Data Protection

Talbahn Sport Service GmbH & Co KG
Tröpolach 155, 9631 Tröpolach, Austria
Telephone: +43 (0) 4285 7100 · E-mail: service@soelle.at
Company register number: FN 185593 g · VAT ID: ATU 47602205

Version dated: 19 October 2026

This privacy policy applies to soelle.at, felsenlabyrinth.at, rent.soelle.at, shop.soelle.at and blog.soelle.at, as well as to our rental and retail operations at our business premises.

• Analytics and advertising only with consent: Google Tag Manager loads Google Analytics, Google Ads, Hotjar and the Meta Pixel only once you agree in the cookie banner; withdraw at any time through “Cookie settings”
• No third-party content when a page opens: fonts and images come from our own server
• YouTube only after a click: your browser loads a video only when you start it
• Route maps only after a click: your browser loads a Komoot map only when you load it
• Raffle form only after a click: your browser loads the form from Tally only when you choose “Take part”
• Blog and Instagram through our server: blog posts and Instagram posts, including their images, are delivered by our server; your browser connects to Instagram only when you open a post there
• Newsletter: only after you sign up and confirm (double opt-in)

You may request information about the data we store about you and – where the legal requirements are met – request that it be corrected, erased or that its processing be restricted. You may object to processing and request data portability where these rights apply (Art. 15 to 21 GDPR).

If you have given us your consent, you may withdraw it at any time with effect for the future. Processing carried out before withdrawal remains lawful.

To exercise your rights, write to service@soelle.at or by post to the address above; we reply within one month. You may also lodge a complaint with the Austrian Data Protection Authority: Barichgasse 40–42, 1030 Vienna, telephone +43 1 52 152-0, e-mail dsb@dsb.gv.at, www.dsb.gv.at (opens in a new tab).

When you visit soelle.at and felsenlabyrinth.at, your browser sends technical data to our server. This includes your IP address, the date and time of access, the address requested, the page you came from (referrer), the status code and information about your browser and operating system.

• Why? To operate the website, keep it secure, and identify and defend against attacks.
• Legal basis: our legitimate interest in secure and stable operation (Art. 6(1)(f) GDPR).
• How long? Log files are deleted after 7 days.
• Where and by whom? Proplex GmbH, Seestraße 21, 9500 Villach, Austria (development, hosting and technical support; data processing agreement under Art. 28 GDPR). The servers are run by Hetzner Online GmbH, Industriestraße 25, 91710 Gunzenhausen, Germany, as Proplex GmbH’s sub-processor; the servers are located in data centres in Germany. No data is transferred outside the EU for hosting.

We manage the content with the content management system Payload CMS, self-hosted on the same servers; no data is sent to its maker.

rent.soelle.at is hosted by netcup GmbH, Emmy-Noether-Straße 10, 76131 Karlsruhe, Germany; the servers are located in Germany. A data processing agreement is in place. There, too, server log files as described above are deleted after 7 days.

On soelle.at and felsenlabyrinth.at we use cookies and similar technologies that require consent only with your consent in the cookie banner (see “Analytics and advertising”). Without consent we only store what is strictly necessary (§ 165(3) TKG 2021):

• Your cookie choice: the entry “soelle-consent” in your browser storage (local storage) with your choice, its date and the version of the settings – so that the banner does not ask on every page and we can prove your consent. It never leaves your device and is valid for 12 months; then we ask again. You can change or withdraw your choice at any time through “Cookie settings” at the bottom of every page.
• Notice windows (pop-ups): once a notice window (for example about opening hours) has appeared, your browser remembers this in its session storage (entry “site-popup-closed:…”) so that it does not appear again in this tab. The entry holds no personal data, never leaves your device and is deleted when you close the tab.
• Login to the content management system: only when staff sign in to the admin area is a login cookie (“payload-token”) set. It is never used for visitors.

