Name and contact details of the controller
Bayerische Zugspitzbahn Bergbahn AG
Olympiastraße 31 | 82467 Garmisch-Partenkirchen | Germany

Contact details of the data protection officer
Bayerische Zugspitzbahn Bergbahn AG
Data Protection Officer
Olympiastraße 31 | 82467 Garmisch-Partenkirchen | Germany
Email: datenschutz@zugspitze.de 

Categories of data processed
We process personal data that we receive from our customers, service providers, and suppliers.
Last name, first name, address, email address, telephone number, travel dates (if applicable), credit card and account details (IBAN) (if applicable).

Purposes and legal basis of data processing
Your data will be processed for the purpose of fulfilling the sale of products in the online shop (Art. 6 (1) (b) GDPR).
Your aforementioned data is also processed for the purpose of advertising contact in order to provide you with information about offers or similar by email, post, and telephone, provided that you have expressly consented to this or we are legally entitled to do so (Art. 6 (1) sentence 1 lit. a) or lit. f) GDPR).

Legitimate interests
The use of your address or email address, which was collected in the context of sales in the online shop, for our own advertising purposes constitutes a legitimate interest. From our point of view, our interest in advertising use prevails if this is permissible within the narrow legal limits, in particular the Law Against Unfair Competition (UWG). You can object to the use for advertising purposes at any time (see below).

Storage period or criteria for determining the duration
Within the framework of our existing business relationship with you, we store your personal data for as long as the business relationship lasts. This includes the initiation and execution of the contract as well as the regular statute of limitations. In addition, we store the data collected in connection with the purchase if and to the extent that we are subject to statutory retention obligations. These may arise, for example, from the German Commercial Code (HGB) or the German Fiscal Code (AO). Necessity of providing the data In order to process the sale of products from the online shop, it is necessary for you to provide us with the above-mentioned data. Without the provision of this data, we cannot send you the products or make them available to you. 

Possible recipients of the data
Shippers (postal services), IT service providers (e.g. for maintenance/hosting, ticketing), service providers for file and data destruction, telecommunications, payment service providers, auditors, web hosting service providers, contractual partners. Data is not processed outside the EEA.

Information on the rights of data subjects
The data subject has the right to obtain from the controller confirmation as to whether personal data concerning him or her are being processed; where that is the case, he or she has the right to access the personal data and to the information specified in Article 15 GDPR.

The data subject has the right to obtain from the controller without undue delay the rectification of inaccurate personal data concerning him or her and, where applicable, the completion of incomplete personal data (Art. 16 GDPR).

The data subject has the right to request that the controller delete personal data concerning them without delay if one of the reasons specified in Art. 17 GDPR applies, e.g. if the data is no longer required for the purposes pursued (right to erasure). 

The data subject has the right to request that the controller restrict processing if one of the conditions listed in Art. 18 GDPR applies, e.g. if the data subject has objected to the processing, for the duration of the controller's review. 

The data subject has the right to object at any time to the processing of personal data concerning him or her on grounds relating to his or her particular situation. The controller shall then no longer process the personal data unless it can demonstrate compelling legitimate grounds for the processing which override the interests, rights, and freedoms of the data subject, or the processing serves to assert, exercise, or defend legal claims (Art. 21(1) GDPR).

If personal data is processed for direct marketing purposes, the data subject has the right to object at any time to the processing of personal data concerning him or her for such marketing purposes (Art. 21(2) GDPR). If the data subject objects to processing for direct marketing purposes, the personal data will no longer be processed for these purposes (Art. 21 (3) GDPR).

Without prejudice to any other administrative or judicial remedy, every data subject has the right to lodge a complaint with a supervisory authority if the data subject considers that the processing of personal data concerning him or her infringes the GDPR (Art. 77 GDPR). The data subject may exercise this right with a supervisory authority in the Member State of their residence, place of work, or place of the alleged infringement. In Bavaria, the competent supervisory authority is the Bavarian State Office for Data Protection Supervision.

You also have the right to withdraw your consent at any time without affecting the lawfulness of processing based on your consent prior to its withdrawal. 

To exercise your rights, you can contact the controller or the data protection officer using the contact details provided. We will process your requests promptly and in accordance with legal requirements and inform you of the measures we have taken.

Last updated: October 7, 2025