Privacy Policy

Find a Ski School ("FASS", "we", "us", "our") is a trading name of WPDesigns SARLU, a société à responsabilité limitée unipersonnelle registered in France (SIREN 939118303, VAT FR09939118303), with its registered office at 1 Rue de Luc, 64100 Bayonne, France. We operate the website findaskischool.com — a global ski school directory and booking platform connecting skiers and learners with ski schools and instructors worldwide.

We are the data controller for the personal data processed through our platform, except where ski schools or instructors process personal data independently (in which case they are separate data controllers).

Contact: [email protected]
Postal address: WPDesigns SARLU, 1 Rue de Luc, 64100 Bayonne, France
Supervisory authority: Commission Nationale de l'Informatique et des Libertés (CNIL), France. If you are in another EU or EEA country, or in the UK, you may also contact your local data protection authority.

Throughout this policy:

• "Skiers" or "learners" means individuals who use the platform to find, compare, and book ski lessons.
• "Ski schools" means businesses listed on the platform that offer ski or snowboard instruction.
• "Instructors" means individuals who teach skiing or snowboarding, whether employed by a school or working independently.
• "Platform" means findaskischool.com, including the website, Progressive Web App, APIs, and embedded booking widgets.
• "AI features" means the AI School Finder, AI Chatbot, AI Instructor Finder, AI Resort Finder, and any other features powered by artificial intelligence.
• "Public data" means information visible to all platform visitors, such as school profiles, reviews, and instructor qualifications.
• "Private data" means information accessible only to you, to us, or to parties you have a direct relationship with (e.g., your booked ski school).

3.1 Data you provide directly

When you create an account, book a lesson, use our AI features, or contact us, we may collect:

• Account data: Name, email address, password (stored as a cryptographic hash — we never see your actual password), role (skier, school owner, instructor), profile photo.
• Booking data: Lesson type, dates, experience level, number of participants, special requirements, goals and “anything else we should know” notes, and equipment sizing preferences. Free-text fields may contain health information, such as injuries, disabilities, or physical limitations. Providing health information is optional and requires the separate explicit health-data consent before it is processed and shared with the school for lesson planning. Entering text alone does not provide that consent. We treat this as special-category data under GDPR Article 9 and apply the health-data retention period in section 8.
• Communication data: Messages sent through our messaging system are available to the participants and authorised staff where needed for operation, support, moderation, or handling a report. Share health information only where relevant and with the appropriate consent. AI Concierge and school-chatbot conversations have different processing and storage arrangements, described in section 3.5.
• Read receipts: When you read a message, the sender is shown that you have read it, and you are shown the same for messages you send. This is on by default and you can turn it off at any time in your messaging settings — turning it off stops your read status being shared and stops you seeing anyone else's.
• Review data: Star ratings, written reviews, and the school or instructor they relate to. Reviews are published publicly under your first name.
• Gear profile data: Height, weight, ability level, gender, age group, and equipment preferences — used solely for gear recommendations. This data is not used to assess your health.
• Support data: Information you provide in support tickets, including screenshots and descriptions of issues.
• Payment data: We do not store your card details. When you pay online, you enter them in Stripe Checkout, and Stripe processes the payment to the Stripe account of the ski school or instructor you are booking with. We keep the references Stripe returns for the payment, any refund, and any dispute, together with the amount, the currency, and our own commission record for the booking. The ski school or instructor, as the seller, is the data controller for the payment taken on its Stripe account, and Stripe is an independent data controller for the card data it processes for its own fraud-prevention and legal-compliance purposes. See Stripe's Privacy Policy.

3.2 Data collected automatically

When you visit our website, we automatically collect:

• Device data: IP address, browser type and version, operating system, device type, screen resolution, language preference.
• Usage data: Pages visited, time spent on pages, clicks, scroll depth, referring website or search terms. Cloudflare Web Analytics records page views and referring websites without cookies. Google Analytics 4 records the rest, and only if you accept analytics cookies.
• Online status: While you are signed in, providers and instructors are shown in our directories as being online now, and visitors can filter for it. This is derived from when your account was last seen; nothing about your location or activity is collected. It is on by default and can be switched off in your settings.
• Cookie data: See our Cookie Policy for full details.

