Privacy Policy

1. Data Controller

Protecting your personal data is important to us. We process personal data exclusively in accordance with the applicable data protection legislation, in particular the General Data Protection Regulation (GDPR) and the applicable Austrian data protection provisions.

This Privacy Policy applies in particular to the website www.gerbersports.com, the online booking platform odoo.gerbersports.com and the related GERBER SPORTS services in the areas of ski school, ski rental and sports shop.

2. Personal Data We Process

The personal data we process depends on which GERBER SPORTS services you use.

In particular, the following personal data may be processed:

• Name, title and contact details
• Address and billing information
• Email address and telephone number
• Booking, reservation and contract data
• Payment and transaction information
• Age or date of birth
• Information about participants included in a booking
• Ability level or skiing/riding ability
• Information about existing or required equipment
• Height and body weight in connection with ski rental
• Accommodation and room number, where provided during the rental process
• Voluntary comments and additional information
• Technical data such as IP address, browser and device information

We process only data that is necessary for the respective purpose or that you provide to us voluntarily.

3. Purposes and Legal Bases

Personal data is processed in particular to handle enquiries, reservations and bookings, organise ski school lessons, select and provide rental equipment, process payments, perform contracts and comply with legal obligations.

• Art. 6(1)(a) GDPR – processing based on your consent.
• Art. 6(1)(b) GDPR – performance of a contract or steps taken prior to entering into a contract.
• Art. 6(1)(c) GDPR – compliance with legal obligations.
• Art. 6(1)(f) GDPR – legitimate interests, provided that these are not overridden by the interests or fundamental rights and freedoms of the data subject.

4. Website Visits and Server Data

When you access our websites, technically necessary information may be processed. This may include, in particular, your IP address, date and time of access, the page or file accessed, browser type and browser version, operating system, as well as technical status and error information.

This processing serves in particular to provide the website technically, ensure system security and stability, analyse errors and protect against misuse and unauthorised access.

5. Contacting Us

If you contact us by telephone, email, contact form or by other means, we process the personal data you provide in order to handle your enquiry and any related follow-up questions.

Where the enquiry relates to an existing contract or specific pre-contractual measures, processing is carried out in particular on the basis of Art. 6(1)(b) GDPR.

6. Ski School Bookings via Odoo

During the booking process, we may process in particular your name, email address, telephone number, participant's age, type of lesson booked, date and time, ability level, information about available equipment, as well as voluntary comments and additional information.

The data is used in particular to process the booking, organise and provide the lesson, assign participants, communicate with the customer and handle billing.

The legal basis is in particular Art. 6(1)(b) GDPR.

7. Ski Rental and Rentmaxx

We use the external ski rental and booking system Rentmaxx for the reservation, administration and processing of our ski and snowboard rental services.

In particular, the following data may be processed:

• Title, first name, surname and, where applicable, academic title
• Address, postal code, city and country
• Telephone number and email address
• Accommodation and room number
• Date of birth or age
• Body weight
• Height
• Skiing or riding ability
• Rental period and booked category
• Rental equipment issued
• Information concerning returns, exchanges, damage or insurance

Processing is carried out in particular for the performance of the rental contract pursuant to Art. 6(1)(b) GDPR and, where applicable, to comply with statutory documentation requirements.

8. Bookings via External Distribution Partners

GERBER SPORTS services may also be booked in part through external booking and distribution partners.

In such cases, we receive from the respective partner the personal data required to process and provide the booking. This may include, in particular, master and contact data, booking and service data, as well as information required to provide and adjust the booked equipment.

For data collected and processed directly on the respective external booking platform, the privacy information of the respective provider also applies.

9. Payment Processing via hobex

For the processing of online payments, we use in particular the following payment service provider:

As part of payment processing, the data required for the respective payment is transmitted to hobex and/or processed directly by hobex.

This may include, in particular, master and contact data, payment data, reference numbers, the payment amount and technical information. The specific data processed depends on the payment method selected.