Only when you start a YouTube video with a click may YouTube set cookies or store entries in your browser (see “YouTube videos”).

rent.soelle.at and shop.soelle.at are separate applications. There we use necessary cookies for functions such as session management, login and the shopping cart; the session in the booking process on rent.soelle.at ends after no more than 90 minutes. We set non-essential cookies there only with your consent, which you give, change or withdraw at any time in the cookie settings of the respective site.

We load fonts, images and program code exclusively from our own server – not from Google Fonts or other content delivery networks. Opening our pages does not connect your browser to any third party – analytics and advertising services only once you agree in the cookie banner.

We do not embed Google Maps. Links to Google Maps, to our profiles on Facebook, Instagram and YouTube, and to booking and partner sites are plain links: no data is transferred until you click. After the click, the respective provider’s privacy policy applies.

Some pages show videos from YouTube. We embed them with a two-click solution: at first you only see a preview image from our own server and a notice. Only when you click “Play video” does your browser load the player in privacy-enhanced mode from youtube-nocookie.com.

• Provider: Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland (responsible for YouTube).
• Data after the click: your IP address, information about your browser and device, the page the video is embedded in and your use of the player. YouTube may set cookies and store entries in your browser; if you are signed in to Google, Google may link the visit to your account.
• Legal basis: your consent given by the click (Art. 6(1)(a) GDPR, § 165(3) TKG 2021). Nothing is loaded without the click; the consent covers only this video and this page view.
• Third country: Google may transfer data to the United States. Google LLC is certified under the EU–US Data Privacy Framework (adequacy decision, Art. 45 GDPR).
• Details: Google’s privacy policy (opens in a new tab).

Videos we upload ourselves are played by our own player from our own server; no data is transferred to third parties.

On our bike routes page you can view a map of each route from the service Komoot. We embed it with a two-click solution: at first you only see a placeholder graphic from our own server and a notice. Only when you click “Load map” does your browser load the map from www.komoot.com. The “View on Komoot” links are plain links.

• Provider: komoot GmbH, Germany [OPEN: confirm komoot’s address]
• Data after the click: your IP address, browser and device details, the page the map is embedded in and your use of the map. Komoot may set cookies or store entries in your browser.
• Legal basis: your consent given by the click (Art. 6(1)(a) GDPR, § 165(3) TKG 2021); it applies to this page view only.
• Third country: [OPEN: whether Komoot processes data outside the EU and on which basis]
• Details: Komoot’s privacy policy (opens in a new tab).

On the home page, under “Sölle Stories”, we show our latest posts from Instagram (account @soellesport). Our server fetches them from Instagram through a service of Proplex GmbH (our processor, see “Service providers and recipients”), caches them for up to one hour and delivers texts and images from our own server. Instagram is operated by Meta Platforms Ireland Limited, Merrion Road, Dublin 4, Ireland.

• When a page opens: your browser sends no data to Instagram or Meta; Instagram sets no cookies on soelle.at. We process no personal data about you to show the posts.
• After a click: “More” and “@soellesport on Instagram” are plain links. Only when you click them does instagram.com open in a new tab; Meta’s privacy policy applies there.
• Legal basis: our legitimate interest in showing our own social media content on our website (Art. 6(1)(f) GDPR).

If you contact us by e-mail (service@soelle.at), phone or a form, we process the information you provide to respond to your enquiry. The legal basis is preparing or performing a contract (Art. 6(1)(b) GDPR), otherwise our legitimate interest in answering enquiries (Art. 6(1)(f) GDPR).

How long? Until your enquiry has been fully dealt with, and then for no more than 6 months, unless statutory retention obligations apply or a dispute requires us to retain the information for longer.

Our blog and newsletter are operated using Ghost (Ghost(Pro), EU region). The provider is Ghost Foundation Ltd, 160 Robinson Road #14-04, SBF Center, Singapore 068914. The data are stored in data centres within the EU. Access from third countries in connection with support and maintenance cannot be ruled out; such access is protected by Standard Contractual Clauses. A data processing agreement is in place.

