DATENSCHUTZRICHTLINIEN UND VERARBEITUNG PERSONENBEZOGENER DATEN IN DER TMR GROUP

Mölltaler Gletscherbahnen GmbH & Co KG & Hochgebirgsbahnen Ankogel, Talstation, Innerfragrant 46, 9831 Flattach, Österreich,

Firmenbuchnummer 19797p, Steuern-Id.-Nr.: FN 19797 p, VAT reg. No.: AT U33329902

Datenschutzerklärung und Informationen gem. Art. 13 und 14 DSGVO

Einteilung:

Allgemeines: Wer wir sind

DATENSCHUTZERKLÄRUNG TMR Group - Kunden

RECHTE DER BETROFFENEN PERSONEN

Wer wir sind

GOPASS, a.s., sídlo: Demänovská Dolina 72, 031 01 Liptovský Mikuláš, IID: 53 824 466, IČ DPH: SK2121518487, eingetragen im Handelsregister des Bezirksgerichts in Žilina, Abteil: Sa, Einlage Nr. 11039/L, ist zusammen mit anderen Eigentums-, Personal- oder sonstigen verbundenen Unternehmen oder verbündete Unternehmen, ein gemeinsamer Verantwortlicher bei der Verarbeitung personenbezogener Daten innerhalb der TMR Group.

Mitglieder der TMR Group sind:

Gemeinsame Verantwortlicher im Rahmen eines geschlossenen Vertrages über gemeinsamen Verantwortlichen:

GOPASS, a.s.

Loyality program Gopass

sídlo: Demänovská Dolina 72, 031 01 Liptovský Mikuláš

IČO: 53 824 466

IČ DPH: SK2121518487

Zapísaná: v Obchodnom registri Okresného súdu Žilina oddiel: Sa, vložka číslo: 11039/L

Tatry mountain resorts, a.s.

Skigebiet Štrbské pleso, Jasná, Tatranská Lomnica, Jakubkova lúka, Aquapark Tatralandia

Demänovská Dolina 72, 031 01 Liptovský Mikuláš

ID: 31 560 636

Ust.-Ident.-Nr.: SK2020428036

Eingetragen im Handelsregister des Amtsgerichts Žilina, Abteil: Sa, Einlage Nr.: 62 / L

EUROCOM Investment, s.r.o.

Aquapark Bešeňová

136, 034 83 Bešeňová

ID: 35 756 985

Ust.-Ident.-Nr.: SK2021394969

Eingetragen im Handelsregister des Amtsgerichts Žilina, Abteil: Sro, Einlagen-Nr. 14558 / L

MELIDA, a.s.

Skigebiet Skiareál Špindl

Spindlermühle 281, 543 51 Spindlermühle, Tschechische Republik

ID: 241 66 511

Steuern-Id.-Nr.: CZ24166511

Eingetragen in Handelsregister beim Landgericht in Hradec Králové, Abteil: B, Einlage Nr. 3175

SZCZYRKOWSKI OŚRODEK NARCIARSKI S.A

Skigebiet SZCZYRK

Narciarska 10, 43-370 Szczyrk Polen

ID / Regon: 072818322

Registriert in Krajowy rejester sadowy, Sad Rejonowy Bielsku-Białe

Nummer: 0000140818

SLASKIE WESOŁE MIASTECZKO SPÓŁKA Z OGRANICZONA ODPOWIEDZIALNOSCIA

Vergnügungspark LEGENDIA

Straße PLAC ATRAKCJI, Nr. 1, 41 501 Chorzow, Polen

Steuern-Id.-Nr.:243516267

Eingetragen in Sad Rejonowy Katowice-Wschod w Katowicach KRS-Nummer: 0000499958

Mölltaler Gletscherbahnen GmbH & Co KG & Hochgebirgsbahnen Ankogel

Skigebiet Mölltaler Gletscher, Ankogel

Talstation, Innerfragrant 46, 9831 Flattach

Firmenbuchnummer 19797p

Steuern-Id.-Nr.: FN 19797 p

VAT reg. No.: AT U33329902

Muttereralm Bergbahnen Errichtungs GmbH

Skigebiet Muttereralm

Nockhofweg 40, 6162 Mutters, Rakousko

Firmenbuchnummer: 270746g

VAT reg. No.: ATU62238929

Tatry mountain resorts CR, a.s.

