Privacy Policy

Introduction and scope

This Privacy Policy explains which personal data we process in connection with www.eishockey.at and its functions, the purposes and legal bases, how long data is stored, who receives it and which rights data subjects have. It also applies to the contact channels and linked social-media profiles described below. Third-party websites and services to which we merely link are governed by their own privacy notices.

Controller

Austrian Ice Hockey Association (ÖEHV) Attemsgasse 7/D, 1st floor 1220 Vienna, Austria Austrian association register number (ZVR): 288035099 Phone: +43 1 20 200 20-0 Email: info@eishockey.at

Legal bases

We process personal data only where an applicable legal basis exists: your consent (Art. 6(1)(a) GDPR), performance of a contract or pre-contractual steps (Art. 6(1)(b) GDPR), compliance with a legal obligation (Art. 6(1)(c) GDPR), or our legitimate interests (Art. 6(1)(f) GDPR), particularly the secure, stable and efficient operation of this website and responding to enquiries. Where information is stored on or read from your device, § 165(3) of the Austrian Telecommunications Act 2021 (TKG 2021) also applies. Non-essential storage and access take place only after your prior consent.

How we collect and use data

We receive data that you actively provide, for example when contacting us, subscribing to the newsletter or placing an order. Technically necessary connection and log data is also generated when the website is accessed. With your consent, we additionally process usage data for web analytics. We use this data only for defined purposes: providing and securing the website, dealing with enquiries, operating the newsletter and shop, measuring reach, and complying with legal obligations. We do not sell personal data and limit processing to what is necessary.

Web hosting, delivery and server log files

The website is hosted within the European Union on servers operated by Hetzner Online GmbH, Industriestr. 25, 91710 Gunzenhausen, Germany. We use Cloudflare, Inc., including Cloudflare R2, for fast and secure delivery and for media and document storage. Both providers process data on our behalf under Art. 28 GDPR. Each request processes, in particular, the IP address, date and time, requested resource, HTTP status, referrer, and browser and device information. This is necessary for delivery, troubleshooting and attack prevention (Art. 6(1)(f) GDPR). Our operational access and security logs are generally erased or anonymised after no more than 14 days. Extracts relating to a specific security incident or legal claim may be retained until final resolution. Media and documents remain stored for as long as they are needed on the website or statutory retention duties apply.

Fonts and local media

Fonts used on the website are delivered by the website itself; viewing a page does not connect to Google Fonts or another external font provider. Images, videos and documents are loaded from our own infrastructure or the media and document storage described above. Embeds that are activated only with your consent are described separately.

Cookies, local storage and your consent

We use technically necessary storage and, only after your prior consent, analytics technologies. You can change or withdraw your choice at any time through the cookie settings; rejecting is as easy as accepting. Technically necessary: • oehv_shopify_cart_id – associates your browser with the Shopify cart; retained for 14 days. • cookieshield_consent and cookieshield-consent-id – store and document your consent decision; retained for no more than 12 months. Analytics, only after consent: • ph_*_posthog and comparable PostHog storage – pseudonymous user and session identifiers for web analytics; retained for no more than 12 months. The consent decision and its record are processed under Art. 6(1)(c) and (f) GDPR in conjunction with § 165(3) TKG 2021. PostHog is based on consent under Art. 6(1)(a) GDPR and § 165(3) TKG 2021. The cart storage is technically necessary for the shop function you request.

Web analytics with PostHog

With your consent, we use PostHog Cloud EU from PostHog, Inc. to analyse use of our website and diagnose technical errors. Page views, interactions, referrers, browser and device data, an approximate region, technical error and diagnostic data, and pseudonymous user and session identifiers may be processed. PostHog is loaded only after you consent through the cookie settings. We do not combine this information with directly identifying data or use it to create advertising profiles. Event data is stored in PostHog's EU region in Frankfurt and erased after no more than 12 months. PostHog acts as our processor under Art. 28 GDPR. The legal basis is your consent (Art. 6(1)(a) GDPR; § 165(3) TKG 2021). You may withdraw it at any time through the cookie settings with future effect; collection is then stopped and the local PostHog identifier is reset.