We also show the posts of our blog on soelle.at (the “Blog” page and “Latest from our blog” on the home page). Our server fetches them from Ghost, caches them briefly and delivers texts and images itself; when you read them on soelle.at, your browser sends no data to Ghost. YouTube videos embedded in posts load only after you click (see “YouTube videos”); other embedded content (such as Pinterest) is shown only as a link.

For the newsletter we need your e-mail address and your consent. If you sign up on soelle.at, our server forwards your e-mail address directly to Ghost; it does not store it. After subscribing, you will receive an e-mail with a confirmation link. You will receive the newsletter only after confirming your subscription (double opt-in).

• Purpose: sending our newsletter with news and offers from Sölle.
• Legal basis: your consent (Art. 6(1)(a) GDPR, § 174 TKG 2021).
• Why do we store subscription and confirmation details? Ghost stores the IP address and the time of subscription and confirmation so that we can demonstrate consent and investigate fraudulent subscriptions.
• Opens and clicks: our newsletters contain tracking pixels and personalised links. These allow us to see whether and when an e-mail was opened and which links were clicked. This helps us tailor our content to readers’ interests. If you do not want this, you can unsubscribe from the newsletter.
• How long? We send you the newsletter until you unsubscribe or withdraw your consent. After that, your e-mail address remains on a suppression list so that we do not accidentally send you further newsletters.
• Unsubscribing and withdrawal: at any time via the link at the end of any newsletter e-mail or by writing to service@soelle.at. Processing before the withdrawal remains lawful.

Protection of the sign-up form against abuse

Our form protects itself against automated sign-ups without cookies, picture puzzles or third-party services: your browser solves a small computing task in the background (ALTCHA, on our own server), plus a field invisible to people and a minimum time to fill in the form. Each connection can sign up at most 5 times in 10 minutes and each e-mail address 3 times per hour; for this, a hash of the IP or e-mail address is kept in our server’s memory for at most one hour. Our server stores no sign-up data; its logs contain only the outcome (for example “signed up” or “refused”), no e-mail or IP address. The legal basis is our legitimate interest in a form that cannot be abused (Art. 6(1)(f) GDPR).

For our raffle “Win your next skis with Sölle” (winter 2026/27) we use an online form by Tally. The controller is Talbahn Sport Service GmbH & Co KG (see above); Tally processes the data as our processor.

• Provider: Tally BV, Sint-Pietersnieuwstraat 11, 9000 Gent, Belgium. According to the provider, the data are stored on servers in the European Union. A data processing agreement is to be concluded or in place [OPEN: confirmation that the data processing agreement with Tally has been accepted].
• Only after your click: when you open soelle.at, your browser sends no data to Tally. Only when you choose “Take part” does it load the form from tally.so; Tally then receives technically necessary data such as your IP address and browser details. You can also open the form directly on tally.so.
• Which data? Name, e-mail address, preferred way of contact, Instagram name, your confirmation that you follow @soellesport and are over 14, and voluntary details (link to your post, who referred you, phone number).
• Purpose: running the raffle: managing entries, drawing and notifying the winners and handing over the prizes.
• Legal basis: your participation in the raffle under our terms and conditions (Art. 6(1)(b) GDPR). You do not need to give separate consent to take part.
• Newsletter (optional): if you tick the newsletter in the form, that is your consent (Art. 6(1)(a) GDPR, § 174 TKG 2021). You first receive an e-mail with a confirmation link; we add you to the newsletter only after you confirm (see “Blog and newsletter”). You can withdraw at any time.
• How long? Until the raffle has ended and the winners have been notified; according to the terms and conditions no later than 30 May 2027 [OPEN: confirm the deletion date]. Records of prize handovers are kept as long as statutory retention obligations require.
• Your rights: access, rectification, erasure, restriction, data portability and objection, and the right to lodge a complaint with the data protection authority (see “What rights do you have?”).

More about how Tally handles data: Tally’s privacy policy (opens in a new tab).