With Analytics consent, eligible public homepage visitors may see title A, B or C for the assistant orb. Testing is paused until Admin starts it; without Analytics consent you see A or the chosen winner, with no experiment identifier or metrics. A random browser identifier in local storage lasts 30 days and is cleared when Analytics consent is withdrawn. First-party server records retain its hash, experiment run, variant, language and assignment/event timestamps for visible impressions, clicks and successful text replies or voice connections for up to 90 days. They contain no IP address, account ID, profile, messages, transcripts or audio. Private previews, demos, administrators and impersonation sessions are excluded. This visual test does not require AI consent; actual chatting still does. The body and button stay the same, and Admin chooses a winner manually. Withdrawing Analytics stops new measurement; existing server records expire under this retention schedule.

3.3 GPS and location data

If you use our GPS Ski Tracking feature, we collect precise location data including GPS coordinates, speed, elevation, and route waypoints. This data is collected only with your explicit consent and only while you actively use the tracking feature. You can stop tracking at any time. GPS data is stored locally on your device when you're offline and synced to our servers when you reconnect.

You control who sees your GPS data and for how long through your privacy settings. You can delete your GPS data at any time from your dashboard.

3.4 Lesson notes, pre-arrival questionnaires, and progress data

When an instructor uses Quick Notes after a lesson, the recording is uploaded to private storage and sent to a configured speech-to-text processor. The raw transcript, together with any student name, activity and level supplied by the instructor, is then sent to the configured text-model provider to clean the note, generate a title and extract action items. The audio, raw transcript and generated outputs are saved with the note. Authorised instructors, relevant school staff and administrators can access it; the learner or parent can access it when the instructor shares it. Lesson notes may contain health, injury or fitness information and therefore require additional care.

Pre-arrival questionnaires: Some schools send a questionnaire before your lesson that explicitly asks about medical conditions, physical requirements, and equipment sizing. This data is shared with your instructor and school to ensure your safety. The medical fields are disabled by default — you must provide explicit consent before entering medical information. This data is retained for the duration of your booking plus 12 months, then deleted.

Quick Notes itself does not collect a learner consent record and does not offer a manual-only mode. Before recording, the school or instructor must inform the learner or parent and establish consent or another applicable lawful basis, including explicit consent where special-category data is involved. If you decline, ask the provider not to use Quick Notes and request a manually written recap through another agreed channel. Existing notes can be removed through a data privacy request or by contacting us. Removing the storage reference ends in-app access to the private audio; the underlying object is then handled under our private-storage lifecycle or an accelerated deletion request.

3.5 AI chatbot and AI feature data

Live voice and text assistant

The optional live assistant uses OpenAI for text and voice, listing searches and support in customer, school, instructor and administrator dashboards. With your AI & chatbot consent it processes messages, voice transcripts, microphone audio while connected, minimal page/language context and only the authorised records needed for your request. Its full conversation stays in page memory and clears on reload, reset, account change or consent withdrawal. FASS does not save full live transcripts or raw voice audio to its application database and does not use conversations to train or fine-tune models. Server security checks inspect submitted messages/transcripts in memory. OpenAI processing, retention and transfers depend on the applicable service, account settings and terms. Avoid payment credentials and sensitive health information.

After AI & Chatbot consent, the signed-in assistant may automatically send OpenAI your saved account name, self-reported activity and ability, piste comfort, up to eight currently public favourite schools, instructors and resorts per type, and limited completed-booking counts and scheduled hours for learner accounts. These are reference preferences, not verified skill or time skied; bookings may be for other people. Your current request takes precedence. Health information, contact details, birth dates, free-text bios, payment data and other people's profiles are excluded from this automatic context. Guests, demos and support-impersonation sessions do not receive a real account's saved preferences. Information is read for the request or tool; conversations do not train the assistant.

