Privacy Policy

Protecting your personal data matters to us. We process your data solely on the basis of the applicable law (GDPR, the Austrian Data Protection Act, TKG 2021). This privacy policy tells you which data is processed on st-trail.at and for what purpose.

Controller:
Trailrunning Club Sonnenterrasse
Register number (ZVR) 1890997058
c/o TVB Salzburger Sonnenterrasse
Markt 12, 5621 St. Veit im Pongau, Austria

Contact for data protection enquiries: info@st-trail.at

This website is hosted by obinet; the servers are located in Austria or elsewhere in the EU. When you visit the site, the web server automatically processes what are known as log files: IP address, date and time of access, the page requested, the amount of data transferred, the referrer URL and details of your browser and operating system.

This data serves solely to keep the site running smoothly, to analyse faults and to fend off attacks (legal basis: legitimate interest under Art. 6(1)(f) GDPR). It is not combined with any other source of data. Log files are kept only as long as they are needed for these purposes and are then deleted.

When you register for the Sonnenterrassen Trail through our registration form, we process the data you provide (e.g. name, year of birth, gender, address, email address, telephone number, club or team, chosen race) in order to carry out your participation in the event – that is, for registration, managing places, handing out race numbers, timing and the results service. The legal basis is the performance of a contract under Art. 6(1)(b) GDPR.

To process your registration, your data is passed to the participant management system we use, which processes it in order to run the event. The entry fee is paid through the payment service provider Stripe (see the separate section).

Team registration (Dorf-Run): For the Dorf-Run, one contact person registers the whole team. For this we process the team name, the contact person’s email address and telephone number, and the first name, surname and gender of the three team members. The team name, the email address and the team members’ details are passed to the participant management system; the telephone number stays on this website and is used only if the organisers have questions. The team name and the names of the team members appear in the start list (see “Start lists and results lists”). We do not create a runner account for teams, and there is no live tracking. As above, the legal basis is the performance of a contract under Art. 6(1)(b) GDPR. The contact person informs the team members about this privacy policy.

Address suggestions: While you enter your address, the form suggests matching addresses. For Austria we use the official address register of the BEV, and for postcodes in other countries the freely available GeoNames data; both are held on our server. If Austria is selected as your nationality in the form, your entries do not leave our server for these suggestions. If another nationality or none is selected, our server may also query the Photon service of komoot GmbH (Schönefeld, Germany), which is based on OpenStreetMap data. Only what you have typed in the address field (street and, where entered, house number) together with any postcode and town already filled in – or, when looking up a town, only the postcode – is then transmitted; neither your name nor your IP address is passed on, because the request is made by our server, not by your browser. We cache the answers for one day. The legal bases are steps taken prior to entering into a contract (Art. 6(1)(b) GDPR) and our legitimate interest in correctly and consistently recorded addresses (Art. 6(1)(f) GDPR).

The process data stored locally on this website during registration (the registration and payment flow) is deleted after 90 days. Beyond that, we keep participation data for as long as it is needed to run and follow up the event and to meet statutory retention obligations.

We use the payment service provider Stripe to collect the entry fee (Stripe Payments Europe, Ltd., 1 Grand Canal Street Lower, Dublin, Ireland; parent company: Stripe, Inc., USA). When you pay, the data required for this (e.g. name, email address, payment details, amount) is transmitted directly to Stripe. Your full card or account details are not stored on our servers.

The legal basis is the performance of a contract (Art. 6(1)(b) GDPR). Processing a payment may involve a transfer of data to the USA; Stripe bases such transfers on the European Commission’s standard contractual clauses under Art. 46 GDPR. You will find further information in Stripe’s privacy policy: stripe.com/at/privacy.

As part of the event we publish start lists and results lists showing name, gender, year of birth, nationality, club or team, place of residence and bib number, where applicable with the notes “Ever-present” or “Defending champion”, and for Dorf-Run teams the team name and the names of the team members – on this website, in the start and finish area and to the media. The start list is shown in order of registration. Publishing these lists is an essential part of a public sporting event. The legal bases are the performance of a contract (Art. 6(1)(b) GDPR) and our legitimate interest in running the competition transparently (Art. 6(1)(f) GDPR).

You may object at any time to your data being published in start lists and results lists. Please send your objection to the club (address above); we will then remove your data from the lists under our control.

This website uses only technically necessary cookies. No tracking, analytics or advertising cookies are used.

• Session cookie: set during registration to keep your session alive while you register, and deleted once the session ends.
• Checkout reminder: briefly remembers whether a registration you started has not yet been completed, so that we can remind you the next time you visit.

The legal basis is our legitimate interest in providing the website technically (Art. 6(1)(f) GDPR) in conjunction with § 165(3) TKG 2021. Technically necessary cookies do not require consent, which is why this website does not show a cookie banner.

We use the service CleverReach to send our newsletter (CleverReach GmbH & Co. KG, Schafjückenweg 2, 26180 Rastede, Germany). Signing up for the newsletter always uses the double opt-in procedure: after entering your address you receive an email with a confirmation link, and only once you have confirmed is your address added to the mailing list. The newsletter is currently offered only in connection with registering for the event.

