Privacy policy

1.Controller and contact

1. The controller of the personal data of users of the skionline.eu website is SKIONLINE Sp. z o.o., ul. Prosta 109, Kawęczynek, 05-520 Konstancin-Jeziorna, Poland, KRS 0000815915, NIP 123-145-56-23 (hereinafter: “we”). skionline.eu is the English edition of skionline.pl; skionline.pl and its ski market have their own documents.
2. For personal data matters, write to [email protected] or by post to our registered office address. We do not handle personal data matters by telephone.
3. We have not appointed a data protection officer; we are not required to do so.
4. In some matters another entity is the controller: Google for advertising (section 4.2). We indicate this for each purpose.

2.Where we get data from

• from you: the contact form and e‑mails you send us,
• automatically: technical connection data (section 6) and, after your consent, data from cookies (cookie policy),
• from public sources: sources of editorial content.

3.Why we process data and on what legal basis

Abbreviations of the legal bases under Article 6(1) GDPR: (a) consent, (b) contract or steps taken before entering into it, (c) legal obligation, (f) our legitimate interest (named next to the letter). Storing and accessing information on your device for purposes other than strictly necessary ones (statistics, advertising) additionally requires consent under Article 399 of the Polish Electronic Communications Law (Prawo komunikacji elektronicznej).

3.1. Contact form

1. We are the controller of data from the contact form (section 1). You provide a subject (editorial, advertising and partnerships, something else), your first name, e‑mail address and the content of the message. All fields are required; without them we cannot reply to the message.
2. We process the data to reply to the message and to continue the correspondence: this is our legitimate interest (Article 6(1)(f) GDPR).
3. We forward the message by e‑mail to our mailbox [email protected] (Google Workspace) and reply to the e‑mail address provided. On the website we keep the message for 90 days from sending, and its copy in the mailbox for up to 12 months from the last message in the matter.
4. We use the sender’s IP address solely to protect the form against abuse and do not store it permanently. The form is also protected by the Cloudflare Turnstile service (section 4).
5. You have the rights described in section 8, including the right to object to processing based on legitimate interest.

On skionline.eu we do not process national identification numbers, identity document numbers, health data or payment card data.

4.Recipients of data

4.1. Entities processing data on our behalf

4.2. Separate controllers

• Google Ireland Limited for Google ads on the website; how Google uses data from partner websites,
• Cloudflare, Inc., to the extent that it uses data from Turnstile verification to improve bot detection,
• providers of maps and embedded content: the list, when they load and the data passed to them are set out in the cookie policy, section 6,
• public authorities, where the law requires it.

5.Transfers of data outside the European Economic Area

1. We host the website on servers in Poland (OVH), and e‑mail in Google Workspace; as a rule, we process data in the EEA. The following may be transferred outside the EEA:
   • technical data (IP address, cookie identifiers, pages visited and events) to Google LLC for visit statistics and advertising, and to Cloudflare, Inc. for content delivery and Turnstile verification: on the basis of European Commission adequacy decision (EU) 2023/1795 (EU-US Data Privacy Framework), to which these companies have signed up,
   • e‑mail correspondence in Google Workspace to Google LLC: on the basis of the European Commission adequacy decision (EU-US Data Privacy Framework) and standard contractual clauses.
2. Video players loaded after you click connect your browser directly to the provider (cookie policy, section 6).
3. You can obtain a copy of the safeguards by writing to [email protected].

6.Technical data and logs

1. The server records in its logs the IP address, the address of the requested page, the browser, the time and the referring page. Logs are used to ensure security and fix errors; we keep them for 14 days.
2. The map fetches tiles from the OpenFreeMap server: the provider receives the IP address and the coordinates of the area being viewed (cookie policy, section 6).
3. We do not permanently store the IP address used to protect forms and search against abuse.

7.Security

We apply technical and organisational measures appropriate to the risk (Article 32 GDPR), including encryption of connections to the website. Only authorised persons have access to the data.

8.Your rights

1. You have the right to access your data and obtain a copy of it, the right to rectification, erasure, restriction of processing and data portability (where the basis is a contract or consent), and the right to withdraw consent at any time without affecting earlier processing. You can withdraw consent to cookies using the “Cookie settings” link in the page footer or in the cookie policy.
2. You have the right to object at any time to processing based on our legitimate interest. After an objection we stop processing the data unless we demonstrate compelling, overriding grounds.
3. Send your request to [email protected]. We reply within one month; for complex matters we may extend this period by a further two months, and we will inform you of this. We may ask you to confirm your identity.
4. You have the right to lodge a complaint with the President of the Personal Data Protection Office (Prezes Urzędu Ochrony Danych Osobowych), ul. Stawki 2, 00-193 Warszawa, Poland, uodo.gov.pl, or with the supervisory authority of the EU country where you live or work.
5. Providing data is voluntary, but without the data marked as required we will not reply to a message.

9.Profiling, automated decisions, statistics and advertising

1. We do not profile users ourselves and do not make decisions about them based solely on automated processing which produce legal effects concerning them or similarly significantly affect them (Article 22 GDPR). We do not send a newsletter or carry out direct marketing from skionline.eu.
2. For visit statistics we use Google Analytics 4. Google Analytics cookies are stored only after you consent to statistics in the consent banner. Without consent, Google receives only measurements without cookies and without a browser identifier (Google consent mode), on the basis of which it estimates traffic. We do not pass personal data from forms to Google. Details: cookie policy, section 4.
3. We display ads on the website via Google Ad Manager and Google AdSense. Without your consent to advertising, Google shows limited ads without cookies, and after consent in the banner it stores advertising cookies and shows ads tailored to your interests (Google’s rules on advertising). You can withdraw consent in “Cookie settings” (cookie policy, section 7); you can also switch off ads selected on the basis of your activity in your Google account settings (adssettings.google.com).

10.Changes to the policy

We change the policy when the law, the scope of our services or our providers change. The new version has its date in the header; we make previous versions available on request.