For online bookings, we process your name, e-mail address, telephone number, billing address, booking period, location, rented equipment and payment data. To set the ski binding safety release correctly, we also need your height, shoe size, weight, date of birth and information about your skiing ability. We use this information to calculate the binding setting value (Z-value), so you do not have to provide these details again when collecting your equipment.

Why? To manage your booking, assign the equipment, set it up safely, process returns and handle billing.

Customer account

In your customer account, you can view bookings and access invoices.

How long? You can delete your account yourself or ask us to delete it. If you do not use it for 36 months, we will notify you and then delete it. Regardless of this, we must retain invoice and accounting data for 7 years from the end of the relevant calendar year.

The tax-relevant receipt is created when the equipment is handed over on site and stored in our rental software (see “On-site rental”). In addition, online booking data are retained in backup copies on the netcup server. These copies are used solely for retention during the statutory retention period and are deleted afterwards.

For rentals and the standards-compliant adjustment of ski binding safety settings, we use the Sportrental rental software from WINTERSTEIGER Sports GmbH, Wintersteigerstraße 1, 4910 Ried im Innkreis, Austria. The software runs on a server at our premises; there is also a cloud backup provided by Mahr EDV GmbH.

If you booked online, we transfer the setting details you have already provided. If you book directly in the shop, we ask you for these details on site.

We process your name and contact details, rental period and equipment, as well as your height, weight, age, ski boot sole length and skier type. These details are used to determine the binding setting value (Z-value).

Why? To manage the rental agreement and ensure that the ski binding safety settings are adjusted correctly and in accordance with applicable standards. These details are necessary to set the bindings safely.

Where is the data stored? The setting record and the associated receipt are stored on our own server and not transmitted to a cloud service or other third parties, except for the backup by Mahr EDV GmbH [OPEN: storage location and scope of the Mahr EDV cloud backup].

How long?

• Contract and invoice data: 7 years from the end of the relevant calendar year.
• Binding setting records: 3 years after the equipment is returned.

Our online shop is operated through Shopify. The provider is Shopify International Limited, Ireland. A data processing agreement is in place.

We process your name, delivery and billing addresses, e-mail address, items ordered, payment information and technical usage data.

Why? To process orders, deliver goods, allocate payments and meet our legal obligations.

How long?

• Order and invoice data: 7 years from the end of the relevant calendar year.
• Documents relevant to warranty claims: at least until the end of the warranty period of 2 years plus 3 months.

Shopify may transfer data to affiliated companies in Canada and the United States. The European Commission has issued an adequacy decision for Canada. For the United States, the EU–US Data Privacy Framework and supplementary Standard Contractual Clauses are used.

We process card payments through Stripe Payments Europe, Limited, One Wilton Park, Wilton Place, Dublin 2, D02 FX04, Ireland. Your card details are sent directly to Stripe; we do not receive complete card details. For more information, see Stripe’s privacy policy (opens in a new tab).

On soelle.at and felsenlabyrinth.at we use analytics and advertising services only with your consent in the cookie banner. The legal basis is your consent (Art. 6(1)(a) GDPR; for storing and reading information on your device § 165(3) TKG 2021). Without consent none of these services loads and your browser does not connect to Google, Hotjar or Meta. The services are loaded through Google Tag Manager, and only those of the categories you allowed; we also pass your choice to Google through its “Consent Mode”.

Withdrawal: you can change or withdraw your consent at any time with effect for the future – through “Cookie settings” at the bottom of every page. The services then stop loading from the next page on, and their cookies on our domain are deleted. Cookies on the providers’ domains (such as google.com, doubleclick.net, facebook.com) you delete in your browser or with the provider.

Proof: we store your choice in your browser (entry “soelle-consent” in local storage) with its date and the version of the settings; after 12 months, or when the services change, we ask again.