Golf & Ski areal Ostravice, Golf Kaskáda

č.p. 75, 739 14 Ostravice, Česká republika

Steuern-Id.-Nr.: 06871917

Firmenbuchnummer: Spisová značka: B 23258 vedená u Městského soudu v Praze

VAT reg. No.: CZ06871917

TMR Ještěd, a.s.

Skigebiet Skiareál Ještěd

Jablonecká 41/27, Liberec V-Kristiánov, 460 05 Liberec, Česká republika

Steuern-Id.-Nr.: 06080413

Eingetragen in: Spisová značka: B 2685 vedená u Krajského soudu v Ústí nad Labem

VAT reg. No.: CZ06080413

DATENSCHUTZERKLÄRUNG TMR Group - Kunden

Diese Datenschutzerklärung gilt für Sie und Ihre persönlichen Daten, da Sie ein Kunde eines Unternehmens der TMR Group sind. Unser Unternehmen handelt als Verantwortlicher bei der Verarbeitung Ihrer personenbezogenen Daten. Für die Zwecke dieser Datenschutzerklärung liegt der Schutz Ihrer persönlichen Daten in der Verantwortung der TMR Group-Einheit, bei der Sie einen Vertrag oder Mitgliedschaft in einem Treueprogramm abgeschlossen haben (Verantworlicher). In dieser Erklärung wird erläutert, wie wir die von Ihnen oder Dritten gesammelten personenbezogenen Daten für die Dauer Ihres Vertragsverhältnisses mit dem Unternehmen innerhalb der TMR Group verwenden. Da diese Aussage für die gesamte TMR Group gilt, kann es zu kleinen lokalen Unterschieden bei der Verarbeitung bestimmter Informationen für jeden Zweck kommen. Einzelheiten erfahren Sie von unserem örtlichen Datenschutzbeauftragten (siehe unten).

PRINCIPLES OF PRIVACY AND PERSONAL DATA PROTECTION IN COMPANIES OF TMR GROUP

Mölltaler Gletscherbahnen GmbH & Co KG & Hochgebirgsbahnen Ankogel, Talstation, Innerfragrant 46, 9831 Flattach, Firmenbuchnummer 19797p, Company reg. No.: FN 19797 p, VAT reg. No.: AT U33329902

Information to be provided where personal data are collected from the data subject according to article 13 and 14 of GDPR

Division:

Who we are

PRIVACY STATEMENT TMR Group - customers

RIGHTS OF THE PERSONS CONCERNED

Who we are

GOPASS, a.s., sídlo: Demänovská Dolina 72, 031 01 Liptovský Mikuláš, Company Registration Number: 53 824 466, registered with Commercial Registry of County Council Žilina File: Sa insert No.: 11039/L is, together with other in terms of property, personnel and otherwise associated companies, a joint data controller at personal data processing within TMR Group.

TMR Group members are:

Joint Operators under the Joint Operators Agreement entered into on 25. May 2018:

GOPASS, a.s.

LOYALITY program Gopass

sídlo: Demänovská Dolina 72, 031 01 Liptovský Mikuláš

ID: 53 824 466

VAT ID: SK2121518487

Registered in the Commercial Register maintained by the Žilina District Court, section: Sa, Insert no.: 11039/L

Tatry mountain resorts, a.s.

Ski resorts Štrbské pleso, Jasná, Tatranská Lomnica, Jakubkova lúka, Aquapark Tatralandia

Demänovská Dolina 72, 031 01 Liptovský Mikuláš

ID: 31 560 636

VAT ID: SK2020428036

Registered in the Commercial Register maintained by the Žilina District Court, section: Sa, Insert no.: 62/L

EUROCOM Investment, s.r.o.

Aquapark Bešeňová

136, 034 83 Bešeňová

ID: 35 756 985

VAT ID: SK2021394969

Registered in the Commercial Register maintained by the Žilina District Court, section: s.r.o., Insert no.: 14558/L

MELIDA, a.s.

