Legal
Privacy Policy
Which data we process, how we protect it — and what rights you have as a data subject.
Controller
- Company
- Intersport Ladner, Ladner Josef GmbH
- Address
- Dorf 112, 6555 Kappl, Austria
- Phone
- +43 5445 6151
- info [at] skiverleih-kappl [dot] at
Which data we process
Server logs: When you access our website, technical data (IP address, browser, time, page accessed) is automatically recorded and stored. These server logs are stored only for as long as necessary for secure operation and the analysis of technical faults, and are deleted regularly thereafter. Legal basis: legitimate interest in secure operation (Art. 6(1)(f) GDPR).
Contact requests: Emails or telephone enquiries are processed in order to handle your request. Legal basis: pre-contractual measures or legitimate interest (Art. 6(1)(b) and (f) GDPR). Your enquiry is deleted once it has been conclusively handled and no statutory retention obligations apply.
External services
Fonts (locally hosted): The fonts used on this website (Barlow) are delivered exclusively locally from our server (self-hosted). No connection to Google Fonts or any other external font service is established; no transfer of your IP address or other data to Google takes place as a result.
INTERSPORT Rent (booking): Online reservation is handled via the booking system of INTERSPORT Rent (intersport-rent.at). When you click “Book online”, you leave this website. The privacy policy of INTERSPORT Rent then applies.
Partner ID: Links to the booking system intersportrent.at carry a partner identifier (partid) that solely identifies our business as the referring website. It contains no data about you and sets no cookies.
Cloudflare (hosting): This website is hosted via Cloudflare Pages. The provider is Cloudflare, Inc. (101 Townsend Street, San Francisco, CA 94107, USA), represented in the EU by Cloudflare Germany GmbH (Rosental 7, c/o Mindspace, 80331 Munich). On access, technical data (IP address, browser, time) is transferred to Cloudflare’s globally distributed edge network and processed in server logs. Requests from the EU are typically served by the EU edge network (incl. Frankfurt, Vienna, Amsterdam). Any transfer to the USA takes place on the basis of the Standard Contractual Clauses (SCCs) and the EU-US Data Privacy Framework. Legal basis: legitimate interest in secure operation of the website (Art. 6(1)(f) GDPR). Privacy policy: cloudflare.com/privacypolicy.
Snow and weather data (GeoSphere Austria): For the current snow depth and temperature shown on our pages, your browser retrieves data from GeoSphere Austria (Bundesanstalt für Geologie, Geophysik, Klimatologie und Meteorologie, Hohe Warte 38, 1190 Vienna, Austria; dataset.api.hub.geosphere.at) when the page loads. Your IP address is transmitted to GeoSphere as a technical necessity. No cookies are set and no user profiles are created. Legal basis: our legitimate interest in providing up-to-date information to our guests (Art. 6(1)(f) GDPR).
Resend (mail delivery for the contact form): The contact form at /kontakt/ first sends the data you enter (name, email, optionally phone, location reference, message) to our server (Cloudflare Worker in the edge network), which delivers the message via the service Resend (Resend, Inc., 2261 Market Street #5039, San Francisco, CA 94114, USA) by email to our mailbox. Resend processes the mail content and technical metadata (IP address, timestamp) in the EU region Frankfurt. Transfer to the USA takes place on the basis of the Standard Contractual Clauses and the EU-US Data Privacy Framework. Legal basis: pre-contractual measures or legitimate interest in handling your request (Art. 6(1)(b) and (f) GDPR). Privacy policy: resend.com/legal/privacy-policy.
Spam protection for the contact form: To prevent automated form submissions, our Cloudflare Worker checks the Origin header of incoming requests and limits the number of submissions per IP address (max. 3 per hour). This check is performed server-side in the edge network; IP addresses are held only briefly in the Worker’s memory and are not stored persistently. Legal basis: legitimate interest in preventing spam and abuse (Art. 6(1)(f) GDPR).