The optional trip brief contains details you apply, such as a country or resort, dates, activity, self-reported ability, adult counts, child ages you enter, lesson format and budget. After AI & chatbot consent, the applied brief can be sent to OpenAI with your next question or when you update a connected voice conversation. Child ages are not inferred from other people or automatically taken from their profiles. Your latest explicit request takes precedence. These are your stated requirements, not verified suitability, a booking quote or confirmed availability.

Saving a trip is a separate choice: you must confirm saving the structured brief and selected public listings to your own account. We store those details, your account reference and timestamps until you delete the plan or account; they are included in account export and erasure. The full conversation and audio are not saved with the plan. Saving or reading a plan does not itself call an AI provider or spend assistant credits. Public shortlist entries are checked again when saved or read and can become unavailable. Loading a plan does not book anything; applied details reach OpenAI only under the AI-consent rules above.

Answer feedback is optional and account-linked. By default we retain only your selected category and topic, an account reference and timestamps. You may separately choose an edited answer excerpt of up to 500 characters, review its redacted preview and explicitly confirm sharing it with FASS. Common contact details, links and credentials are removed, but names or other personal details may remain: check the preview. Authorised administrators review categories and deliberately shared excerpts; report displays omit account identities, but the underlying feedback remains linked to your account. Feedback is not sent to an AI provider or used to train models, and it does not create a support request. You can remove your feedback; retained reports are included in account export and erasure. Reports are excluded from ordinary feedback views after 90 days. Bounded hourly maintenance removes expired rows; physical deletion is not guaranteed at an exact deadline.

Voice requires a deliberate start and microphone permission. After 90 seconds of inactivity microphone input pauses; without continuing within another 30 seconds, voice ends. You can mute, end, reset, withdraw AI consent or download the available text/captions locally, without audio; captions may be incomplete and reset does not erase your downloaded file. The assistant can navigate, filter and highlight when requested. Supported account-name/bio updates, unpublished lesson drafts and authorised booking rescheduling require an exact preview and your separate explicit confirmation. It cannot perform every platform action. The Privacy Policy is a notice, not blanket permission to train. Standard search, forms and human support remain available. Admin can disable the assistant.

Full live history stays in current page memory, not browser local storage or the application database. Reset, reload, account change or withdrawing AI consent clears it. A local download is your copy and contains no audio. After assistant consent/start, an HTTP-only pseudonymous guest cookie (up to 90 days) and keyed network identifiers enforce free allowances and prevent abuse. Server usage/quota and credit receipts contain timestamps, durations, counts and charges, not full transcripts or raw audio; operational records are retained up to 90 days. Security flags contain keyed hashes, categories, counts and expiry, not raw IP or prompts; they expire after 24 hours and are removed by maintenance. Action previews expire after ten minutes, are scrubbed after execution and purged after 24 hours. Minimal audit and required financial records follow their separate retention rules. Account export/erasure includes account-linked operational data. Consent preferences are stored separately. OpenAI processing and retention remain governed by the applicable provider terms. Daily keyed network-quota records are retained for up to two days. Separately, essential assistant service-health statistics contain only hourly totals and coarse response-time distributions, retained for up to 30 days and removed by maintenance. They contain no account, session, guest or network identifiers, page URLs, messages, transcripts or audio; they support reliability and abuse monitoring, separately from optional Analytics measurement. Contextual support is separate from the live conversation. An inline offer does not save your draft text. If you choose Show me how, the selected issue context expires from use within 24 hours and is removed by scheduled maintenance, or scrubbed sooner when assistance ends. Account-linked guide steps, outcomes, a keyed issue fingerprint and event times are retained for up to 30 days, then removed by scheduled maintenance; account export and erasure include these records. Published guidance works without AI credits. An optional AI explanation requires AI & chatbot consent and a deliberate request before a bounded selection of the issue and customer-visible ticket text is sent to the AI provider; internal notes, private staff replies and attachments are excluded. No full live transcript or audio is stored for this feature or used for training. A handoff summary is sent only after you review and confirm it; it becomes an ordinary customer-visible support record subject to the existing support retention rules.

