Privacy Policy

1. Controller and contact

The controller responsible for processing your personal data on this website is:

Kitzbühel Pro-Motion GmbH
Sportfeld 2
6370 Kitzbühel, Austria
Phone: +43 720 971 734
Email: rallye@alpenrallye.at

Company details (commercial register number, VAT ID, management) can be found in the legal notice. Please send questions about data protection and requests to exercise your rights to the email address above.

Personal data is any information relating to an identified or identifiable person, such as a name, email address or IP address. We process it in accordance with the General Data Protection Regulation (GDPR), the Austrian Data Protection Act (DSG) and the Austrian Telecommunications Act 2021 (TKG 2021).

We have not appointed a data protection officer because Art. 37 GDPR does not require us to.

2. Hosting, server log files and Squarespace

This website is run on the website builder and hosting service Squarespace. The provider is Squarespace, Inc., 225 Varick Street, 12th Floor, New York, NY 10014, USA; for users in the European Economic Area, Squarespace Ireland Ltd., Le Pole House, Ship Street Great, Dublin 8, Ireland, acts on its behalf. Squarespace processes visitor data on our behalf. We have a data processing agreement with the provider under Art. 28 GDPR.

When you visit the website, the server automatically records information that your browser transmits:

  • IP address

  • date and time of the request

  • the page requested and the referrer URL (the page you visited before)

  • browser type and version, operating system, device type

  • approximate location, which can be derived from the IP address

This processing is technically necessary to deliver the website, to keep it stable and secure, and to prevent abuse. The legal basis is Art. 6(1)(f) GDPR. Our legitimate interest lies in the security and stability of the website, the defence against attacks and the traceability of faults. We have weighed this interest against yours: only basic technical data is processed, and only for operating the website. Providing this data is technically necessary; without it the website cannot be displayed. We do not combine this data with other data sources. Log data is retained according to Squarespace's rules.

Squarespace also processes data in the USA. The transfer relies on the European Commission's adequacy decision on the EU-US Data Privacy Framework, to the extent that the recipient is certified under it (Art. 45 GDPR). If the decision lapses or a recipient is not certified, we use the European Commission's standard contractual clauses (Art. 46(2)(c) GDPR). More information: Squarespace privacy policy.

3. Cookies and consent

Cookies are small text files stored by your browser. We distinguish two kinds:

  • Strictly necessary cookies make the website work, for example for security, load balancing, the shopping cart and your cookie choice. They are set without consent (Section 165(3) TKG 2021). The legal basis for the related data processing is Art. 6(1)(f) GDPR.

  • Cookies and similar technologies for statistics, marketing and embedded content are used only if you consent in the cookie banner beforehand (Section 165(3) TKG 2021, Art. 6(1)(a) GDPR).

On your first visit you can accept, reject or individually select all categories in the cookie banner, with equal ease; no category is pre-selected. To prove your consent (Art. 7(1) GDPR), we store your choice and the time of your decision. Your decision applies for the period stated in the banner. You can change or withdraw it at any time with effect for the future by reopening the cookie banner via the link "Cookie settings" in the footer of the website. The lawfulness of processing up to the withdrawal remains unaffected.

You can also block or delete cookies in your browser settings. Individual functions of the website, such as the shopping cart, may then no longer work.

A list of the cookies used, with name, provider, purpose and storage period, is available in the cookie banner under "Details".

4. Contact, registration for the rally and newsletter

Contact by email, phone or form

When you contact us, we process your details (for example name, email address, phone number, content of your message) to answer your enquiry and to handle follow-up questions. The legal basis is Art. 6(1)(b) GDPR if the enquiry relates to participation or a contract, otherwise our legitimate interest in answering enquiries in a traceable way and protecting ourselves against possible claims (Art. 6(1)(f) GDPR). Without a way to reach you, such as your email address, we cannot reply; further details are optional. We delete the data once the enquiry is dealt with and no statutory retention duty applies, and no later than three years afterwards (general limitation period, Section 1489 ABGB).

