1. Who is responsible for your data?

Skizaak B.V. is the controller for the processing described in this policy.

Skizaak B.V.
Herculesplein 25
3584 AA Utrecht
The Netherlands
Chamber of Commerce (KvK) number: 96922540
VAT number: NL867834079B01
Phone: +31 85 018 5072
Email: info@skizaak.nl

This policy applies to all our online shops: skizaak.nl (including skizaak.nl/fi, /da, /pt and /cz), skizaak.be, skizaak.de, skizaak.at, skizaak.fr, skizaak.it, skizaak.es, skizaak.se, skizaak.com and skizaak.co.uk, and to our store in Utrecht. We have not appointed a data protection officer. For any privacy question, please contact info@skizaak.nl.

2. What data do we process?

• Contact details: name, billing and delivery address, email address and phone number, and for business orders your company name and VAT number.
• Account details: if you create an account, your login details (we only store your password in encrypted form), saved addresses, order history and wish list.
• Order details: the products you buy, prices, order numbers, invoices, returns, warranty and repair requests, and complaints.
• Payment details: chosen payment method, payment status, transaction reference and refunds. Your full card or bank details are processed by the payment provider; we never see them.
• Delivery details: delivery address, shipping method, tracking details and information about delivery and returns.
• Rental details: if you rent from us: rental period, equipment rented, deposit, collection and return, condition of the equipment and the details we need to set up the equipment safely, such as height, weight, age, shoe size or boot sole length and skiing ability.
• In-store purchases: if you pay in our store, the details of your purchase and payment, and your name and email address if you give them to us, for example for a digital receipt or warranty.
• Customer service: the content of emails, phone calls and messages sent through the contact form, and any photos or documents you send us.
• Newsletter: your email address and the date you subscribe or unsubscribe.
• Technical and usage data: IP address, browser and device details, server logs, cookie IDs, the pages and products you view and the search terms you use in our online shop.

We do not ask for special categories of personal data (such as health data), and we do not need them. We only use height, weight and age to set up rental equipment safely.

The ski length calculator on our product pages works in your browser. We do not store the values you enter there.

3. Where do we get data from?

We usually get your data directly from you. We also receive data from:

• marketplaces where you order from us, such as Decathlon and Refurbed: your name, address, contact details and order details, so that we can deliver your order;
• our payment provider Mollie: the status of your payment or refund;
• carriers: information about the delivery or return;
• someone else who orders or rents on your behalf, for example a parent renting equipment for a child.

4. What do we use your data for, and on what legal basis?

We only process your data where we have a legal basis under Article 6 of the General Data Protection Regulation (GDPR) or, for customers in the United Kingdom, the UK GDPR.

Orders, payment, delivery, returns and warranty

To process your order, handle payment, ship your parcel, deal with returns and refunds, and handle warranty or repair requests. This also covers orders placed through a marketplace and purchases in our store. Legal basis: performance of a contract (Article 6(1)(b) GDPR).

Your customer account

To manage your account so that you can sign in, save addresses and view your orders. Legal basis: performance of a contract (Article 6(1)(b) GDPR).

Rental and equipment set-up

To arrange your rental and to set up skis, bindings and boots safely for your height, weight, age and ability. Legal basis: performance of a contract (Article 6(1)(b) GDPR).

Customer service and contact

To answer your questions, complaints and requests by email, phone, the contact form or in the store. Legal basis: performance of a contract or, if you are not yet a customer, our legitimate interest in answering your question (Article 6(1)(b) and (f) GDPR).

Accounting and legal obligations

To keep our accounts, file our tax returns and comply with statutory record-keeping requirements. Legal basis: legal obligation (Article 6(1)(c) GDPR).

Security and preventing misuse

To protect our online shop and systems, to prevent fake accounts, spam, fraud and automated bot traffic, and to fix faults. For this we use server logs, our own bot check (which places a security cookie in your browser) and Google reCAPTCHA when you create an account. Legal basis: our legitimate interest in a secure, properly working online shop (Article 6(1)(f) GDPR).