Navigation reliability checks use receipts that expire after 10 minutes and keyed hashes in server memory to bind them to the owner, offered action and access context. A 30-minute report for the current server process counts page loads, applied filters, highlights, failures and cancellations; it contains no routes, filter values, account identifiers, transcripts, audio or IP addresses and clears on restart. These are browser reports, not confirmation that a problem was solved. Streamed draft replies remain temporary page content under the conversation rules above.

An Admin-issued private preview link provides access in one browser for at most 72 hours. Its one-time redemption sets the signed HttpOnly fass_assistant_preview cookie. It grants no extra account or data permissions and bypasses neither AI consent nor credits, rates or safeguards. Server grant records contain hashes, labels and timestamps, not the raw link token; expired or revoked grants are removed after 24 hours by maintenance. Existing authorised QA demos use the signed HttpOnly fass_assistant_demo_scope cookie for at most 3 hours, a fixed fictional school and a separate Admin setting. These requested access/security cookies do not themselves permit optional AI processing or create a self-service temporary account.

When you use our AI-powered features, your queries are sent to the AI provider configured for that feature. The live voice/text assistant uses OpenAI: text and voice transcripts, microphone audio while connected, and the limited listing or permitted customer information needed for requested tools are processed to answer you. The live conversation stays in the current page's memory, and our application does not store raw voice audio. OpenAI's retention and processing depend on the applicable service, account settings, and terms. Other features and fallback routes can change; section 6 describes supported services, and you can ask us which recipients process a feature. What we retain depends on the feature. AI Concierge conversation history is kept in your browser and clears 24 hours after your last message; we do not store those conversations in our database. AI School and Resort Finder queries are different: we log the query text, generated summary, result count, IP address, and your user ID when signed in. If you save an AI search, we also retain its query, summary, filters, and result references with your account. Moderated popular search queries may appear as public search suggestions; your account ID and IP address are not shown with them. A school's own chatbot is different — those conversations are stored for up to 12 months so the school can review them, as described in section 8. You must agree to the chatbot privacy terms before starting a conversation. You are interacting with an AI, not a human.

Find a Ski School does not train AI models on your data — we do not run our own foundation models or fine-tune third-party ones. A provider’s use and retention of inputs and outputs depends on the service, account settings, and applicable contractual terms. Do not assume every supported provider has the same training or retention terms. Contact [email protected] for the active recipient and applicable terms. See section 7 for international transfers and our AI Transparency page for the plain-language breakdown plus opt-out toggles.

3.6 Data from third parties

We may receive personal data from:

• Ski schools: When a school adds instructor profiles or imports student booking data.
• Stripe: Confirmation that a payment, refund, or dispute has taken place on the ski school's or instructor's Stripe account, with its reference, amount, currency, and status, and, for a dispute, the reason and the evidence deadline — never your card number.
• Public sources: Resort, altitude, and weather information, and unclaimed school information discovered through search engines such as Google and collected from school websites or other public professional sources. This can include personal professional information; see section 14.

Under GDPR Article 6, we process personal data on the following bases:

Where we rely on legitimate interest, the processing must be necessary and balanced against your interests, rights, and freedoms. Public availability alone does not establish this basis. Contact us for information about the applicable assessment.

