content is displayed on the website by notifying your browser. According to Google, in extended data protection mode, your data (in particular which of our web pages you have visited) and device-specific information, including your IP address, are only transmitted to the YouTube server when you watch the video. Google is a certified partner of the EU-US Data Privacy Framework. The legal basis for (at least occasional) data transfers to the USA is therefore an adequacy decision of the European Commission within the meaning of Art. 45 (3) GDPR. Art. 45 (3) GDPR, with which the European Commission certifies that the USA has an adequate level of data protection. If you are logged in to Google at the same time, this information will be assigned to your Google member account. You can prevent this by logging out of your member account before visiting our website or by making individual settings in your Google account under the following link: https://adssettings.google.com/authenticated. Further information on YouTube's data protection can be found at: https://www.google.com/policies/privacy/. More information on how Google uses personal data: https://business.safety.google/privacy/.

Webcams

We integrate webcams from other websites of providers in our region into our website in order to display the current weather in our region. The implementation is based on our legitimate interest in accordance with Art. 6 (1) lit. f GDPR, whereby our interest lies in providing information on the current weather in our region within our website. When you call up a page in which we have embedded webcams, a connection is established to the provider's servers and the content is displayed on the website by notifying your browser. For this purpose, it is necessary that your IP address together with some browser information (browser type, browser version, etc.) together with information about when you accessed these pages is transmitted to the provider's servers.

Accessiway accessibility application

In order to make our website accessible, we integrate the "accessiway" service of the service provider AccessiWay GmbH (Liechtensteinstraße 111, 1090 Vienna) via an interface. This requires that your IP address, including some browser information (browser type, browser version, etc.) and information about when you accessed these pages, is transmitted to the accessiway server. The above-mentioned data is deleted immediately after accessing the website in the barrier-free display / is not stored. The legal basis for this data processing is our legitimate interest pursuant to Art. 6 (1) lit. f GDPR. Our legitimate interest lies in making our website accessible to people with disabilities. Further information on the processing of this data and data protection at AccessiWay can be found at: https://www.accessiway.com/privacy-policy and https://www.accessiway.com/privacy-security

 

3. other data processing in business and customer contact

In this section, we inform you about other data processing processes outside our website.

3.1 Job applications

The contact details and application documents sent to us in the course of a job application are processed by us exclusively internally for the purpose of selecting suitable candidates for an employment relationship. There is no legal or contractual obligation to provide personal data. The only consequence of not providing this data is that you will not be able to submit your application and we will not be able to process it. The personal data transmitted will be stored by us in accordance with the statutory provisions for a maximum of 6 months, or for a maximum of 2 years if the applicant has expressly consented to the documents being kept on file.

3.2 Online presences in social media

In addition to our website, we maintain online presences within social networks and platforms. The legal basis for using these services is our legitimate interest pursuant to Art. 6 (1) lit. f GDPR. Our legitimate interest lies in communicating with the customers and business partners active there and being able to inform them about our services on these networks. When accessing the respective networks and platforms, the terms and conditions and data protection guidelines of the respective operators of these networks apply. Further information on the processing of your personal data by the respective providers of these services (which personal data is processed for which purposes on which legal basis, how long this data is stored by the respective provider and, if applicable, information on profiling and third country transfers) can be found below in the descriptions of the individual services or via the information links provided there.

Facebook Fanpage

We operate a Facebook fan page on the Facebook platform of Meta Platforms Ireland Ltd (4 Grand Canal Square, Grand Canal Harbour, Dublin 2, Ireland). The legal basis for the processing of the associated personal data is our legitimate interest within the meaning of Art. Art. 6 (1) lit. f GDPR. Our legitimate interest lies in providing customers and potential new customers with information about us and our offers via this information channel. We would like to point out that you use this Facebook page and its functions on your own responsibility. This applies in particular to the use of the interactive functions (e.g. commenting, sharing, rating). When you visit our Facebook page, Facebook collects, among other things, your IP address and other information that is collected in the form of cookies or other tracking technologies. The data collected about you in this context is processed by Facebook and may be transferred (at least in part) to the USA. Facebook / Meta is a certified partner of the EU-US Data Privacy Framework. The legal basis for (at least in some cases) data transfers to the USA is therefore an adequacy decision of the European Commission within the meaning of Art. 45 (3) GDPR. Art. 45 (3) GDPR, with which the European Commission certifies that the USA has an adequate level of data protection. In a decision, the CJEU determined that "Facebook" and the operator of a Facebook fan page process this personal data as joint controllers within the meaning of Art. Art. 26 GDPR. Facebook provides the contract for joint data processing under the following link: https://www.facebook.com/legal/terms/page_controller_addendum. As the operator of our fan page, we have no influence on the specific content of the agreement. What information Facebook receives and how it is used (how Facebook uses the data from visits to Facebook pages for its own purposes, to what extent activities on the Facebook page are assigned to individual users in order to individualize content or advertising, how long Facebook stores this data, whether data from a visit to the Facebook page is passed on to third parties, etc.) is described by Facebook in general terms in its data usage guidelines. There you will also find information on how to contact Facebook and the settings options for advertisements. The privacy policy is available at the following link: https://www.facebook.com/privacy/policy/. As a fan page operator, we do not receive any additional (non-public) information about individual Facebook users from Facebook's analyses, but only statistically prepared information (e.g. total number of page views, page activity, post reach, etc.), which helps us to make our posts more attractive.

