Privacy Policy

Preamble

The protection of your personal data is very important to us. Therefore, we would like to inform you here below, which data of your visit will be used for which purposes. If you have any further questions regarding the handling of your personal data, please do not hesitate to contact our data protection officer. Continuous technological development, changes to our services or the legal situation, as well as other reasons may require adjustments to our data protection notice. We therefore reserve the right to change this privacy policy at any time, and ask you to regularly inform yourself about the current status.

Person responsible/Data protection officer
Person responsible for data processing
Bayerische Zugspitzbahn Bergbahn AG
Olympiastraße 31
82467 Garmisch-Partenkirchen
Germany

Represented by the Executive Board
Matthias Stauch
Email: zugspitzbahn@zugspitze.de

Data protection officer of the person responsible
Bayerische Zugspitzbahn Bergbahn AG
Data Protection Officer
Olympiastraße 31
82467 Garmisch-Partenkirchen
Germany
Email: datenschutz@zugspitze.de

General data collection when calling up our website
For the provision of the website we use the service of Skiperformance. Skiperformance is an e-commerce platform for the sale of ski passes and tickets.
In the case of merely informative use of the website, we only collect the personal data that your browser transmits to our server. If you wish to view our website, we collect the following data, which is technically necessary for us to display our website to you and to ensure stability and security (legal basis for data processing is the legitimate interest pursuant to Art. 6 para. 1 p. 1 let. f of the GDPR, as well as Art. 25 para. 2 No. 2 of the Telecommunications Telemedia Data Privacy Act). Within the framework of the balancing of interests pursuant to Art. 6 para. 1 let. f of the GDPR, we have taken into account and weighed our interest in providing, and your interest in processing your personal data in accordance with data protection. Since the following data is sometimes technically necessary for the provision of our service, in order to be able to offer you our website and also to ensure stability and security, in particular to provide protection against misuse, we have come to the conclusion that this data can be processed – with a guarantee of data security following the state of the art standards – taking into account your interest in an appropriate way of the data processing in accordance with data protection.

Data Purpose of processing Storage duration
Operating system used Evaluation according to devices to ensure an optimised display of the website The data is deleted when the respective session has ended. IP addresses are deleted after 7 days at the latest.
Information about the browser type and version used Evaluation of the browsers used in order to optimise our web pages for this purpose
Internet service provider of the user Evaluation of the internet service provider
IP address Display of the website on the respective device
Date and time of the call-up Ensuring the proper operation of the website.
Or, Manufacturer and type designation of the smartphone, tablet or other user’s device Evaluation of device manufacturers and types of mobile devices for statistical purposes
Log files Ensuring the proper operation of the website

The collection of data for the provision of the website and the storage of the data in log files is mandatory for the operation of the website. Consequently, there is no possibility of rejection by the user.

General information for the legal bases of the processing, deletion, and deactivation of cookies
According to Art. 13 para. 1 let. c) of the GDPR, the following applies to the legal bases – if not mentioned in this privacy policy:
• in case of consent, Art. 6 para. 1 let. a) of the GDPR and Art. 7 of the GDPR apply
• for the fulfillment of a contract or for the execution of pre-contractual measures and the response to inquiries, Art. 6 para. 1 let. b) of the GDPR applies
• in case of fulfillment of a legal obligation, Art. 6 para. 1 let. c) of the GDPR applies
• for the protection of legitimate interests, Art. 6 para. 1 let. f) of the GDPR applies
The use of tracking options is generally carried out within the framework of Art. 6 para. 1 let. a (consent), or in individual cases the let. f (legitimate interest) of the GDPR.
Our concern in the sense of the GDPR (legitimate interest) is marketing, as well as the improvement of our offer and our web presence. If we base the processing on a legitimate interest, personal data is generally pseudonymised.
Unless otherwise stated in this privacy policy, the personal data processed by us will be deleted, or its processing restricted in accordance with Art. 17 and 18 of the GDPR. Personal data is deleted when it is no longer necessary for the purposes for which it was collected or otherwise processed, and there are no statutory retention obligations that would require the contrary. Processing is restricted if the personal data cannot be deleted, but is absolutely necessary for other purposes, in particular for the fulfillment of obligations under commercial or tax law. In principle, it is also possible to deactivate cookies in general or to reject their use. For example, http://www.youronlinechoices.com/ can be used for this purpose. You can also disable cookies via your browser settings.

