Privacy Policy for the jennerbahn.de website and the use of Jennerbahn (as at: October 2024)
Thank you for your interest in Berchtesgadener Bergbahn AG (“BB AG”), its website at the URL https://www.jennerbahn.de (hereinafter referred to as the “Website”) and its other services. Below we inform you in detail about the handling of your data that we collect in connection with the operation of our website.
I. Responsible persons
The controller within the meaning of data protection law is:
Berchtesgadener Bergbahn AG (“BB AG” or “we”)
Jennerbahnstr. 18
83471 Schönau am Königssee
Executive Board: Thomas Mühlthaler
Tel: 08652 95810
E-Mail: info@jennerbahn.de
II. Data protection officer
You can reach our data protection officer at the following e-mail address: datenschutz@jennerbahn.de
III. Data processing operations
1. Calling up our website
Personal data:
You can visit our website without providing any personal information. We temporarily store your access data, which is summarized in a log file on our web servers. The access data includes the following information:
- IP address of the requesting end device,
- Date and time of access,
- Name and URL of the retrieved file,
- Amount of data transferred,
- Message indicating whether the retrieval was successful,
- Recognition data of the browser and operating system used,
- The website from which our website is accessed and
- Name of your Internet access provider.
Purpose of data processing:
Every visit to the website is logged by us. In particular, IP addresses and user IDs are logged and stored in order to optimize the user-friendliness of the website. The aforementioned data is technically necessary to enable your device to access our website and use its functions.
Legal basis:
The data is collected for pre-contractual purposes, if you wish to purchase tickets, or in our legitimate interest in showing you the content of this website (Art. 6 (1), sentence 1 b), f) GDPR).
Recipient:
The recipient of the data is our host provider ALL-INKL.COM – Neue Medien Münnich, Friedersdorf.
Storage duration:
The log file data is stored on our servers for up to 14 days after collection. If services are purchased via the website (e.g. a ticket purchase or a voucher purchase), the generated IP address is stored in accordance with the periods specified under III. 2. and III. 5.
2. Purchase tickets for the Jennerbahn via the website
Personal data:
To order tickets via our website, all you need to do is enter your e-mail address and payment details. Payment can be made with VISA and Mastercard credit cards as well as VPay and Maestro. Payments are made via the payment service provider hobex AG (“hobex”), Salzburg, Austria (hobex.at). We do not receive any bank details in this respect.
Purpose of data processing:
If you want to use the Jennerbahn alone or as a family/group, you will need a ticket. You can purchase certain tickets on our website in the store area.
Legal basis:
Data processing is carried out for pre-contractual purposes for the conclusion and execution of a ticket contract (Art. 6 para. 1 sentence 1 b) GDPR).
Recipient:
The recipient of the payment data is the credit institution of the bank card you use.
Storage duration:
Data storage takes place within the framework of the legal regulations of 6-10 years (§§ 257 HGB, 147 AO). The details of your bank card will be deleted by hobex as soon as the paid transaction has been successfully completed and confirmed.
3. Purchase of tickets on site (especially season ticket or annual pass)
Personal data:
When purchasing tickets on site, you do not need to provide an e-mail address, unlike when purchasing tickets online. Your payment details will be processed as stated above under III.2.
When you purchase a season or annual pass, we collect your name, date of birth and address and take and store a photo of you.
Proof of age for a corresponding discount may require the presentation of an ID card. This will only be viewed by the relevant employee, but not saved.
Purpose of data processing:
Data is processed in order to issue you with the desired ticket. When purchasing a season or annual ticket, you are personally registered in our system and can therefore receive a replacement if you lose it.
Legal basis:
The data processing is carried out for pre-contractual purposes for the conclusion and execution of a ticket contract (Art. 6 para. 1 sentence 1 b) GDPR).
Recipient:
The recipient of the payment data is the credit institution of the bank card you use.
Storage duration:
Data is stored for 6-10 years in accordance with the statutory provisions (§§ 257 HGB, 147 AO). Your bank card details will be deleted as soon as the paid transaction has been successfully completed and confirmed.
