Skip to main content
Contact
Legal

Privacy policy

How we handle your data – short, honest and without tracking.

1. Controller

The controller responsible for the processing of personal data on this website is:

Helmut Knauss – Kajaktiv
Aich 56, 8966 Aich-Assach, Austria
Phone: +43 650 4214383
Email: info@kajaktiv.at

We process personal data exclusively on the basis of the General Data Protection Regulation (GDPR), the Austrian Data Protection Act (DSG) and the Telecommunications Act 2021 (TKG 2021).

2. The key points in brief

  • No tracking: We use no analytics or marketing tools, no advertising cookies and no profiling.
  • No cookie banner needed: Only technically necessary storage is used.
  • No reCAPTCHA and no social media plugins: Facebook and Instagram are only included as ordinary links.
  • Everything on our own server: Fonts, scripts and the booking system run on our own server. External content is only loaded when you actively start a YouTube video or begin a booking (payment service provider Stripe, see section 7).

3. Hosting, Cloudflare & server log files

This website is operated by a web hosting provider acting on our behalf as a processor (Art. 28 GDPR). When you visit the website, the following data is automatically stored in server log files: IP address, date and time of access, page accessed, amount of data transferred, referrer URL, and browser and operating system.

We need this data to operate the website securely and reliably and to detect attacks. The legal basis is our legitimate interest (Art. 6(1)(f) GDPR). The log files are deleted after 14 days, unless they are needed for longer to investigate a specific security incident. Transmission is encrypted (HTTPS).

For secure and fast delivery of the website we use the content delivery network and security service of Cloudflare (Cloudflare Germany GmbH, Rosental 7, 80331 Munich, Germany; parent company Cloudflare, Inc., 101 Townsend St., San Francisco, CA 94107, USA). All requests to the website are routed via Cloudflare servers. In this process, technical data such as your IP address, pages accessed, browser information and the time of access are processed in order to defend against attacks and deliver the website quickly.

The legal basis is our legitimate interest in a secure and stable website (Art. 6(1)(f) GDPR). Processing in the USA is possible; Cloudflare, Inc. is certified under the EU-US Data Privacy Framework. More information: Cloudflare Privacy Policy.

4. Cookies & local storage

We use only technically necessary cookies and storage (Section 165(3) TKG 2021):

  • Language selection (cookie “pll_language”): remembers the selected language of the website, storage period up to 1 year.
  • Light/dark mode (local browser storage “ennsflussw-theme”): only remembers if you switch to dark mode yourself. This information does not leave your browser.
  • Booking: During a booking, our booking system temporarily stores your selection so that it is retained until the booking is completed.
  • Online payment (Stripe): As soon as you begin a booking, the Stripe payment module is loaded. Stripe sets cookies for fraud prevention and secure payment (“__stripe_mid”, storage period 1 year, and “__stripe_sid”, storage period 30 minutes).
  • Login: When logging in to the administration area, WordPress sets session cookies. This only affects editors, not visitors.

You can delete or block cookies and local storage in your browser at any time. The website remains usable; only your settings are lost and a booking in progress has to be started again.

5. Contact form, email & telephone

If you contact us via the contact form, by email or by telephone, we process the data you provide (name, email address, subject, message and, if applicable, telephone number) in order to answer your enquiry and prepare a booking.

The contact form sends your details to us by email and additionally stores them in our website database so that no enquiry gets lost. Neither reCAPTCHA nor other external services are used.

The legal basis is the performance of pre-contractual measures (Art. 6(1)(b) GDPR) or your consent (Art. 6(1)(a) GDPR), which you give by ticking the box in the form. You can withdraw your consent at any time informally by email; the lawfulness of the processing carried out until then remains unaffected.

We generally store your enquiry for 1 month after it has been dealt with. Longer only if this is necessary for processing a booking or statutory retention obligations apply.

6. Online booking

For courses, tours and private courses we use the Amelia booking system, which runs on our own server. When you make a booking, we process the information you provide in the booking form: first and last name, email address, telephone number, selected date, number of persons, selected tickets and extras, and any message.

We use this data to carry out your booking, to send you confirmations, reminders and changes regarding your appointment by email, and to organise the course or tour. The legal basis is the performance of a contract or of pre-contractual measures (Art. 6(1)(b) GDPR).

We store booking data for as long as necessary for processing, and beyond that only within the scope of statutory retention obligations (e.g. 7 years under Section 132 BAO for invoice-relevant data).

7. Payment

You pay for bookings that require payment on site or, where offered, online in the booking system. In doing so, we process the information required for the invoice (name, email address, booking and amount).

For online payments we use Stripe (Stripe Payments Europe, Ltd., 1 Grand Canal Street Lower, Grand Canal Dock, Dublin, D02 H210, Ireland). As soon as you begin a booking (booking button or booking form), our website loads the Stripe payment module (js.stripe.com); technical data such as IP address and device information is transmitted to Stripe. No connection to Stripe is established beforehand. If you pay online, your payment data (e.g. card details), your name, your email address, the amount and technical data such as IP address and device information are transmitted directly to Stripe and processed there, also for fraud prevention. Card data does not reach our server. Processing in the USA is possible; Stripe is certified under the EU-US Data Privacy Framework. More information: Stripe Privacy Policy. The legal basis is the performance of a contract (Art. 6(1)(b) GDPR) and our legal obligations (Art. 6(1)(c) GDPR).

Free tickets (e.g. with the Schladming-Dachstein Summer Card) are confirmed directly without payment.

8. YouTube video

On the home page we show a video from YouTube (Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland). The video is only loaded when you click “Play” (two-click solution). No connection to YouTube is established beforehand.

After your click, the video is embedded via the domain youtube-nocookie.com. In this process, data such as your IP address is transmitted to Google; processing in the USA is possible. Google is certified under the EU-US Data Privacy Framework. The legal basis is your consent by clicking (Art. 6(1)(a) GDPR). More information: Google Privacy Policy.

9. Fonts & scripts

All fonts (Roboto, Ethnocentric) and the software libraries used are loaded directly from our own server. No connection to Google Fonts or other content delivery networks is established. The only exception is the Stripe payment module (js.stripe.com), which is only loaded when you begin a booking, see section 7.

Our website contains links to other websites, e.g. to ennsflusswandern.at, Kajak Pyhrn-Priel, Facebook, Instagram, Google Maps, our partners or press articles. These links are ordinary references: you only reach the respective provider's site once you click a link. From then on, that provider's privacy policy applies.

11. Recipients & retention period

To handle enquiries, bookings and legal obligations, personal data may be transmitted to the following recipients to the extent required:

  • our web hosting and IT service provider (processor)
  • Cloudflare (delivery and protection of the website)
  • our payment service provider Stripe (for online payment)
  • tax advisors or auditors
  • legal counsel and debt collection agencies (only where the occasion arises)

We store personal data only for as long as is necessary for the respective purpose or statutory retention obligations apply (e.g. 7 years under Section 132 BAO).

12. Your rights

You have the right at any time to access (Art. 15 GDPR), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20) and objection (Art. 21), as well as the right to withdraw any consent given at any time. Simply write to us at info@kajaktiv.at.

If you believe that the processing of your data violates data protection law, you can lodge a complaint with the Austrian Data Protection Authority: Barichgasse 40–42, 1030 Vienna, dsb@dsb.gv.at, www.dsb.gv.at.

Last updated: October 2026