Our platform uses artificial intelligence to power several features. We are transparent about how AI is used:

• AI School Finder / AI Chatbot: Your questions are processed by the third-party AI provider configured for that feature. Supported providers include Anthropic, OpenAI, Google, Groq, Together AI, Mistral, DeepSeek, OpenRouter and xAI. Responses are informational and may not always be accurate. No automated decisions with legal or similarly significant effects are made solely by AI.
• School-specific chatbots: A claimed, published school may offer an AI chatbot that uses its lesson data, pricing, and policies as context for answers. Conversations with a school chatbot are visible to that school’s owner. You must agree to the chatbot privacy terms before chatting.
• Quick Lesson Notes — speech-to-text and AI formatting: A private audio recording is sent to our configured speech-to-text processor. The resulting transcript and any student name, activity and level supplied by the instructor are sent to the configured text-model provider to clean the note, create a title and extract action items. The recording, transcript and generated results are then stored as the lesson note.
• Profile prefill from your website or a PDF: When you list a school or register as an instructor you can paste page links or upload a PDF so the form is drafted for you. We fetch the pages or read the PDF in memory and send the text to the configured text-model provider (section 6) to extract the form fields. Neither the file nor the page text is stored: only the values that appear in the form, which you can edit or clear, are sent when you submit. Nothing runs until you tick the consent box next to the tool.
• AI-assisted messaging: When schools reply to your messages, they may use AI to help draft responses. AI-assisted replies are labelled as such.
• Search ranking: Schools and instructors are ranked in search results using algorithms that consider relevance, ratings, verification status, and how complete a profile is. Paying does not move a listing up these results. Separately, schools and instructors can buy a small, fixed number of Sponsored slots at the top of the first page of results; every sponsored listing carries a Sponsored label and has to meet the same eligibility rules as every other listing. This is not automated decision-making under Article 22 as it does not produce legal or similarly significant effects on individuals.

Under the EU AI Act (compliance deadline August 2026), we label all AI interactions clearly. You always know when you are interacting with an AI system.

We do not sell your personal data. We never have and we never will.

