Privacy

Privacy policy for Trysil Skishop Eiendom AS

This privacy policy describes how Trysil Skishop Eiendom AS processes personal data in accordance with the Norwegian Personal Data Act and the GDPR. This is a translation for information. In case of discrepancies, the Norwegian version applies.

Data controller

The data controller is Trysil Skishop Eiendom AS, Vestmovegen 24, NO-2420 Trysil. Email: info@skishop.no. Telephone: +47 91 92 92 91. Company no.: 981 443 489.

Shop goods are sold by Trysil Sportshop AS (company no. 914 141 656) from the same address. Our small shop "Lille Hjørnet" is located in Trysilsenteret, Storvegen 2, 2420 Trysil.

What data we process

• Contact data: name, email, telephone, address and the content of enquiries via forms, chat or email.
• Account and sign-in: email address, verified mobile number, sign-in method (email or Google) and security events.
• Order and payment data: what you have ordered, rental period, delivery or collection point, amount, payment status and receipts. We never store your card number; card payments are handled by Stripe.
• Body measurements for rentals: height, weight, date of birth/age and boot size for those who will use the equipment. This data is used solely to set bindings, dampers and other equipment correctly for safety reasons, and is necessary in order to deliver the rental. The data is transferred to the EasyRent rental system (Wintersteiger) to link the settings to the equipment. Measurements are stored on your profile only if you actively tick the box at checkout, and can be deleted under My page at any time. For participants under 24, height is recorded because binding settings require it.
• Shopping cart stored on your account: when you are signed in, the contents of your cart (items, dates, sizes and quantity) are stored in our database so that the cart follows you across devices. We also store the time you last changed the cart yourself.
• Shopping cart reminders: if you have consented to marketing by email, we may send you up to two reminders per cart, and a maximum of three reminders within 183 days, about items you have left behind. The email contains the items in the cart, the price and an unsubscribe link.
• SMS notifications: your mobile number is used to verify your account and to notify you about orders, collection and delivery.
• Documentation for exceptional cancellations: if we ask for documentation for an exceptional cancellation, for example a medical certificate, we assess it manually. We do not keep a copy and do not record health data – only whether the exception was granted or declined.
• Partner and tour operator customers: for companies and tour operators we process the contact person's name, email and telephone, agreement and signature data, invoicing data, and the names and necessary equipment measurements of the guests who will rent.
• Usage data and cookies: technical information about visits and usage patterns (page views, device, referrers), including optional analytics cookies.

Purposes

• Customer dialogue and delivery: answering enquiries, giving quotes and carrying out agreed services.
• Ordering, payment, delivery and accounting.
• Security: verifying identity and preventing misuse of accounts and orders.
• Communication and marketing: offers, campaigns and shopping cart reminders where consent has been given.
• Operation, security and improvement: statistics, error correction and development of the website.

Legal basis

• Contract or steps prior to a contract (GDPR art. 6(1)(b)): processing necessary to handle enquiries, orders, rentals and payment.
• Legal obligation (art. 6(1)(c)): bookkeeping and retention of sales documentation.
• Legitimate interest (art. 6(1)(f)): operation, security, improvement and reasonable retention of correspondence for follow-up, complaints and legal claims.
• Consent (art. 6(1)(a)): marketing by email and SMS, shopping cart reminders, storing measurements on your profile and optional analytics cookies. Consent may be withdrawn at any time.

• Body measurements linked to rentals: deleted or anonymised no later than 12 months after the rental period, unless you have chosen to store them on your profile. They are then stored until you delete them or your account.
• Shopping carts that are not paid: deleted automatically 90 days after you last changed them yourself.
• Enquiries and customer dialogue: up to 3 years from the last active contact, after which the data is deleted or anonymised.
• Marketing, newsletters and reminders: until consent is withdrawn, or at the latest 3 years after the last interaction.
• Technical logs and security: for as long as necessary for operation and security.
• Statutory data such as accounting records: retained for the applicable statutory periods.

Our own site measurement and Skishop Hub

We also measure how the website is used ourselves. The measurements are stored in our own database (see the overview of data processors), are not shared with advertising networks and are used to improve the website and the booking flow.