Ski resort Skiareál Špindl

Špindlerův Mlýn 281, 543 51 Špindlerův Mlýn, Česká republika

ID: 241 66 511

VAT ID: CZ24166511

Registered in the Commercial Register maintained by the Court Hradci Králové, section: B, Insert no.: 3175

SZCZYRKOWSKI OŚRODEK NARCIARSKI S.A

Ski resort SZCZYRK

Narciarska 10, 43-370 Szczyrk Poľsko

IČO/Regon: 072818322

Zápísaná v Krajowy rejester sadowy, Sad Rejonowy Bielsku-Białe

Registered in the Krajowy regjester sadowy, Sad Rejonowy Bielsku-Białe no. KRS: 0000140818

SLASKIE WESOŁE MIASTECZKO SPÓŁKA Z OGRANICZONA ODPOWIEDZIALNOSCIA

Funpark LEGENDIA

ul. PLAC ATRAKCJI, nr.1 , 41 501 Chorzow, Poland

ID/Region: 243516267

Registered in the Katowice-Wschod Regional Court in Katowice no. KRS: 0000499958

Mölltaler Gletscherbahnen GmbH & Co KG & Hochgebirgsbahnen Ankogel

Ski resortsMölltaler Gletscher and Ankogel

Talstation, Innerfragrant 46, 9831 Flattach

Firmenbuchnummer 19797p

Company reg. No.: FN 19797 p

VAT reg. No.: AT U33329902

Muttereralm Bergbahnen Errichtungs GmbH

Ski resort Muttereralm

Nockhofweg 40, 6162 Mutters, Rakousko

Firmenbuchnummer: 270746g

VAT reg. No.: ATU62238929

Tatry mountain resorts CR, a.s.

Golf and Ski resort Ostravice, Golf Kaskáda

č.p. 75, 739 14 Ostravice, Česká republika

ID/Region: 06871917

Registered in: Spisová značka: B 23258 vedená u Městského soudu v Praze

VAT reg. No.: CZ06871917

TMR Ještěd, a.s.

Ski resort Skiareál Ještěd

Jablonecká 41/27, Liberec V-Kristiánov, 460 05 Liberec, Česká republika

ID/Regon: 06080413

Registered in: Spisová značka: B 2685 vedená u Krajského soudu v Ústí nad Labem

VAT reg. No.: CZ06080413

PRIVACY STATEMENT OF TMR Group – customers

This statement applies to you and to your personal data because you are a customer of an entity within TMR Group. Our company acts as the data controller at the processing of your personal data. For the purposes of this privacy statement, the entity of TMR Group (the data controller) with which you have concluded your contract or a membership in a loyalty programme is responsible for the protection of your personal data. This statement explains how we will use your personal data, which we will obtain from you or from a third party during your contractual relation with the company within TMR Group. We point out that since this statement applies to all TMR Group, some minor local differences in the way of processing for individual purposes can occur. If you want to obtain detailed information, please contact our local person responsible for the protection of personal data (see below).

General data categories

Basic personal data (e.g. name, date of birth and age, address)

Contact data (e.g. e-mail address, telephone number, fax number)

Communication data (time and content of communication)

Order or booking data (e.g. ordered goods or ordered services and invoice data such as service period, payment method, invoice date, tax identification number, etc.)

Payment data (e.g. account number, credit card data)

Ski ticket usage data (for internal billing between the lift)

Web usage data (e.g. server data, log files and cookies)

