Privacy

The protection of your personal data is important to us. In this Privacy Policy, we inform you about which personal data is processed when you use our website roc-skischool-kronplatz.com, for what purposes the processing takes place, and what rights you have under the General Data Protection Regulation (EU) 2016/679 (“GDPR”).

1. Controller
The controller responsible for the processing of personal data is:
ROC Ski & Snowboardschool GmbH
Seilbahnstraße 6C
39031 Reischach / Bruneck (BZ)
South Tyrol – Italy

VAT No. / Tax No.: IT03219510215
E-mail: info@roc-school.com
Telephone: +39 0474 250 023
Website: roc-skischool-kronplatz.com
PEC:
If you have any questions regarding data protection or wish to exercise your rights, you can contact us at any time at info@roc-school.com.

2. Processing of Personal Data
Depending on how you use our website and services, the following personal data in particular may be processed:
- technical access and usage data;
- IP address;
- browser and device information;
- first and last name;
- e-mail address;
- telephone number;
- information relating to enquiries and bookings;
- information about participants, requested services, dates and skill level;
- contractual, booking and billing data;
- payment information, insofar as required for processing;
- newsletter registration data;
- cookie and privacy preferences;
- analytics and usage data, provided that you have consented to the corresponding processing.
As a general rule, we process only the personal data that is necessary for the respective purpose.

3. Visiting Our Website and Server Log Files
When you access our website, technically necessary information is automatically transmitted to our website server.
This may include in particular:
- IP address of the device used;
- date and time of access;
- page or file accessed;
- referrer URL;
- browser type and browser version;
- operating system used.
The processing takes place for the technical provision of our website and to ensure the security, stability and functionality of our systems.
Legal basis: Art. 6(1)(f) GDPR.
Our legitimate interest lies in the secure, stable and technically reliable operation of our website. The data is stored only for as long as necessary for these purposes and is subsequently deleted or anonymised, unless statutory obligations require a longer retention period.

4. Contact and Enquiries
If you contact us via a contact or enquiry form, by e-mail, by telephone or through other communication channels offered by us, we process the personal data you provide in order to handle your enquiry.
This may include in particular:
- first and last name;
- e-mail address;
- telephone number;
- requested period;
- requested service;
- skill level;
- information about participants;
- other information voluntarily provided.
The processing takes place in order to respond to your enquiry and, where applicable, to prepare or perform a contractual relationship.
Legal bases: Art. 6(1)(b) GDPR and, where applicable, Art. 6(1)(f) GDPR. The data will be deleted as soon as it is no longer required to process the enquiry, unless statutory retention obligations or other legitimate reasons require further storage.

5. Online Bookings and Provision of Our Services
If you book a ski or snowboard lesson, a course, a guiding service or another service via our website or an integrated booking system, we process the data required to process and provide your booking.
This may include in particular:
- contact and customer data;
- information about participants;
- requested services;
- dates and booking information;
- billing and payment information.
Processing is necessary to handle your booking, organise and provide the booked services and comply with legal obligations.
Legal bases: Art. 6(1)(b) GDPR for the performance of the contract and pre-contractual measures; Art. 6(1)(c) GDPR for compliance with legal obligations.
External booking, IT or payment service providers may be used for technical processing. They receive only the data necessary to provide their respective services.
If a booking is made via the platform of an external provider, that provider’s privacy policy also applies.

6. Payment Processing
For paid bookings, personal data may be transmitted to the payment service provider used for the respective payment method. Processing takes place exclusively insofar as this is necessary for payment processing and the performance of the contract.
Legal basis: Art. 6(1)(b) GDPR.
The privacy policy of the respective payment service provider applies to any further processing carried out by that provider.

7. Newsletter
You can subscribe to our newsletter on our website and receive information about news, offers and promotions from ROC Ski & Snowboardschool. For this purpose, we process your e-mail address in particular. The newsletter is sent exclusively on the basis of your voluntary consent.
Legal basis: Art. 6(1)(a) GDPR.
Where technically implemented, registration takes place using a double opt-in procedure. Your registration is verified by means of an additional confirmation by e-mail. To document your consent, the time of registration and confirmation as well as technical information may be stored. You may withdraw your consent at any time with effect for the future, for example via the unsubscribe link in the newsletter or by e-mail to info@roc-school.com. The lawfulness of processing carried out prior to the withdrawal of consent remains unaffected.

8. Cookies and Similar Technologies
Our website uses cookies and comparable technologies. Technically necessary cookies may be used to:
- ensure basic functions of our website;
- store your privacy and cookie settings;
- ensure the security of the website;
carry out technically necessary processes.
Non-essential cookies and technologies, particularly those used for analytics, marketing or personalisation purposes, are generally activated only after you have given your explicit consent.
Legal basis for processing requiring consent: Art. 6(1)(a) GDPR.
You can change or withdraw your consent at any time via the cookie settings on our website. An up-to-date overview of the cookies used, providers, purposes and storage periods can be found in our Cookie Policy or cookie settings.