Google Tag Manager

• Provider: Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Irland
• Used on: soelle.at and felsenlabyrinth.at
• Category in the cookie banner: loads with Analytics or Marketing
• Purpose: Loads the analytics and marketing services of this website – only after consent and only those of the allowed categories. Sets no cookies itself; when it loads, Google receives the IP address and browser and device details.
• Cookies and storage: none
• Recipients and transfers: Google Ireland Limited. Data may be transferred to Google LLC in the United States. Google LLC is certified under the EU–US Data Privacy Framework (DPF) (adequacy decision of the European Commission of 10 July 2023).
• Retention: According to Google, the data sent when it loads is kept only briefly in server logs.
• Privacy policy of Google Ireland Limited (opens in a new tab)

Google Analytics 4

• Provider: Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Irland
• Used on: soelle.at and felsenlabyrinth.at
• Category in the cookie banner: Analytics
• Purpose: Analytics: which pages are visited, how often and for how long, where visitors come from and which device they use – pseudonymously, with a truncated IP address. We use it to improve our pages.
• Cookies and storage: _ga (our domain, 2 years): Random ID that recognises your browser on later visits.; _ga_ (our domain, 2 years): Stores the state of the current session (time, page views).
• Recipients and transfers: Google Ireland Limited. Data may be transferred to Google LLC in the United States. Google LLC is certified under the EU–US Data Privacy Framework (DPF) (adequacy decision of the European Commission of 10 July 2023).
• Retention: Usage data is deleted in Google Analytics after 14 months [OPEN: check the retention setting of the GA4 property].
• Privacy policy of Google Ireland Limited (opens in a new tab)

Hotjar

• Provider: Hotjar Ltd., Dragonara Business Centre, 5th Floor, Dragonara Road, Paceville, St Julian’s STJ 3141, Malta
• Used on: soelle.at
• Category in the cookie banner: Analytics
• Purpose: Analytics: how pages are used (clicks, scrolling, mouse movements, possibly recordings of single visits) – text typed into form fields is not recorded. It helps us find places where our pages are hard to use.
• Cookies and storage: _hjSessionUser_ (our domain, 1 year): Random ID that recognises your browser on later visits.; _hjSession_ (our domain, 30 minutes): Keeps the current session together.
• Recipients and transfers: Hotjar Ltd.. Hotjar stores the data in the EU (Ireland). Sub-processors in the United States are possible; they are certified under the EU–US Data Privacy Framework or bound by Standard Contractual Clauses.
• Retention: Recordings and events are deleted after 365 days [OPEN: check the setting in the Hotjar account].
• Privacy policy of Hotjar Ltd. (opens in a new tab)

Google Ads (Conversion-Tracking, Remarketing)

• Provider: Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Irland
• Used on: soelle.at and felsenlabyrinth.at
• Category in the cookie banner: Marketing
• Purpose: Advertising: measures whether a visit came from one of our Google ads and led to an inquiry or booking, and shows relevant ads from us on other websites (remarketing).
• Cookies and storage: _gcl_au (our domain, 90 days): Links ad clicks to later actions on our website.; _gcl_ls (browser local storage, until deleted): Like _gcl_au, in the browser storage.; IDE (doubleclick.net (Google), 13 months): Recognition for remarketing and measuring ad performance.
• Recipients and transfers: Google Ireland Limited. Data may be transferred to Google LLC in the United States. Google LLC is certified under the EU–US Data Privacy Framework (DPF) (adequacy decision of the European Commission of 10 July 2023).
• Retention: Google deletes conversion data after no more than 540 days; remarketing lists after the period we set (no more than 540 days).
• Privacy policy of Google Ireland Limited (opens in a new tab)

Meta Pixel (Facebook, Instagram)

• Provider: Meta Platforms Ireland Limited, Merrion Road, Dublin 4, D04 X2K5, Irland
• Used on: soelle.at
• Category in the cookie banner: Marketing
• Purpose: Advertising: measures the success of our ads on Facebook and Instagram and builds audiences for relevant advertising (remarketing). We and Meta are jointly responsible for the collection and transmission to Meta.
• Cookies and storage: _fbp (our domain, 90 days): Random ID that recognises your browser for advertising and measurement.; _fbc (our domain, 90 days): Only after a click on an ad: remembers that click.; fr (facebook.com (Meta), 90 days): Set by Meta when logged in to Facebook: delivering and measuring ads.
• Recipients and transfers: Meta Platforms Ireland Limited. Data may be transferred to Meta Platforms, Inc. in the United States. Meta Platforms, Inc. is certified under the EU–US Data Privacy Framework (DPF).
• Retention: According to Meta, pixel events are deleted after no more than 2 years.
• Privacy policy of Meta Platforms Ireland Limited (opens in a new tab)