Purpose of data processing	Category of personal data	Legal base	The recipients or categories of recipients of the personal data
Contractual relationships Ski pass sales	Contact personal data. For instance, your first name and surname, permanent address, address for sending writings, e-mail address, contact telephone number, identity card number, birth certificate number, university degree, the date of birth, forgotten values (such as wallets, clothing, bags, or electronics in our facilities, especially hotels or cableways, etc.). Payment information. For example, bank account number and payments.	The legal basis for the processing of your data is the fulfillment of the contract within the meaning of Art. 6 (1) lit b GDPR.	Gopass, a.s. - when purchase was made using Gopass
Customer management Accommodation contractual relationships	Professional contact details. For example, the business address of the company you represent, your business email address, and your phone number Data from the ID card. Identity card or international passport. Payment Information. Such as bank account number and fees.	The legal basis is the concluded contract and the legitimate interest of the person responsible.	-
Travel book	Identification data and information about your travel destination and your travel dates. In this case, it involves the enrolment and registration of your first and last name, the telephone contact, the date and time of your trip to the alpine surroundings and the date and time of your expected return from the trip.	The legal basis is our legitimate interest, Art. 6 (1) lit f GDPR. If you are going on an excursion specifically to the mountain or alpine world, it is in our legitimate interest to know when you will be returning from there and, in the event of a search event, by the mountain service, which will certainly meet your expectations.	Austrian mountain rescue service
Gift vouchers Identification of the donor and the recipient together with the object of the donation and dedication of the donor to the recipient, insofar as this is necessary for the processing.	If you would like to give someone a gift with one of our products or services, we have to process the identification data of the donor and recipient to the required extent. Our company processes the personal data of the voucher holder in order to check the authorization of the services provided by the person responsible in the individual centers of the person responsible and to the recipient to whom the voucher was issued.	The legal basis for the processing of your data is the fulfillment of the contract within the meaning of Art. 6 (1) lit b GDPR. Personal data are processed for the time necessary to fulfill the purpose of processing - checking the authorization, the services provided by the controller in the individual centers of the controller and / or in the ski area for which the gift voucher was issued, together with the expectation Recipient.	Gopass, a.s.
GOPASS loyalty program and Gopass newsletters	Name, surname, place of residence, postal address, email address, contact telephone number, date of birth Customer registration and newsletter sending of the latest offers and services related to membership in the loyalty program.	The legal basis is the concluded contract Art. 6 (1) lit b GDPR and our legitimate interest is Art. 6 (1) lit f GDPR.
Sporting events and competitions	For this purpose, we will process your personal data to the extent necessary to process and register the competition.	The legal basis for processing is the contract between you and us, under which you accept the terms of the competition and from which we both have rights and obligations.	Regional und Country Medias
Losses and Findings	If you forget your device, we will be happy to pass it on to you if you ask about it. To do this, however, we need to verify your identity and record who we gave those forgotten items to.	The legal basis is the legitimate interest of our company.	-
Consumer contests	For this purpose, we will process your personal data to the extent necessary to process and register the competition.	The legal basis for processing is the contract between you and us, under which you accept the terms of the competition and from which we both have rights and obligations.	-
Video surveillance	Video surveillance in our premises (only online in our Mölltaler Gletscherexpress). Security control and protection of the rights and interests protected by the person responsible.	The legal basis is the legitimate interest of our company.	-
Dispute resolution and criminal investigation	We may process personal data for the purpose of resolving disputes, complaints or legal proceedings, or if there is a suspicion of a criminal offense that we would like to investigate further.	The legal basis is the fulfillment of the legal requirement and the legitimate interest of the person responsible and the processing is necessary to fulfill a legal obligation to which the person responsible is subject to Art. 6 (1) lit c GDPR	-
Legality	We may have to process your personal data in order to comply with the legal requirements (e.g. compare your name with the names in the so-called lists of named parties and comply with the Money Laundering Act) or comply with a court order.	The Legal basis for the processing is to fulfill a legal obligation to which the person responsible is subject to Art. 6 (1) lit c GDPR	-
Marketing Consents	Other data may also be used, but only with prior express consent (described in the consent).	The legal basis is the consent that we have received from you, Art. 6 (1) lit a GDPR.	-

Special categories of data ("sensitive data") according to Art. 9

As a rule, we do not process any sensitive data as defined by Art. 9 GDPR in the course of business contacts with our customers. Art. 9 GDPR. Only in exceptional cases (e.g. reimbursement of ski tickets in the event of sports injuries or customer enquiries about suitable offers for allergy sufferers) is health data also then processed.

