The short version, so you do not have to read all of it: this website sets
no advertising and no tracking cookies. There is no Google
Analytics, no Facebook pixel, and your data is never shared for marketing.
That is exactly why you see no cookie banner here. What we do process, and
why, is below.
1. Who is responsible
The controller for data processing on this website under the General Data
Protection Regulation (GDPR) is:
Arash Bakhshesh
Ski11 Academy
Heiligkreuz 21
6136 Pill, Tyrol
Austria
E-mail: [email protected]
For any privacy question, or to exercise your rights, the
contact form is the easiest route.
The e-mail address above works just as well and reaches the same inbox.
2. The basics
We process personal data only when there is a legal basis for it, and only
for as long as it is needed. Depending on the case, that is one of these
four:
Art. 6(1)(a)
Your consent. For example the quiz result sent by e-mail.
Art. 6(1)(b)
Preparing or performing a contract. For example a training enquiry.
Art. 6(1)(c)
Legal obligations. For example tax retention periods.
Art. 6(1)(f)
Legitimate interest. For example running, securing and measuring the website.
The site is served over an encrypted HTTPS connection only. You can see this
from the padlock in your browser address bar.
3. Server log files and hosting
When you open this website, your browser has to send data to our server,
otherwise the page cannot be delivered. The server records:
- the IP address of the requesting device
- date and time of the request
- the address requested and the amount of data transferred
- whether the request succeeded
- browser type and version, operating system
- the previously visited page, if your browser sends it
Purpose
Technical operation, troubleshooting and defence against attacks.
Legal basis
Art. 6(1)(f) GDPR. Our legitimate interest is keeping the site stable and secure.
Retention
Deleted or anonymised after 30 days at the latest, unless a specific security incident requires keeping them longer.
Where the server is
The server for this website is located in Amsterdam, Netherlands and
is operated by Sharktech. Your data is therefore stored and processed
inside the European Union and does not leave the scope of the GDPR. A data
processing agreement under Art. 28 GDPR is in place.
4. Cloudflare as content delivery network
This website runs through the network of Cloudflare, Inc., 101 Townsend St.,
San Francisco, CA 94107, USA. Cloudflare serves content from a data centre
near you, filters out attacks and provides TLS encryption. Technically this
means your request reaches Cloudflare first and is only then passed to our
server. In doing so, Cloudflare processes your IP address.
Purpose
Security, availability and loading speed.
Legal basis
Art. 6(1)(f) GDPR.
Transfer to the USA
A contract under Art. 28 GDPR is in place. Cloudflare relies on the EU Commission Standard Contractual Clauses and on its certification under the EU-US Data Privacy Framework.
Cloudflare sets no persistent cookies on this website
Only if a request is classified as potentially harmful and answered with a
security challenge may a strictly necessary cookie named
cf_clearance be set. It only remembers that the challenge was
passed, for a short time, and carries no advertising identifier.
Cloudflare privacy policy:
cloudflare.com/privacypolicy
5. Our own analytics, without cookies
No external analytics tool on this website
We want to know which pages get read and whether our content is being
found. For that we use a small piece of code we wrote ourselves that runs
entirely on our own server. No Google Analytics, no other service.
In practice that means:
No cookie
Nothing is stored in your browser and nothing is read from it.
IP is truncated
203.0.113.47 becomes 203.0.113.0 before it is stored. The individual connection can no longer be identified.
Daily pseudonym
Derived from the IP address, browser string, the date and a secret value. It changes every day and cannot be reversed.
What else is stored
Page viewed, language, country at country level, device type, operating system, browser and the referring website.
No sharing
Not with third parties, not for advertising, not combined with any other source.
Retention
Individual page views are deleted after 90 days. After that only an anonymous daily total remains, with no personal reference.
Legal basis: Art. 6(1)(f) GDPR. Our legitimate interest is designing
the website around what visitors actually need. Because nothing is stored on
or read from your device, no consent under the ePrivacy rules is required.
6. Cookies
This website uses exactly one cookie, and it is a strictly necessary one:
ASP.NET_SessionId
Purpose: keeps your session together during your visit, for example
so a submitted form is matched to the right request.
Lifetime: deleted as soon as you close your browser.
Content: a random identifier, no personal data.
Legal basis: strictly necessary, therefore exempt from consent.