Google Analytics 4 (category “Statistics”): We use Google Analytics 4, a service of Google Ireland Limited (Gordon House, Barrow Street, Dublin 4, Ireland; parent company Google LLC, USA), to understand how our website is used (e.g. pages viewed, approximate region, device type). Google Analytics is loaded exclusively after your active consent to the category “Statistics” — before consent, no script from Google is loaded, no cookie is set and no connection to Google is established. Only afterwards does Google Analytics set cookies (incl. _ga, _ga_*, storage period up to 2 years) and process your IP address, which, according to Google, is used only for approximate location and is not stored in the GA4 reports. The category “Statistics” activates no advertising functions — these depend solely on the “Marketing” consent (see next paragraph). Legal basis: your consent (Art. 6(1)(a) GDPR). You can withdraw your consent at any time with effect for the future — via the “Cookie settings” link in the footer or by deleting the cookies in your browser. Any transfer to the USA takes place on the basis of the Standard Contractual Clauses (SCCs) and the EU-US Data Privacy Framework (Google is certified). Privacy policy: policies.google.com/privacy.
Marketing — Google Ads, remarketing & Google signals (category “Marketing”): Only if you consent to the category “Marketing” do we activate Google’s advertising functions. Via Google signals, Google Analytics can then use data of signed-in Google users for cross-device and demographic analyses (age, gender, interests), and remarketing audiences can be formed which we use for advertising via Google Ads. Technically, the consent signals ad_storage, ad_user_data and ad_personalization are released. Without your marketing consent, these functions remain fully deactivated. Legal basis: your consent (Art. 6(1)(a) GDPR), revocable at any time via “Cookie settings”. Any transfer to the USA takes place on the basis of the Standard Contractual Clauses and the EU-US Data Privacy Framework. Privacy policy: policies.google.com/privacy. To measure the success of our Google Ads campaigns we pass on — only with your marketing consent — the click ID that Google appends to the URL (gclid, gbraid, wbraid) to the booking system intersportrent.at (INTERSPORT Austria Gesellschaft m.b.H., Flugplatzstraße 10, 4600 Wels, Austria) so that reservations completed there can be attributed to the ad. The ID is not stored on our website; it is only handed over within the current visit. In addition — likewise only with your marketing consent — we load Google Tag Manager (Google Ireland Limited), which runs solely the “Conversion Linker” tag. It sets the first-party cookies _gcl_au and _gcl_aw (storage period 90 days each) on our domain and passes the click ID on to the booking system intersportrent.at as a URL parameter (_gl) when you switch to it, so that the reservation can be attributed to the ad across domains. Tag Manager is not loaded before consent; after a withdrawal no new cookies are set, and existing ones expire after 90 days at the latest or can be deleted in your browser. Legal basis: your consent (Art. 6(1)(a) GDPR), revocable at any time via “Cookie settings”.
Cookies
We set technically necessary cookies (session functionality) and the storage of your cookie choice and language choice without separate consent. Statistics cookies (Google Analytics) and marketing cookies (Google Ads/remarketing, Google signals, Conversion Linker via Google Tag Manager) are each set only after your active, separate consent via the cookie banner — otherwise the website remains cookie- and tracking-free. You can allow or refuse each category individually and change your choice at any time via “Cookie settings”.
Your rights (Art. 15–22 GDPR)
You have the right at any time to:
- access to the data stored about you
- rectification of inaccurate data
- erasure (“right to be forgotten”)
- restriction of processing
- data portability
- objection to the processing
Please address your request to info [at] skiverleih-kappl [dot] at.
In addition, you can withdraw any consent given (e.g. for statistics or marketing cookies) at any time with effect for the future — via the “Cookie settings” link in the footer. The lawfulness of processing carried out before the withdrawal remains unaffected (Art. 7(3) GDPR).
Supervisory authority
You have the right to lodge a complaint with the data protection authority:
Österreichische Datenschutzbehörde (Austrian Data Protection Authority), Barichgasse 40–42, 1030 Vienna.
Last updated: June 2026