Privacy notice

Controller

Sporthaus Andreas Egger KG

Marktstraße 78, 5661 Rauris, Austria

Phone: +43 660 8500011 · Email: info@sportegger.at

Optional customer account

You can still book without an account. If you register, we store your verified email address. Your password is stored only as a secure hash. Your account shows bookings with the same email address, including earlier guest bookings. We process necessary session and security data for sign-in, email verification and password recovery. Verification links last 30 minutes and sign-in sessions last up to seven days. Resetting your password signs out all previous sessions.

Registration does not subscribe you to a newsletter. Contact info@sportegger.at with questions or to request account deletion; required booking and accounting records are retained separately from the account.

Booking and contract

For a reservation we process contact and participant details, including age group and – for guests under 17 – age at pickup, as well as sizing data, selected equipment, rental dates and payment status. Age information is used to determine the appropriate price and equipment category. This is required to prepare the reservation, manage availability, allocate payments and perform the rental contract.

The main legal bases are requested pre-contract steps and contract performance (Article 6(1)(b) GDPR), plus statutory retention duties (Article 6(1)(c) GDPR).

Payments and email

Online payments are processed by Stripe. Full card data is not stored on our server. Booking and service emails are sent through our World4You email infrastructure.

Data is shared with service providers only where required for hosting, payment, email delivery, maintenance or legal obligations.

Hosting and abuse protection

This website and its database run on a server provided by netcup GmbH, Daimlerstraße 25, 76185 Karlsruhe, Germany, in a data centre in Germany. netcup processes the data as a processor solely on our behalf (Article 28 GDPR).

For bookings, customer accounts and booking-link requests, we use Cloudflare Turnstile (Cloudflare, Inc.) to check that a request comes from a person. Cloudflare processes technical data such as your IP address and browser information; processing outside the EU is possible. The legal basis is our legitimate interest in protecting against automated requests and abuse (Article 6(1)(f) GDPR).

Security and retention

Technical logs, session data and security events may be processed to protect booking and administration areas (Article 6(1)(f) GDPR).

Data is retained only as long as necessary for bookings, contracts, accounting, warranty, legal claims and statutory duties.

Google Maps with consent

The Visit us section can show a Google Maps map. The map is only requested from Google when you load it with “Show map” or allow Google Maps in the cookie notice or with “Always show” (Article 6(1)(a) GDPR). Google then receives information including your IP address and technical browser data and may use cookies. This embed does not connect to Google Maps before you load it.

“Show map” applies only to the current page view. Permission given in the cookie notice or with “Always show” is stored on your device with your other cookie preferences for six months; the map then loads automatically on every page. You can withdraw it at any time in the cookie preferences; “Hide map” removes the embed from the current page. This does not recall information already sent to Google. A link to the Google privacy policy is provided beside the map. You can also read the address without loading the map or open the external directions link.

Analytics and cookies

Technically necessary cookies and similar storage technologies are used for secure sessions, booking functions, payments, language settings and abuse prevention. Optional categories (currently only Google Maps) are disabled by default.

The selection is stored on the device with a version and expiry date for six months. It can be changed or withdrawn at any time through “Cookie preferences”. No analytics or marketing service is currently connected; such a service may be activated only after explicit consent.

When you select DE, EN or NL, we store your choice in the “sportegger_language” cookie for one year. On your next visit to the homepage address without a language prefix, we use this choice; without a saved choice, we use your browser language. Links containing /de, /en or /nl keep their specified language. You can change your choice using the language switch or remove it by deleting the cookie.

Your rights

Where legal requirements apply, you may request access, rectification, erasure, restriction, portability or object to processing. Consent can be withdrawn for the future. You may complain to the Austrian Data Protection Authority.

• Privacy contact: info@sportegger.at
• Austrian Data Protection Authority: dsb.gv.at