Registration and participation (entry)

Entries for the Kitzbüheler Alpenrallye are made through a separate registration system at anmeldung.alpenrallye.at. The registration system is run with the service Wix. The provider is Wix.com Ltd., 40 Namal Tel Aviv St., Tel Aviv 6350671, Israel. Wix processes the data on our behalf; we have a data processing agreement with the provider under Art. 28 GDPR. Wix uses sub-processors for this, including in the USA (see Section 9). More information: Wix privacy policy (https://www.wix.com/about/privacy-policy). For your entry we process the data you provide, such as the names of driver and co-driver, address, contact details, date of birth, driving licence details, vehicle details, team name and chosen participation options. We need it to check, handle and invoice your participation, to carry out the event rules and for insurance and safety of the event. The legal basis is Art. 6(1)(b) GDPR, and for statutory retention duties Art. 6(1)(c) GDPR.

We publish start lists and results with start number, names of participants, team, vehicle and ranking on the website and in event reporting. Our legitimate interest (Art. 6(1)(f) GDPR) lies in running the competition transparently and verifiably, which participants and spectators expect. Your interests do not override it, because only start number, name, team, vehicle and ranking are published. Results remain online as an event archive. You can object to the publication at any time on grounds relating to your particular situation (see Section 10).

We store entry data until the event and its accounting are completed. Data relevant for accounting is kept for seven years (Section 132 BAO).

Other persons you register. If you register a co-driver, team members or guests, you confirm that you are entitled to do so and that you have informed these persons about this privacy policy. We then receive their data from you (Art. 14 GDPR); it falls into the categories listed above.

Mandatory information. The details marked as mandatory in the registration system are required for participation. Without them an entry is not possible.

Newsletter

We use the newsletter to inform you about news on the Alpenrallye. For this we process your email address and the time of your sign-up. The legal basis is your consent (Art. 6(1)(a) GDPR, Section 174 TKG 2021). We confirm the sign-up by email (double opt-in) and log it as proof. You can unsubscribe at any time via the link in every email or by writing to rallye@alpenrallye.at. We send it using Mailchimp. The provider is The Rocket Science Group LLC (Mailchimp), 675 Ponce de Leon Ave NE, Suite 5000, Atlanta, GA 30308, USA, a company of the Intuit group. Mailchimp processes your email address and the sending data on our behalf; we have a data processing agreement with the provider under Art. 28 GDPR. The data is transferred to the USA (see Section 9). More information: Mailchimp privacy policy (https://mailchimp.com/legal/privacy/). We do not pass on addresses for third-party advertising. We collect open and click statistics for individual recipients.

5. Online orders and payment processing

When you order something through the website (for example tickets, participation options or merchandise), we process your name, billing and, where applicable, delivery address, email address, order details and payment information. This is necessary to perform the contract (Art. 6(1)(b) GDPR). Without this information an order is not possible. Squarespace provides the order and shopping cart function.

We keep invoicing and accounting data for seven years (Section 132 BAO, Section 212 UGB; Art. 6(1)(c) GDPR). We pass data on to third parties only where this is necessary for payment, shipping or tax advice.

6. Embedded content and third-party services

We load some content from third-party servers. In doing so, your IP address is transmitted to the provider, who can use it to recognise your visit. This content is loaded only after you have consented in the cookie banner (Art. 6(1)(a) GDPR, Section 165(3) TKG 2021). Without consent you see a placeholder at this point.

YouTube

On the "Videos" pages and in reports we embed videos from YouTube. The provider is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. When you play a video, YouTube learns which page you visited and may set cookies. If you are logged in to your YouTube account, YouTube can link your visit to your profile. Google privacy policy

Google Maps

For maps (for example directions, route, event locations) we embed Google Maps. The provider is Google Ireland Limited. When the map loads, your IP address and your use of the map are transmitted to Google, including to the USA. Google privacy policy

Fonts

Fonts are provided by Squarespace via its own servers and partners such as Adobe Fonts or Google Fonts. Your browser loads them when a page is opened, and your IP address is transmitted in the process. The legal basis is our legitimate interest in a consistent and appealing presentation (Art. 6(1)(f) GDPR).

Linked sites and social media

Links to partners, Kitzbühel Tourismus and social media channels lead to third-party websites. Your browser transmits data to the respective operator only once you follow a link, and that operator's privacy policy applies.

7. Statistics

With your consent (Art. 6(1)(a) GDPR, Section 165(3) TKG 2021) we evaluate how the website is used in order to improve it. Without your consent this processing does not take place.

Squarespace Analytics

On our behalf, Squarespace records usage data such as pages viewed, time on site, where visitors come from (referrer), device type and approximate location. Squarespace sets cookies for this. We see the evaluation only in aggregated form. The data is stored according to Squarespace. You can withdraw your consent at any time in the cookie banner (see Section 3).

