Personal Data Protection Policy

SKI-PLANET cares about your privacy and is committed to protecting it. We collect your personal data (your "Data") transparently.

From the moment we collect your Data, our entire team ensures to :

• Use your data lawfully, fairly, and transparently;
• Collect only the data necessary for managing our Sites and online reservations;
• Retain your data only for the duration strictly necessary to achieve the objectives of our processing, ensuring their security and confidentiality.

This policy details our approach to the collection, use, protection, and sharing of your information, which we process when you use the sites www.ski-planet.com, www.mer-evasion.com, and www.montagne-vacances.com (hereinafter referred to as the "Sites").

By accepting the General Terms and Conditions of Sale and using our services and Sites, you acknowledge that you accept SKI-PLANET's practices as described in this Personal Data Protection Policy.

For any information, questions, or comments regarding this Personal Data Protection Policy, we invite you to contact us (see "Contact" section below).

Identity of the Data Controller and Site Publisher S.A.S. SKI-PLANET R.C.S. Chambéry : 429 482 888 575, rue de la Prairie 73350 BOZEL President : S.A.S. SoftNext, represented by its General Manager

"SKI-PLANET" or "We"

Host S.A.S. OVH R.C.S. Lille : 537 407 926 2, rue Kellermann 59100 Roubaix

Data Processing

The personal data collected is essential for managing your reservation file, personalizing our site and newsletters/marketing communications according to your preferences, and combating fraud.

1. Categories of Data Collected and Processed by SKI-PLANET

SKI-PLANET collects your Data when you create or modify an account, make a reservation on the Sites, subscribe to its newsletter, fill out an online form, contact it by email, leave a review, request an online quote, or allow it to set cookies and/or communicate with you according to the proposed methods.

SKI-PLANET collects the following data for each Client booking a stay and/or subscribing to optional services on one of the Sites :

• Identity : title, last name, first name of the person for whom the reservation is made, date of birth, and, if applicable, the people accompanying them who subscribe to optional services.
• Specific information for equipment rental : height and weight.
• Contact : email address, landline and/or mobile phone number, postal address.
• Technical : IP address, browser, connection logs, registration date, desktop/mobile interface, last connection date, connection logs.
• Transaction, payment : transaction number, purchase details, stay dates, subscription dates, purchased item or service details, data strictly necessary for payment execution; discounts granted, receipts, balances, and credits subscribed (amount and duration, name of the lending institution) if the order is financed by credit.

We inform you that SKI-PLANET does not have any information regarding the bank card used in transactions. The information collected for your payment by this method is directly collected by our payment provider, which is PCI DSS certified.

Additionally, SKI-PLANET may collect the following data from users of the Sites, depending on the data they share, with their consent if applicable :

• Identity : title, last name, first name.
• Contact : email address, landline and/or mobile phone number.
• Technical : IP address, browser, registration date, desktop/mobile interface, last connection date, connection logs, selection of favorites.

SKI-PLANET may collect data related to contributions from people who leave reviews on its services, products, or content, including their pseudonym.

2. Types of Processing Operated by SKI-PLANET

Collection via its online forms (reservation and contact), recording, organization, storage, adaptation, modification, extraction, consultation, use, communication by transmission or dissemination or any other form of making available, matching, profiling.

3. Purposes and Legal Bases of Data Processing

Depending on the cases and contexts, we may process your Data for the following purposes :

• Management of our contractual relationship (pre and post-contract period included) – legal basis : contractual performance :
  • creating quotes;
  • organizing and managing your stay reservations, service orders, and insurance subscriptions, if applicable;
  • customer relationship follow-up : after-sales service, satisfaction surveys, complaint management, request for reviews;
  • managing requests; queries, and suggestions sent by email and contact forms.
• Sending communications by electronic, postal, or telephone means regarding SKI-PLANET news, commercial offers related to the Sites, games, contests, sponsorships, during the retention period of prospect and client Data defined below - legal bases : consent or legitimate interest of SKI-PLANET when you are a SKI-PLANET client and the communication concerns products or services similar to those you previously purchased;
• Communication : online publication (website, social networks) of reviews and comments – legal basis : consent (prior information about publication before collecting the review);
• Management of the exercise of your rights - legal basis : legal obligation;
• Securing the Sites - legal basis : legal obligation;
• Quality studies, statistical analyses to improve the user experience on the Sites, communications, and SKI-PLANET’s product and service offering – legal basis : legitimate interest of SKI-PLANET;
• Compliance with our legal obligations, including tax and security, with national control authorities and other regulatory bodies - legal basis : legal obligation;
• Accounting management - legal basis : legal obligation.