• Ski schools you book with: Your name, email, phone (if provided), booking details, experience level, and any pre-arrival questionnaire responses are shared with the ski school or instructor you book with. When you pay online, the payment is made to the ski school's or instructor's own Stripe account, so it also receives the payment record Stripe creates for that payment: the amount, the currency, the name and email address entered at checkout, and the card details Stripe shows to a merchant, such as the card brand and last four digits, but never the full card number. The ski school or instructor is an independent data controller for this booking and payment data.
• Stripe (payment processing): When you pay online, Stripe Checkout collects your card details and processes the payment as a direct charge on the ski school's or instructor's own Stripe account; Find a Ski School never receives your card number or security code and never holds the payment. We pass Stripe the amount, the currency, a description of the lesson or rental, the booking reference, and the name and email address you enter, and Stripe returns the references and status of the payment, any refund, and any dispute. Find a Ski School's commission is collected from the payment as a Stripe application fee, and we keep a record of it. Stripe processes card data as an independent data controller for its own fraud-prevention and legal-compliance purposes, under its privacy policy at stripe.com/privacy.
• Speech-to-text and AI text processors: The processor active for a feature receives the inputs needed to perform it. For Quick Lesson Notes this includes the audio recording for speech-to-text, followed by the transcript and supplied student name, activity and level for text processing. The text provider is configurable and may be Anthropic, OpenAI, Google, Groq, Together AI, Mistral, DeepSeek, OpenRouter or xAI. Ask [email protected] for the active subprocessor list and applicable terms.
• Email delivery — EmailIt: EmailIt processes delivery information, including sender and recipient addresses, subject, message content, and any reply-to address. Privacy-request acknowledgements, reviewed responses, extension notices, and account-deletion notices have open and click tracking disabled in both the delivery service request and FASS links and pixels. Delivery and retry records are still retained. Other transactional and marketing emails may include engagement tracking.
• Error monitoring — Sentry: Sentry receives error reports to help diagnose failures. Browser reporting starts only after analytics consent; server-side operational error reporting is separate and does not depend on that browser choice. We filter specified identifiers, URL parameters, and tokens, but error messages and stack traces can still contain personal data. Reports are handled for operation and security of the service, as described in this policy.
• Privacy-friendly analytics — Cloudflare Web Analytics: We use Cloudflare Web Analytics to count page views, understand how visitors find the site and measure how quickly pages load. It uses no cookies or other storage in your browser, and Cloudflare states that it does not fingerprint visitors or collect or use their personal data. Because nothing is stored on your device, it runs for every visitor and is not controlled by the cookie banner.
• Website analytics — Google Analytics: We use Google Analytics (GA4) to understand traffic patterns and measure marketing effectiveness. It loads only after you accept analytics cookies. GA4 collects device and browser metadata, approximate location derived from your IP address, the pages you visit, your use of the site menus, and the steps of a booking — the booking form opening, the request being sent, and payment completing or being cancelled — together with the school and, where known, the resort, lesson type, and group size. It never receives your name, contact details, or payment details, and private links have their access tokens removed before anything is sent. Google processes this data under their privacy policy and as a data processor on our behalf. You can withdraw consent at any time from Cookie preferences in the footer, or opt out via the Google Analytics opt-out browser add-on.
• Maps — Google Maps Platform: Resort and school location maps are served by the Google Maps Platform. When a map loads, Google receives your IP address and the map coordinates requested. Google processes this data under their privacy policy.
• Infrastructure and security — Cloudflare: Traffic passes through Cloudflare's CDN for performance and security. We also use Cloudflare Turnstile to protect forms from automated abuse — Turnstile analyses browser signals without traditional CAPTCHAs. IP addresses are processed by Cloudflare under their privacy policy.
• Browser push notifications: If you opt in to browser push notifications, your browser’s push service processes subscription and device delivery identifiers and related metadata. FASS stores the subscription against your account and sends encrypted notification content through that service. Notifications may contain names, booking details, lesson times, and links; consider who can see notifications on your device. You can revoke permission in your browser settings.
• Hosting provider: Our application and database are hosted on infrastructure that may process personal data as a sub-processor.
• Law enforcement: We may disclose data if required by law, court order, or to protect the safety of our users.

A full list of our sub-processors is available upon request at [email protected].

Some service providers may process personal data outside the UK or EEA. Those transfers require an applicable lawful transfer mechanism and any additional safeguards required for the destination and processing involved:

• EU-US Data Privacy Framework (DPF): An applicable adequacy decision can cover a transfer. For the EU-US Data Privacy Framework, the actual recipient must hold a current certification covering the relevant data and processing. A UK transfer relying on the UK Extension also requires the recipient’s participation in that extension. Supporting a provider in our software does not establish that these conditions are met.
• Standard Contractual Clauses (SCCs): Where no applicable adequacy decision covers the transfer, appropriate safeguards are required, such as the European Commission’s Standard Contractual Clauses. UK transfers may require the UK Addendum or International Data Transfer Agreement. The applicable arrangement must include any required transfer assessment and supplementary measures.

Contact [email protected] for the actual recipients, processing destinations, and the applicable transfer mechanism, or to request information about the relevant safeguards. The mechanisms described here are not a statement that every supported provider has been certified or that an assessment or contract exists for a provider that is not in use.

We retain personal data only as long as necessary for the purpose it was collected, unless a longer retention is required by law:

Account erasure removes or anonymises account-associated data, subject to applicable legal retention exceptions. Some financial and security records, and limited listing-suppression identifiers, may remain for the purposes described above. Removing a public directory listing is separate from erasing an account or records that must lawfully be retained.

We use cookies and similar technologies. You can manage your preferences at any time using our cookie banner or by visiting our Cookie Policy. We use five categories of cookies: Strictly Necessary (always active), Functional, Analytics, Marketing, and AI & Chatbot. Non-essential cookies are only placed after you give consent.