Instagram

Instagram is an online service for sharing photos and videos. We have a profile (account) on Instagram. The provider is Meta Platforms Ireland Ltd (4 Grand Canal Square, Grand Canal Harbour, Dublin 2, Ireland). Further information on the processing of your personal data through the use of Instagram as well as a way to contact us can be found at: https://privacycenter.instagram.com/policy/

Pinterest

Pinterest is a mixture of social network and search engine that focuses on visual content, i.e. images and videos. We use this service to generate interest for other of our content on the Internet (in particular our website) with so-called PINs. The provider of this service is Pinterest Europe Ltd (Palmerston House, 2nd Floor, Fenian Street, Dublin 2, Ireland). Further information on the processing of your personal data through the use of Pinterest as well as a way to contact us can be found at: https://policy.pinterest.com/de/terms-of-service.

YouTube

We use a YouTube channel via the video portal "YouTube" to publish our videos. The provider of the service is Google Ireland Limited (Gordon House, Barrow Street, Dublin 4, Ireland). Further information on the processing of your personal data through the use of YouTube as well as a way to contact us can be found at: https://www.google.com/policies/privacy/.

3.3 Competitions

Your personal data (e-mail address, name, address) provided for participation in our competitions will only be used by us to determine a winner, to inform them of the prize and to send out prizes. Your data will not be passed on to third parties. The legal basis for the processing of your personal data is contract fulfillment pursuant to Art. 6 para. 1 lit. b GDPR. There is no legal or contractual obligation to provide personal data. The only consequence of not providing the data is that you will not be able to take part in the competition. Your data will be stored for the duration of the competition and - for the processing of any prize and compensation claims - for a maximum of 3 years afterwards and then deleted. By participating, you also consent to your name being published on our website and on our public social media channels if you win.

3.4 Photo/video documentation at events

At events, we may take photos and videos of these events or have them taken by photographers commissioned by us in which you are recognizable as a participant in these events. We need these photos/videos to document and promote our events and will therefore also publish them in our media (e.g. print brochures, website and social media) and make them available to other media owners (print and online) to promote our event. There is no legal or contractual obligation on your part to provide this data. The legal basis for the processing of your personal data (images and videos on which you are recognizable) is our legitimate interest pursuant to Art. 6 (1) lit. f GDPR. Our legitimate interest lies in our right to public relations (presentation of our activities) and the promotion of our events. You have the right to object to the processing. Please send your objection to the email address we have provided in this privacy policy. However, it can be assumed that our above-mentioned interest in using the photos does not unduly interfere with your rights as the person depicted. This is particularly the case as we take these photos/videos in public spaces and point out the production and use of the photos/videos in advance of each event. We also always ensure that no legitimate interests of persons depicted are violated. Should your personal rights and freedoms be violated by an image / video created by us for reasons worthy of special consideration, we will refrain from further processing / publication. Removal from print media that have already been circulated is not possible. In this case, however, we will delete them from our website or our social media channels. We generally delete photos / videos of events if we no longer need these images to document and promote these events.

3.5 Wildlife cameras

For the purpose of species monitoring, we have installed wildlife cameras at several locations in the Kalkalpen National Park area. Our wildlife cameras thus pursue a documentation interest within the meaning of Art. § Section 12 (3) Z 3 DSG, which is not aimed at the identification of uninvolved persons or the targeted recording of objects that are suitable for the indirect identification of such persons. The legal basis for this data processing is therefore our legitimate interest pursuant to Art. 6 (1) lit. f GDPR in conjunction with § 12 (2) Z 4 DSG and § 12 (3) Z 3 DSG. Our legitimate interest as a national park conservation organization lies in the documentation of the species population in our national park. A deletion obligation within 72 hours according to § 13 (3) DSG is excluded according to § 13 (4) DSG. If, in addition to the animals being observed, people are unintentionally or at least identifiably depicted on these images taken by the wildlife cameras, we will delete these images immediately after evaluating them. Unintentional recordings of people will not be passed on to third parties without the person's consent, unless a criminal offense has been committed. There is no obligation to label these cameras in accordance with § 13 (6) DSG.

3.6 Guests/visitors WLAN

We offer a freely accessible visitor WLAN in our visitor centers and in our offices. In order to provide you with the services of the hotspot, it is necessary to use personal data from your end device. In this context, the MAC addresses (Media Access Control address) of end devices may also be temporarily stored. Furthermore, we may store log data ("log files") on the type and scope of use of the services for 7 days. This data cannot be assigned directly to your person, but it can be assigned directly to the end device you are using and thus also indirectly to your person.

3.7 Registration for events and functions

It is possible to register for events organized by various providers in our region at our visitor centers. For this purpose, we process your personal data (name, e-mail address and telephone number). This data is processed by us on the legal basis of Art. 6 (1) lit. b GDPR (fulfillment of contract/pre-contractual measures) and also passed on to the respective organizer. This data will be deleted or destroyed by us after the event. There is no legal or contractual obligation to provide personal data. The only consequence of not providing the data is that we will not be able to process your registration on your behalf.

3.8 Issuing of travel permits

Under certain strict conditions, we issue driving permits for closed roads in our national park. The personal data you provide us with for the purpose of issuing the driving permit will be used exclusively to issue you with the desired driving permit and to monitor the use of this driving permit. Your data (title, first name, surname, license plate number, car make/type, car color, validity period and purpose of the trip, reference to deposit and barrier key, if applicable) will also be stored by us for documentation purposes (deposit/accounting) and will not be passed on to third parties. The legal basis for the processing of your personal data is contract fulfillment pursuant to Art. 6 para. 1 lit. b GDPR. There is no legal or contractual obligation to provide personal data. The only consequence of not providing the data is that we will not be able to issue your driving license.

Current version of the data protection information dated 25.11.2024