4. Ticket use and photocompare
Personal data:
If you want to use the Jennerbahn with your ticket, you must pass through the passage at the lift facilities. To do this, you must hold the barcode printed on your ticket in the scanner. The barrier will then clear the passage. In addition, a reference photo is taken at some turnstiles when you use the lift for the first time. This photo is randomly checked by the lift staff on subsequent uses by comparing it each time the turnstile is passed through. This enables us to ensure that the tickets are used in accordance with the rules.
Purpose of data processing:
Data processing is carried out to enable you to use the Jennerbahn and to ensure that no unauthorized tickets have been passed on to third parties.
Legal basis:
Your data will be processed for contractual purposes for the execution of the ticket contract in accordance with the rules (Art. 6 para. 1 sentence 1 b) GDPR) and in our legitimate interest to prevent damage and avoid or detect fraud (Art. 6 para. 1 sentence 1 f) GDPR).
Recipient:
The recipient of the data is Seilbahnverbund Berchtesgadener Land GmbH & Co KG. If you use a ski association card, the time and place of access to the lift pass will be shared with these other ski areas for billing purposes.
Storage duration:
Data is stored in accordance with the statutory provisions; data is deleted when it is no longer required. If a criminal offense is suspected, the data may be stored until the facts of the case have been clarified or the proceedings have been fully concluded.
5. Purchase of vouchers via the website
You also have the opportunity to purchase vouchers for yourself or third parties for various BB AG services in our “Voucher World”.
Personal data:
If you would like to use the Jennerbahn (including other services) with a voucher, we store:
- To the giver/purchaser: first and last name, payment details, and e-mail address. The data of the actual voucher user is not required. If you upload photos, we will also store them in order to provide the service you have ordered. If people are recognizable in the photos, please ensure that they agree to data processing for the voucher.
- About the user of the voucher: If you want to use the voucher, no further information is required. When the voucher is redeemed, it is only checked that it has been paid for in full.
In exceptional cases, you have the option of reassigning the voucher and using it for services other than those ordered. If this requires the conclusion of a new contract, further personal data may be collected insofar as it is required for this new contract.
Purpose of data processing:
The purpose of data processing is to give you the opportunity to purchase and redeem a voucher.
Legal basis:
Your data will be processed for contractual purposes in order to enable you to purchase a voucher, redeem it and use the services of BB AG (Art. 6 para. 1 sentence 1 b) GDPR).
Recipient:
The recipient of the data is INCERT eTourismus GmbH & Co KG based in Linz, Austria, which creates the vouchers for us. The privacy policy of this company can be found here: https://www.incert.at/en/data-protection/. Austria is a safe third country within the meaning of Art. 13 para. 1 f) GDPR.
Storage duration:
We store the data collected for the voucher within the statutory retention periods of 6-10 years (§§ 257 HGB, 140 AO). We delete other personal data, such as your uploaded photo, immediately after the voucher has been created and sent. Only the pure voucher data remains in our system for the validity period of 3 years.
6. Our contact form on the website
Personal data:
You can use our contact form to send us messages and questions. The data you enter in the contact form (name, e-mail address, message and, if applicable, subject) will first be transmitted to us as the controller.
Purpose of data processing:
We use your data to answer your contact request and to follow up on your request after receiving certain information.
Legal basis:
The legal basis for the processing of the data is our legitimate interest in responding to your request in accordance with Art. 6 para. 1 f) GDPR (legitimate interest in responding to inquiries). If your contact is aimed at the conclusion of a contract, the legal basis for data processing is Art. 6 para. 1 b) GDPR with regard to the conclusion of a contract, e.g. for the purchase of a ticket or a voucher.
Storage duration:
In order to process your request, your data will be stored until your request has been fully processed and deleted after the purpose has ceased to apply. This is the case when it can be inferred from the circumstances that the matter in question has been conclusively clarified. This does not apply to data that is required for other purposes, such as billing and accounting purposes, or that is subject to statutory retention requirements; the duration of storage of this personal data is governed by § 257 HGB and § 147 AO.
7. Contact us by e-mail or telephone
Personal data:
If you contact us by e-mail or telephone, we process the contact details you provide (e-mail address or telephone number) as well as other data you provide, such as your name and your request.
Purpose of data processing:
If you contact us, we will be happy to respond to your request and process your inquiry and the data you have provided.
