Draft for the staging website — organisational details and providers must be confirmed before publication on the main website.

Version dated 4 October 2026.

Scope and data controller

This notice describes how personal data are processed when you browse the School’s website or contact us through the form or the published contact details. Bookings made on external platforms are described in the information available on those platforms.

The data controller is Scuola Sci e Snowboard Ponte di Legno Tonale, VAT number 00640820981, with its registered office at Corso Milano 6, 25056 Ponte di Legno (BS), Italy. For privacy enquiries and to exercise your rights, write to info@scuolascipontetonale.com.

Data we process

• Contact data: name, email address, telephone number when provided, message subject and contents, and any other information you choose to send us.
• Technical data: IP address and information about the browser, device, requests for pages and operation of the connection. These data are transmitted while browsing and may appear in technical records of the services used.
• Choices about external content: preferences concerning cookies and optional services, as described in the cookie notice.

Only include what is needed for your enquiry in the contact form. Avoid identity documents, health details and children’s personal data unless necessary: for specific needs, contact the School first so that an appropriate channel can be identified.

Purposes and legal bases

• Answering enquiries about lessons, availability or quotations: processing needed to handle your request is based on steps taken at your request before entering into a contract, under Article 6(1)(b) of the GDPR.
• Handling other communications and general enquiries: the basis is the School’s legitimate interest in responding to people who contact it, under Article 6(1)(f).
• Operating the website and preventing abuse: technical data needed for availability, maintenance and security are processed on the basis of the legitimate interest in protecting the website and its users, under Article 6(1)(f). This basis does not replace consent required for non-essential tracking tools.
• Handling requests about your rights and meeting legal obligations: the basis is compliance with applicable obligations, under Article 6(1)(c).
• Enabling optional content or tools subject to consent: processing associated with your choice is based on consent, under Article 6(1)(a).

Providing your data

You can browse the website without sending an enquiry. If you contact us, the information needed to understand your message and reply must be available; without it, we may be unable to handle your request. Additional details are optional. Providing contact data to receive a reply does not constitute consent to cookies or optional external content.

External services and content

The website uses external resources for certain functions: Google Maps for maps, Google reCAPTCHA for spam protection, Google resources for review images, Trustindex to display reviews, and Font Awesome, loaded from use.fontawesome.com, for interface icons. Pages that include video content may also use YouTube components. Loading external resources may transmit technical data to the provider, such as an IP address, browser information and the referring page, even if you do not submit the form.

You can consult Google’s Privacy Policy and Trustindex’s privacy notice for processing performed by those providers. The cookie notice distinguishes essential services from those subject to a choice and describes the related preferences.

For optional services based on consent, you can refuse or change your choice through cookie preferences. Refusing may prevent embedded content from being displayed. You can still contact the School by email. Withdrawal applies to subsequent processing and does not make prior processing based on consent unlawful.

The Booking Online link

The Booking Online button opens the external Skiwork website. It is not a booking form embedded in this website. When you follow the link, consult the platform’s privacy notice before entering data; it describes processing related to bookings and any payments.

Recipients and how data are processed

The School’s email service is managed through Microsoft. Website hosting is provided by CBMA. The service terms and applicable configuration must be completed in the final version of this notice.

Enquiries are accessible to people authorised to handle them for the School. Data may also be processed by hosting, email, maintenance and security providers, within the scope of the service they perform. Where a provider acts on the School’s behalf, the relationship requires the arrangements under Article 28 of the GDPR; providers that independently determine their own processing supply their respective notices.

Data may be disclosed to authorities where required by law. Contact the Controller for information about actual recipients and their roles. Processing uses computer systems, and access to data must be limited to activities for which they are needed.

Transfers outside the European Economic Area

Google states that it operates servers worldwide and uses adequacy decisions, Standard Contractual Clauses (SCCs) and the Data Privacy Framework for certified US entities, depending on the transfer. Details are available in Google’s data transfer frameworks.

In its privacy notice updated on 31 August 2026, Trustindex states that data may be processed outside the European Economic Area and identifies adequacy decisions, SCCs or other safeguards permitted by law. It also refers to data processing agreements (DPAs) with providers, where appropriate.

These are providers’ statements: destination countries, safeguards applicable to the website’s configuration and the Controller’s agreements still need to be confirmed. Contact the Controller for information or to obtain a copy of applicable safeguards.

Retention

Email and form communications are retained for the time needed to handle the enquiry and related exchanges, which may continue for several months. This criterion takes account of the conclusion of the enquiry, any follow-up clarification and its nature. Where a communication relates to a contractual relationship or a dispute, applicable legal obligations and the need to establish or defend rights are also considered.

For technical records, the criterion is the period needed to operate the service, handle incidents and maintain security. Data no longer needed must be erased or anonymised; any backups must be considered when defining deletion times. Cookie durations and criteria concerning preferences are described separately in the cookie notice. External providers describe the criteria for processing they perform independently in their own notices.

Your rights

Where the GDPR provides for them, you can request access, rectification, erasure or restriction of processing. You can object to processing based on legitimate interests for reasons relating to your situation. Where the legal conditions apply, you can request data portability. You can also withdraw consent you have given.

To exercise your rights, write to info@scuolascipontetonale.com, explaining your request and providing contact details for our reply. You can lodge a complaint with the Italian Data Protection Authority or the competent supervisory authority.

Cookie notice and updates

The cookie notice and preferences available on the website supplement this information for cookies, tracking tools and external content. This notice may be updated when the website’s functions or processing change; the version date appears at the beginning of the page.