Under UK GDPR and EU GDPR, you have the following rights:

• Right of access (Art. 15): Request a copy of all personal data we hold about you.
• Right to rectification (Art. 16): Correct inaccurate or incomplete data. You can update most data directly in your account settings.
• Right to erasure (Art. 17): Request deletion of your personal data. We assess your request and respond within one calendar month, subject to permitted extensions and applicable legal retention exceptions.
• Right to restriction (Art. 18): Request that we limit processing of your data while a dispute is resolved.
• Right to data portability (Art. 20): Receive your data in a structured, machine-readable format (JSON).
• Right to object (Art. 21): Object, on grounds relating to your situation, to processing based on legitimate interests. We must stop unless we demonstrate compelling legitimate grounds overriding your interests, rights, and freedoms, or grounds connected with legal claims. We stop direct marketing when you object to it.
• Right to withdraw consent: Where processing is based on consent, you can withdraw it at any time. For lesson notes, tell both us and the relevant school or instructor so that future Quick Notes recordings stop. Withdrawal does not affect the lawfulness of processing before it was withdrawn.
• Right regarding automated decisions (Art. 22): You have the right not to be subject to decisions based solely on automated processing that produce legal or similarly significant effects. We do not currently make such decisions.

How to exercise your rights: Email us at [email protected], or use our self-service Data Privacy Request Form. Requests receive human review. We respond without undue delay and within one calendar month of receipt. Where permitted because of complexity or the number of requests, we may extend by up to two further calendar months; we explain the extension and reasons within the initial month.

You also have the right to lodge a complaint with the Commission Nationale de l'Informatique et des Libertés (CNIL) at cnil.fr, or with the data protection authority in your own country.

We implement technical and organisational measures to protect your data:

• All data is transmitted over HTTPS (TLS 1.2+).
• Passwords are hashed using bcrypt before storage — we never store or see your actual password.
• Session tokens are cryptographically signed and expire after inactivity.
• Card payments are processed by Stripe on the ski school's or instructor's Stripe account — we never store card numbers.
• Database access is restricted and encrypted.
• We use Cloudflare for DDoS protection and bot detection (without CAPTCHAs).
• All security-relevant actions are recorded in an immutable audit log.
• Two-factor authentication (2FA) is available for all accounts and enforced for administrators.
• Input validation (using Zod schemas) is applied to every API endpoint to prevent injection attacks.

No system is 100% secure. Where required, we will notify the relevant supervisory authority within 72 hours of becoming aware of a breach, in accordance with GDPR Article 33. If the breach is likely to pose a high risk to you, we will also notify you without undue delay.

Our platform is not directed at children under 16 (EU) or 13 (UK). We do not knowingly collect personal data from children under these ages without parental consent. Ski lesson bookings for children are made by parents or guardians, and the parent's account and consent governs that data.

If you believe we have collected data from a child without appropriate consent, please contact us immediately and we will delete it.

When you leave a review, your first name, rating, and review text are published publicly on the school or instructor's profile. Reviews are moderated according to our Review Policy. You can request removal of a review through our support system, and we will assess whether removal is appropriate under our legitimate interest in maintaining platform trust.

If you delete your account, retained reviews are attributed to “Former Student”. This changes the account attribution; the review text may still identify someone. We assess requests concerning that text separately, including correction, objection, or erasure where applicable.

Basic directory facts, such as a school’s name, location, and website, can be published for unclaimed schools. Eligible claimed school profiles can also show descriptions, lesson offers, and pricing. Published instructor profiles may show qualifications. These details are public data to help skiers find and compare schools.

When a skier books with you, their personal data (name, email, experience level) is shared with you. You become an independent data controller for that booking data and are responsible for handling it in accordance with applicable data protection laws. We recommend you maintain your own privacy policy.

Instructor certification documents, verification submissions, and business registration data are stored securely and accessible only to you and our verification team.