4. Retention Period of Personal Data

We retain Data only for periods consistent with the principles set out by Regulation (EU) 2016/679 of the European Parliament and Council of April 27, 2016, on the protection of individuals with regard to the processing of personal data and on the free movement of such data, repealing Directive 95/46/EC (General Data Protection Regulation) ("GDPR"), if the processing purpose is still ongoing and depending on the nature of the Data. Once the periods are exhausted, these Data will be deleted or archived in the cases provided for by law.

Notably, subject to the possible exercise of your rights :

• Client and prospect data : up to 5 years after the end of the business relationship or the last positive act by a prospect or client (e.g., newsletter subscription, request for information, active consultation of our communicated offers, login to your account, etc.).
• Data related to a contract : 5 years or beyond, if applicable, until the closure of ongoing litigation or pre-litigation.
• Billing data : 10 years, in accordance with the Commercial Code.
• Technical data related to cybersecurity obligations : 12 months.

5. Transfer of Personal Data

Access to your Data is strictly limited to SKI-PLANET employees and agents authorized due to their functions and bound by a confidentiality obligation.

In addition to our internal services, Data may be shared, to the necessary extent, with our subcontractors (e.g., server host, email and SMS sending platform, cookie consent collection), contractually responsible for performing the services necessary for the proper functioning of the Sites and/or the proper management of SKI-PLANET's operations and communications; and with our suppliers responsible for executing your reservations and orders (e.g., accommodation, ski equipment, ski lifts, ski schools, insurance and other providers, depending on the options subscribed).

SKI-PLANET pays particular attention to ensuring that subcontractors' servers operate within the European Economic Area and Switzerland. However, if SKI-PLANET were to transfer personal data to a country outside this area, SKI-PLANET will ensure that it is a country with a level of protection considered adequate by European authorities. Otherwise, we undertake to frame the transfer concerned with appropriate safeguards in accordance with applicable legislation.

In all cases, these recipients are subject to a confidentiality obligation and may only use your Data in accordance with our contractual provisions aimed at protecting your data, and applicable legislation.

Furthermore, SKI-PLANET will communicate the following Data to its suppliers (notably hosts, service providers delivering the reserved and ordered services, and the insurer or its representative, if applicable), such Data being communicated solely for the purpose of providing you with the services you have reserved, subscribed to, and/or ordered : your name, your mobile number (to manage late arrivals), your arrival and departure dates, the identifier, city, and characteristics of the accommodation and your subscribed options, the applicable VAT-inclusive price on the day of your reservation. The names, first names, and birthdates of all individuals benefiting from the options you have subscribed to may also be communicated to these suppliers if this information is necessary for them to execute the services corresponding to these options.

Apart from the aforementioned cases, we undertake not to sell, rent, transfer, or give access to unauthorized third parties to your Data without your prior consent.

Moreover, SKI-PLANET may share its clients' and users' Data if the law or judicial process requires it, if any public authority requests it, or if the transmission of such Data is necessary to ensure the safety of its Clients and protect its own rights, in application of the applicable GDPR provisions.

6. SKI-PLANET's Obligations

SKI-PLANET commits to adhering to the provisions of the amended law of January 6, 1978, concerning data processing, files, and liberties, as well as the provisions of the GDPR and any other applicable regulations that may supplement or replace them in the future.

To this end, SKI-PLANET commits to the following obligations:

• Process Data only within the framework of this Personal Data Protection Policy.
• Ensure that only duly informed personnel have access to the Data.
• Implement technical and organizational measures to protect the Data, as required by the GDPR, specifically to ensure that the Data is not used, manipulated, distributed, copied, or processed for purposes other than those specified in this Privacy Policy.

SKI-PLANET has chosen a French host for its Sites and databases, whose servers are located in France with OVH, and an SSL encryption for banking transactions. No credit card number is stored after the transaction.