Cookies – General information
Our website uses cookies. Cookies are text files that are stored in the internet browser or by the internet browser on the user's computer system. If a user calls up a website, a cookie may be stored on the user's operating system. This cookie contains a characteristic string that allows the browser to be uniquely identified when the website is revisited.

Different types of cookies – a) Technically necessary cookies
We use cookies to make our website more user-friendly. Some elements of our website require that the calling browser can be identified even after a page change.
Technically necessary cookies are not mandatory to display the website. However, some functions of the website, such as the contact form, cannot be used properly without these cookies. Consequently, there is no possibility for the user to reject them; these cookies can be deactivated by setting the browser each time.
We base the processing of your personal data on Art. 6 para. 1 sentence 1 let. f) of the GDPR, as well as Art. 25 para. 2 no. 2 of the Telecommunications Telemedia Data Privacy Act. Technically necessary cookies are required to provide you with the service and are accordingly limited to the most necessary. In this respect, your interests and our interests are concurrent if you wish to use our service. In this respect, cookies are retained for up to one year.
Domain Duration Purpose
PHPSESSID zugspitze.skiperformance.com Session Required for user recognition
cookie_msg_read .
zugspitze.skiperformance.com 30 days Required to process orders properly
home_msg zugspitze.skiperformance.com 30 days Required to process orders properly
lang zugspitze.skiperformance.com Session Required to process orders properly
skp_sid zugspitze.skiperformance.com 30 minutes Required to process orders properly
vuid zugspitze.skiperformance.com 1 year Required to process orders properly

Different types of cookies – b) Cookies for range measurement
Range measurement cookies collect information about how our website is used. These cookies do not store information that allows identification of the user. The information collected is exclusively aggregated and thus evaluated anonymously.
The use of cookies for range measurement is based on your consent in accordance with Art. 6 para. 1 let. a of the GDPR and Art. 25 para. 1 of the Telecommunications Telemedia Data Privacy Act. The consent applies to both the website and its mobile applications. You can revoke your consent at any time with effect for the future by making the appropriate selection in the “Cookie settings” (at the bottom of the page).

Google Analytics
This website uses Google Analytics, a web analytics service provided by Google Inc, (1600 Amphitheatre Parkway Mountain View, CA 94043, USA; “Google”). The responsible entity for users in the EU/EEA and Switzerland is Google Ireland Limited, Google Building Gordon House, 4 Barrow St, Dublin, D04 E5W5, Ireland.
Google Analytics uses the so-called "cookies", which are text files placed on your computer, to help the website analyse how users use the site. The information generated by the cookie about your use of this website is usually transmitted to a Google server in the USA and stored there. However, IP anonymisation is activated on our website, i.e. your IP address is truncated beforehand by Google within member states of the European Union or in other contracting states of the Agreement on the European Economic Area. Only in exceptional cases is the full IP address transmitted to a Google server in the USA and shortened there.
Insofar as data is processed outside the EU/EEA, we have concluded, based on the standard data protection clauses adopted by the EU Commission in accordance with Art. 46 of the GDPR with the service provider, in order to establish a secure level of data protection, to allow the transfer of personal data to a third country in individual cases.
The IP address provided by Google Analytics as part of Google Analytics will not be merged with other Google information. On behalf of the operator of this website, Google will use this information to evaluate your use of the website, to compile reports on website activity, and to provide other services related to website usage and internet usage to the website operator. The data sent by us and linked to cookies, user IDs (e.g. user ID) or advertising IDs are automatically deleted after 14 months. The deletion of data whose retention period has been reached, takes place automatically once a month.
The legal basis for accessing the information is your consent pursuant to Art. 25 para. 1 of the Telecommunications Telemedia Data Privacy Act. The legal basis for the described data processing is your consent, Art. 6 para. 1 p. 1 let. a of the GDPR. You can give this consent during your first visit to the website. If you have already consented, you can revoke your consent at any time by changing the selection under "Cookie settings". You can find the link to the cookie settings at the bottom of this website. You can also prevent the collection of data generated by the cookie and related to your use of the website (including your IP address) by Google and the processing of this data by Google by downloading and installing the Browser-Add-on. Opt-out cookies prevent the future collection of your data when visiting this website.
The data sent by us and linked to cookies are automatically deleted after a maximum of 24 months. The deletion of data whose retention period has been reached, takes place automatically once a month.
For more information on the terms of use and privacy, please visit https://www.google.com/analytics/terms/de.html or https://policies.google.com/?hl=de.