Unclaimed listings and public sources

FASS creates unclaimed directory entries from publicly available professional sources, including school websites found through search engines such as Google. Staff may use AI tools to extract information from source pages. An unclaimed listing does not indicate that the school reviewed or approved it, agreed to join FASS, or accepted our provider terms.

Generic facts about an incorporated business may not be personal data. Information identifying a sole trader, proprietor, employee, or instructor is personal data, even when shown on a business website. Our interests are helping learners discover providers and operating a commercial directory; personal-data use requires an applicable lawful basis, a necessity and balancing assessment where legitimate interests are relied on, and the required information and rights safeguards. Public availability is not consent, and an instructor’s signup consent does not cover other people or school content.

For unclaimed schools, we delete stored descriptions, staff qualification summaries, generated school metadata, and AI school or review summaries from the active school-content stores, including school translations and generated-copy caches. We do not keep this copy for reuse after a school is claimed or save replacement generated school copy while it remains unclaimed. Generated school-copy caches whose school record no longer exists are also removed. Basic directory facts, such as the business name, location, and website, can still appear; lesson offers remain withheld while the school is unclaimed. Historical exports, backups and copies held by service providers require separate retention and deletion handling: deleting active school content does not itself erase every historical copy. Claiming a listing does not confirm every statement, provide consent for every person mentioned, or establish rights to photos or other content. FASS remains responsible for the content it creates and publishes.

You can request correction, object to personal-data processing, request restriction, or ask for a public listing to be removed through our data-request form or privacy email. No account, profile claim, purchase, or fee is required to submit an ordinary request. A person reviews requests. Public directory removal is separate from account deletion or statutory erasure; records required for lawful financial retention or legal claims may need separate handling.

Correct information · Object or request removal

After an accepted removal, we retain a limited private suppression record containing the listing URL, relevant business name, website domains and source identifiers, the reason and date, and the admin decision reference. This helps honour the request and prevents accidental re-import or restoration; re-addition requires an admin review and recorded approval. These identifiers may themselves be personal data. We retain the record while needed for that purpose, with no automatic expiry at present; you can ask us to review its scope or continued retention. Permanent deletion of the directory record is separate from retaining this limited evidence or financial records that must lawfully be kept.

Widget embed analytics. If you embed our booking widget or reviews widget on your own website, we log aggregate counts of how often the widget loads, grouped by the host that embedded it. This data is used to surface usage statistics to you in your dashboard and to help us understand product adoption. We do not store visitor IP addresses, cookies, User-Agent strings, or any other identifier of the visitors who see the widget — only the hostname of the page that embedded it (taken from the standard HTTP Refererheader) and a daily load count. This processing is based on our legitimate interest in operating and improving the service.

WordPress plugin telemetry (opt-in only). Our WordPress plugin can optionally send us a daily heartbeat with your FASS embed token, the plugin version, your WordPress version, and your site hostname. This channel is off by default — it only activates when you tick the "Send anonymous usage info to FASS" toggle in the plugin's settings page. Ticking the toggle is your explicit consent for this processing under UK and EU GDPR Article 6(1)(a); unticking it stops the plugin from sending further heartbeats immediately and is recorded locally in your WordPress site's settings. We do not receive your site admin email, your visitors' data, or any free-text settings — only the four fields listed above. We use this data to understand plugin version distribution and to plan support for older WordPress versions.

We may update this privacy policy and publish the revision date at the top of the page. We will provide notice of material changes where required by law and seek fresh consent where a change requires it. Reading this notice or continuing to use the platform does not itself give consent to new processing.

If you have questions about this privacy policy or how we handle your data:

• Email: [email protected]
• Data request form: findaskischool.com/data-request
• Support tickets: Available in your dashboard after logging in

Lead supervisory authority: Commission Nationale de l'Informatique et des Libertés (CNIL), France. Website: cnil.fr.

EU, EEA and UK residents: You may also contact the data protection authority in your own country. A list of European authorities is available at edpb.europa.eu.