Legal basis:
The legal basis for the processing of the data is our legitimate interest in responding to your request in accordance with Art. 6 para. 1 f) GDPR (legitimate interest in responding to inquiries). If your contact is aimed at the conclusion of a contract, the legal basis for data processing is Art. 6 para. 1 b) GDPR with regard to the conclusion of a contract, e.g. for the purchase of a ticket or a voucher.
Recipient:
If you make a booking as a group, we will leave tickets and/or a delivery bill at the desired location (usually a hotel) on request. The contact person at the desired location will provide you with the relevant documents if you state your name.
If you make a booking in the Jenneralm restaurant by contacting us, we will pass on your reservation to the Jenneralm Gastro team. The restaurant is operated by Jenneralm GmbH.
Storage duration:
In order to process your request, your data will be stored until your request has been fully processed and deleted after the purpose has ceased to apply. This is the case when it can be inferred from the circumstances that the matter in question has been conclusively clarified. This does not apply to data that is required for other purposes, such as billing and accounting purposes, or that is subject to statutory retention requirements; the duration of storage of this personal data is governed by § 257 HGB and § 147 AO.
8. Applications / Jobs on the mountain
You can use the “Jobs on the mountain” link to find out about current vacancies at BB AG. It is not possible to apply online via the website. If you are interested in a specific position that we have advertised on the website, or in general, you can send us a message at the e-mail address info@jennerbahn.de or send us your application directly. In this respect, please ensure that your personal data is adequately protected.
Personal data:
To process your application, we use all personal data that you provide to us. This includes in particular your name, your address, your gender, and your education.
We also reserve the right to view information about you that is generally and publicly accessible on the Internet by entering your name and to use this information in your application, e.g. as a question in a job interview.
Purpose of the processing:
All data you provide us with will be used to process your application and thus for pre-contractual purposes and for a possible employment relationship. The e-mail address is required in order to be able to confirm receipt of your application immediately. Contact details are used to get in touch with you, e.g. to arrange an interview.
Your personal data will be processed in order to enable you to participate in our application process.
Legal basis:
Your application data is processed on the basis of Art. 6 para. 1 b) GDPR, § 26 BDSG.
Storage duration:
Your applicant data will be stored for 6 months after the desired training place or position has been awarded or, in the case of an unsolicited application, after rejection. Immediately after the award of the training place or position, the data of applicants (m/f/d) who have not been awarded the contract will be blocked for any use other than the clarification of applicant claims. In the case of unsolicited applications, the data will be blocked after rejection. Any further storage and use of applicant data will only take place if you have given us your express consent to the further storage of your applicant data or in the case of a legitimate interest of BB AG, e.g. in the case of a burden of proof in legal proceedings. If an employment or training contract is concluded with an applicant, the data will be stored and processed for the implementation and processing of the employment relationship and thus for contractual purposes.
IV. Services on the website
1. Services from Google
The Google services listed here are offered by Google Ireland Limited (“Google”). You can change the privacy settings for your Google account here: Google Privacy Settings.
Google’s privacy policy can be found here: Google Privacy Policy.
Google stores the data in Germany, but reserves the right to also process the data on servers in the USA. The USA is currently considered a country with an adequate level of data protection (see adequacy decision of the EU Commission of 10.07.2023, C (2023) 4745 final), and Google LLC USA has certified itself accordingly: Privacy Framework of Google LLC.
1.1 Google Maps
This website contains maps from Google Maps to display geographical information. When you access the website, Google makes a request (so-called third-party request) and establishes a connection with its server by collecting the IP number. If you are logged in to Google when you use the website, Google may link this data to your account. We would like to point out that, as the provider of the website, we have no influence on the collection and use of data by Google. The additional terms of use for Google Maps and Google Earth apply: Terms of Use for Google Maps.
We are joint controllers with Google and have concluded a joint control agreement (Google Controller-Controller Data Protection Terms, available at the URL: Google Joint Control Agreement) specified by Google via our account with Google.
Summary of the Joint Control Agreement with Google:
- Each party is responsible for ensuring that there is a legal basis for the respective data processing.
- Data subject rights are implemented by Google insofar as this does not involve exclusive data processing by us. However, you can contact us and/or Google to assert your rights as a data subject.
- The reporting of data protection violations in accordance with Art. 33 GDPR is handled by Google. We are obliged to report immediately if a data protection breach is suspected.
