Privacy policy

1. Data controller

The controller of the personal data collected through this website is Uniski Vacaciones S.L., VAT number B-59988881, with registered office at Calle Mallorca, 300, 08037 Barcelona. To exercise your rights you can write to uniski@uniski.es.

Uniski Vacaciones S.L. processes personal data in accordance with Regulation (EU) 2016/679 of the European Parliament and of the Council (GDPR) and Spanish Organic Law 3/2018 on the Protection of Personal Data and the Guarantee of Digital Rights (LOPDGDD).

2. Data we collect

We only collect the data necessary to provide the services you request:

• Registration and account: first name, surname, email address, encrypted password.
• Bookings: skier details (name, date of birth, level), contact details of the lead booker and billing details.
• Payments: card details are processed directly by our payment gateway; Uniski does not store the full card number.
• Marketing communications: the email address you provide when subscribing to the newsletter.
• Support and contact: the content of the messages you send us so we can answer your enquiries.
• Browsing: cookies and similar technologies as described in the Cookie policy.

3. Purposes of processing

The data is used for the following purposes:

• Managing the creation of and access to your user account.
• Managing bookings for hotels, ski passes and additional services.
• Sending booking confirmations, reminders and updates.
• Answering enquiries and support requests.
• Sending marketing communications about offers and news, only if you have given us your consent.
• Complying with the applicable legal, tax and accounting obligations.

4. Legal basis for processing

Each processing activity relies on one of the legal bases set out in Article 6 of the GDPR:

• Performance of a contract: bookings, account management and the associated support.
• Consent: newsletter, non-essential cookies and marketing communications.
• Legal obligation: invoicing, accounting and responding to requests from the authorities.
• Legitimate interest: fraud prevention, site security and service improvement.

5. Retention periods

We keep your data for the time strictly necessary for the purpose for which it was collected and, where applicable, for the periods required by law. As a guide:

• Account data: for as long as the account remains active and until you ask us to delete it.
• Booking data: for the duration of the trip and for up to 6 years afterwards due to commercial and tax obligations.
• Newsletter data: until you withdraw your consent.
• Security logs: 12 months maximum, unless an incident is being investigated.

6. Recipients and data processors

In order to provide the service, we share the strictly necessary data with the following types of recipients, all of them bound by data processing agreements compliant with the GDPR:

• Hotels and suppliers of the services booked (accommodation, ski passes, ski school, equipment rental).
• Channel managers and booking engines integrated with Uniski in order to check availability and confirm bookings.
• Payment gateway to process charges and refunds.
• Transactional email provider to send confirmations and notifications.
• Commercial email provider (Brevo, Sendinblue SAS, France) to send the newsletter and marketing messages, only to those entitled to receive them and always with an unsubscribe link.
• Infrastructure providers (hosting, backups, monitoring) located in the European Union.
• Web analytics provider (Google Ireland Ltd., as data processor) only if you accept analytics cookies. This may involve a transfer to Google LLC in the United States, covered by its certification under the EU–US Data Privacy Framework.

We do not carry out international transfers of data outside the European Economic Area without the appropriate safeguards set out in the GDPR.

7. Your rights

You can exercise the following rights over your personal data at any time:

• Access to the data we process about you.
• Rectification of inaccurate or incomplete data.
• Erasure when the data is no longer necessary.
• Objection to processing based on legitimate interest.
• Restriction of processing in the cases provided for by the GDPR.
• Portability, to receive your data in a structured and reusable format.
• Withdrawal of consent at any time, without retroactive effect.

8. How to exercise your rights

To exercise these rights, send us an email to uniski@uniski.es stating your full name, the right you wish to exercise and, if possible, a copy of a document proving your identity. You have the right to receive a reply within a maximum of one month.

9. Complaints

If you believe that the processing of your data does not comply with current regulations, or that your rights have not been properly addressed, you can lodge a complaint with the Spanish Data Protection Agency (AEPD) through its electronic office at www.aepd.es.