Your Data is stored on a secure server protected by a firewall and antivirus. We implement security measures designed to ensure the confidentiality of your Data against any accidental loss and against any unauthorized access, use, modification, and disclosure.

Given the inherent characteristics of the Internet, it is nevertheless impossible for us to guarantee optimal security for information exchanges on this network. We strive to protect your Data, but we cannot guarantee the absolute security of information transmitted on the Sites or when connecting to your personal account.

We cannot be held responsible for non-compliance with privacy settings or security measures in place on the Sites. As such, you accept that the security of your information is also your responsibility. For example, it is your responsibility to keep confidential the identification Data that allows you to access your Client Area. Do not disclose them to third parties under any circumstances.

Finally, for your online credit card payments, SKI-PLANET uses a recognized market provider, PCI DSS certified, with whom all communication is encrypted via SSL.

7. Cookies

Cookies and other trackers are deployed on the Sites in compliance with recommendation no. 2019-093 of July 4, 2019, which users can access via a banner allowing them to continue browsing without accepting optional cookies, accept them, or specifically choose which ones they consent to.

We notably perform audience measurements.

For more details on the cookies deployed on the Sites: https://www.ski-planet.com/fr/infos/charte-sur-les-cookies.php

8. Exercising Your Rights

In accordance with the provisions of the GDPR, you have rights related to the processing of your Data. To exercise your rights, please contact us using the information in the following Section.

Right of Access
When we process Data for account management, billing, or marketing purposes, we provide you the opportunity to access, review, modify, and delete any personal information we process in accordance with GDPR provisions.
You have the right to request that we disclose certain information regarding the collection and use of your personal information.

Right to Rectification
You have the right to obtain the rectification of inaccurate Data concerning you and to have incomplete Data completed. You can exercise this right directly through your personal account or by contacting SKI-PLANET at the "Contact" details.

Right to Restrict or Object to Processing
You have the right to restrict the processing of your Data under certain circumstances. This means you can limit how we use your data.

The right to restrict the processing of your personal Data can be exercised in the following circumstances:

• You contest the accuracy of your personal Data.
• Your personal Data has been processed unlawfully.

This right is an alternative to your right to erasure.

Right to Erasure
You have the right to request that we delete all Data we have collected from you and stored, subject to certain exceptions.

We may deny your deletion request if retaining the information is necessary to enable us or our providers and/or subcontractors to:

• Complete the transaction for which we collected the Data, provide the service you requested, or fulfill our obligations reasonably.
• Comply with a legal or regulatory obligation.
• Detect security incidents, protect against malicious, deceptive, fraudulent, or illegal activities, or prosecute those responsible for such activities.
• Identify and repair errors that impair existing service functionality.

Right to Withdraw Consent
If we have collected and processed your Data based on your consent, you can withdraw your consent at any time. Withdrawing your consent will not affect the legality of any processing we conducted prior to your withdrawal, nor will it affect the processing of your Data based on other legal bases provided by the GDPR.

We specify that an unsubscribe link is included in each newsletter email, and you can manage your subscription directly on our Sites.

Right to Data Portability
The right to Data portability gives you the right to receive the Data you have provided to us in a structured, commonly used, and machine-readable format. Upon your request, we can also transmit your Data directly to another entity.

9. Contact

If you have any questions, comments, or requests regarding this policy, or if you wish to exercise one of your rights related to Data protection, you can contact us:

• By sending a message using the contact form
• By mail at: SKI-PLANET - 7 avenue Jean Jaurès - 73200 Albertville

You can also file a complaint with the Commission Nationale Informatique et Libertés (CNIL), the competent GDPR supervisory authority in France:

• Through the online form available at: https://www.cnil.fr/fr/plaintes
• By mail at: CNIL - Service des Plaintes - 3 Place de Fontenoy - TSA 80715 - 75334 PARIS CEDEX 07

SKI-PLANET reserves the right to modify this Policy, particularly in response to changes in regulations related to Data protection, legal precedents, technological developments, and the processing methods implemented by SKI-PLANET.

SKI-PLANET will make its best efforts to keep you informed by any means of any modifications. When processing is based on consent, SKI-PLANET will notify you of changes to this Policy so that you can consent to the new version of the said Policy.

SKI-PLANET invites you to regularly consult the supports publishing this Personal Data Protection Policy.