1. Controller
The controller responsible for data processing on this website and on the BookYourSki booking platform is RESOL GmbH, Talstraße 101, 5700 Zell am See, Austria (FN 668286 z, Regional Court of Salzburg).
For any questions regarding data protection and to exercise your rights, you can contact us at support@bookyourski.com. Our company is not legally required to appoint a data protection officer.
2. Overview
We process personal data only to the extent necessary to operate the website, to broker your booking, to comply with legal obligations or on the basis of your consent. We do not sell personal data.
BookYourSki brokers services provided by partner businesses (e.g. ski rental, ski lessons). The respective partner business is an independent controller under data protection law for the provision of the booked service. Its name and contact details are shown to you before you complete your booking and in your booking confirmation.
3. Accessing the website and hosting
When you access our website, technically necessary data is processed: IP address, date and time, requested address, referrer, browser and device information, and technical status messages. We need this data to deliver the website and to ensure its security and stability.
The website is hosted by Vercel Inc. (USA); server-side functions run in a data centre in Dublin (Ireland). We operate the booking database with Supabase Inc. in a data centre in Frankfurt am Main (Germany). Both providers act as our processors.
The legal basis is our legitimate interest in a secure and functional website (Art. 6(1)(f) GDPR). Server logs are stored by our providers only for a short period and then deleted.
4. Bookings
What data we process
- Contact details of the person making the booking: first and last name, date of birth, email address, telephone number, postal address (street, postcode, town/city, country).
- Data of the persons for whom the booking is made (including children): first and last name, date of birth or age, skill level.
- Booking data: selected partner business and location, items, courses, periods, prices, add-ons, booking status, language.
- Your messages to the partner businesses, if you write any when booking (e.g. shoe sizes or arrival time).
- Payment status and transaction identifiers (no card data – see section 5).
- Information on the source through which you reached us, i.e. which partner link or campaign (e.g. partner identifier, UTM parameters, referring page).
Purposes and legal bases
- Brokering and processing your booking, payment processing, sending the booking confirmation and communicating with you about your booking (Art. 6(1)(b) GDPR – contract or pre-contractual measures).
- We need the dates of birth for age- and size-dependent prices, child and family offers, and for the safe adjustment of equipment by the partner business (Art. 6(1)(b) GDPR).
- Compliance with statutory retention and accounting obligations (Art. 6(1)(c) GDPR, in particular Section 132 of the Austrian Federal Fiscal Code (BAO)).
- Invoicing the brokerage commission to our partner businesses on the basis of the source information (Art. 6(1)(f) GDPR – legitimate interest in accurate invoicing).
Data of accompanying persons
If you book for other persons, in particular for children, you provide us with their data. Please inform these persons or their parents or legal guardians about this privacy policy. Bookings can only be made by persons of full age.
Recipients
- The booked partner business (an independent controller): it receives the data required to provide the service via its partner dashboard, by email and – depending on the partner – as a data transfer to its rental or merchandise management system (e.g. names, dates of birth, postal address and contact details). For bookings involving several partner businesses, each partner receives only the data relating to its own services, and only the message you wrote to it.
- Our processors for hosting, database, email delivery, PDF generation and error analysis (see sections 3, 6 and 10).
- Stripe as payment service provider (see section 5).
Providing the booking data is necessary to complete a booking. Without this data we cannot broker a booking.
5. Payment processing (Stripe)
We process payments via Stripe Payments Europe, Limited, 1 Grand Canal Street Lower, Dublin 2, Ireland. You enter your card details directly into a Stripe payment form; they do not reach our servers. For this purpose, Stripe receives your email address, the payment amount, booking references and technical device and connection data.
Stripe processes data for payment processing as a service provider and, for fraud prevention and compliance with its own legal obligations, in part as an independent controller. In this context, data may also be transferred to Stripe, Inc. in the USA. The legal basis is Art. 6(1)(b) GDPR. Further information: https://stripe.com/gb/privacy
6. Booking confirmations and emails
We send booking confirmations via the email service Resend (USA) acting as our processor. For the confirmation as a PDF document, we transmit the content of the confirmation to the service ConvertAPI (Lithuania, EU), which generates a PDF from it. When a booking is paid, we issue the booked partner business an invoice for our commission and the payment fee; for its PDF, we also transmit the invoice content to ConvertAPI, including the name of the person making the booking, the names of the guests and the booked items. Replies to booking confirmations go directly to the booked partner business.
The legal basis is Art. 6(1)(b) GDPR. We do not send newsletters or promotional emails.
7. AI booking assistant “Booky”
You may optionally prepare your booking with our AI booking assistant “Booky”. Booky is an AI system; you are not communicating with a human. We expressly inform you of this before your first chat. Use is voluntary – you can always book without AI.
What data is processed
Your messages to Booky, the previous conversation history (up to 20 messages) and the current status of your booking – which may include the names and dates of birth of the persons for whom you are booking – are transmitted to the AI provider Anthropic (Anthropic PBC, USA) to generate the responses. Text that you enter in the Booky search field on our home page is only transmitted once you start the chat and confirm the AI notice.