Google Audiences
We also use Google Audiences ("GA Audiences"), another web analytics service provided by Google. The operator of this service is Google Ireland Limited, Google Building Gordon House, 4 Barrow St, Dublin, D04 E5W5, Ireland. Through this service, data is collected and stored, from which pseudonymised usage profiles are created. Through this technology, users who have visited our web pages, can be shown targeted advertising from us on other external pages of the Google Partner Network.
GA Audiences uses, among other things, cookies that are stored on your computer, as well as other mobile devices (e.g. smartphones, tablets, etc.) and that enable an analysis of the use of the respective devices. Some of the data is evaluated across devices. GA Audiences receives access to the cookies created in the context of the use of Google Analytics. In the course of use, data, such as in particular the IP address and activities of the user, may be transmitted to a server of the company Google LLC and stored there. Google LLC may transfer this information to third parties where required to do so by law, or where such third parties process the information. You can prevent the collection and forwarding of personal data (especially your IP address) and the processing of this data by deactivating the execution of Java Script in your browser or installing a tool such as 'NoScript'. You can also prevent the collection of data generated by the Google cookie and related to your use of the website (including your IP address) to Google, as well as the processing of this data by Google, by following the link below (http://tools.google.com/dlpage/gaoptout?hl=de) and by downloading and installing the browser plugin. You can access further information on data protection when using GA Audiences at the following link: https://support.google.com/analytics/answer/2700409?hl=en&ref_topic=2611283.
The legal basis for accessing the information is your consent pursuant to Art. 25 para. 1 of the Telecommunications Telemedia Data Privacy Act. The legal basis for the described data processing is your consent, Art. 6 para. 1 p. 1 let. a of the GDPR. You can give this consent during your first visit to the website. If you have already consented, you can revoke your consent at any time by changing the selection under "Cookie settings". You can find the link to the cookie settings at the bottom of this website.

Doubleclick
We use the online marketing tool DoubleClick by Google LLC, 1600 Amphitheatre Parkway Mountain View, CA 94043, USA on our website. The responsible entity for users in the EU/EEA and Switzerland is Google Ireland Limited, Google Building Gordon House, 4 Barrow St, Dublin, D04 E5W5, Ireland. DoubleClick uses cookies to display ads that are relevant to users, to improve campaign performance reports, or to prevent users from seeing the same ads more than once. Google records which ads are displayed in which browser via a cookie ID. This excludes the possibility of the same ad being placed more than once. In addition, DoubleClick can use cookie IDs to record the so-called conversions related to ads. This is the case, for example, when a user sees a DoubleClick ad and later uses the same browser to visit the advertiser's website and make a purchase.
When you call up a page that uses DoubleClick and for which the DoubleClick script is permitted, your browser automatically establishes a direct connection with Google's server. We as the website operator have no influence on the scope and further use of the data collected by Google through the use of this tool. We will inform you according to the best of our knowledge: Through the integration of DoubleClick, Google receives the information that you have called up the corresponding part of our website or clicked on an advertisement from us. If you are registered with a Google service, Google can assign the visit to your account. Even if you are not registered with Google or have not logged in, there is a possibility that the provider will find out and store your IP address.
For more information about DoubleClick by Google, please visit https://www.google.de/doubleclick, as well as on data protection at Google in general: https://www.google.de/intl/de/policies/privacy. Alternatively, you can visit the Network Advertising Initiative (NAI) website at https://www.networkadvertising.org.
The legal basis for accessing the information is your consent pursuant to Art. 25 para. 1 of the Telecommunications Telemedia Data Privacy Act. The data collection and storage are only carried out after explicit consent according to Art. 6 para. 1 p. 1 let. a) of the GDPR. This can be revoked at any time with effect for the future.