9. Web Analytics
If you have given your consent via our consent management system, we may use analytics services to understand how our website is used and to improve our online services. In particular, pseudonymous identifiers, browser and device information, usage data, page views and information about interactions with our website may be processed. Such processing takes place exclusively with your consent.
Legal basis: Art. 6(1)(a) GDPR.
You can withdraw your consent at any time via the cookie settings. Further information about the analytics technologies actually used can be found in our cookie settings.

10. Google Analytics
If Google Analytics is used on our website and has been activated by you via the cookie settings, we use Google Analytics 4 for statistical analysis of website usage.
The provider is generally:
Google Ireland Limited
Gordon House
Barrow Street
Dublin 4
Ireland
Google Analytics enables us, among other things, to analyse page views, sessions, devices used, browsers and interactions with our website. Cookies or comparable technologies may be used for this purpose. Google Analytics is used exclusively with your consent.
Legal basis: Art. 6(1)(a) GDPR. You can change or withdraw your consent at any time via the cookie settings.

11. Google Ads and Conversion Measurement
If the relevant services are used and you have given your consent, we may use Google Ads technologies to measure the success of our online advertising activities. For example, it may be determined whether a specific action was carried out on our website after viewing or clicking on an advertisement. Processing takes place exclusively with your prior consent.
Legal basis: Art. 6(1)(a) GDPR.
You can withdraw your consent at any time via the cookie settings.

12. External Content and Social Media
Our website may contain links to our profiles on social networks as well as content or functions provided by external providers. In the case of simple links to social networks, data is generally transferred to the respective provider only when you access the corresponding link. If external content such as videos, maps or social media content is embedded directly into our website and consent is required for this purpose, such content will only be loaded after you have given your consent. When accessing external platforms, the privacy policies of the respective providers apply.

13. Recipients and Service Providers
External service providers may be used to provide our website and services.
These may include in particular:
- hosting and IT service providers;
- website and software service providers;
- booking system providers;
- payment service providers;
- newsletter and e-mail service providers;
- analytics and marketing providers;
- tax advisers and accounting service providers;
- other professional service providers, insofar as their involvement is necessary.
Personal data is disclosed only where this is necessary for the provision of our services, where there is a legal obligation, where a legitimate interest exists or where you have consented to the disclosure.
Service providers who process personal data on our behalf are contractually bound in accordance with applicable legal requirements.

14. Transfer of Data to Third Countries
Some of the service providers we use may process personal data outside the European Union or the European Economic Area. Such transfers take place exclusively in compliance with the requirements of Art. 44 et seq. GDPR. If the European Commission has issued an adequacy decision for the relevant third country, data may be transferred on this basis. Otherwise, the Standard Contractual Clauses approved by the European Commission and, where appropriate, additional safeguards may be used. Further information regarding possible transfers to third countries by analytics and marketing services can be found in our cookie settings.

15. Storage Period
We generally store personal data only for as long as necessary for the respective purpose. Where statutory retention obligations exist, particularly under tax, commercial or accounting law, the relevant data is stored for the legally prescribed period. Enquiry data is generally deleted once the enquiry has been fully processed, unless it is required for a subsequent contractual relationship. Contractual, booking and billing data is stored in accordance with the applicable statutory retention periods. Newsletter data is generally processed until you withdraw your consent, unless another legal basis exists for further storage.

16. Data Security
We implement appropriate technical and organisational security measures to protect personal data against loss, manipulation, unauthorised access, disclosure or other unlawful processing. Data transmission via our website is generally encrypted using HTTPS/TLS. Our security measures are regularly reviewed and adapted, taking into account technological developments and existing risks.

17. Your Rights
Subject to the applicable legal requirements, you have the following rights in particular:
- right of access pursuant to Art. 15 GDPR;
- right to rectification pursuant to Art. 16 GDPR;
- right to erasure pursuant to Art. 17 GDPR;
- right to restriction of processing pursuant to Art. 18 GDPR;
- right to data portability pursuant to Art. 20 GDPR;
- right to object pursuant to Art. 21 GDPR;
- right to withdraw consent with effect for the future.
To exercise your rights, you can contact us at info@roc-school.com.

18. Right to Object
Where we process personal data on the basis of a legitimate interest pursuant to Art. 6(1)(f) GDPR, you have the right, pursuant to Art. 21 GDPR, to object to such processing on grounds relating to your particular situation. Where personal data is processed for direct marketing purposes, you may object to such processing at any time.

19. Right to Lodge a Complaint
Pursuant to Art. 77 GDPR, you have the right to lodge a complaint with a data protection supervisory authority if you believe that the processing of your personal data infringes data protection law. The competent Italian data protection supervisory authority is:
Garante per la protezione dei dati personali
Piazza Venezia 11
00187 Rome
Italy

20. Automated Decision-Making
As a general rule, we do not use exclusively automated decision-making procedures, including profiling, that produce legal effects concerning you or similarly significantly affect you. Should this change in the future, we will inform you in accordance with the applicable legal requirements.

21. External Websites
Our website may contain links to third-party websites or services. When you access such a link, you leave our area of responsibility. The privacy policies of the respective providers apply to the processing of personal data on external websites.

22. Changes to this Privacy Policy
We reserve the right to amend this Privacy Policy if our website, the technologies used, our services or legal requirements change. The current version of this Privacy Policy is available at all times on our website at roc-skischool-kronplatz.com.