Privacy Policy

The controller responsible for the processing of your personal data is:

Sport Bründl Gesellschaft m.b.H.
Nikolaus-Gassner-Straße 4, 5710 Kaprun
Phone: +43 6547 83 88-0
Email: office@bruendl.at

(hereinafter referred to as “We”, “Us”, the “Controller” or “SPORT BRÜNDL”)

We have acquired from Strolz GmbH (FN 633064b), Dorf 116, 6764 Lech, all locations in Vorarlberg for the sale of sports and fashion articles of all kinds, including ski service and ski rental operations (hereinafter referred to as the “STROLZ Shops”), as well as the website https://www.strolz.at and the related social media accounts, and continue to operate them under the STROLZ brand.

2.1. Scope of the Processing of Personal Data

We may collect the following personal data about you when concluding a contract in connection with a purchase or rental in a STROLZ Shop: title, first name and surname, billing address, delivery address, telephone number, email address, and STROLZ advertising flag.

In addition, we collect the following data during the payment process: receipt number, details of the goods purchased, individual price, total purchase price, and payment method.

If you are already a STROLZ customer and have not objected to the transfer of your data to us, the following data has been transferred to us by Strolz GmbH to enable the processing of your orders and to ensure that STROLZ services remain available to you without interruption:

Customer number, first name and surname, address, email address, telephone number, date of birth, purchase data, type and quantity of ordered products, and consent to receive advertising/newsletters.

2.2. Legal Basis for the Processing of Personal Data

The legal basis for the processing of the data referred to under section 2.1. is Article 6(1)(b) GDPR, namely the necessity of processing for the performance of a contract or in response to another request.

The provision of your contact details is voluntary; naturally, a purchase can also be made without providing personal data. However, if such data is exceptionally required for the performance of the purchase contract (e.g. shipment of ordered goods) and you do not provide it, we may not be able to process the purchase or rental accordingly.

Where we have received your data from Strolz GmbH, we rely on our legitimate interest as the legal successor of Strolz GmbH in continuing the business relationships under the STROLZ brand (Article 6(1)(f) GDPR).

2.3. Purpose of Data Processing

The system is used for the internal management of customer relationships and the central collection of customer data to the extent necessary for the processing of purchases or rentals. This processing supports the Controller in maintaining customer relationships (contact management), including the prompt and efficient handling of enquiries, and promotes in particular an overview of the status of contract performance and customer enquiries, as well as the systematic recording and management of business transactions.

Upon acquisition of the STROLZ Shops, we assumed the legal position with regard to the contracts and business relationships previously held by Strolz GmbH. Upon completion of the sale, all rights and obligations arising from contractual relationships with customers and other business partners, as well as all sales and marketing activities under the STROLZ brand, were transferred to us.

Accordingly, the purpose of our processing of the data is to ensure the continued optimal support of STROLZ Shop customers, maintain customer relationships, and serve customers’ interests in the STROLZ brand.

2.4. Retention Period

This data shall be deleted after termination of the contractual relationship with the customer, unless the data is required beyond this period to comply with statutory tax retention obligations or for as long as claims arising from the contractual relationship may still be asserted.

2.5. External Recipients of Data

For the storage and hosting of personal data, we engage an IT service provider, namely Sport Management und Consulting GmbH, Kaprun, which, acting on behalf of and in accordance with the instructions of the Controller, may also have access to personal data where necessary for the provision of the commissioned IT services.

Sport Management und Consulting GmbH is authorised to engage further processors and has commissioned advarics GmbH, Grabenweg 58, 6020 Innsbruck, and BSI Business Systems Integration AG, Täfernweg 1, 5405 Baden, Switzerland (for Switzerland, as a third country, an adequacy decision pursuant to Article 45(1) and (3) GDPR exists). Appropriate data processing agreements pursuant to Article 28 GDPR are in place between Sport Management und Consulting GmbH and advarics GmbH as well as BSI Business Systems Integration AG.

BSI Business Systems Integration AG in turn engages the following additional processors:

• BSI Business Systems Integration Deutschland GmbH, Rheinstrasse 97, 64295 Darmstadt, Germany, for IT services within the scope of the SaaS agreement.