Facebook Connect
We use "Facebook Connect" on our website, a service provided by Meta Platforms Ireland Limited, 4 Grand Canal Square, Grand Canal Harbour, Dublin 2, Ireland, a subsidiary of Meta Platforms, Inc, 1601 S California Ave, Palo Alto, California 94304, USA (hereinafter "Facebook"). Facebook Connect makes it easy for you to register for services on the internet. Through this, we give you the possibility to register and log into our website through your Facebook account in order to use our offer.
When you register through Facebook, Facebook will ask for your consent to share certain information in your Facebook account with us. This may include your first name, last name, and email address to verify your identity and gender, as well as general location, a link to your Facebook profile, time zone, date of birth, profile picture, "likes" and friends list.
This data is collected by Facebook and transmitted to us in compliance with the terms of Facebook's data policy (https://de-de.facebook.com/privacy/explanation). You can control the information we receive from Facebook through the privacy settings in your Facebook account.
This data is used to set up, provide and personalise your account.
If you register with us via Facebook, your account will automatically be connected to your Facebook account, and information about your activities on our websites may be shared on Facebook and published in your chronicle and news display for friends.
Insofar as data is processed outside the European Economic Area / the EU, where there is no level of data protection equivalent to the European standard, Facebook states that it uses standard contractual clauses.
The legal basis for accessing the information is your consent pursuant to Art. 25 para. 1 of the Telecommunications Telemedia Data Privacy Act. The legal basis for the described data processing is your consent, Art. 6 para. 1 p. 1 let. a of the GDPR. You can give this consent during your first visit to the website. If you have already consented, you can revoke your consent at any time by changing the selection under "Cookie settings". You can find the link to the cookie settings at the bottom of this website.
You can prevent Facebook from processing the above information by using our registration form and not using Facebook Connect.

Orders in the online store
We offer you the possibility to purchase tickets in our online store provided for this purpose, and to place orders with us for this purpose.
The data processed includes inventory data, communication data, contract data, payment data, and the data subjects of the processing include our customers, prospective customers, and other business partners. The processing is carried out for the purpose of providing contractual services within the framework of the operation of an online store, billing, delivery, and customer services. We use session cookies to store the contents of the shopping cart and permanent cookies to store the login status.
Of course you can inform yourself on our website in general – without having to make a purchase – about our offered products.
When you decide to purchase one or more items, these items are first placed in a shopping cart. For this you need to register. During the registration process, the required mandatory information is provided to the users.
After selecting your items, enter the required shipping and billing information. As a customer, you can of course also choose from customer data stored for this purpose from the last order. You then choose your preferred delivery service and payment method. Afterwards, you will receive a summary, on which all order details are once again clearly displayed. This summary can be confirmed afterwards.
Upon confirmation of the order details, you will be redirected to the desired payment method to make the payment. The order is then completed and you will receive a confirmation email about the completed order.
The processing of your personal data related to this process is based on Art. 6 para. 1 sentence 1 let. b of the GDPR. Your personal data will be deleted upon expiry of the statutory retention obligations, i.e. after six or ten years.

In addition, the legal basis for the data processing associated with this is Art. 6 para. 1 p. 1 let. f of the GDPR, as well as Art. 25 para. 2 no. 2 of the Telecommunications Telemedia Data Privacy Act, our legitimate interest in providing you with a smooth ordering process and the provision of our products, and to handle all your requests in the most efficient manner possible.

Adyen N.V.
We use the services of the payment service provider Adyen N.V. German Branch, Friedrichstraße 63, 10117 Berlin. Adyen N.V. receives your data required in connection with the purchase for payment processing (e.g. e-mail address), and contract data (such as order details). The transfer of your data takes place exclusively for the purpose of payment processing. The legal basis is Art. 6 para. 1 p. 1 let. b of the GDPR. We have no knowledge of the storage period at Adyen N.V. and no possibility to influence it. For further information on data protection, please refer to the privacy policy of Adyen N.V.(Link https://www.adyen.com/de_DE/richtlinien-und-haftungsausschluss/privacy-policy)

PayPal
If you select payment via PayPal, your data will be transmitted to the payment service provider PayPal (Europe) S.à.r.l. et Cie, S.C.A., 22–24 Boulevard Royal, L-2449 Luxembourg. Your data will only be passed on for the purpose of payment processing and only to the extent necessary for this purpose. The legal basis is Art. 6 para. 1 p. 1 let. b of the GDPR. When paying with PayPal, the bank data you have deposited with PayPal, will be used by PayPal for payment. We have no knowledge of the storage period at PayPal and no possibility to influence it. For further information on data protection, please refer to PayPal's privacy policy (link https://www.paypal.com/de/webapps/mpp/ua/privacy-full)

Social Bookmarks
The so-called social bookmarks of the following providers are integrated on our website:
• Facebook (Operator: Facebook Inc., 1601 S. California Ave, Palo Alto, CA 94304, USA)
• Twitter (Operator: Twitter Inc., 795 Folsom St., Suite 600, San Francisco, CA 94107, USA)
• LinkedIn (Operator: LinkedIn Corporation, 1000 W Maude Ave, Sunnyvale, CA, 94085-2810 USA)
Social bookmarks are Internet bookmarks that allow users of such a service to collect links and news messages. These are only integrated on our website as a link to the corresponding services. After clicking on the embedded graphic, you will be redirected to the page of the respective provider, i.e. only then will user information be transmitted to the respective provider. For information on the handling of your personal data when using these websites, please refer to the respective data protection regulations of the providers.

