Privacy Policy
Last updated: 3 November 2026
This policy explains what we do with your personal data when you visit this website, make an enquiry, chat with us, book a session, are photographed by us, or join our affiliate programme. It is written to meet the EU General Data Protection Regulation (GDPR), the Austrian Datenschutzgesetz and the Austrian Telecommunications Act (TKG 2021).
We have deliberately kept this specific rather than generic. Everything below describes something we actually do.
1. Who is responsible
The controller for your data is:
- Iain Mortimer, sole trader, trading as Arlberg Collective
- St. Jakober Dorfstraße 68, 6580 St. Anton am Arlberg, Tirol, Austria
- hello@arlbergcollective.com · +43 670 6557857
We are not required to appoint a Data Protection Officer. Data protection questions go to the address above.
2. What we collect, why, and on what legal basis
2.1 When you book a session
Bookings are made through the booking form on this website. We collect your first and last name, email address, phone number (ideally one with WhatsApp), the package and dates you choose, your group size, ski level and preferred area, your confirmation about a mountain guide if you choose off-piste, any notes you add, and whether you agree to us using images of you in our portfolio. Your booking request is stored on our website and sent to us by email.
Why: to check availability, form and perform your booking contract, arrange the session, send confirmations and payment links, and deliver your images.
Legal basis: Art 6(1)(b) GDPR — performance of a contract and steps before entering into one.
2.2 When you contact us
Our contact form collects your first and last name, email address, WhatsApp or mobile number, the topic and your message. The message is stored on our website and sent to us by email.
The live chat on this site is provided by Chatway. If you use it, we receive whatever you type, including any name or email address you give.
Why: to answer you.
Legal basis: Art 6(1)(b) GDPR where you are asking about a booking; otherwise Art 6(1)(f) — our legitimate interest in responding to enquiries.
2.3 When you pay
Once we have confirmed availability, we email you a secure payment link. Card payments are processed by Stripe Payments Europe, Ltd. Stripe receives your card and billing details directly. We never see or store your full card number. We receive confirmation of payment, the amount, and the last four digits of the card.
Why: to take payment for your booking. Legal basis: Art 6(1)(b) GDPR.
2.4 Photographs and film of you
Photographs and video in which you are recognisable are personal data. During a session we create a large number of them.
- Taking and delivering your images — Art 6(1)(b) GDPR, performance of the contract you booked.
- Using images of you in our portfolio, website, social media or advertising — Art 6(1)(a) GDPR, your consent, together with your right to your own likeness under § 78 Urheberrechtsgesetz. We ask for this separately in the booking form. Saying no costs you nothing and changes nothing about your session.
You can withdraw consent at any time by emailing us. Withdrawal does not affect use that already took place.
2.5 Next-day previews by WhatsApp
Your preview images are normally sent by WhatsApp, by 8pm on the day after your session, to the number you give us. WhatsApp is operated by Meta Platforms Ireland Ltd. Using it means your phone number and the images pass through Meta’s systems, which can involve transfer to the United States.
Legal basis: Art 6(1)(b) GDPR — it is how the preview service you booked is delivered. If you would rather we did not use WhatsApp, tell us and we will send your preview by email instead.
2.6 Delivering your full gallery
Your full gallery is delivered through a private download link on Google Drive (Google Ireland Ltd.) or Dropbox (Dropbox International Unlimited Company). Anyone with the link can view the gallery, so please do not share it more widely than you want to. The link stays active for 90 days from delivery.
Legal basis: Art 6(1)(b) GDPR.
2.7 If you join the affiliate programme
Our affiliate programme runs on AffiliateWP, on this website. Applying means giving us your name, a username, your account email, a password (stored only in encrypted form), and optionally a payment email, your website, how you intend to promote us, your business name and type, and a phone or WhatsApp number. Once you are approved, you send us your bank details (including IBAN) by email so we can pay commission.
To credit you, we record visits that arrive through your referral link (date, landing page and referring page) and the bookings that result from them.
Why: to run the programme, attribute referrals and pay commission.
Legal basis: Art 6(1)(b) GDPR for the affiliate agreement; Art 6(1)(c) for the tax records we must keep of payments made.
Bank details are used only for paying you and nothing else.
2.8 Website statistics (only with your consent)
If you accept “Analytics” cookies in our cookie banner, we use Google Analytics (Google Ireland Ltd.) to understand how visitors use the site, for example which pages are read and which devices are used. Google Analytics is not loaded at all unless you accept. We do not use it to identify you, and we do not use advertising features.
Legal basis: Art 6(1)(a) GDPR and § 165(3) TKG 2021 — your consent, which you can withdraw at any time through the cookie settings button on every page.