Proof of low epidemiological risk for ski pass validity ("2G proof")

According to the COVID 19 regulations, people using our cable car facilities for recreational purposes must provide a valid proof of a low epidemiological risk. Currently, this is "2G proof" (vaccinated or recovered). The legal basis for the checking of the proof by us is a legal obligation in accordance with the COVID 19 regulations (in its current version) in connection with Art. 6 (1) lit. c GDPR. To simplify the checking of the proof in the case of multi-day and season tickets, it is possible to store the 2G proof check outcome (passed the check / did not passed the check and validity date of the 2G proof/green pass) in the Safe2Ski solution. Safe2Ski solution is provided by our business partner SKIDATA (SKIDATA Austria GmbH, Hochthronstraße 1-7, A-5083 Grödig/Salzburg). The Safe2Ski solution currently saves three data types: ski pass carrier serial number, GreenPass serial number and DCC-end date. Safe2Ski does not store any names, date of birth, addresses or the type of GreenPass (vaccinated or recovered). The customer must accept a separate clause to save the DCC-end date, otherwise the ticket is only activated for the day when the customer uses the Safe2Ski solution for the "2G proof". For more information about SKIDATA's privacy policy, please visit: https://www.skidata.com/de-at/datenschutz/ .

We do process only information that you have passed the check according to the COVID 19 regulations together with your ski pass ID based on which you are able to use our cable car facilities. Beyond this, processing may take place if this is necessary for the assertion or defence of claims. You can revoke your consent at any time by sending an e-mail to us, without this having any effect on the lawfulness of the processing until the date of revocation.

Data retention of processed data

Ticket shop(s) / Booking portal

For the purpose of providing contractual services as well as their payment and execution in the context of online purchases, bookings and brochure orders, we process your personal master data, contract and payment data as well as communication data (IP address and server log files) on the legal basis of Art. 6 (1) lit. b GDPR (contract performance) as well as Art. 6 (1) lit. c GDPR (legal obligation for invoicing and archiving).

We store this data for as long as it is required for the purpose, for as long as it is required by law (retention period for invoices according to § 132 BAO for 7 years; voucher orders until the expiry of the redemption period for 30 years) or we require this data on the basis of the legal basis of Art. 6 (1) lit. f GDPR (legitimate interest) to defend against possible liability claims. If you cancel the order process, we store the data for 14 days to clarify possible problems during the order process.

There is no legal or contractual obligation to provide personal data. The only consequence of not providing it is that we cannot process your bookings/orders.

Online Ticket Shop(s)

As part of using our website, it is possible to purchase ski tickets/passes online. The purpose of processing your personal data provided in the order process is to be able to provide you with the requested tickets. The legal basis for the processing of your data is the fulfilment of the contract iSd. Art. 6 (1) lit b GDPR. In principle, there is no legal obligation to provide this data, but we cannot provide you with our services without your data. We will store the data of your order for 7 years for reasons of company law and tax law. As part of the joint processing of personal data in the ticket office and access system, data is exchanged between all the operating companies of the ski regions where your ski ticket is valid and all the affiliated companies listed on our website or in our information folders. This data exchange serves the purpose of joint access control and the handling of a comprehensive ski operation.

Parties which can have access to your data

The data controller can share your personal data with third parties under the following circumstances:

We can share your personal data with other third parties which act on our behalf, for instance, with the provider of services. In such cases the third parties can use your personal data only for above-mentioned purposes and only in accordance with our instructions.

Our employees will have access to the personal data. In such cases the access will be given only if it is necessary for above-mentioned purposes and only if the employee is bound by confidentiality obligation.

If it is required by the law or a court order, we can share your personal data, for instance, with our suppliers or clients, with tax authorities, social welfare authorities, law enforcement authorities or with other governmental bodies.

We protect the personal data provided by the operator from unauthorized use and do not perform any operations that would disclose the provided personal information or otherwise make it available to unauthorized persons. We undertake not to provide the collected personal data to any third party or any other recipient, except for reasoned case law or under conditional case law.

Prize competitions

Your personal data provided for participation in our competitions (e-mail address, name, address) will only be used by us to determine a winner, to inform him/her of the prize and to send prizes. Your data will not be passed on to third parties. The legal basis for the processing of your personal data is the fulfilment of a contract pursuant to Art 6 para 1 lit b GDPR. There is no legal or contractual obligation to provide the personal data. Failure to provide the data will only result in you not being able to participate in the competition. Your data will be stored for the duration of the competition and - in order to process any claims for winnings and damages - for a maximum of 3 years thereafter and then deleted. By entering, you also agree that your name may be published on our website as well as on our public social media channels in the event that you win.

Location of your personal data

Your personal data will be stored exclusively within EU and EEA countries.