1.2 Google Analytics
We use Google Analytics, a web analysis service from Google, which enables us to analyze your use of the website. This service sets cookies if you have expressly consented to this via our cookie banner. The legal basis for the use of the service is therefore your consent (Art. 6 para. 1 sentence 1 a) GDPR).
The information generated by the cookie about your visit to this website will be transmitted to and stored by Google on servers in the United States. Google uses this information for the purpose of evaluating your use of the website, compiling reports on website activity for us and providing us with other services relating to website activity and internet usage. We are joint controllers with Google and have entered into a joint control agreement with Google via our Google account (see Section IV.1.1 above for further information on this agreement).
The IP address is automatically recorded only in anonymized form.
You can also prevent the storage of cookies by selecting the appropriate settings in your browser. You can also prevent Google from collecting the data generated by the cookie and relating to your use of our website (including your IP address) and from processing this data by Google by downloading and installing the browser plug-in available at the following link: Google Analytics Opt-Out.
Alternatively, you can prevent the collection and use of your data by Google by clicking on the following link: Deactivate Google Universal Analytics.
Clicking this link sets an opt-out cookie that prevents your data from being collected by Google. You can find more information about Google’s terms of use and privacy policy for this service at the following links:
Data is collected by Google in particular from users of a Gmail account, as Google is also the operator here. You can change your advertising settings for this at Google Advertising Settings so that activities and information are no longer collected for personalized advertising.
1.3 YouTube
The YouTube icon takes you to the YouTube channel of Berchtesgaden, which is operated by the Zweckverband Bergerlebnis Berchtesgaden, of which BB AG is also a member. The video channel can be accessed at the following URL: https://www.youtube.com/channel/UCZqWkxTjRrDcJZjxiUpfoSA.
The provider of the corresponding website at https://www.youtube.com is Google. If you are active on YouTube and use functions such as sharing, posting or liking posts, you do so on your own responsibility and on the basis of your own user relationship with Google. As things stand at present, there is no joint responsibility on the part of Google and the above-mentioned special-purpose association.
YouTube’s terms of use are available here: YouTube Terms of Use, the privacy policy can be viewed here: Google Privacy Policy.
2. Cookies
We use cookies for the use of our website. Cookies are small files that are stored on users’ computers. Different information can be stored within the cookies. A cookie is primarily used to store information about a user (or the device on which the cookie is stored) during or after their visit to an online service.
Cookie management is carried out by Usercentrics GmbH (hereinafter referred to as “UserCentrics”) in Munich as a processor. We have concluded a corresponding data processing agreement with UserCentrics for this purpose.
All cookies are displayed via the banner and you have the choice, depending on the function of the cookies. Cookies that are technically necessary for the operation of our website are automatically set without your consent in our legitimate interest in the proper operation of the website (Art. 6 para. 1 f) GDPR).
For the “Preferences”, “Statistics” and “Marketing” functions, you have the choice and your consent is required (Art. 6 para. 1 a) GDPR). Under the “Details” tab, you will be informed about the respective cookies and their storage duration as well as the providers. You can also find this information in our cookie policy at the URL https://www.jennerbahn.de/en/cookie-policy.
3. Webcam
We have installed a camera at certain points at the top of the Jennerbahn. You can view images from these cameras via the “Webcam” tab on our website.
Personal data:
If you are in the camera’s field of vision, we may receive image data of your person.
Purpose of data processing:
Processing is carried out to display the landscape, in particular to inform users about weather conditions.
Legal basis:
The presentation is in our legitimate interest to give users of the website an impression of the landscape and the current conditions (Art. 6 para. 1 f) GDPR).
Recipient:
The recipient of the data is any user who views the webcams via the corresponding tab.
Storage duration:
The video sequences are each 53 seconds long. Between 3 and 6 sequences are recorded per hour. The video sequences are stored for 48 hours. They are then deleted. However, one sequence per day is saved for archiving and documentation purposes. Users have the option of forwarding the link to the webcam via Facebook, X, Email Videos and WhatsApp or downloading the video via “Video download”.
The recipient of the data is also feratel media technologies AG, Innsbruck, Austria, which acts as a technical service provider for us.
The data is not saved. However, users have the option of downloading a short sequence of the webcam via the “Video Download” tab. It is also possible to forward the link to the webcam via Meta (Facebook), e-mail, X or WhatsApp.