For soelle.at and felsenlabyrinth.at see the previous section. We use the following services on rent.soelle.at and shop.soelle.at, and there only if you have first given consent through the cookie settings of the respective site (Art. 6(1)(a) GDPR, § 165(3) TKG 2021). You can withdraw your consent there at any time.

Google Analytics 4

Google Analytics 4 from Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland, uses cookies and similar technologies to analyse use and to create pseudonymous usage profiles. Why? To understand how our services are used and to improve them. How long? The retention period specified in our current configuration is 2 months. A transfer to the United States cannot be ruled out; Google LLC is certified under the EU–US Data Privacy Framework, and Standard Contractual Clauses may also apply.

Google Ads conversion tracking

With conversion tracking from Google Ireland Limited we measure whether advertisements lead to specific actions. How long? Conversion cookies expire after no more than 90 days.

Meta Pixel and audience-based advertising

With the Meta Pixel from Meta Platforms Ireland Limited, Merrion Road, Ballsbridge, Dublin 4, Ireland, we record which pages are visited and what actions are taken. Why? To measure the effectiveness of our Facebook and Instagram ads and create audiences for relevant advertising (retargeting and so-called lookalike audiences). We and Meta are jointly responsible for the collection of data and its transmission to Meta; Meta is responsible for its subsequent processing. You may exercise your rights with us as well; where appropriate, we will forward your request. Data may be transferred to the United States; the EU–US Data Privacy Framework and supplementary Standard Contractual Clauses are used for this. You can withdraw your consent through the cookie settings and also through the advertising settings of your Meta account.

If you apply for a job with us, we process the information you provide to assess your application and conduct the recruitment process (Art. 6(1)(b) GDPR). How long? As a rule, we delete application data 6 months after the recruitment process has ended. If we would like to keep your details in an applicant pool for longer, we will first ask for your separate consent.

Search: the search on this website also understands whole questions. For this, an AI model (a language model that turns texts into numbers for searching by meaning) runs on our own server. It processes only the text you type into the search field, in memory, to find matching sections of our pages. The search text is not stored, not logged, not used for training and not sent to third parties; we answer the same query from memory for up to one minute, without any link to you. To prevent abuse, each connection can search at most 120 times per minute; for this, a hash of the IP address is kept in memory for about one hour at most. The legal basis is our legitimate interest in a working search that cannot be abused (Art. 6(1)(f) GDPR).

Apart from that, we do not use artificial intelligence to process data of visitors to this website; there is no chatbot. There is no automated decision-making, including profiling, within the meaning of Art. 22 GDPR. More on this, and how AI was used to build the website, on our AI transparency page.

This website can only be reached encrypted (HTTPS/TLS). Data you send to us is therefore protected from third parties on its way between your browser and our server. Our pages allow the browser to load content only from our own server and, after your click, from the YouTube player (Content Security Policy).

We must retain certain data for longer periods because of legal requirements, particularly invoices and accounting records: as a rule 7 years from the end of the relevant calendar year. This also applies if you delete your customer account. Documents needed for ongoing administrative or court proceedings may be retained for longer.

We use, in particular, the following service providers to operate our services:

Some services may process data outside the European Union, particularly YouTube (after your click), Google, Hotjar and Meta (analytics and advertising, only with your consent), Shopify and Ghost support. Depending on the service, we rely on an adequacy decision, the EU–US Data Privacy Framework or Standard Contractual Clauses for such transfers. Details are provided in the sections above.

We update this privacy policy when our services, the tools we use or legal requirements change. The version published on this page applies. This English version is a courtesy translation; the German version is legally binding.