Registration
You have the option to register on our website and create a customer/user account. The specification of the e-mail address and a password are necessary for this action. Registration is also possible via Facebook or with a Google account.
We store your data required for the fulfillment of the contract, if necessary, also information on the method of payment, until you finally delete your access. The necessary data is stored until current order processes have been completed and active tickets have been used. You can manage and change all details in the protected customer area.
You can delete your customer/user account at any time. When the account is deleted, all personal data that is not subject to a legal obligation to retain data or Article 17 para. 3 of the GDPR, will be deleted.
The legal basis for this data processing is Art. 6 para. 1 let. a, b and f of the GDPR.

Contact options
You have the possibility to contact us via our e-mail address or by phone. We will, of course, use the personal data provided to us in this way exclusively for the purpose for which you provide it when contacting us. A communication of this information is expressly on a voluntary basis and with your consent, Art. 6 para. 1 sentence 1 let. a of the GDPR. Insofar as this involves information on communication channels (e.g. e-mail address, telephone number), you also give us consent to contacting you via this communication channel, if necessary, in order to respond to your request. Of course, you can revoke this consent at any time for the future. Please contact our data protection officer for this purpose. The data will be deleted after responding to the contact if they are no longer required or and legal storage obligations are not contrary to it.

Data sharing
Your personal data will not be transferred to third parties for purposes other than those listed.
We will only share your personal information with third parties if:
• you have given your express consent to this,
• the disclosure is necessary for the assertion, exercise or defense of legal claims and there is no reason to assume that you have an overriding interest worthy of protection in the non-disclosure of your data,
• in the event that there is a legal obligation for the disclosure, and
• this is legally permissible and necessary for the processing of contractual relationships with you.
Subject to legal or contractual permissions, we process or allow the processing of data in a third country only if the special requirements of Art. 44 et seq. of the GDPR are met. This means, for example, that processing takes place on the basis of special guarantees, such as the officially recognised determination of a level of data protection that corresponds to the EU, or compliance with officially recognised special contractual obligations (so-called "standard contractual clauses").

Instruction on the rights of those affected
Every affected person has the right to information under Art. 15 of the GDPR, the right to rectification under Art. 16 of the GDPR, the right to erasure under Art. 17 of the GDPR, the right to restriction of processing under Art. 18 of the GDPR, the right to object under Art. 21 of the GDPR and the right to data portability under Art. 20 of the GDPR. With regard to the right to information and the right of deletion, the restrictions pursuant to Art. 34 and Art. 35 of the Federal Data Protection Act apply.

Instruction on the right of appeal
You also have the right to appeal to the competent data protection supervisory authority about the processing of your personal data by us.

Instruction on revocation in case of consent
You can revoke your consent to the processing of personal data at any time. This also applies to the revocation of declarations of consent given to us before the applicability of the General Data Protection Regulation, as before May 25, 2018. Please note that the revocation is only effective for the future. Processing that took place before the revocation is not affected by this.

Right in case of data processing for direct marketing purposes
Pursuant to Art. 21 para. 2 of the GDPR, you have the right to object at any time to the processing of personal data concerning you. In the event of your objection to processing for the purpose of direct marketing, we will no longer process your personal data for these purposes. Please note that the objection is only effective for the future. Processing that took place before the objection is not affected.

Reference to right of objection when weighing interests
Insofar as we base the processing of your personal data on a balance of interests, you can object to the processing. When exercising such an objection, we ask you to explain the reasons why we should not process your personal data as described by us. In the event of your justified objection, we will review the situation and either discontinue or adjust the data processing or explain to you our compelling reasons why protection is justified.

Links to other websites
Our websites may contain links to websites of other providers. We would like to point out that this data protection declaration applies exclusively to the websites of our company. We have no influence on and do not control whether other providers comply with the applicable data protection regulations.

Changes to the privacy policy
We reserve the right to change this privacy policy at any time in compliance with the applicable data protection regulations.





As of: April 2023