Personal data

When you book and/or access our services, your personal data is processed by:

and,

In this policy, the "we" refers to these two companies, which may act together as joint controllers for the processing operations referenced below.

While Compagnie des Alpes is responsible for managing and supervising the IT system used to collect and process your personal data, it is however solely up to SAP, as an independent data controller, to manage the contractual relationship with you, provide you with the services ordered, and carry out marketing and advertising operations on its services and brands or additional services on the ski area (wifi, photos, ski lockers).

Internally within the Compagnie des Alpes Group:

Your personal data is processed jointly by SAP and Compagnie des Alpes, the head office of the Compagnie des Alpes Group.

Within these two companies, your personal data is only accessible to a limited number of people, within specific departments (customer services, sales, accounting, IT department, etc.), and only if access to the data is necessary to their activity.

Your personal data is not, however, shared with other member companies of the Compagnie des Alpes Group, unless you have expressly authorized it.

Outside the Compagnie des Alpes Group:

Your data may also be shared with recipients external to the Compagnie des Alpes Group:

If you choose this option, you can use your Facebook, Apple or Google account to register on our site, without having to re-enter your information. By using this feature, you agree to share with us certain information about you from your social network account.

The data transmitted to us by the social network is, your last name, first name and email address. This data is needed to create your customer account. We do not communicate information to social networks about your activities and orders on the site https://www.skipass-laplagne.com/fr/ or our mobile application, however these networks will have information relating to connections to your account. We suggest you read the privacy policies of the social networks before using the "Social Login" for information regarding their use of your personal data.

You may also receive communication relating to the activities of the resort where you purchased your ski passes. This communication is sent to you thanks to our partnership with the tourist office, who collaborate with writing resort newsletters, as the ski lifts are a major contributor to the activity of the resort. Your data is not, however, shared or reexploited by these partners in this context.

We may collect your personal data on several occasions:

Online:

On our website or mobile application, for your orders of ski passes, to receive our newsletters, or for the purposes of logging into your account, or to benefit from our digital services.

In our resorts and ski areas:

When using our facilities, alone or with others: at the lift pass office, at our automated lift pass machine, taking photographs, accessibility for people with disabilities, accessing reduced rates, using public Wi-Fi, ski lockers, video surveillance.

In our customer interactions:

When you open or respond to a newsletter, participate in a survey or a competition. When you contact customer services to make a complaint.

Via our Partners:

When you access our services through an intermediary (e.g. travel agencies, partner distributors, tourist office).

We only collect data which is strictly necessary.

During your visit to the ski area, the resort, or on our websites, we may collect the following information:

At the end of the retention periods defined below, we delete it from our systems or anonymize it so you can no longer be identified.

While families are naturally a major factor in our business, we do not direct any data processing specifically towards children.

If our services are used by a person under the age of 15, we recommend they are accompanied by an adult. The consent of parents or legal guardians may be obtained at the time of collection of their personal data, if necessary.

All your personal data is stored exclusively on servers located within the European Union.

Although hosted in the territory of the European Union, this data may be accessible by other countries when we use technical service providers (e.g. AWS, Microsoft, Google), which are established abroad (namely: United States, Israel). Access from these countries is considered as data transfers but is necessary for the proper function and maintenance of the IT tools they offer. These service providers have genuine expertise which justifies their use.

We make every effort with these service providers to ensure that your data is protected in accordance with European regulations. These service providers only act within the framework of our instructions. A contract is systematically concluded with the latter and the transfer of personal data is governed by the signature of reinforced contractual clauses specifically provided for this purpose (standard contractual clauses - SCC - published by the European Commission) when the laws of the country concerned do not offer protection equivalent to the GDPR (so-called "adequate" countries). Where appropriate, additional technical or legal measures are put in place.

The security of your personal data is a top priority of the Compagnie des Alpes Group companies, which pool their resources to ensure an appropriate level of security that is up to date with the latest technology.

In order to preserve the confidentiality and security of your personal data and in particular to protect it against illicit or accidental destruction, accidental loss or alteration, or unauthorized disclosure or access, the Compagnie des Alpes Group takes appropriate technical and organizational measures and imposes the same level of requirement on its subcontractors. These measures are adapted according to the level of sensitivity of the data processed and according to the level of risk.

The Compagnie de Alpes Group has implemented procedures to detect, analyse and monitor security incidents as well as any suspected violation of your personal data, and is able to block access to the data at any time. Procedures for managing personal authorizations have also been implemented to ensure that access to the data is as restricted as possible.

Despite our efforts, vulnerabilities may still be present in our systems. If you believe you have detected a flaw, we invite you to contact us via this contact form Policy | Compagnie des Alpes (vulnerability disclosure page), respecting the principles described therein.

You have several rights over your personal data in our possession:

Contact information below if you wish to exercise these rights.

Any questions? Would you like to stop receiving our newsletters? Delete your account?

We have appointed a data protection officer responsible for answering all your questions and ensuring the protection of your personal data.

You can contact him:

Or

In the event of serious doubt regarding your identity, and if it cannot be done otherwise, you may be asked to produce proof of identity along with your request, simply to ensure that we are interacting with the right person.

If, despite our efforts, you consider our response to be incomplete, you can contact the CNIL https://www.cnil.fr/fr