1 Introduction

AS PARKS and its subsidiaries, including Skimore AS, TryvannWyller AS, Drammen Skisenter AS, and Kongsberg Skisenter AS (Skimore Oslo, Skimore Drammen, and Skimore Kongsberg), are committed to handling your personal data in a safe and secure manner, in accordance with applicable regulations.

Below you will find information about how Skimore AS, as the data controller, handles personal data collected from users of the Skimore app, as well as from the use and rental of our other services (such as ski rental, ski school, bike rental, climbing parks, etc.).
This statement also covers Skimore’s processing of personal data in any partner resorts with which Skimore has an active cooperation agreement.

2 What personal data we collect and why

2.1 Contract fulfilment and service delivery

When you enter into a membership agreement with us or register to use our services, we collect personal data from you in order to complete your booking and fulfil our obligations under the agreement. These obligations include providing access to the application, identifying you as a valid member, supplying correctly fitted rental equipment, ensuring the correct level for ski school participation, and contacting you regarding matters related to your membership.
In this context, we process the following personal data: name, email address, mobile number, user photo, date of birth, account information, skill level, size, and height.

The legal basis for this processing is GDPR Article 6(1)(b) (contract), as the data is necessary to fulfil our agreement with you.

If your booking includes minors, we also collect this information when necessary to fulfil the agreement. The legal basis for this processing is likewise GDPR Article 6(1)(b) (contract).

2.2 Registration of activity

We may process information about your activity at AS PARKS facilities to ensure that your use is in accordance with the agreement. The legal basis for this processing is GDPR Article 6(1)(f) (legitimate interest).

We may also process information about your purchase and visit history to tailor which offers we communicate to you. From time to time, for example, we may offer conversion of guest passes to memberships at a favourable rate, and we will adapt our marketing based on who has purchased a guest pass. The legal basis for this processing is the Norwegian Marketing Act §15(1) and GDPR Article 6(1)(a) (consent).

In addition, we may process anonymised activity data for internal business purposes, such as (i) revenue allocation between AS PARKS group companies, (ii) preparing reports and statistics to improve our services, and (iii) other analyses aimed at enhancing your user experience in the app.
This processing will, as far as possible, be based on anonymised data that cannot be traced back to you. Such processing is based on a balancing of interests, as we believe it contributes to efficient company operations and the best possible conditions and services for our customers, cf. GDPR Article 6(1)(f) (legitimate interest).

2.3 Marketing to existing customers and members

Skimore strives to ensure that our members and customers receive updated and relevant information about news and other matters that may enhance their use of our services. From time to time, we may send newsletters and other relevant information to all our customers via email, push notifications, or SMS. These messages may include information about products and offers relevant to your membership or purchased service.

This type of marketing is sent without prior consent to existing customers and members. The communication will be sent to the contact details you provided when entering into the membership. This marketing is based on an existing customer relationship, cf. the Norwegian Marketing Act §15(3), and a balancing of interests, cf. GDPR Article 6(1)(f).
For individuals who are not existing customers or members, such marketing will be based on the Norwegian Marketing Act §15(1) and GDPR Article 6(1)(a) (consent).

If you have given your consent, we may also send you electronic marketing and newsletters containing information about products and services from companies within the same corporate group as Skimore, or from our commercial partners. The legal basis for such marketing is the Norwegian Marketing Act §15(1) and GDPR Article 6(1)(a) (consent).

2.4 Visits to our websites – Log data and cookies

When you visit our service or websites, we collect information that your browser sends to us, known as log data. This may include information such as your computer’s IP address, geolocation, browser version, the pages you visited, the time and date of your visit, the time spent on each page, and other statistics.

Cookies are small data files that usually serve as anonymous unique identifiers. These are sent to your browser from the website you visit and stored on your computer’s hard drive.

Our website uses cookies to collect information and improve your user experience. The purpose of using cookies is to gain insight into user interactions on our website through anonymous reporting, measurement, and statistics. The data processed in this context includes cookie ID, device type, browser type, and IP address.

You may delete these cookies in your browser after they are sent to your device. If you choose to refuse cookies, you may miss out on optimal user experiences and be unable to use certain parts of our service.

Our use of cookies is based on GDPR Article 6(1)(a) (consent).

3 Sharing of personal data

To complete your booking, we may need to share your personal data with our suppliers and partners. We only share data to the extent necessary for them to deliver their services to you or to us, and they only receive the data that is required.

We may also disclose personal data to other companies within the same corporate group when necessary for internal administrative purposes or to meet group-level management, control, and/or reporting obligations established by law. The legal basis for this processing is GDPR Article 6(1)(f) (legitimate interest).

We use the following subcontractors and entities to:

• assist our services: Google Tag Manager, Google Analytics
• provide services and handle payments on our behalf: Skidata, NETS
• perform service-related tasks or help us analyse how our service is used: MailGun, Firebase, Teletopia
• internal group administration: AS PARKS and its subsidiaries, including TryvannWyller AS, Drammen Skisenter AS, Kongsberg Skisenter AS, and other relevant companies within the same corporate group as the data controller.

These subcontractors process personal data on our behalf and only in accordance with our instructions. In accordance with GDPR Article 28, data processing agreements have been entered into with all recipients of your personal data.

4 How long your personal data is stored

We never store personal data longer than necessary to fulfil our membership agreement or to deliver other services to you. Personal data that is no longer needed will be permanently anonymised or securely deleted.
When you terminate your Skimore membership, your personal data will be deleted after two years, or when it is no longer necessary for the purpose for which it was collected.

Certain information must be stored for specific periods as required by Norwegian law. The duration depends on the type of information and the reason for storage:

• The Norwegian Bookkeeping Act requires us to retain transaction data for five years.
• The Norwegian Limitation Act requires us to retain certain personal data related to your customer relationship.

5 Your rights

You have rights regarding how your personal data is used, including:

• The right to object to our processing of your data. Please note that in cases where personal data is required, such an objection will make it impossible to purchase or rent services, except for guest passes purchased online. In that case, it is possible to buy tickets at the counter without providing personal data.
• The right to request deletion of your data or restriction of further processing.
• The right to request a copy of the data we hold about you.
• The right to correct, amend, or update the information you have provided.
• The right to contest any automated decisions we make about you. An automated decision is one made without human involvement that has legal consequences (e.g., a credit check). We do not normally use automated decision-making, but if we do, we will notify you when such decisions are made.

6 How we store your information

Your information is stored in Skimore’s database, as well as in Skidata, Wintersteiger (Easy Rent), and Walthard (Ski School). All our solutions are secured by Cloudflare’s CDN, and all data is stored in Google Cloud, except for Wintersteiger and Walthard, which are stored locally.
Access to this data is restricted to a limited number of service administrators, all of whom have signed a data processing agreement.

7 How to access and control your information

You can access your personal data in the Skimore app under Profile → Edit Profile.

If you have questions about this statement, wish to exercise your rights under Section 5, or have other inquiries, please contact us at personvern@skimoreoslo.no.
You also have the right to lodge a complaint with a supervisory authority — in Norway, this is the Norwegian Data Protection Authority (Datatilsynet) — in accordance with GDPR Article 13(2)(d).

Updated November 1, 2023