Privacy Policy

CMY Ski Instructor operates this booking platform. The ski instruction services are provided by the individual instructor named in the booking confirmation. That instructor is the Data Controller for the personal data you provide.

For questions about this policy or your data, email info@courmayeurskiinstructor.com.

• Contact details (name, email, phone)
• Booking information (dates, times, participants, ability level, notes)
• Payment confirmation (we do not store card details)
• Safety or medical information you voluntarily provide
• If you connect Google Calendar as an instructor: your Google account email, an encrypted refresh token, calendar event IDs, and free/busy time ranges from the calendars you choose to sync
• For visitors whose IP address geolocates to Italy: a timestamp, IP address and page reference logged when the residency warning is displayed

Under Article 6 GDPR, we process data for:

• Contractual necessity — to deliver the ski lesson and manage bookings
• Legal obligation — accounting, tax, insurance and residency-compliance records
• Legitimate interest — safety, fraud prevention and communication
• Consent — where you explicitly connect your Google Calendar or agree to optional communications

When an instructor chooses to connect their Google Calendar, we access only the Google Calendar data needed to:

• Read free/busy information so that existing calendar events block booking slots
• Write confirmed ski-lesson bookings back to the instructor's Google Calendar

We do not:

• Read email, contacts, Drive files or any other Google data
• Use calendar data for advertising, profiling or any purpose unrelated to booking
• Share Google user data with third parties

The refresh token used to access Google Calendar is encrypted and stored server-side. It is deleted when the instructor disconnects their calendar.

Personal data is stored securely and retained only as long as necessary to:

• Deliver the service
• Meet legal obligations (typically up to 6 years for accounting/tax records)
• Demonstrate compliance with the Italian-residency restriction — the audit log is retained for 2 years then automatically deleted
• Keep calendar sync active while the connection remains enabled

Data is never sold.

• Payment or booking platforms used by you
• Insurers or competent authorities where legally required

If third-party services transfer data outside the EU, they do so under GDPR-compliant safeguards such as Standard Contractual Clauses.

You may request:

• Access to your data
• Correction of inaccurate data
• Deletion (where legally permissible)
• Restriction or objection to processing
• Data portability

Requests can be made directly to the instructor or by emailing info@courmayeurskiinstructor.com.

We may update this Privacy Policy from time to time. The latest version will always be available at this page.