• Without consent to statistics we only record anonymous events: page views and steps in the booking flow (for example chosen equipment, date and checkout), with the page (without parameters in the web address), language, device type (mobile, tablet or computer) and country. Nothing is stored on your device for this, and your IP address is not stored in the measurements. The legal basis is our legitimate interest in operating and improving the website (GDPR Art. 6(1)(f)).
• With consent to statistics we also store a random session ID (sessionStorage, deleted when you close the browser) and a random visitor ID (localStorage) on your device, and record campaign parameters (utm, gclid, fbclid) and the referring page. When you view a product, add it to the cart or buy it, we send the product ID and the random session ID to Skishop Hub, our own point-of-sale and inventory system, so that we can see which products are in demand. Storing and reading these IDs on your device requires consent under section 3-15 of the Norwegian Electronic Communications Act, and the legal basis is consent (GDPR Art. 6(1)(a)).
• Google Analytics 4 (Google Ireland Ltd. / Google LLC) is used with Google's consent mode. The Google tag loads on every page, but without consent to statistics no cookies are stored and Google only receives anonymous signals without an identifier: that a page was viewed or a booking step was completed, the device type and approximate location derived from your IP address. With consent to statistics the cookies `_ga` and `_ga_…` (up to 2 years) are stored with a random client ID, and Google receives page views, booking-flow events (item number, category and amount), device and browser, and approximate location. We never send your name, email address, phone number or address to Google Analytics, and codes and links that give access to a booking are removed from web addresses before they are sent. Google may process the data in the USA on the basis of the EU–US Data Privacy Framework and the EU Standard Contractual Clauses. The legal basis is consent (GDPR Art. 6(1)(a)) for the cookies and the measurement with a client ID, and our legitimate interest in measuring the use of the website (Art. 6(1)(f)) for the anonymous signals. You can withdraw your consent at any time under «Cookies» at the bottom of the page.
• Google Ads (Google Ireland Ltd. / Google LLC): With consent to marketing we measure whether an ad on Google led to a booking (conversion measurement). Google may then store cookies such as `_gcl_au` (up to 90 days) and receives that a purchase was completed, the amount and our internal order number. To link the purchase to the ad click we also send your email address in one-way encrypted form (SHA-256 hash), never in plain text ("enhanced conversions"). Without consent to marketing no advertising cookies are stored and your email address is not sent; an ad click ID (gclid), if any, may then be passed along in the web address between our pages without being stored on your device. Google may process the data in the USA on the basis of the EU–US Data Privacy Framework and the EU Standard Contractual Clauses. The legal basis is consent (GDPR Art. 6(1)(a)). You can withdraw your consent at any time under «Cookies» at the bottom of the page.
• Anonymous visit statistics without consent: If you have not consented to statistics, we count your visit anonymously in our own database. No cookies are used and nothing is stored on your device (not in localStorage or sessionStorage either), and your IP address is not stored. The visit is only recognised by a random visit number that exists in the browser's memory and disappears when you close or reload the page. We count page views (the page without parameters in the web address, and the page title), which website you came from (the domain name only), campaign parameters (utm_source, utm_medium, utm_campaign), device type (based on screen width), language, country and the steps in the shop – item or item list viewed, added to cart, cart viewed, checkout started, delivery and payment chosen and purchase completed, with item number, item name, category, price, quantity, amount and our internal order number (used only to prevent the same purchase from being counted twice). Your name, email address, phone number, address or other customer information is not sent. The same anonymous counts are forwarded to Google Analytics from our server (Measurement Protocol), marked as anonymous: without your IP address, without information about your browser, without a customer or user ID and without any identifier Google can link to you – only the random visit number, and with ad personalisation turned off. Google may process the data in the USA on the basis of the EU–US Data Privacy Framework and the EU Standard Contractual Clauses. The legal basis is our legitimate interest in measuring and improving the website and the online shop (GDPR Art. 6(1)(f)). We keep the raw counts for 13 months; in Google Analytics the retention period set in our Analytics account applies. If you consent to statistics, the anonymous counting stops and measurement takes place as described above instead.
• The events do not contain your name, email address or phone number and are not linked to your customer account. Raw events are deleted after 13 months; aggregated statistics without identifiers may be kept for up to five years.
• To prevent abuse, a one-way hash of your IP address is used briefly to limit the number of requests. The country is derived by our hosting provider from the connection.
• You can change or withdraw your consent at any time via "Cookies" at the bottom of the page. If you withdraw it, we stop sending and storing the IDs, and the Skishop Hub session ID is deleted from your device.