Depending on the selected payment method, additional parties such as banks, credit card organisations or providers of the respective payment method may be involved in payment processing.

Their respective privacy policies apply to their independent processing of personal data.

10. Cookies and Usercentrics

Our websites use cookies and comparable technologies. Technically necessary technologies are used where required for operation, security and essential website functions.

We use the Usercentrics Consent Management Platform to manage consent on gerbersports.com.

Usercentrics can be used in particular to manage and document consent and privacy preferences for essential, statistical and marketing technologies.

Consent that has been granted can be changed or withdrawn at any time with effect for the future using the privacy or cookie settings provided on the website.

11. Google Tag Manager

We use Google Tag Manager on gerbersports.com.

Google Tag Manager is used for the technical management and control of website tags and integrated services. Any additional data processing depends in particular on which services are integrated or activated through Tag Manager.

Where services requiring consent are controlled through Google Tag Manager, they are activated in accordance with the choices made via our consent management system.

12. Google Maps and Location Function

We use Google Maps, a service provided by Google, to display our GERBER SPORTS locations and provide map and route functions.

Google Maps can display our locations on an interactive map. If you enable the location function on your device or browser, your current location may also be used to display your position and provide directions to our locations.

When using Google Maps, information including your IP address, device and browser information and – where you have granted permission – location data may be processed and transmitted to Google.

Our Most Important Technical Systems

13. Recipients of Personal Data

Personal data is disclosed only where this is necessary for a specific purpose or is legally permitted or required.

Recipients may include in particular:

• Hosting and IT service providers
• Providers of website and booking systems
• Provider of the Rentmaxx ski rental software
• Odoo in connection with the technical services used
• hobex and other parties involved in the selected payment method
• External booking and distribution partners
• Tax advisers, accounting services and other professional advisers
• Public authorities and courts where required by law

Where service providers process personal data exclusively on our behalf, such processing is carried out in accordance with the statutory requirements governing data processing on behalf of a controller.

14. Transfers of Data to Third Countries

Where personal data is processed outside the European Economic Area in connection with individual technical services, such transfers are made only in compliance with the legal requirements of the GDPR.

Depending on the service, this may in particular be based on an adequacy decision of the European Commission or appropriate safeguards such as Standard Contractual Clauses.

15. Storage Period

As a general rule, we store personal data only for as long as is necessary for the respective processing purpose.

Data may also be retained where statutory retention and documentation obligations apply or where continued storage is necessary for the establishment, exercise or defence of legal claims.

Once the respective processing purpose no longer applies and the relevant statutory periods have expired, the data is deleted or otherwise no longer processed in accordance with statutory requirements.

16. Data Relating to Children and Young People

Personal data relating to minors is also processed in connection with our ski school services.

This may include in particular the participant's name, age, ability level, booked service and other information required for the organisation and safe provision of the lesson.

The booking and provision of this data is carried out by the person making the booking or by a person authorised to represent the minor.

17. Data Security

We implement appropriate technical and organisational measures to protect personal data against loss, unauthorised access, unlawful alteration or unauthorised disclosure.

The security measures used are reviewed in accordance with technological developments and the respective risks and are adjusted where necessary.

18. Your Rights

Subject to the applicable statutory requirements, you have in particular the following rights:

Withdrawal of consent does not affect the lawfulness of processing carried out on the basis of consent before its withdrawal.

19. Right to Lodge a Complaint

If you believe that the processing of your personal data infringes data protection legislation, you have the right to lodge a complaint with a competent data protection supervisory authority.

20. Provision of Personal Data

Certain personal data is required in order for us to process a reservation, booking or contract.

If the information required for the respective service is not provided, it may not be possible to process the relevant booking or provide the requested service.

There is no obligation to provide information that is voluntary.

21. Changes to This Privacy Policy

We reserve the right to amend this Privacy Policy if legal requirements, our services, the technical systems used or our processing activities change.

The current version published on our websites applies.