4. Social media
Social bookmarks with the logos of Meta (Facebook), Instagram and YouTube (see section IV.1.3) are stored on our website. Social bookmarks are internet links to a company’s channels on social networks.
If you are logged in to one of the aforementioned networks at the same time as using our website, no automatic data transfer takes place. A direct connection is only established between your browser and the server of the selected social media service when you activate the respective button by clicking on it. As a result, the network provider receives the information that you have accessed our website with your IP address and wish to share the page you visited on the corresponding social network.
4.1 Facebook (Meta)
The Facebook page for the Jennerbahn can be found at the following URL: https://www.facebook.com/Jennerbahn.
There is a joint responsibility of two parties: On the one hand, BB AG is responsible for the data processing described below on our Facebook page. BB AG is only solely responsible if it processes the data itself. On the other hand, Meta Platforms Ireland Ltd, 4 Grand Canal Square Grand Canal Harbour, Dublin 2 Ireland (hereinafter referred to as “Meta”) is responsible as the operator of the platform. You can contact Meta’s data protection officer by using the Meta form on the website with the URL https://www.facebook.com/help/contact/540977946302970.
Meta has concluded a Controller Addendum with all site providers and also with us, which can be viewed here: https://www.facebook.com/legal/terms/page_controller_addendum.
This so-called “Page Insights Controller Addendum” represents an extension of the terms of use which Meta alone stipulates for the use of its services. We have no influence on the content of this agreement.
Details on the processing procedures can be found in Meta’s terms of use and privacy policy:
4.2 Instagram
BB AG also operates a channel on Instagram under the URL https://www.instagram.com/jennerbahn/. This service is also operated by Meta. The provisions set out in Section IV.4.1 apply. If you click on the Instagram logo, you will be redirected directly to our channel and Meta will learn that you came from our website. If you are logged in to Instagram, Meta can assign this information to your user account; otherwise, you remain anonymous.
Details on the processing procedures can be found in Meta’s terms of use and privacy policy for this service:
V. Legal and contractual obligations to provide
The provision of your data as described in this privacy policy is neither contractually nor legally required. However, without the provision of applicant data, we will not be able to consider your application, nor will we be able to respond to your inquiry without a contact date. Furthermore, the provision of the specified mandatory data is required to order and receive certain services from BB AG.
VI. Your rights (objection, revocation, information, rectification, restriction of processing, erasure, transfer, complaint)
1. Contradiction
You can object to the processing of your personal data by us at any time for reasons arising from your particular situation. To do so, you can use the contact options listed in sections I. and II. If we process your personal data for the purpose of direct marketing, you have the right to object at any time to the processing of your personal data for the purpose of such marketing. You can exercise your objection as described in this section.
If you object, we will no longer process your personal data unless we can demonstrate compelling legitimate grounds for the processing which override your interests, rights and freedoms.
2. Revocation
Furthermore, you have the right to revoke any consent you have given with effect for the future. However, the legality of the data processing based on your consent remains unaffected until you exercise your right to withdraw your consent.
3. Other rights
You have the right to receive information about your personal data stored by us free of charge at any time, to correct incorrect data and to have the processing of your data restricted or deleted. You also have the right to receive your data in a structured, commonly used and machine-readable format and to have your data transferred by us to someone else. Finally, you have the right to lodge a complaint with a data protection authority.
Measures in connection with automated decision-making in individual cases, including profiling (Art. 22 GDPR): In certain cases, you have the right to obtain human intervention on the part of the controller, to express your point of view and to contest the decision.
With the exception of your right to lodge a complaint with the data protection authority, you can address your respective concerns to us using the contact details provided in sections I. and II.
VII. Data security
This website is SSL-encrypted to protect your data. BB AG also takes appropriate technical and organizational measures in accordance with Art. 32 GDPR, taking into account the state of the art, the costs of implementation and the nature, scope, context and purposes of processing as well as the likelihood and severity of the risk to the rights and freedoms of natural persons. Furthermore, the confidentiality, integrity, availability and resilience of the systems and services in connection with the processing and the rapid restoration of the availability of personal data in the event of a physical or technical incident are ensured.
Please be aware that while we endeavor to provide a secure and reliable website for users, the absolute confidentiality of any communication or material transmitted to or from our website cannot be guaranteed.