Map

The maps on the website (activities, accommodation, cycling and the delivery choice in checkout) use map tiles from OpenStreetMap. The tiles are fetched and cached by our own server, so your browser never contacts OpenStreetMap, and OpenStreetMap receives neither your IP address, cookies nor which page you are viewing. The same applies to the static map image on the cycling page, which is fetched from Google via our server. Map data © OpenStreetMap contributors (ODbL).

AI assistant ("Ask us")

The "Ask us" chat is an automated AI assistant, and it is labelled as such in the chat window. It can only be used when you are signed in. The answers are machine-generated and may contain errors. The assistant makes no binding decisions – for example on refunds or complaints – these are always made by a member of staff, and you can ask to talk to one of us at any time.

• What is sent: your question and the most recent messages in the conversation. Only when the conversation is about rental or equipment sizing do we also send the first name, age (in whole years), height, shoe size and skill level for you and the people saved on your account – including children – so that the assistant can suggest the right equipment without asking again. We never send surnames, dates of birth, email addresses, phone numbers, addresses or saved weight. Please do not type sensitive information, such as health information, in the chat.
• Who processes it: the request passes through the Lovable AI Gateway (Lovable) to the Gemini AI model from Google. Both are our data processors and only process the information to produce the answer. See the overview of data processors.
• Transfers outside the EEA: Google and Lovable's sub-processors may process the information in the USA. The transfer is based on the EU–US Data Privacy Framework (Google LLC is certified) and the EU standard contractual clauses (SCC).
• Legal basis: contract or pre-contractual steps when you ask for help with a rental (GDPR Art. 6(1)(b)); otherwise our legitimate interest in answering customer questions quickly and correctly (GDPR Art. 6(1)(f)).
• Storage: we do not store the conversation in our database. It only exists in your browser window until you close the chat or reload the page. To prevent abuse, we store a one-way hash of your user ID and IP address for up to two days. Lovable and Google may store the request briefly for operations and abuse monitoring under the data processing agreement.

We also use AI support when planning shifts for our staff. The suggestions are always approved by a person, and staff receive separate information about this.

Transfers outside the EEA

Some of our data processors may process data outside the EEA. This takes place on the basis of the EU standard contractual clauses (SCC), or other valid transfer mechanisms, such as the EU–US Data Privacy Framework where the supplier is certified, or a decision by the European Commission that the country ensures an adequate level of protection (for example the United Kingdom). See the overview of data processors for who processes what, where and on which basis.

Security

We implement technical and organisational measures to protect personal data against unauthorised access, alteration, loss or disclosure. Sensitive data is stored encrypted, and access is given only to those who need it for their work.

Your rights

You have the right to access, rectification, erasure, restriction, data portability and to object to processing based on legitimate interest. Where processing is based on consent, consent may be withdrawn at any time – for marketing and reminders you do this under My page or via the unsubscribe link in the email. Enquiries are addressed to info@skishop.no.

Deleting your account

When you choose "Delete my user" under My page, we delete everything the website has stored about you: account, profile, stored measurements and people, stored shopping cart, the link between your email address and your customer card in the rental system, consents and stored conversations. Data we are required to keep under the Bookkeeping Act – receipts, payment records and order history – is kept for the statutory period, but name, email, telephone and address are removed from it.

The shop's point of sale and rental system may in addition hold data from earlier rentals that must be retained under accounting rules. You may ask the shop to delete what does not have to be kept: info@skishop.no or +47 91 92 92 91.

If you later create a new account with the same email address, it starts completely blank. No measurements, people, history or pre-filling is taken from the deleted account.

Right to complain

If you believe the processing breaches the rules, you may complain to the Norwegian Data Protection Authority (Datatilsynet).

Contact

Trysil Skishop Eiendom AS, Vestmovegen 24, NO-2420 Trysil. Email: info@skishop.no. Telephone: +47 91 92 92 91. Company no.: 981 443 489.