- The way their personal data is collected and processed. All data likely to identify a user must be considered personal data. In particular this means first name, last name, age, mailing address, email address, a user's location or even IP address.
- Users' rights concerning this data
- Who is responsible for handling the personal data collected and processed
- To whom this data is sent
- Possibly, the site's policy towards cookies
2. General principles around collecting and processing data
In keeping with the provisions of article 5 of European regulation 2016/679, the collection and processing of data of the site's users respect the following principles:
- Legality, good faith and transparency: the data can only be collected and processed with consent of the users who own the data. Each time personal data is collected, users will be notified that their data was collected, and for what reasons their data was collected.
- Limited purposes: data is collected and processed to respond to one or more objectives set out in these general terms and conditions of use
- Minimizing the collection and processing of data: only data necessary to properly execute objectives being pursued by the site are collected
- Retention of data for limited time: data is retained for a limited period, indicated to users. If the retention period cannot be communicated to the user
- Integrity and confidentiality of data collected and processed: the party responsible for data processing promises to guarantee the integrity and confidentiality of collected data.
To be legitimate, and in keeping with the requirements of article 6 of European regulation 2016/679, personal data can only be collected and processed if at least one of the conditions listed hereafter is followed:
- The user has expressly consented to processing
- Processing is necessary for the proper execution of a contract
- The processing responds to a legal obligation
- Processing is justified by a need associated with protecting the vital interests of the individual concerned or another individual
- Processing can be justified by a need associated with executing a task in the public interest or one that falls under the exercise of official authority
- Processing and collection of personal data are necessary for the purposes of legitimate, private interests being pursued by the processing party or by a third party
3. Personal data collected and processed while browsing the site
A. Data collected and processed and collection method
The personal data collected on the www.my-ski.fr/en site is as follows:
- Mandatory: Last name, first name, email, mailing address, city, country of residence
- Optional: title, birthdate, first name of individual(s) associated with each package or piece of equipment rented, landline or mobile phone number, size, shoe size, age, sex, ski ability level, weight, calf type, foot width, head size.
This data is collected when users perform one of the following operations on the site:
- Use of contact forms, online order on the www.my-ski.fr/en website, newsletter signup
The processing party will retain all the data collected in the site's information systems under reasonably secure conditions for the following periods:
- Encrypted bank data handled by a third banking party for the time it takes to complete the payment transaction
- 6 months for login data
- 3 years from the end of a business relationship for customers
- 5 years involving a rental contract
- 10 years involving accounting and financial data
Data collection and processing respond to the following purposes:
- Managing online reservations
- Creating an account
- Ordering on the website
- Tracking an order
- Sending personalised recommendations and promotions for similar services or products
- Sending the newsletter
- Requesting feedback on transactions or customer experiences
- Measuring audiences and creating statistics
B. Transmission of data to third parties
The data may be communicated to the third party (parties) listed hereafter:
- To companies in the SPC Group
To technical service providers, especially those who:
- Process payments
- Route emails, both transactional and sales-related
- Analyse traffic on the Group's websites
C. Hosting data
The www.my-ski.fr/en site is hosted by:
114 Rue Ambroise Croizat, Saint-Denis 93200, France
The hosting company can be contacted at the following telephone number: +188.8.131.52.00
The data collected and processed by the site is transferred to the following country (countries): Switzerland. This transfer of personal data outside the European Union is justified by the technologies associated with hosting.
4. Data processing party and data protection officer
A. Data processing party
The party responsible for processing personal data is: SPC, 424 Bureaux de la Colline, 92210 St. Cloud, registered with the Trade and Companies Registry under number: 877 610 923. It can be contacted in the following ways:
The data processing party is responsible for determining the purposes and means used for processing personal data.
B. Obligations of data processing party
The processing party promises to protect personal data collected, to not communicate it to third parties without informing users and to respect the purposes for which this data was collected.
The site has an SSL certificate to guarantee that the information and data transfer passing through the site are secured.
