We take the protection of your personal data seriously. This policy explains what data we process when you use our website at www.stgis.at, on what basis, and what rights you have. We process personal data in accordance with the EU General Data Protection Regulation (GDPR), the Austrian Data Protection Act (DSG) and the Austrian Telecommunications Act (TKG 2021).
This policy covers our own website. Where we link to third-party websites, their own privacy policies apply.
1. Controller
St. Gilgen International School GmbH
Ischlerstrasse 13, 5340 St. Gilgen, Austria
Tel. +43 6227 202 59 · info@stgis.at
For all data protection enquiries, please contact us at info@stgis.at.
2. Visiting our website
Each time you visit, our server automatically records your IP address, browser type and version, operating system, referring page, the pages you view, and the date and time of access. This is technically necessary to deliver the website and to maintain its security and stability.
Legal basis: Art. 6(1)(f) GDPR — our legitimate interest in operating a secure and functioning website.
Storage: log data is deleted after no more than 30 days.
We use Cloudflare (Cloudflare, Inc.) as a content delivery network and for protection against automated attacks, including Cloudflare Turnstile on our forms. This involves processing your IP address.
3. Enquiries, school tours and applications
If you contact us by email, submit an enquiry, book a school tour, register for an event or submit an application, we process the information you provide — typically the name and contact details of the parent or guardian and of the prospective student, the student’s date of birth, nationality and educational background, and the content of your message.
In a full application we also process information about health, medication, allergies, immunisations, dietary requirements and any learning or emotional support needs. This is special category data.
Legal basis: Art. 6(1)(b) GDPR for steps taken at your request prior to entering into a contract, and for the performance of a contract. For health and support information, Art. 9(2)(a) GDPR — your explicit consent, which you may withdraw at any time with effect for the future.
Storage: enquiry and event data is deleted once the matter is concluded, event registrations after 120 days. Application data is retained for the duration of the contractual relationship and for at least two further years thereafter; unsuccessful applications are retained for two years and then anonymised or deleted, subject to statutory retention obligations.
3.1 OpenApply
For enquiries, school tour bookings and applications we use OpenApply, operated by ManageBac LLC, 548 Market St. #40438, San Francisco, CA 94104, USA, which acts as our processor under a data processing agreement pursuant to Art. 28 GDPR. Where OpenApply content is embedded on our website, it loads only after you have given your consent (Art. 6(1)(a) GDPR in conjunction with § 165(3) TKG 2021); until then no connection to OpenApply is established.
Data is stored on servers in Ireland, the United Kingdom, Canada, the USA, Hong Kong and Singapore. Transfers to the United Kingdom and Canada are based on adequacy decisions of the European Commission (Art. 45 GDPR), transfers to the USA on ManageBac LLC’s certification under the EU–U.S. Data Privacy Framework, and any further transfers on the EU Standard Contractual Clauses (Art. 46(2)(c) GDPR). Further information: OpenApply GDPR Addendum
4. Job applications
If you apply for a position, we process the data contained in your application for the purpose of the recruitment process, on the basis of Art. 6(1)(b) GDPR. Unsuccessful applications are deleted six months after the process concludes, unless you consent to our retaining them longer.
5. Cookies, analytics and advertising
Our website uses cookies and similar technologies. Those that are technically necessary are used on the basis of Art. 6(1)(f) GDPR. All others are used only with your consent, which we obtain through our consent banner (Art. 6(1)(a) GDPR, § 165(3) TKG 2021). You can review and change your choices at any time via the cookie settings link on our website.
With your consent, we use:
- Google Analytics 4 and Google Ads, provided by Google Ireland Limited, to measure how our website is used and the effectiveness of our advertising, and to show you relevant advertising on Google services.
- Meta pixel, provided by Meta Platforms Ireland Limited, to measure and target advertising on Facebook and Instagram.
- TikTok pixel, provided by TikTok Technology Limited, for the same purpose on TikTok.
- Microsoft Clarity, provided by Microsoft Ireland Operations Limited, to understand how visitors use our pages.
- Jetpack Statistics, provided by Aut O’Mattic A8C Ireland Ltd, for basic website statistics.
These services may transfer data to the USA. The providers named are certified under the EU–U.S. Data Privacy Framework and/or rely on the EU Standard Contractual Clauses. Despite these safeguards, access by US authorities cannot be entirely ruled out.
Consent management is provided by Cookiebot (Usercentrics A/S, Denmark). A full, continuously updated list of the cookies used is available in our cookie settings.
6. Embedded content
YouTube (Google Ireland Limited) and Google Maps (Google Ireland Limited) are embedded on some pages, and our homepage displays an Instagram feed (Meta Platforms Ireland Limited). These services load only after you have consented; once loaded, your IP address is transmitted to the provider, and if you are logged in to that service the visit may be associated with your account. Legal basis: Art. 6(1)(a) GDPR.
7. Recipients of your data
We pass data to third parties only where necessary: to our IT and hosting providers, to OpenApply as described above, and to the providers named in sections 5 and 6. All processors act under a data processing agreement pursuant to Art. 28 GDPR. We also disclose data where we are legally obliged to do so.
8. Your rights
You have the right of access (Art. 15), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20) and objection (Art. 21) GDPR. Where processing is based on consent, you may withdraw it at any time with effect for the future.
Please address requests to info@stgis.at.
You also have the right to lodge a complaint with a supervisory authority. The competent authority in our case is the Austrian Data Protection Authority (Österreichische Datenschutzbehörde, Barichgasse 40–42, 1030 Vienna, dsb@dsb.gv.at).
9. Data security and changes to this policy
Our website is transmitted using TLS encryption, and we apply appropriate technical and organisational measures to protect your data against loss, misuse and unauthorised access.
We update this policy when our services or the legal requirements change. The version published here applies.
St. Gilgen, October 2026