• Amazon Web Services EMEA SARL, 38 Avenue John F. Kennedy, L-1855 Luxembourg, for cloud services with data centres located in Frankfurt. Standard Contractual Clauses have been concluded by BSI with AWS, and a transfer impact assessment has been carried out by BSI.

• Mailjet GmbH, Rankestraße 21, 10789 Berlin, Germany, for the dispatch of newsletters and emails.

We disclose your data to third parties involved in the provision of services (e.g. suppliers) and, in the event of disputes, to legal representatives, courts, or public authorities.

Apart from this, your data will not be disclosed to external third parties for their own purposes without your consent. Personal data may, however, be shared internally with other departments where necessary for the fulfilment of other purposes within the company, for example with the accounting department for billing purposes.

3.1. Scope of the Processing of Personal Data

We process your first name and surname, email address, telephone number and address, provided that you supply us with this information when making a purchase. If you do not provide this information, we will not be able to provide you with an electronic invoice.

In addition, we automatically store and process the following data for the purpose of electronic invoicing: customer number (if available), invoice data (date of invoice issuance, date of purchase, description and quantity of goods, unit price and total price).

3.2. Legal Basis for the Processing of Personal Data

The legal basis for the processing of the data is Article 6(1)(a) GDPR, as you consent to the processing by voluntarily providing your data, and Article 6(1)(b) GDPR, as the processing is necessary for the performance of a contract, since you have indicated that you wish to receive the invoice electronically.

3.3. Purpose of Data Processing

The personal data listed under section 3.1 are processed by us for the purpose of issuing an electronic invoice and sending it by email. The contact details are necessary in order to enforce claims against the customer should the electronically delivered invoice, which becomes due upon receipt, not be paid on time.

3.4. Recipients of Data

Sport Management und Consulting GmbH, Kaprun, is engaged as the technical IT service provider and may have access to the data where required for the provision of IT services (in particular technical support, installation of updates, etc.). An appropriate data processing agreement has been concluded.

Sport Management und Consulting GmbH is authorised to engage further processors and has commissioned advarics GmbH, Grabenweg 58, 6020 Innsbruck. An appropriate data processing agreement pursuant to Article 28 GDPR has been concluded between Sport Management und Consulting GmbH and advarics GmbH.

3.5. Retention Period

The personal data shall be retained for seven (7) years following the end of the financial year in which the purchase was made, based on a statutory retention obligation (§ 132 Austrian Federal Fiscal Code – BAO).

4.1. Scope of the Processing of Personal Data

Bründl Sports uses the personal data provided by you in connection with the rental of sports equipment (see section 1.1.), namely first name, surname, address, and country, for the purposes of direct marketing, in order to send you general information about STROLZ’s own activities and products.

In addition, we collect the following data: marketing activities carried out (marketing campaigns, correspondence); customer support data (such as promotional materials sent); and the customer’s response behaviour in relation to Bründl Sports marketing campaigns associated with STROLZ.

4.2. Legal Basis for the Processing of Personal Data

The conduct of direct marketing using these personal data constitutes a legitimate interest of Bründl Sports in reaching customers and prospective customers as effectively as possible and adapting marketing strategies accordingly. The legal basis for the processing is therefore the existence of a legitimate interest pursuant to Article 6(1)(f) GDPR.

The sending of advertising by email or SMS shall only take place in compliance with the applicable telecommunications regulations pursuant to Section 174 of the Austrian Telecommunications Act 2021 (TKG 2021).

4.3. Purpose of Data Processing

Your personal data is used for the dispatch of offers, product catalogues and other promotional material relating to STROLZ branded products.

The personal data is also used for analysis and interpretation for the purposes of personalised advertising. The data described in section 4.1. is evaluated and analysed using various statistical methods (exploratory, descriptive and inductive) and by enriching the personal data with aggregated socio-demographic data relating to customer groups to which you belong based on your identification data (e.g. gender, age).

Analysis means that, on the basis of the combined data and with the aid of automated analysis models, probabilities are calculated in order to select offers that are likely to be relevant to you.

4.4. Retention Period

Bründl Sports stores your data for up to three (3) years after your last contact with us, unless you object to the use of your data for marketing purposes before that time.

4.5. Recipients of the Data

Sport Management und Consulting GmbH, Kaprun, is engaged as the technical IT service provider and may have access to the data where required for the provision of IT services (in particular technical support, installation of updates, etc.).

