Privacy Policy

The Base Zell am See GmbH

1. Data Controller

The controller within the meaning of the General Data Protection Regulation (GDPR) is:

The Base Zell am See GmbH

Karl Vogt Straße 65, 5700 Zell am See

Commercial Register No. FN 682009 f, Commercial Court Salzburg

Tax No. 90 390/8440 · VAT ID: ATU83406903

Phone: +436645077648 · Email: office@thebase-zellamsee.at

2. General Information on Data Processing

We process the personal data of our users and members only to the extent necessary to provide our services (court bookings, membership), where there is a legal obligation to do so, or where you have given your consent to the processing. Processing is based on Art. 6 para. 1 lit. a (consent), lit. b (performance of a contract), lit. c (legal obligation), and lit. f (legitimate interest) GDPR.

3. Use of the Website

When you visit our website, our hosting provider Hostinger (Hostinger International Ltd.) automatically processes technical access data (server log files), including the IP address, date and time of access, page accessed, and browser type. This data is used for the technical provision and security of the website and is automatically deleted after [period, e.g., 7 days]. The legal basis is Art. 6 para. 1 lit. f GDPR (legitimate interest in the secure and functional operation of the website).

Cookies and Consent

In addition to technically necessary cookies, our website also uses cookies and comparable technologies from third-party providers (Google Analytics), which are only set or loaded after you have actively given your consent via our cookie consent tool. You may withdraw your consent at any time with effect for the future by deleting the cookies in your web browser.

Google Analytics

We use the web analytics service Google Analytics, provided by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland (Google). Google Analytics uses cookies that enable an analysis of website usage (e.g., pages visited, time spent on the site, approximate location of visitors). The information generated is transferred to and processed on Google's servers, potentially including its parent company Google LLC, USA.

The legal basis is your consent (Art. 6 para. 1 lit. a GDPR). Where data is transferred to the USA, we rely on the safeguards offered by Google (e.g., EU Standard Contractual Clauses or participation in the EU-U.S. Data Privacy Framework). Further information can be found in Google's privacy policy at https://policies.google.com/privacy.

4. Booking and Membership via Eversports

We use the booking platform Eversports for booking tennis and padel courts, as well as for concluding and managing functional fitness memberships. In this context, your master data (name, address, email address, telephone number, date of birth) as well as booking, contract, and payment data are processed in order to carry out and bill the booking or membership. The legal basis is Art. 6 para. 1 lit. b GDPR (performance of a contract). Payment data is used exclusively to process the agreed payments; membership fees are paid by bank transfer to our account, even where the contract is concluded via Eversports.

For the use of an Eversports customer account (creating the account, login, cross-account booking history with other providers on the Eversports platform), Eversports is an independent controller within the meaning of the GDPR, not us. Eversports' own privacy policy applies in addition, available at https://www.eversports.de/h/privacy.

Health-Related Information

When concluding a membership contract, you confirm that you have no health limitations that would preclude participation in the training, or you inform us of any existing limitations. Where health data (special categories of personal data under Art. 9 GDPR) is processed in this context, this is done exclusively on the basis of your explicit consent (Art. 9 para. 2 lit. a GDPR), which you give separately when concluding the contract and which you may withdraw at any time with effect for the future. This information is used exclusively to ensure safe training and is not disclosed to third parties, except where necessary to avert a risk to health.

For minor members, the corresponding information is provided by their legal representative in the course of giving consent to the conclusion of the contract.

5. Video Surveillance

Parts of our facility are monitored by video for security reasons, in particular because our staff is not present on-site at all times. The monitored areas are marked with signage prior to entry.

Purpose of Processing

Protection of persons and property, as well as the investigation of incidents (e.g., property damage, theft, violation of the terms of use).

Legal Basis

Art. 6 para. 1 lit. f GDPR (legitimate interest in the safety of persons and property, and in protecting the facility during unsupervised operation).

Scope and Exceptions

Only the entrance, outdoor, and playing areas are recorded. Changing rooms, showers, and restroom areas are excluded from any camera surveillance.

Retention Period

Recordings are automatically deleted after 72 hours, unless they are still required to investigate a specific incident (e.g., for evidence preservation or disclosure to security authorities). In such cases, the relevant recordings are separately preserved until the respective proceedings have concluded.

Recipients

Access to the recordings is restricted to the managing directors and, in individual cases, persons authorized to investigate a specific incident (e.g., security authorities in the event of a report, insurers in the event of a claim).

6. Recipients and Processors

Your data is disclosed, where necessary, to the following categories of recipients:

• Booking platform Eversports (court booking, payment processing)

• Bank(s) (processing of bank transfers/direct debits)

• Tax advisor (bookkeeping, statutory retention obligations)

• Website hosting provider: Hostinger (Hostinger International Ltd.)

• Google Ireland Limited / Google LLC (e.g., Google Analytics, only where consent has been given)

• Authorities, insofar as there is a legal obligation to disclose data

Data is not transferred to third countries outside the EU/EEA, unless this is carried out by one of the service providers named above and is safeguarded by appropriate guarantees (e.g., EU Standard Contractual Clauses).

7. Retention Period

Personal data that we process ourselves is deleted as soon as the purpose of the processing no longer applies, provided no statutory retention obligations apply. Accounting and invoicing data must generally be retained for 7 years pursuant to statutory requirements (Austrian Commercial Code (UGB), Federal Fiscal Code (BAO)). The retention period set out in Section 5 applies to video surveillance recordings.

A different retention period applies to data stored as part of a booking within the Eversports customer account (e.g., profile data, booking history): this data remains in the user's Eversports account for as long as that account exists and is not automatically deleted by us or by Eversports once the purpose of the processing (e.g., an individual booking) no longer applies. Deletion only takes place once the user deletes their Eversports account themselves, or in accordance with Eversports' privacy policy, available at https://www.eversports.de/h/privacy. If you would like the data we hold about you to be deleted, please contact us at the address given in Section 1; to delete your Eversports account itself, please also contact Eversports directly.

8. Your Rights as a Data Subject

Subject to the applicable statutory requirements, you have the following rights:

• Right of access to the data processed about you (Art. 15 GDPR)

• Right to rectification of inaccurate data (Art. 16 GDPR)

• Right to erasure of your data (Art. 17 GDPR)

• Right to restriction of processing (Art. 18 GDPR)

• Right to data portability (Art. 20 GDPR)

• Right to object to the processing (Art. 21 GDPR)

• Right to withdraw consent given, with effect for the future (Art. 7 para. 3 GDPR)

To exercise your rights, please contact us at the address given in Section 1.

9. Right to Lodge a Complaint

You have the right to lodge a complaint with the Austrian Data Protection Authority if you believe that the processing of your personal data violates the GDPR:

Austrian Data Protection Authority (Österreichische Datenschutzbehörde), Barichgasse 40–42, 1030 Vienna, www.dsb.gv.at

10. Changes to This Privacy Policy

We reserve the right to amend this privacy policy in order to adapt it to changes in the legal situation or to changes in our services. The version published on the website at any given time shall apply.

As of: July 2026