Storage of personal data

We store your personal data for a limited time period and when they are not needed any more for the purposes of processing, the data will be erased. In the case of pre-registration through B2B partners as our brokers, it will be within 30 days; in the case of offline orders, your data will be processed for the duration of the order, which in most cases it means that we store your personal data for the time of your relation with us.

Transitions through turnstiles. Your photos will be kept as follows: seasonal tickets for the whole season, as well as the GOPASS card, and short-term tickets for their validity and the next 30 days after the expiration date to provide information for resolving the complaint. When crossing the turnstiles, all photos are kept during the day and after 23:59:59 only the first and last photo from the passage through the turnstile of the previous day will be kept.

If it is possible, we will erase your data even during your relation with us as soon as they are not needed any more. The standard retention period of your personal data after providing the service is 5 years, in the fulfillment of legal obligations under the Act on Accounting and the Value Added Tax Act 10 years. In any case, we will erase your personal records not later than the expiration of legal time periods after the termination of the contractual relation, unless the legislation demands their storage. In the case of other deadlines, you will be notified of them directly in the processing conditions (for example, in relation to the processing of personal data in competitions and events).

We may process your personal information for a longer period of time after termination of the relationship in the event of a continuing legal dispute or if you have granted us permission to store your personal data for a long time.

RIGHTS OF THE DATA SUBJECTS

It is important for you to understand that those are your personal data we process and that we want you to be aware of the fact. Even if we do not need your consent to process your personal data, you have a lot of rights in connection with the processing of them.

Your rights What does it mean?

Right to access You can require to be informed how we process your personal data including the information about:

the reason why we process your personal data
what categories of personal data we process
with whom we share your personal data
how long we store your personal data or what criteria we exercise to determine the time limit
what rights you have
from where we obtain your personal data (if we have not obtained them from you)
if processing includes automated decision-making (so called profiling)
if your personal data have been transferred to a country outside EEA, how we ensure your personal data protection.

All the above-mentioned information is available in these Principles of the Personal Data Protection.

You can also ask for a copy of your personal data which we process. However, additional copies will be chargeable.

Right to remedy It is important for us to have accurate information about you and we request you to inform us if any of your personal data is incorrect, for instance, if you have changed your name or if you have moved.

Right to erasure If we process your personal data in an illegal way, for instance, if we process them longer than it is necessary or if we do it groundlessly, you can ask us for their erasure.

Right to restriction From the moment you have asked for remedy of your personal data, or if you have objected to the processing and until we can look into the problem or confirm the accuracy of your personal data (or change them according to your instructions), you are entitled to restricted processing. It means that we can process your personal data only in accordance with your consent (with the exception of their storage) if it is necessary in connection with legal claims to the protection of somebody else ‘s rights or if there exists a significant public interest in the processing.

You can also require restriction of the processing of your personal data if the processing is illegal, but you do not want us to erase your personal data.

Right to object If you suppose that we do not have the right to process your personal data, you can object to our processing. In such cases we can continue to process them only if we are able to prove persuasive legitimate reasons which prevail your interests, rights and freedoms. But we can always process your personal data if it is necessary for determination, exercise and defence of legal claims.

Right to data portability You can demand your personal data, which you have provided us for processing based on your consent or for the contract performance, to be provided in structured commonly used and computer-readable format. You also have the right to require portability of the information to another data controller.

Right to withdraw your consent You have the right to withdraw your consent and subsequently we will stop our processing activities based on this legal ground.

We will also inform the other parties to whom we may have provided your personal information of your request (s).

How can I complain about the use of my data or how can I exercise my rights?

If you would like to lodge a complaint about how we process your personal data, including the rights mentioned above, you can contact our data protection officer (DPO) and your suggestions and requests will be considered.

If you are dissatisfied with our answer or believe that we are processing your data unfairly or unlawfully, you can contact the competent supervisory authority, i.e. the data protection authority. Further information on the data protection authority and the complaint procedure can be found here:

Austrian Data Protection Authority

Wickenburggasse 8-10

1080 Vienna

Austria

Telephone: +43153115202525

Contact data

In case of any further questions relating to the processing of your personal data, you can contact us via Data Protection Officer (DPO). Please, send your e-mail to the following address: privacy@tmr.sk.

More information about personal data processing in 2 level information on 2linien