Sport Management und Consulting GmbH has in turn engaged BSI Business Systems Integration AG, Täfernweg 1, 5405 Baden, Switzerland, as a further processor. Switzerland benefits from an adequacy decision as a third country pursuant to Article 45(1) and (3) GDPR. An appropriate data processing agreement pursuant to Article 28 GDPR has also been concluded.

BSI Business Systems Integration AG in turn engages the following additional processors:

• BSI Business Systems Integration Deutschland GmbH, Rheinstrasse 97, 64295 Darmstadt, Germany, for IT services within the scope of the SaaS agreement.

• Amazon Web Services EMEA SARL, 38 Avenue John F. Kennedy, L-1855 Luxembourg, for cloud services with data centres located in Frankfurt. Standard Contractual Clauses have been concluded by BSI with AWS, and a transfer impact assessment has been carried out by BSI.

• Mailjet GmbH, Rankestraße 21, 10789 Berlin, Germany, for the dispatch of newsletters and emails.

Personal data will not be transferred to third parties without your consent.

4.6. Withdrawal / Right to Object

You may object at any time to the processing of your data for direct marketing purposes, which we base on our legitimate interests, by email to datenschutz@bruendl.at or by telephone at +43 (0)6547 8388-0 (see section V.6 below).

5.1. Scope of the Processing of Personal Data

On our website https://www.strolz.at, you have the option of subscribing to a free newsletter in order to receive ongoing information about products and activities relating to the STROLZ brand. When subscribing to the newsletter, we ask for your email address, which you may provide voluntarily so that we can send you the newsletter.

In addition, during the registration process or automatically in connection with the distribution of the newsletter, we process the following personal data:

• IP address of the accessing computer

• Date and time of registration

• Objection to receiving the newsletter (date of objection)

• Entry in the Robinson List (Yes/No)

• Log data (date of dispatch, read confirmation)

5.2. Legal Basis for the Processing of Personal Data

Subscription to the newsletter is only possible with your consent. The legal basis for the processing is Article 6(1)(a) GDPR.

The telecommunications regulations pursuant to Section 174 of the Austrian Telecommunications Act 2021 (TKG 2021) are complied with, as electronic contact through the sending of mailings/newsletters only takes place following subscription to the newsletter.

5.3. Purpose of Data Processing

We process the data of visitors to our website who subscribe to the newsletter for the purpose of fulfilling the request to receive the newsletter.

5.4. Recipients of Data

Sport Management und Consulting GmbH, Kaprun, is engaged as the technical IT service provider for the distribution of the newsletter and may have access to the data where necessary for the provision of these services.

Sport Management und Consulting GmbH has in turn engaged BSI Business Systems Integration AG, Täfernweg 1, 5405 Baden, Switzerland, as a further processor. Switzerland benefits from an adequacy decision as a third country pursuant to Article 45(1) and (3) GDPR. An appropriate data processing agreement pursuant to Article 28 GDPR has also been concluded.

BSI Business Systems Integration AG in turn engages Mailjet GmbH, Rankestraße 21, 10789 Berlin, Germany, as a further processor for the dispatch of newsletters.

5.5. Retention Period

The data may be retained until you object to receiving the newsletter.

6.1. Scope of the Processing of Personal Data

We use the following data, collected in connection with the rental of sports equipment, in anonymised form for analytical purposes in order to generate information for business strategy, product development and product improvement: country of origin, name of the hotel or travel agency, and description of the rented sports equipment.

6.2. Legal Basis for the Processing of Personal Data

The legal basis for the processing of data lawfully collected in accordance with section 6.1. and subsequently anonymised is Article 6(1)(f) GDPR. The protected interests of customers are not affected by this processing.

6.3. Purpose of Data Processing

The personal data referred to in section 6.1. is anonymised and used for analysis and interpretation in the areas of product development and quality management. The non-personal results obtained from the analysis are used to prepare evaluations of customer structures and to identify customer interests and customer behaviour.

This information is used to generate insights that help align business and sales strategies, assess potential future customer demand, adapt and improve products and services, and develop other concepts aimed at better reaching customers and meeting their needs.

No personal reference is established in connection with the results of these analyses.

