Legal
Privacy Policy
Which data we process, how we protect it — and what rights you have as a data subject.
Controller
- Company
- Intersport Ladner, Ladner Josef GmbH
- Address
- Dorf 112, 6555 Kappl, Austria
- Phone
- +43 5445 6151
- info [at] skiverleih-kappl [dot] at
Which data we process
Server logs: When you access our website, technical data (IP address, browser, time, page accessed) is automatically recorded and stored. These server logs are stored only for as long as necessary for secure operation and the analysis of technical faults, and are deleted regularly thereafter. Legal basis: legitimate interest in secure operation (Art. 6(1)(f) GDPR).
Contact requests: Emails or telephone enquiries are processed in order to handle your request. Legal basis: pre-contractual measures or legitimate interest (Art. 6(1)(b) and (f) GDPR). Your enquiry is deleted once it has been conclusively handled and no statutory retention obligations apply.
External services
Fonts (locally hosted): The fonts used on this website (DM Sans, JetBrains Mono) are delivered exclusively locally from our server (self-hosted). No connection to Google Fonts or any other external font service is established; no transfer of your IP address or other data to Google takes place as a result.
INTERSPORT Rent (booking): Online reservation is handled via the booking system of INTERSPORT Rent (intersport-rent.at). When you click “Book online”, you leave this website. The privacy policy of INTERSPORT Rent then applies.
Cloudflare (hosting): This website is hosted via Cloudflare Pages. The provider is Cloudflare, Inc. (101 Townsend Street, San Francisco, CA 94107, USA), represented in the EU by Cloudflare Germany GmbH (Rosental 7, c/o Mindspace, 80331 Munich). On access, technical data (IP address, browser, time) is transferred to Cloudflare’s globally distributed edge network and processed in server logs. Requests from the EU are typically served by the EU edge network (incl. Frankfurt, Vienna, Amsterdam). Any transfer to the USA takes place on the basis of the Standard Contractual Clauses (SCCs) and the EU-US Data Privacy Framework. Legal basis: legitimate interest in secure operation of the website (Art. 6(1)(f) GDPR). Privacy policy: cloudflare.com/privacypolicy.
Resend (mail delivery for the contact form): The contact form at /kontakt/ first sends the data you enter (name, email, optionally phone, location reference, message) to our server (Cloudflare Worker in the edge network), which delivers the message via the service Resend (Resend, Inc., 2261 Market Street #5039, San Francisco, CA 94114, USA) by email to our mailbox. Resend processes the mail content and technical metadata (IP address, timestamp) in the EU region Frankfurt. Transfer to the USA takes place on the basis of the Standard Contractual Clauses and the EU-US Data Privacy Framework. Legal basis: pre-contractual measures or legitimate interest in handling your request (Art. 6(1)(b) and (f) GDPR). Privacy policy: resend.com/legal/privacy-policy.
Spam protection for the contact form: To prevent automated form submissions, our Cloudflare Worker checks the Origin header of incoming requests and limits the number of submissions per IP address (max. 3 per hour). This check is performed server-side in the edge network; IP addresses are held only briefly in the Worker’s memory and are not stored persistently. Legal basis: legitimate interest in preventing spam and abuse (Art. 6(1)(f) GDPR).
Google Analytics 4 (category “Statistics”): We use Google Analytics 4, a service of Google Ireland Limited (Gordon House, Barrow Street, Dublin 4, Ireland; parent company Google LLC, USA), to understand how our website is used (e.g. pages viewed, approximate region, device type). Google Analytics is loaded exclusively after your active consent to the category “Statistics” — before consent, no script from Google is loaded, no cookie is set and no connection to Google is established. Only afterwards does Google Analytics set cookies (incl. _ga, _ga_*, storage period up to 2 years) and process your IP address, which, according to Google, is used only for approximate location and is not stored in the GA4 reports. The category “Statistics” activates no advertising functions — these depend solely on the “Marketing” consent (see next paragraph). Legal basis: your consent (Art. 6(1)(a) GDPR). You can withdraw your consent at any time with effect for the future — via the “Cookie settings” link in the footer or by deleting the cookies in your browser. Any transfer to the USA takes place on the basis of the Standard Contractual Clauses (SCCs) and the EU-US Data Privacy Framework (Google is certified). Privacy policy: policies.google.com/privacy.
Marketing — Google Ads, remarketing & Google signals (category “Marketing”): Only if you consent to the category “Marketing” do we activate Google’s advertising functions. Via Google signals, Google Analytics can then use data of signed-in Google users for cross-device and demographic analyses (age, gender, interests), and remarketing audiences can be formed which we use for advertising via Google Ads. Technically, the consent signals ad_storage, ad_user_data and ad_personalization are released. Without your marketing consent, these functions remain fully deactivated. Legal basis: your consent (Art. 6(1)(a) GDPR), revocable at any time via “Cookie settings”. Any transfer to the USA takes place on the basis of the Standard Contractual Clauses and the EU-US Data Privacy Framework. Privacy policy: policies.google.com/privacy.
Cookies
We set technically necessary cookies (session functionality) and the storage of your cookie choice without separate consent. Statistics cookies (Google Analytics) and marketing cookies (Google Ads/remarketing, Google signals) are each set only after your active, separate consent via the cookie banner — otherwise the website remains cookie- and tracking-free. You can allow or refuse each category individually and change your choice at any time via “Cookie settings”.
Your rights (Art. 15–22 GDPR)
You have the right at any time to:
- access to the data stored about you
- rectification of inaccurate data
- erasure (“right to be forgotten”)
- restriction of processing
- data portability
- objection to the processing
Please address your request to info [at] skiverleih-kappl [dot] at.
In addition, you can withdraw any consent given (e.g. for statistics or marketing cookies) at any time with effect for the future — via the “Cookie settings” link in the footer. The lawfulness of processing carried out before the withdrawal remains unaffected (Art. 7(3) GDPR).
Supervisory authority
You have the right to lodge a complaint with the data protection authority:
Österreichische Datenschutzbehörde (Austrian Data Protection Authority), Barichgasse 40–42, 1030 Vienna.
Last updated: June 2026