2.9 Security and server logs
Our host records standard access data — IP address, date and time, page requested, browser and referring page. Our security firewall (Wordfence) also checks requests and records suspicious activity and login attempts, including IP addresses, to protect the site from attacks.
Why: security, troubleshooting and keeping the site running. Legal basis: Art 6(1)(f) GDPR.
3. Cookies
When you first visit, a cookie banner asks for your choice. Nothing that is not strictly necessary is set until you agree, and you can change your choice at any time with the cookie settings button on every page.
| Cookie | Purpose | Duration | Type |
|---|---|---|---|
| cookieyes-consent | Remembers your cookie choices | 1 year | Necessary |
| pll_language | Remembers the language you are viewing the site in | 1 year | Necessary |
| wordpress_*, wp-settings-*, wfwaf-authcookie-* | Only set when someone logs in (site administrators and affiliates) | Session to 1 year | Necessary |
| Chatway chat data | Keeps your chat conversation together if you use the live chat | Until cleared | Necessary for the chat you start |
| affwp_ref, affwp_ref_visit_id, affwp_campaign | Records that you arrived through a partner’s link, so the right partner is credited if you book | 360 days | Advertising — only with your consent |
| _ga, _ga_* | Google Analytics: distinguishes visits for statistics | Up to 2 years | Analytics — only with your consent |
We do not use the Meta pixel or any advertising or profiling tracker.
4. Who receives data
| Who | What they get | Where |
|---|---|---|
| Hostinger International Ltd. | Website hosting and our email: everything stored on the site and emails we send and receive, as our processor | EU |
| Stripe Payments Europe, Ltd. | Payment and card data | Ireland / USA |
| Meta Platforms Ireland Ltd. (WhatsApp) | Phone number and preview images, if you use WhatsApp | Ireland / USA |
| Google Ireland Ltd. (Google Drive, Google Analytics) | Your gallery, if delivered by Google Drive; usage statistics, only with your consent | Ireland / USA |
| Dropbox International Unlimited Company | Your gallery, if delivered by Dropbox | Ireland / USA |
| Chatway | Your chat messages and IP address, if the chat loads or you use it | Outside the EU |
| Your bank and ours | Payment details for affiliate payouts | EU |
| Tax adviser and authorities | Invoices and accounting records | Austria |
We do not sell your data and we do not share it for anyone else’s marketing.
Transfers outside the EU
Stripe, Meta, Google, Dropbox and Chatway may process data outside the EU, including in the United States. Transfers rely on an adequacy decision such as the EU–US Data Privacy Framework where the recipient is certified, and otherwise on Standard Contractual Clauses under Art 46 GDPR.
5. How long we keep things
| Data | Kept for | Why |
|---|---|---|
| Invoices, booking and payment records | 7 years | § 132 Bundesabgabenordnung |
| Your gallery download link | 90 days from delivery | Delivery of the service |
| Master image files | 12 months | Re-supply and, with your consent, portfolio |
| Enquiries and chats that don’t become bookings | 12 months | Follow-up and context |
| Affiliate account and payout records | Duration of participation, then 7 years for financial records | Contract and tax law |
| Google Analytics data | Up to 14 months | Statistics, with your consent |
| Server and security logs | Typically up to 30 days | Security |
6. Your rights
Under the GDPR you have the right to:
- Access the personal data we hold about you (Art 15)
- Correct anything inaccurate (Art 16)
- Erasure — have your data deleted (Art 17), subject to our tax retention duties
- Restrict processing (Art 18)
- Portability — receive your data in a machine-readable form (Art 20)
- Object to processing based on legitimate interests (Art 21)
- Withdraw consent at any time, including consent to cookies and to our use of your images (Art 7(3))
Email hello@arlbergcollective.com. We reply within one month, normally far sooner, and we do not charge for this.
Complaining
If you think we have handled your data wrongly, you can complain to the Austrian supervisory authority:
Österreichische Datenschutzbehörde
Barichgasse 40–42, 1030 Wien, Austria
+43 1 52 152-0 · dsb@dsb.gv.at · www.dsb.gv.at
You may also complain to the authority where you live or work.
7. Is any of this required?
Providing your name, email, phone number and session details is necessary to make a booking — without them we cannot form or perform the contract. Everything else, including consent to cookies and to portfolio use of your images, is genuinely optional.
8. Automated decision-making
We do not carry out automated decision-making or profiling that produces legal or similarly significant effects.
9. Children
This site is not directed at children. Where a child takes part in a session, their parent or guardian makes the booking and gives any consent to the use of images.
10. Changes
We will update this policy when what we do changes. The date at the top tells you which version you are reading.