6.4. Retention Period

As the data is anonymised, it is retained without any time limitation.

7.1. Scope of the Processing of Personal Data

You may contact us in writing via the online form available at https://www.strolz.at/de/kontakt or otherwise get in touch with us if you are interested in our activities and services. When you contact us, the data voluntarily provided by you (first name and surname, salutation, telephone number or email address, subject, relevant shop, and the content of your enquiry) will be processed in order to answer your questions and handle your request.

You are free to decide whether to provide your data for your enquiry. However, if you do not provide certain information, the online form cannot be submitted, as we would then be unable to properly process your request.

In addition, we automatically process and store the following information for documentation purposes: the date of the enquiry, the content of the information provided or response given, and the communication history (log data).

7.2. Legal Basis for the Processing of Personal Data

We base the processing on Article 6(1)(a) GDPR, as you have voluntarily provided us with your data and the enquiry does not constitute a pre-contractual measure. In addition, we base the processing on Article 6(1)(f) GDPR in order to properly manage enquiries and organise responses.

7.3. Purpose of Data Processing

The purpose of storing and processing the data is to ensure that enquiries and responses are handled consistently and efficiently and that the necessary information for contacting and communicating with you is available.

In addition, we process the data for the administration of these messages, in particular for assigning enquiries to the responsible employees and documenting the handling of the enquiry.

If your enquiry relates to a contractual relationship, we will continue to process your data internally within the processing activity “Data Processing in Connection with a Transaction in a STROLZ Shop”.

7.4. Recipients of Data

Sport Management und Consulting GmbH, Kaprun, is engaged as the technical IT service provider for the operation of the online contact form and may have access to the data where necessary for the provision of IT services (in particular technical support, installation of updates, etc.).

7.5. Retention Period

The data will be retained for as long as contact with the data subject exists or consent has not been withdrawn, but in any case for no longer than one year after your last contact with us.

Eine automatisierte Entscheidungsfindung einschließlich Profiling gem Art 22 Abs 1 und 4 DSGVO wird von uns nicht durchgeführt und besteht somit nicht. 

1. Right of Access

You have the right to obtain information from SPORT BRÜNDL regarding all data relating to you that is processed by SPORT BRÜNDL. In particular, you may request information from SPORT BRÜNDL regarding:

(1) the purposes for which the personal data is processed;

(2) the categories of personal data being processed;

(3) the recipients or categories of recipients to whom your personal data has been or will be disclosed;

(4) the intended period for which your personal data will be stored or, if specific information is not possible, the criteria used to determine that period;

(5) the existence of a right to rectification or erasure of your personal data, a right to restriction of processing by the controller, or a right to object to such processing;

(6) the existence of a right to lodge a complaint with a supervisory authority;

(7) all available information regarding the source of the data where the personal data is not collected from the data subject;

(8) the existence of automated decision-making, including profiling, pursuant to Article 22(1) and (4) GDPR and, at least in those cases, meaningful information about the logic involved, as well as the significance and envisaged consequences of such processing for the data subject.

You also have the right to request information as to whether your personal data is transferred to a third country or to an international organisation. In this context, you may request to be informed of the appropriate safeguards pursuant to Article 46 GDPR relating to such transfer.

2. Right to Rectification and Right to Restriction of Processing

You may request the rectification or completion of inaccurate or incomplete data. Under certain circumstances, for example where the accuracy of data is disputed, you may request restriction of processing until the accuracy has been verified, meaning that the data may only be processed with your consent, for the establishment, exercise or defence of legal claims, for the protection of the rights of another natural or legal person, or for reasons of important public interest.

3. Right to Data Portability

You may request that SPORT BRÜNDL provide you – or, where technically feasible, a third party designated by you – with a copy of the data you have provided in a structured, commonly used and machine-readable format. You also have the right to transmit this data to another controller without hindrance from the controller to which the personal data was originally provided, provided that:

(1) the processing is based on consent pursuant to Article 6(1)(a) GDPR or Article 9(2)(a) GDPR, or on a contract pursuant to Article 6(1)(b) GDPR; and

(2) the processing is carried out by automated means.

In exercising this right, you also have the right to have your personal data transmitted directly from SPORT BRÜNDL to another controller, where technically feasible. The rights and freedoms of other persons must not be adversely affected by this.