The legal basis is your consent (Art. 6(1)(a) GDPR). You can unsubscribe at any time using the link in every email or by writing to the club. Further information: cleverreach.com/de/datenschutz.

We embed videos (YouTube, Vimeo) and map services using “click to load”: when you open a page, no data is transmitted to the respective provider at first; you only see a preview image. The connection to the provider is established only when you actively click on such content. Your IP address and possibly further data are then transmitted to the provider – and, where the provider is based in the USA, to that country as well.

The legal basis for loading the content is the consent you give by actively clicking (Art. 6(1)(a) GDPR). Information on how your data is processed can be found in the privacy policies of the respective providers.

For participants we offer the runner app “ST Trail”. You sign in to it with the email address used for your registration and your start code, which you will find in your registration confirmation and in the runners’ area. The app shows your start details, your schedule, the course and the live map. If you have uploaded a profile picture in the runners’ area, the app shows it only for your own start place, not for start places of other people you have registered with your email address. To prevent misuse, our server counts failed sign-in attempts for one hour per IP address and per combination of IP address and email address, in hashed form only. It records every sign-in – successful or rejected – without the IP address in its process log (database and log file); these entries are deleted after 90 days. The legal basis is carrying out your participation (Art. 6(1)(b) GDPR); for misuse protection and the log it is our legitimate interest in secure operation (Art. 6(1)(f) GDPR).

Live tracking: Your location is processed only if you start tracking yourself – in the app with the tracking button, or on this website’s live map with “Share my position” (again signing in with your email address and start code). While tracking is running, the app sends your location even when the screen is locked; the website sends it only while the page is open. The legal basis is your consent (Art. 6(1)(a) GDPR). You can withdraw it at any time by ending tracking – in the app by tapping the tracking button again, on the website with “Stop sharing”.

Data processed: Your coordinates, their accuracy and a device identifier are transmitted. Our server records the time and links the report to your registration (name, race number, nation, gender, race). The device identifier is a random string that the app generates once (the website once per browser tab); we store only a hash of it. It ensures that only one device at a time sends for each start place. For each start place we store only the latest position: every report overwrites the previous one, so no movement history is created.

Time window: Our server accepts positions only around your race – from 60 minutes before the start until 30 minutes after the finish cut-off. Children’s races and the Dorf-Run are not tracked. No time window applies to a test run that we open before the event, to a race for which no start time has been set yet, or to the demo access we use to present the app (for example when it is reviewed by the app stores); its dot may therefore also appear on the map under a demo name outside the race.

Who sees your position: While you are sending, you appear on the public live map (on this website and in the app) with your name, race number, nation, gender, race and position, together with its age. A position is shown only while it is no more than 120 seconds old; when you stop tracking, your dot disappears immediately. Authorised members of the organising team see the last transmitted position and its time in the organisers’ cockpit – even after you have stopped – so that race control knows where you were last, for example in an emergency. We base keeping this last position after you stop, until it is deleted, on our legitimate interest in the safety of participants (Art. 6(1)(f) GDPR).

Deletion: The stored position is deleted automatically by the next daily clean-up after 24 hours have passed since the finish cut-off of your race (or since your last report, if that was later). For reports outside a time window or without one (test run, race without a fixed start time, demo access), the 24 hours run from the last report.

Notifications: The app reminds you of the briefing and the start and shows messages from the organisers, for example about the course or the weather. The app schedules the reminders itself on your phone and fetches messages regularly from our server; no external push service is used for this. They appear as notifications only if you allow notifications for the app on your phone; reminders can be switched off in the app.

On this website you can also subscribe to push notifications in your browser (news and messages from the organisers). For this we store only the subscription address generated by your browser with the associated keys and the browser identifier (user agent), without any link to your registration. Messages are delivered in encrypted form via the push service of your browser’s provider. The legal basis is your consent (Art. 6(1)(a) GDPR); you withdraw it by blocking notifications for st-trail.at in your browser settings. Subscriptions that the push service reports as invalid are deleted automatically the next time we send a message.

Map in the app: The app loads map tiles directly from OpenStreetMap (tile.openstreetmap.org), which transmits your IP address to their servers. The map appears only after you have confirmed a notice about this the first time you open it. Otherwise the section “External content” applies – as it does to the map on this website.

You have the right of access (Art. 15 GDPR), to rectification (Art. 16), to erasure (Art. 17), to restriction of processing (Art. 18), to data portability (Art. 20) and to object (Art. 21 GDPR). You may withdraw consent you have given at any time with effect for the future. To do so, please contact the controller (address above).

If you believe that the processing of your data breaches data protection law, you may lodge a complaint with the Austrian data protection authority: Österreichische Datenschutzbehörde, Barichgasse 40–42, 1030 Vienna, dsb.gv.at.

Last updated: November 2026. We will amend this privacy policy as soon as the services or procedures we use change.