When you subscribe to the ÖEHV newsletter, we process your email address and the time, IP address and status of the registration to deliver the newsletter and demonstrate your consent. The email address is required; without it you cannot subscribe. We use double opt-in: the address is enabled for delivery only after you confirm the link in the neutral confirmation email. For registration and delivery, we use the newsletter system provided by CTS EVENTIM Sports GmbH, technically based on CleverReach (CleverReach GmbH & Co. KG, Germany). Submitting the form sends the data directly to the existing EVENTIM Sports/CleverReach system. The website does not load a newsletter-provider resource before submission. The providers act as processors. The legal basis is your consent (Art. 6(1)(a) GDPR). You may withdraw it using the unsubscribe link in every newsletter or by emailing info@eishockey.at. Delivery data is retained until you unsubscribe. We then retain minimum suppression and consent evidence for three years from the end of the calendar year in which you unsubscribe where this is required to prevent further mailings or establish, exercise or defend legal claims.

Contacting us

If you contact us by email or phone, we process the contact details and content you provide to handle the enquiry. The basis is Art. 6(1)(b) GDPR for contracts and pre-contractual steps, and otherwise our legitimate interest in responding (Art. 6(1)(f) GDPR). General enquiries are erased no later than twelve months after final completion. We retain them longer only where this is needed for a contract, statutory records, or establishing, exercising or defending legal claims. Business and tax records subject to statutory retention are generally kept for seven years under § 132 BAO or § 212 UGB.

Shop, cart and orders through Shopify

The shop on eishockey.at uses Shopify. Product and cart data is processed through the Shopify Storefront API; the technically necessary cart cookie is described under “Cookies”. When you proceed to checkout, you are redirected to Shopify's hosted checkout. Shopify International Ltd., 2nd Floor, 1–2 Victoria Buildings, Haddington Road, Dublin 4, D04 XN32, Ireland, then processes cart, contact, billing, delivery, order, payment and technical data. Payment and shipping providers offered at checkout are displayed there and receive only the data needed for payment or delivery. The legal bases are Art. 6(1)(b) GDPR for the contract and pre-contractual steps, Art. 6(1)(c) GDPR for statutory retention, and Art. 6(1)(f) GDPR for fraud prevention and a secure order process. Required checkout fields are necessary to conclude and perform the contract; an order cannot be placed without them. Order, payment and invoice records are generally retained for seven years under § 132 BAO and § 212 UGB, and longer only for relevant pending proceedings. The checkout privacy notices also apply. If you use the online withdrawal function, we process your name, address, email address, order number, details of the goods concerned, and any voluntary additional information in order to receive, assign, and process your statement. The legal bases are Art. 6(1)(b) and (c) GDPR. The statement is stored with the required order records for the applicable statutory retention and limitation periods.

YouTube videos using a two-click solution

YouTube videos use privacy-enhanced mode through youtube-nocookie.com and a two-click solution. Merely viewing the page does not connect to YouTube. The video is loaded only when you click the local placeholder; this click constitutes consent (Art. 6(1)(a) GDPR; § 165(3) TKG 2021). From that point, Google Ireland Limited or Google LLC processes, in particular, your IP address, device and usage data and may store information on your device. Google's and YouTube's privacy notices additionally apply. Activation applies to the content loaded; we keep no separate permanent record of it.

Linked social-media profiles and sharing functions

We maintain profiles on Facebook, Instagram and LinkedIn. This website only links to them and does not load plugins, pixels or other platform resources when a page is viewed. Sharing buttons likewise open the relevant platform only after you click. The platform operator then processes data under its own responsibility, including cookies, usage data and, where applicable, profile data. We process messages, comments and other profile interactions on the basis of our legitimate interest in communication and public relations (Art. 6(1)(f) GDPR). For aggregated page statistics we may be joint controllers with Meta Platforms Ireland Limited or LinkedIn Ireland Unlimited Company (Art. 26 GDPR). Platform retention follows the provider's policy; we generally erase our own communication records after twelve months unless a contract, legal duty or unresolved claim requires longer retention.