4. Right to Erasure

You have the right to request the erasure of data under certain circumstances, for example where the data is not processed in accordance with data protection requirements.

The so-called “right to be forgotten” does not apply to you because SPORT BRÜNDL does not make your personal data publicly available under any circumstances.

Where you have exercised your right to rectification, erasure or restriction of processing against SPORT BRÜNDL, we are obliged to notify all recipients to whom your personal data has been disclosed of such rectification, erasure or restriction of processing, unless this proves impossible or involves disproportionate effort.

5. Right to Object

You have the right, on grounds relating to your particular situation, to object at any time to the processing of personal data concerning you which is based on Article 6(1)(e) or (f) GDPR; this also applies to profiling based on those provisions.

In such a case, SPORT BRÜNDL shall no longer process the personal data concerning you unless we can demonstrate compelling legitimate grounds for the processing which override your interests, rights and freedoms, or unless the processing serves the establishment, exercise or defence of legal claims.

6. Right to Withdraw Consent under Data Protection Law

You have the right to withdraw your consent to the processing of personal data at any time.

The withdrawal of consent shall not affect the lawfulness of processing carried out on the basis of consent before its withdrawal.

7. Supervisory Authority

Without prejudice to the possibility of bringing an action before the competent Regional Court pursuant to Section 29(2) of the Austrian Data Protection Act (Datenschutzgesetz) and any other legal remedies, you have the right to lodge a complaint with the national supervisory authority of your place of residence if you believe that your personal data is being processed unlawfully.

In Austria, the competent supervisory authority is the Austrian Data Protection Authority (Österreichische Datenschutzbehörde), Vienna.

1. Recht auf Auskunft

Sie haben gegenüber SPORT BRÜNDL das Recht auf Auskunft über alle Daten zu Ihrer Person, die von SPORT BRÜNDL verarbeitet werden. Im Einzelnen können Sie von SPORT BRÜNDL über folgende Informationen Auskunft verlangen:

(1)    die Zwecke, zu denen die personenbezogenen Daten verarbeitet werden;
(2)    die Kategorien von personenbezogenen Daten, welche verarbeitet werden;
(3)    die Empfänger bzw. die Kategorien von Empfängern, gegenüber denen die Sie betreffenden personenbezogenen Daten offengelegt wurden oder noch offengelegt werden;
(4)    die geplante Dauer der Speicherung der Sie betreffenden personenbezogenen Daten oder, falls konkrete Angaben hierzu nicht möglich sind, Kriterien für die Festlegung der Speicherdauer.
(5)    das Bestehen eines Rechts auf Berichtigung oder Löschung der Sie betreffenden personenbezogenen Daten, eines Rechts auf Einschränkung der Verarbeitung durch den Verantwortlichen oder eines Widerspruchsrechts gegen diese Verarbeitung; 
(6)        das Bestehen eines Beschwerderechts bei einer Aufsichtsbehörde;
(7)    alle verfügbaren Informationen über die Herkunft der Daten, wenn die personenbezogenen Daten nicht bei der betroffenen Person erhoben werden;
(8)    das Bestehen einer automatisierten Entscheidungsfindung einschließlich Profiling gemäß Art 22 Abs 1 und 4 DSGVO und – zumindest in diesen Fällen – aussagekräftige Informationen über die involvierte Logik sowie die Tragweite und die angestrebten Auswirkungen einer derartigen Verarbeitung für die betroffene Person.

Ihnen steht das Recht zu, Auskunft darüber zu verlangen, ob die Sie betreffenden personenbezogenen Daten in ein Drittland oder an eine internationale Organisation übermittelt werden. In diesem Zusammenhang können Sie verlangen, über die geeigneten Garantien gem. Art 46 DSGVO im Zusammenhang mit der Übermittlung unterrichtet zu werden.

2.    Recht auf Richtigstellung und Recht auf Einschränkung der Verarbeitung 

Sie können die Berichtigung oder Vervollständigung unrichtiger oder unvollständiger Daten verlangen. Sie können unter bestimmten Umständen, beispielsweise, wenn die Richtigkeit von Daten streitig ist, bis die Richtigkeit überprüft worden ist, eine Einschränkung der Verarbeitung von Daten dahingehend verlangen, dass diese nur mit Ihrer Einwilligung oder zur Geltendmachung, Ausübung oder Verteidigung von Rechtsansprüchen oder zum Schutz der Rechte einer anderen natürlichen oder juristischen Person, oder aus Gründen eines wichtigen öffentlichen Interesses verarbeitet werden dürfen. 