8. Photo and video recordings at the event

At the Kitzbüheler Alpenrallye, photos and videos are taken of participants, vehicles, spectators and the action along the route. We and the photographers we commission publish them in the galleries and videos on this website, on our social media channels, in press releases and in promotional material for future events.

Legal basis. For general and atmosphere shots in which individuals are not the focus, our legitimate interest is to document and promote the public event (Art. 6(1)(f) GDPR). We have weighed this interest against yours: the recordings are made in public space at a large public event, you are informed in advance (see below), and you can object at any time. For close-ups of individuals in promotional material and for minors, we obtain your consent (Art. 6(1)(a) GDPR). We also observe the protection of likenesses under Section 78 of the Austrian Copyright Act (UrhG).

Information on site. At the event venue we point to this policy with notices carrying a QR code, and we inform participants in the event rules as well.

Objection and deletion. If you are recognisable in a picture and do not want it to stay published, write to us at rallye@alpenrallye.at and name the page or the picture concerned. We remove it from our website and social media channels without undue delay and no later than one month after we receive your message. We cannot recall material that has already been printed.

Photographers. The pictures come from commissioned photographers and from us. We credit the photographers when publishing.

9. Retention, recipients and transfers to third countries

Retention. We store personal data only for as long as the respective purpose requires or the law prescribes. The specific periods are stated with each processing activity above. We store consents and cookie decisions for the period stated in the cookie banner.

Recipients. Your data is passed only to bodies that need it for the stated purpose:

  • Squarespace as hosting and website service provider

  • Wix as provider of the registration system, Mailchimp as provider of the newsletter dispatch, and providers of payment services (see Sections 4 and 5)

  • providers of embedded content and analytics services, if you have consented (see Sections 6 and 7)

  • tax advisers, insurers, authorities and courts, where a legal duty or a claim exists

We do not pass data on for third-party advertising.

Third countries. Squarespace, Wix, Mailchimp and, where you have consented, Google (YouTube, Google Maps) also process data in the USA; Wix also in Israel. The transfer to the USA relies on the European Commission's adequacy decision on the EU-US Data Privacy Framework, to the extent that the recipient is certified under it (Art. 45 GDPR). The transfer to Israel relies on the European Commission's adequacy decision for Israel (Art. 45 GDPR). If the decision lapses or a recipient is not certified, we use the European Commission's standard contractual clauses (Art. 46(2)(c) GDPR). Despite these safeguards, access to the data by US authorities cannot be ruled out completely.

There is no automated decision-making, including profiling, that has legal effects on you.

10. Your rights, complaints and changes

Under the GDPR you have the following rights:

  • Access to your stored data (Art. 15)

  • Rectification of inaccurate data (Art. 16)

  • Erasure of your data (Art. 17)

  • Restriction of processing (Art. 18)

  • Data portability in a commonly used, machine-readable format (Art. 20)

  • Objection to processing based on legitimate interests, on grounds relating to your particular situation (Art. 21), and to direct marketing (see below)

  • Withdrawal of consent given, with effect for the future (Art. 7(3)). The lawfulness of processing up to the withdrawal remains unaffected.

To exercise them, an email to rallye@alpenrallye.at is enough. We answer requests without undue delay and no later than within one month (Art. 12(3) GDPR). For complex or numerous requests we may extend this period by two further months; we will then inform you within the first month. For security, we may ask you to prove your identity.

Right to object

Objection to direct marketing. If we process your data for direct marketing, such as sending the newsletter, you can object at any time without giving reasons. We then stop the processing immediately.

Objection to processing based on legitimate interests. You can object, on grounds relating to your particular situation, to any processing that we base on legitimate interests (Art. 6(1)(f) GDPR). We then stop the processing unless we demonstrate compelling legitimate grounds that override your interests, or the processing serves the establishment, exercise or defence of legal claims.

If you believe that the processing of your data violates data protection law, you can lodge a complaint with us or with the supervisory authority. In Austria this is the Datenschutzbehörde (Data Protection Authority), Barichgasse 40–42, 1030 Vienna, email: dsb@dsb.gv.at, www.dsb.gv.at.

Data transmitted over the internet, for example by email, can have security gaps. Complete protection against access by third parties is not possible. This website uses an encrypted connection (HTTPS/TLS).

We amend this privacy policy when the website, services or the legal situation change. The version published here applies.

Last updated: October 2026