Privacy policy

Overview

You can use our website without providing any personal data. We do not set cookies, do not store anything in your browser and do not use tracking or marketing services. When you visit the website, it does not load content from third parties: fonts, images and scripts are delivered from our own server. This is why there is no cookie banner on this website.

The only exception is the Google reCAPTCHA spam protection in the contact and the application form. It is only loaded after you have given your consent in the form (see “Spam protection with Google reCAPTCHA”).

Below we explain which data we process for which purpose, on which legal basis, who receives it and how long we keep it. “Personal data” means any information relating to an identified or identifiable natural person, for example name, email address, phone number or IP address.

Hosting, server log files and encryption

The website is operated on Amazon Web Services (Amazon Web Services EMEA SARL, Luxembourg) in the Frankfurt am Main data centre. This is based on the AWS Data Processing Addendum.

Each time a page is requested, our web server stores technically necessary information in log files: IP address, date and time, requested address, status code, amount of data transferred, previously visited page (referrer) and browser identification. We use this information only for secure operation, to defend against attacks and for troubleshooting. Form contents are not part of the log files. The legal basis is our legitimate interest in a secure and working website (Art. 6(1)(f) GDPR). The log files are deleted after 14 days.

The connection to our website is always encrypted (HTTPS). Emails from the forms are also sent to our email provider in encrypted form (TLS).

Contact requests

Which data: name, email address, chosen office and message (required) as well as, voluntarily, company, phone number, requested service and event or period. Without the required details we cannot answer your request; you can, however, always reach us by email or phone.

Purpose and recipients: We answer your request. It is sent by email to the chosen office (Spielberg or Vienna) and is not stored in a website database. We send a short confirmation of receipt to your email address without a copy of your information. We use Amazon Simple Email Service (AWS, Ireland data centre) as a processor to send it.

Legal basis: answering your request, for requests about our services as a pre-contractual measure (Art. 6(1)(b) GDPR), otherwise our legitimate interest in answering requests (Art. 6(1)(f) GDPR).

Retention: We keep your request for as long as necessary to handle it and for possible follow-up questions. If it leads to an order, the statutory retention obligations apply (in particular accounting and tax regulations).

Applying for events

Which data: the event and role you are applying for, first and last name, email address and phone number (required), your confirmation that you are at least 18 years old as well as, voluntarily, postcode and place of residence, language skills, class B driving licence, previous work for CAM, days of the event you are available and a message. Without the required details we cannot process your application; you can, however, also apply by email or phone.

Purpose and recipients: We review your application and contact you as soon as staffing for the event starts. The application is sent by email to the office responsible for the event and is not stored in a website database. You receive a short confirmation of receipt without a copy of your information. We use Amazon Simple Email Service (AWS, Ireland data centre) as a processor to send it.

Legal basis: processing your application as a pre-contractual measure (Art. 6(1)(b) GDPR).

Retention: We keep application documents for six months. If you work at an event, the section “Applications and employment” applies.

Protecting the forms against abuse

To prevent spam, we automatically check whether a form was filled in by a person (an invisible check field and a minimum time to fill in the form) and limit the number of requests per IP address. For this, the IP address is only kept in the server’s memory and discarded no later than 20 minutes after your last request. The legal basis is our legitimate interest in protecting the website and our mailboxes against abuse (Art. 6(1)(f) GDPR).

Spam protection with Google reCAPTCHA

In addition, we use Google reCAPTCHA v3 in the contact and the application form. The provider is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland (“Google”). reCAPTCHA is only loaded once you tick the consent box in the form; merely visiting our website and the form pages does not transfer any data to Google.

After your consent, your browser loads program code from Google and transmits information to Google that is used to tell people from automated programs, in particular your IP address, details of your browser and device and of how you use the page. Google may set and read cookies or similar technologies in your browser for this purpose. Google rates the request, and our server checks the result before sending; we transmit neither your IP address nor the content of your request or application to Google. According to Google, the data is used to improve reCAPTCHA and for general security purposes, not for personalised advertising. Google determines how long it keeps the data.

Legal basis: your consent (Art. 6(1)(a) GDPR, § 165(3) Austrian Telecommunications Act 2021). Without consent you cannot send the form, but you can always reach us, or apply, by email or phone. You can withdraw your consent at any time with effect for the future, for example by email to the address above; you can delete cookies set by Google in your browser. Further information: Google Privacy Policy (https://policies.google.com/privacy) and Google Terms of Service (https://policies.google.com/terms).

Applications and employment

In connection with applications and employment contracts, we process your personal data for registration as required by law, for salary payments, to send you information shortly before an event and – unless you have objected – to inform you about events at which you have already worked for us. Where necessary, we also use your data to assert and defend legal claims.

The legal bases are the performance of the contract (Art. 6(1)(b) GDPR), legal obligations (Art. 6(1)(c) GDPR) and our legitimate interest (Art. 6(1)(f) GDPR). We keep this data for as long as statutory retention obligations require, in particular under employment, social security and tax law.

Recipients and transfers to third countries

We treat your data in strict confidence. We do not pass on personal data to third parties without your express consent unless we are legally obliged to do so (for example to authorities) or it is necessary for the performance of a contract (for example tax advice).

Recipients in connection with the website are:

• Amazon Web Services EMEA SARL (Luxembourg) as a processor for hosting and sending emails; the data is stored in data centres in the EU (hosting in Frankfurt am Main, sending emails in Ireland). Access by the parent company Amazon Web Services, Inc. in the USA cannot be completely ruled out; AWS bases transfers to the USA on the EU-US Data Privacy Framework and the European Commission’s standard contractual clauses.
• Google Ireland Limited only after your consent in the form (see “Spam protection with Google reCAPTCHA”). Data may be transferred to Google LLC in the USA; Google LLC is certified under the EU-US Data Privacy Framework.

No automated decision-making

We do not make decisions based solely on automated processing that have legal effects on you (Art. 22 GDPR). The automatic spam check only decides whether a form is accepted; if it is rejected, we show you the phone number and email address of the office.

Race calendar

We load the Formula 1 and MotoGP race calendar on our server from our ticket partner Grand Prix Tickets; the images are also delivered by our own server. No data about you is transmitted to Grand Prix Tickets.

Links to other websites

Our website contains links to OpenStreetMap, Instagram, Facebook and Grand Prix Tickets and, in the forms, to Google’s privacy policy and terms of service. These are plain links: data is only transferred when you click a link. From then on, the privacy policy of the respective provider applies.

Web analytics

We currently do not use web analytics.

Your rights

You have the right of access (Art. 15 GDPR), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18) and data portability (Art. 20). You can withdraw any consent you have given at any time with effect for the future; this does not affect the lawfulness of processing before the withdrawal. Please contact the email address above or one of our postal addresses.

Right to object (Art. 21 GDPR): Where we process your data on the basis of our legitimate interest (Art. 6(1)(f) GDPR), you can object at any time on grounds relating to your particular situation. You can object to being informed about further events at any time without giving reasons.

We answer your request within one month. As we must make sure that you are the person entitled, we may ask for ID or other proof of identity. We take note of requests by phone, but we only provide information after identification and exclusively by email or post.

Right to lodge a complaint

If you believe that the processing of your data violates data protection law, you can lodge a complaint with the supervisory authority. In Austria, this is the Data Protection Authority (Datenschutzbehörde), Barichgasse 40–42, 1030 Vienna, www.dsb.gv.at.

Last updated: 16 October 2026