The goal of a Secure Socket Layer (SSL) certificate is to secure data exchanged between users and the site.
Further, the data processing party promises to notify users in case of correction or deletion of data, unless this would cause disproportionate processes, costs and formalities for it.
In the event the integrity, confidentiality or security of users' personal data is compromised, the processing party promises to inform users by all means.
C. Data protection officer
sers are notified that the following individual was named Data Protection Officer: Mr. Thomas Ducasse
The role of the Data Protection Officer is to ensure that national and supranational provisions relating to the collection and processing of personal data are implemented properly. He is sometimes referred to as the DPO.
The Data Protection Officer may be contacted in the following way: [email protected]
5. Users' rights
In keeping with regulations concerning the processing of personal data, users possess the rights listed hereafter.
For the data processing party to grant requests, users must communicate: their first and last names, as well as their email address and, if relevant, their subscriber, personal space or account number.
The data processing party must respond to users within a period of 30 (thirty) days, which can be extended to 60 (sixty) days, depending on the complexity or number of requests.
A. Presentation of users' rights in collecting and processing data
A. Right to access, correct and right to erase
In keeping with European regulations on protecting personal data, you have a right to access, correct, erase and limit, and a right to portability and opposition of your personal data processed by SPC.
You can exercise these rights at any time and at no cost by sending an email to [email protected], or a letter to SPC – Attn. DPO, 424 Bureaux de la colline, 92210 St Cloud (FRANCE)
B. Right not to be subject to a decision made solely on automatic processes
In keeping with the provisions of regulation 2016/679, users have the right not to be subject to a decision made solely on an automatic process, if the decision produces legal effects for them, or affects them significantly in a similar way.
C. Right to determine fate of data after death
Users are reminded that they may decide on the future of their collected and processed data in case they die, in keeping with law no. 2016-1321 of 7 October 2016.
D. Right to appeal to the responsible supervisory authority
In the event the data processing party decides not to respond to users' requests, and users wish to challenge this decision, or if they think one of the rights listed below has been infringed, they have the right to appeal to the CNIL (the French Data Protection Authority, https://www.cnil.fr) or any judge with jurisdiction.
Any request must be signed and accompanied by a photocopy of a piece of identification and specify the address where a request is expected.
B. Personal data of minors
In keeping with the provisions of article 8 of European regulation 2016/679 and the Data Protection Act, only minors 15 years and older may consent to the processing of their personal data.
If a user is a minor under 15 years old, consent from a legal representative will be required before the personal data can be collected and processed.
The site's publisher reserves the right to verify in any way that a user is over 15 years old, or that they have obtained consent from a legal representative before browsing the site.
The site may resort to the technology of 'cookies'.
A cookie is a small file (under 4KB) stored by the site on a user's hard drive, containing information relating to the user's web browsing habits.
These files allow it to process statistics and traffic information, facilitate browsing and improve the service for users' convenience.
This consent by the user is considered valid for a period of 13 (thirteen) months maximum. At the end of this period, the site will again ask for the user's authorisation to save cookies on their hard drive.
Users are made aware that they may oppose cookies being saved by configuring their web browser.
For reference, users may find the steps to follow at the addresses below to configure their web browsers to stop cookies from being saved:
- Chrome: https://support.google.com/accounts/answer/61416?hl=fr
- Firefox: https://support.mozilla.org/fr/kb/enable-and-disable-cookies-website-preferences
- Safari: http://www.apple.com/legal/privacy/fr-ww/
- Internet Explorer: https://support.microsoft.com/fr-fr/help/17442/windows-internet-explorer-delete-manage-cookies/
- Opera: http://www.opera.com/help/tutorials/security/cookies/
In the event users decide to deactivate their cookies, they may continue browsing the site. However, any problem on the site caused by this change cannot be considered the fault of the site's publisher.
The site's publisher reserves the right to modify it to guarantee it complies with applicable laws.