We set no advertising, marketing or tracking cookies. That is why this
website has no consent banner. You can delete or block cookies in your
browser at any time. If you do, forms may stop working reliably.
7. Contact and training enquiries
When you write to us through the contact form, by e-mail, WhatsApp or
Telegram, we process what you give us: name, contact details and the content
of your message. For training enquiries this includes your skiing level and
goals, because otherwise we cannot judge which programme fits.
Purpose
Answering your enquiry and preparing a possible training agreement.
Legal basis
Art. 6(1)(b) GDPR for contract-related enquiries, otherwise Art. 6(1)(f) GDPR.
Retention
Until your enquiry is fully dealt with. If a contract is concluded, statutory retention periods of up to seven years apply under Austrian tax law.
About WhatsApp and Telegram
If you contact us through these services, the provider processes your data
under its own terms. We have no influence over that. If you would rather
avoid it, send us an e-mail or use the contact form instead.
8. Ski level quiz and e-mail result
On the homepage you can take a short quiz and have the full result sent to
you by e-mail. For that we need your e-mail address. We also store your
answers, the level identified and the time of the request.
Legal basis
Art. 6(1)(a) GDPR, your consent, given explicitly through the checkbox in the form.
Withdrawal
Possible at any time, without giving a reason. A short e-mail is enough. Processing carried out before the withdrawal remains lawful.
Retention
Until withdrawal, and at most three years after your last interaction.
There is currently no automated newsletter. Your address is never sold,
rented or passed to third parties.
9. YouTube videos, only after your click
Without your click, no connection to YouTube
Videos on this website use a two-click solution. When the page loads you
only see a preview image served from our own server.
Only your click loads the video from YouTube. From that moment Google learns
that you opened this page and receives your IP address. If you are signed in
to a Google account at the same time, Google can link the visit to that
account.
Provider
Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. Transfer to the USA is possible; Google relies on the Standard Contractual Clauses and the EU-US Data Privacy Framework.
Legal basis
Art. 6(1)(a) GDPR. Clicking the preview image is your consent. If you do not click, nothing happens.
Google privacy policy:
policies.google.com/privacy
10. Fonts and external content
All fonts are loaded from our own server. There is no connection to
Google Fonts, and therefore no transfer of your IP address to Google
when the page opens.
The Instagram, WhatsApp and Telegram links in the footer are plain links.
Nothing is loaded from those providers and no data is transferred unless you
click.
11. Who receives your data
We pass on data only where it is necessary to run the service or where we
are legally required to:
Hosting
Sharktech, server in Amsterdam, Netherlands. As a processor under Art. 28 GDPR.
Cloudflare
As a processor for delivery and security.
E-mail provider
For sending and receiving messages.
Tax advisors and authorities
Only where legally required.
We do not sell data. We do not share data for advertising.
12. Your rights
You have the following rights at any time:
Access, Art. 15
Find out whether and what data we hold about you.
Rectification, Art. 16
We must correct wrong data and complete incomplete data.
Erasure, Art. 17
You can request deletion, unless a retention obligation applies.
Restriction, Art. 18
You can have processing temporarily frozen.
Portability, Art. 20
You receive your data in a common, machine-readable format.
Objection, Art. 21
You can object to processing based on legitimate interests.
The contact form or a plain e-mail to
[email protected] is enough for all of this. We reply within one month. We may
need to verify your identity so that we do not hand data to the wrong person.
13. Right to complain
If you believe we are not handling your data correctly, you can complain to
a supervisory authority. Ours is:
Austrian Data Protection Authority
Österreichische Datenschutzbehörde
Barichgasse 40 to 42, 1030 Vienna, Austria
E-mail: [email protected]
www.dsb.gv.at
You may also contact the supervisory authority in your own country of
residence.
14. No automated decision making
There is no automated decision making or profiling within the meaning of
Art. 22 GDPR. The quiz on the homepage matches your answers to one of four
descriptions. That is a simple evaluation with no legal effect, not an
automated decision about you.
15. Minors
Our offering is aimed at adults. Training for children and teenagers is
booked exclusively through a parent or guardian. We do not knowingly collect
data from anyone under 14 through this website.
16. Changes to this policy
We update this policy when our website or the legal situation changes. The
version published here is the one that applies. The date at the top shows
when it was last changed.
Still have a privacy question?
Write to us. You will get a plain answer, not a wall of legal text.
Get in touch