3.    Recht auf Datenübertragbarkeit

Sie können verlangen, dass SPORT BRÜNDL Ihnen - oder soweit dies technisch machbar ist, einem von Ihnen bestimmten Dritten - eine Kopie der von Ihnen bereitgestellten Daten in einem strukturierten, gängigen und maschinenlesbaren Format übersendet. Außerdem haben Sie das Recht diese Daten einem anderen Verantwortlichen ohne Behinderung durch den Verantwortlichen, dem die personenbezogenen Daten bereitgestellt wurden, zu übermitteln, sofern

(1)    die Verarbeitung auf einer Einwilligung gem Art 6 Abs 1 lit a DSGVO oder Art 9 Abs 2 lit a DSGVO oder auf einem Vertrag gem Art 6 Abs 1 lit b DSGVO beruht, und
(2)    die Verarbeitung mithilfe automatisierter Verfahren erfolgt.

In Ausübung dieses Rechts haben Sie ferner das Recht, zu erwirken, dass die Sie betreffenden personenbezogenen Daten direkt von SPORT BRÜNDL einem anderen Verantwortlichen übermittelt werden, soweit dies technisch machbar ist. Freiheiten und Rechte anderer Personen dürfen hierdurch nicht beeinträchtigt werden.

4.    Recht auf Löschung

Sie haben das Recht auf Löschung von Daten unter bestimmten Umständen, etwa wenn diese nicht gemäß den Datenschutzanforderungen verarbeitet werden. 

Das sogenannte „Recht auf Vergessenwerden“ findet auf Sie keine Anwendung, weil SPORT BRÜNDL Ihre personenbezogenen Daten auf keinen Fall öffentlich macht. 

Haben Sie das Recht auf Berichtigung, Löschung oder Einschränkung der Verarbeitung gegenüber SPORT BRÜNDL geltend gemacht, sind wir verpflichtet, allen Empfängern, denen die Sie betreffenden personenbezogenen Daten offengelegt wurden, diese Berichtigung oder Löschung der Daten oder Einschränkung der Verarbeitung mitzuteilen, es sei denn, dies erweist sich als unmöglich oder ist mit einem unverhältnismäßigen Aufwand verbunden.

5.    Recht auf Widerspruch

Sie haben das Recht, aus Gründen, die sich aus ihrer besonderen Situation ergeben, jederzeit gegen die Verarbeitung der Sie betreffenden personenbezogenen Daten, die aufgrund von Art 6 Abs 1 lit e oder f DSGVO erfolgt, Widerspruch einzulegen; dies gilt auch für ein auf diese Bestimmungen gestütztes Profiling. SPORT BRÜNDL verarbeitet die Sie betreffenden personenbezogenen Daten in diesem Fall nicht mehr, es sei denn, wir können zwingende schutzwürdige Gründe für die Verarbeitung nachweisen, die Ihre Interessen, Rechte und Freiheiten überwiegen, oder die Verarbeitung dient der Geltendmachung, Ausübung oder Verteidigung von Rechtsansprüchen.

6.    Recht auf Widerruf der datenschutzrechtlichen Einwilligungserklärung

Sie haben das Recht, Ihre datenschutzrechtliche Einwilligungserklärung jederzeit zu widerrufen. Durch den Widerruf der Einwilligung wird die Rechtmäßigkeit der aufgrund der Einwilligung bis zum Widerruf erfolgten Verarbeitung nicht berührt.

7.    Aufsichtsbehörde

Ungeachtet der Möglichkeit einer Klage beim Landesgericht nach § 29 Abs 2 Datenschutzgesetz und etwaiger anderer Rechtsbehelfe besteht das Recht auf Beschwerde bei der nationalen Aufsichtsbehörde Ihres Aufenthaltsortes, wenn eine unrechtmäßige Verarbeitung personenbezogener Daten angenommen wird. In Österreich ist die Österreichische Datenschutzbehörde, Wien, zuständig.