Content management system and admin area

We operate Payload CMS on our EU infrastructure for authorised editors and administrators. We process their name, email address, role, password hash, session and security data, and the time and attribution of editorial changes. This is used for account administration, login, security and traceability and does not affect ordinary website visitors. The bases are Art. 6(1)(b), (c) and (f) GDPR. Accounts are blocked when authorisation ends; attribution of editorial changes remains with the relevant content for as long as that content or evidence is legitimately required. Security logs are generally erased after no more than 90 days, and backups are overwritten under the rolling backup schedule.

Recipients and processors

Personal data is disclosed only to recipients that need it for the purposes described. These include Hetzner Online GmbH for hosting; Cloudflare, Inc. for delivery and media/document storage; PostHog, Inc. for consent-based web analytics; CTS EVENTIM Sports GmbH and CleverReach GmbH & Co. KG for newsletter registration and delivery; Shopify International Ltd. and the payment and shipping providers selected at checkout for the shop; and our appointed IT, maintenance and email providers. Authorities and courts receive data only where legally required. We conclude Art. 28 GDPR agreements with recipients acting as processors.

Transfers to third countries

Some providers belong to international groups or use subprocessors outside the EU/EEA. A transfer takes place only where the requirements of Arts. 44–49 GDPR are met. Relevant US transfers to PostHog, Inc. and Cloudflare, Inc. rely on the EU–US Data Privacy Framework while the relevant certification remains valid. Shopify transfers data within its group, including to Canada under the European Commission's adequacy decision, and uses the EU Standard Contractual Clauses agreed in its data-processing terms for other non-adequate countries. Google LLC processes data in the USA when a YouTube video is activated and relies on its valid EU–US Data Privacy Framework certification. Where Standard Contractual Clauses under Art. 46 GDPR are used instead of an adequacy decision, you may request information about the safeguards or a copy by emailing info@eishockey.at, insofar as this does not prejudice third-party rights.

Storage periods

Specific periods or criteria are stated with each operation. In summary: server and security logs are generally kept for no more than 14 days; CMS security logs for no more than 90 days; general correspondence for twelve months after completion; PostHog events for no more than twelve months; newsletter data until unsubscribe and minimum suppression/evidence data for three years from the end of the unsubscribe year; and business, tax, order and invoice records subject to retention generally for seven years. For a specific security incident, pending proceeding or legal claim, only the necessary data is retained until final resolution. It is then erased or anonymised.

Security of processing

We use appropriate technical and organisational measures, including role and permission concepts, access controls, secure passwords, encryption, logging, backups and regular updates. This website is transmitted over encrypted HTTPS/TLS. Despite careful safeguards, data transmission over the internet can never be protected completely against every risk.

Your rights

Under the GDPR you have, in particular, the following rights: • Access to your processed data and a copy (Art. 15) • Rectification of inaccurate and completion of incomplete data (Art. 16) • Erasure where no legal reason for continued processing exists (Art. 17) • Restriction of processing (Art. 18) • Notification of recipients about rectification, erasure or restriction and, on request, information about those recipients (Art. 19) • Data portability for automated processing based on consent or contract (Art. 20) • Objection to processing based on legitimate interests and at any time to direct marketing (Art. 21) • Withdrawal of consent with future effect (Art. 7(3)) • Protection from solely automated decisions with legal or similarly significant effects (Art. 22). We do not make such decisions through this website. Send requests to info@eishockey.at or the postal address above. We may ask for proof of identity to prevent unauthorised disclosure. We respond without undue delay, generally within one month; for complex or numerous requests the period may be extended by up to two months under the conditions of the GDPR.

Right to lodge a complaint

If you believe that processing of your personal data infringes data-protection law, you may complain to the competent supervisory authority: Austrian Data Protection Authority (Österreichische Datenschutzbehörde) Barichgasse 40–42 1030 Vienna, Austria Phone: +43 1 52 152-0 Email: dsb@dsb.gv.at Web: www.dsb.gv.at You may also complain to the competent authority in the EU/EEA state of your habitual residence, place of work, or the place of the alleged infringement.

Minors

The newsletter subscription and webshop are not specifically directed at children under 14. A person under 14 in Austria must not independently submit a consent-based subscription without approval from a person holding parental responsibility. Purchases by minors are additionally governed by the general civil-law rules on legal capacity.

Changes and questions

We update this Privacy Policy when the law, providers or website functions change. The version published when you visit applies. For privacy questions, contact info@eishockey.at.