Last updated: 21 August 2026
This policy explains what we do with your personal data when you visit this website, make an enquiry, book a session, are photographed by us, or join our affiliate programme. It is written to meet the EU General Data Protection Regulation (GDPR) and the Austrian Datenschutzgesetz.
We have deliberately kept this specific rather than generic. Everything below describes something we actually do.
The controller for your data is:
We are not required to appoint a Data Protection Officer. Data protection questions go to the address above.
Bookings are taken through the Amelia booking system on this site. We collect your name, email address, telephone number, chosen service, session date and time, and your answer to the off-piste mountain guide confirmation.
Why: to form and perform your booking contract, arrange the session, send confirmations and reminders, and deliver your images.
Legal basis: Art 6(1)(b) GDPR — performance of a contract.
Enquiry and contact forms on this site run on Formidable Forms. We collect whatever you put in the form, typically name, email and your message.
Why: to answer you.
Legal basis: Art 6(1)(b) GDPR where you are asking about a booking; otherwise Art 6(1)(f) — our legitimate interest in responding to enquiries.
Card payments are processed by Stripe Payments Europe, Ltd. Stripe receives your card and billing details directly. We never see or store your full card number. We receive confirmation of payment, the amount, and the last four digits.
Why: to take payment for your booking. Legal basis: Art 6(1)(b) GDPR.
Photographs and video in which you are recognisable are personal data. During a session we create a large number of them.
You can withdraw consent at any time by emailing us. Withdrawal does not affect use that already took place.
Your preview images are normally sent by WhatsApp to the number you give us. WhatsApp is operated by Meta Platforms Ireland Ltd. Using it means your phone number and the images pass through Meta’s systems, which involves transfer to the United States.
Legal basis: Art 6(1)(b) GDPR — it is how the preview service you booked is delivered. If you would rather we did not use WhatsApp, tell us and we will send your preview by email instead.
Our affiliate programme runs on Ultimate Affiliate. Applying means giving us your name, username, email address, a password, and your bank details including IBAN, plus whatever you write about how you intend to promote us.
Why: to run the programme, attribute referrals and pay commission.
Legal basis: Art 6(1)(b) GDPR for the affiliate agreement; Art 6(1)(c) for the tax records we must keep of payments made.
Bank details are held only for paying you and are not used for anything else.
Our host records standard access data — IP address, date and time, page requested, browser and referring page.
Why: security, troubleshooting and keeping the site running. Legal basis: Art 6(1)(f) GDPR.
We do not use Google Analytics, the Meta pixel, or any advertising or profiling tracker on this site. What is set is:
| Cookie | Purpose | Type |
|---|---|---|
uap_test_cookie and related affiliate cookies |
Records that you arrived through an affiliate link, so the correct partner is credited. Set for up to 360 days. | Not essential — requires your consent |
maz-resolved-color-mode |
Remembers light or dark display preference | Functional |
perf_* |
Page caching and performance (WP Rocket) | Essential |
wp-settings-* |
Only set for logged-in site administrators | Essential |
[ACTION REQUIRED — resolve before publishing: the affiliate tracking cookie is non-essential, lasts 360 days, and there is currently no consent banner. Under § 165 TKG 2021 it needs opt-in consent before being set. Add a consent tool, or reconsider the affiliate cookie, so that this section is accurate.]
| Who | What they get | Where |
|---|---|---|
| [HOSTING PROVIDER — NAME] | Everything stored on the site, as processor | [COUNTRY] |
| Stripe Payments Europe, Ltd. | Payment and card data | Ireland / USA |
| Meta Platforms Ireland Ltd. (WhatsApp) | Phone number and preview images, if you use WhatsApp | Ireland / USA |
| Google Ireland Ltd. (Google Fonts) | Your IP address when fonts load | Ireland / USA |
| Automattic Inc. (Gravatar) | Your IP address where avatars load | USA |
| Your bank and ours | Payment details for affiliate payouts | EU |
| Tax adviser and authorities | Invoices and accounting records | Austria |
We do not sell your data and we do not share it for anyone else’s marketing.
Stripe, Meta, Google and Automattic may process data in the United States. Transfers rely on the EU–US Data Privacy Framework where the recipient is certified, and otherwise on Standard Contractual Clauses under Art 46 GDPR.
[NOTE: this site loads fonts from Google’s servers, which discloses visitor IP addresses to Google. Self-hosting the font files removes this transfer entirely and is a straightforward change. German courts have found unconsented Google Fonts loading to be an infringement; the Austrian position is less settled but the risk is avoidable.]
| Data | Kept for | Why |
|---|---|---|
| Invoices, booking and payment records | 7 years | § 132 Bundesabgabenordnung |
| Your delivered gallery | 90 Days | Delivery of the service |
| Master image files | 12 Months | Re-supply and portfolio |
| Enquiries that don’t become bookings | 12 Months | Follow-up and context |
| Affiliate account and payout records | Duration of participation, then 7 years for financial records | Contract and tax law |
| Server logs | TYPICALLY 7–30 DAYS | Security |
Under the GDPR you have the right to:
Email hello@arlbergcollective.com. We reply within one month, normally far sooner, and we do not charge for this.
If you think we have handled your data wrongly, you can complain to the Austrian supervisory authority:
Österreichische Datenschutzbehörde
Barichgasse 40–42, 1030 Wien, Austria
+43 1 52 152-0 · dsb@dsb.gv.at · www.dsb.gv.at
You may also complain to the authority where you live or work.
Providing your name, email, phone number and session details is necessary to make a booking — without them we cannot form or perform the contract. Everything else, including consent to portfolio use of your images, is genuinely optional.
We do not carry out automated decision-making or profiling that produces legal or similarly significant effects.
This site is not directed at children. Where a child takes part in a session, their parent or guardian makes the booking and gives any consent to the use of images.
We will update this policy when what we do changes. The date at the top tells you which version you are reading.