Purpose and legal basis
The purpose is to answer your questions and to prepare your booking at your request (Art. 6(1)(b) GDPR – pre-contractual measures). Anthropic processes the data on our behalf as a processor. Under Anthropic's contractual terms, data transmitted via the application programming interface is not used to train AI models and is stored only for a limited period.
Storage
We do not store chat histories on our servers. The history and your draft booking are held only in your browser's session storage and are deleted when you close the tab.
Important notes
- Please do not enter any special categories of personal data in the chat, such as health data.
- Booky's responses may be inaccurate. Only the information in the booking summary before payment is binding.
- Booky does not make any decisions that produce legal effects concerning you or similarly significantly affect you (Art. 22 GDPR). You always complete the booking yourself.
Further information on our use of AI can be found in our AI notice at /en/ai-notice.
8. Map service and location (Google Maps)
In the booking process, we embed Google Maps provided by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland, to display the locations of partner businesses and to search for addresses (e.g. your accommodation). In doing so, your IP address, your search entries and technical data are transmitted to Google; Google may also process data in the USA. The legal basis is our legitimate interest in a user-friendly display of locations (Art. 6(1)(f) GDPR). Information from Google: https://policies.google.com/privacy
If you wish, you can have partner businesses near you displayed. For this purpose, your browser asks for permission to share your location. The location is used only in your browser for sorting. The legal basis is your consent given via the browser prompt (Art. 6(1)(a) GDPR), which you can withdraw at any time in your browser settings.
9. Audience measurement
Google Analytics 4 (only with consent)
If you select “Accept all” in the cookie banner, we use Google Analytics 4 provided by Google Ireland Limited to statistically analyse the use of our website and the booking process (e.g. pages viewed, booking steps, booking value). In doing so, cookies are set (e.g. “_ga”, storage period up to 2 years) and IP addresses are truncated. Google may also process data in the USA; Google is certified under the EU-US Data Privacy Framework.
The legal basis is your consent (Art. 6(1)(a) GDPR, Section 165(3) of the Austrian Telecommunications Act 2021 (TKG 2021)). Without consent, Google Analytics is not loaded. You can withdraw your consent at any time with effect for the future (see section 11).
Vercel Web Analytics (without cookies)
In addition, we use Vercel Web Analytics for aggregated, cookieless measurement of page views. No cookies are set and no cross-device profiles are created. The legal basis is our legitimate interest in improving our services (Art. 6(1)(f) GDPR).
10. Error analysis (Sentry)
To detect and fix technical errors, we use the Sentry service provided by Functional Software, Inc. (USA) as a processor. When an error occurs, technical information is transmitted, e.g. the error message, the page accessed, browser and device information, and internal booking identifiers. If an error occurs in the booking process, a recording of the screen interactions shortly before the error may additionally be transmitted; entries in form fields are masked in the process.
The legal basis is our legitimate interest in an error-free and secure booking process (Art. 6(1)(f) GDPR).
12. Transfers to third countries
Some of our service providers are based in the USA or may process data there (Vercel, Supabase, Resend, Sentry, Anthropic, Stripe, Google). Transfers take place on the basis of an adequacy decision of the European Commission where the recipient is certified under the EU-US Data Privacy Framework (Art. 45 GDPR), and otherwise on the basis of EU standard contractual clauses (Art. 46(2)(c) GDPR). You can obtain a copy of the relevant safeguards on request at support@bookyourski.com.
13. Retention period
- Booking and accounting data: 7 years from the end of the calendar year of the booking (statutory retention obligation under Section 132 of the Austrian Federal Fiscal Code (BAO)), and beyond that only for as long as claims can be asserted.
- Uncompleted bookings: are cancelled after one hour and then retained only for as long as necessary for accounting and security purposes.
- Booky chat histories: only in your browser until you close the tab; at Anthropic only for a limited period in accordance with its contractual terms.
- Storage in your browser: as set out in section 11.
- Enquiries by email: until they have been dealt with and thereafter for as long as necessary to defend against claims.
14. Your rights
You have the right of access (Art. 15 GDPR), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20) and the right to withdraw any consent given at any time with effect for the future (Art. 7(3)).
Where we process data on the basis of legitimate interests, you have the right to object at any time on grounds relating to your particular situation (Art. 21 GDPR).
To exercise your rights, a message to support@bookyourski.com is sufficient. If you believe that the processing of your data infringes data protection law, you can lodge a complaint with the Austrian Data Protection Authority (Datenschutzbehörde), Barichgasse 40–42, 1030 Vienna, Austria, dsb@dsb.gv.at, https://www.dsb.gv.at
15. No automated decision-making
We do not make any decisions based solely on automated processing, including profiling, that produce legal effects concerning you or similarly significantly affect you (Art. 22 GDPR).
16. Changes
We will amend this privacy policy if our data processing or the legal situation changes. The version published on this page applies in each case.