Improving our shop with search and click statistics

Our search function records which search terms are used and which products are viewed, so that we can improve search results and our range. This data stays on our own server, is linked to a random visitor ID and is not shared with anyone else. Legal basis: our legitimate interest in a properly working online shop (Article 6(1)(f) GDPR).

Website statistics and ad measurement (Google Analytics and Google Ads)

We use Google Analytics to measure how visitors use our online shop, and Google Ads to measure whether an ad led to a visit or an order. This uses cookies and similar technologies from Google. Legal basis: consent (Article 6(1)(a) GDPR). You can withdraw your consent at any time; see section 8.

Newsletter

If you sign up for our newsletter, we send you emails about our products and news. Legal basis: consent (Article 6(1)(a) GDPR). You can unsubscribe at any time using the link at the bottom of every newsletter or by emailing info@skizaak.nl.

Legal claims

To establish, exercise or defend our legal rights, for example in a dispute about an order or rented equipment. Legal basis: legitimate interest (Article 6(1)(f) GDPR).

Where we rely on legitimate interest, we have weighed that interest against your privacy. If you do not provide the data we need for an order or rental, we cannot perform the contract. We do not make decisions about you based solely on automated processing that have legal effects for you or similarly significantly affect you.

5. Who do we share your data with?

We do not sell your data. We only share what is necessary with the following parties.

Service providers acting on our behalf (processors)

We have agreements with these parties covering security and confidentiality. They may only use your data on our behalf.

• Hypernode (Netherlands): hosting of our online shop and servers.
• TransIP (Netherlands): sending emails from the online shop, such as order confirmations.
• Google (Google Workspace): our email and customer service mailbox.
• Channable (Netherlands): the link between our online shop and marketplaces such as Decathlon, through which marketplace orders with your name and address reach our online shop.
• our bookkeeper and accountant, for our financial records.

Parties that are controllers in their own right

These parties also process data for their own purposes and are responsible for that themselves. Their own privacy policies apply.

• Mollie B.V. (Netherlands): processing of online payments. If you choose a payment method such as PayPal, Klarna, Riverty, in3, Billie or Alma, that provider also receives your data and may carry out its own checks, for example a credit check for buy-now-pay-later.
• Carriers, currently mainly DPD: your name, address and, if you provide them, your email address or phone number for delivery notifications.
• Marketplaces where you order from us, such as Decathlon and Refurbed: we send them shipping and status information about your order.
• Google Ireland Ltd.: for Google Analytics, Google Ads, Google Tag Manager and reCAPTCHA, and because our online shop loads fonts from Google Fonts and our rental pages show a Google Maps map. Google receives at least your IP address in the process.
• Public authorities, such as the Dutch tax authorities (Belastingdienst), where we are legally required to provide data.

If you leave a review on Google, Google is responsible for that review. If you click a link to social media, that platform's privacy policy applies.

6. Data outside the European Economic Area

Our online shop runs on servers in the Netherlands. Some parties, such as Google, may also process data in the United States. Google LLC is certified under the EU-US Data Privacy Framework, which the European Commission has decided provides an adequate level of protection. Where no such decision applies, transfers are based on the European Commission's standard contractual clauses. The United Kingdom recognises the EEA as providing adequate protection, so data can flow between our shop and UK customers on that basis. Would you like to know more about these safeguards? Just email us.

7. How long do we keep your data?

• Invoices, orders and other tax records: 7 years, because of our statutory tax record-keeping obligation. Records for the VAT scheme for sales to consumers in other EU countries (OSS) are kept for 10 years.
• Customer account: for as long as your account exists. You can ask us to delete your account at any time via info@skizaak.nl; after that we only keep order and invoice data for as long as the law requires.
• Rental data: up to 2 years after the end of the rental, so that we can deal with questions or damage. Anything covered by the tax record-keeping obligation is kept for 7 years.
• Customer service and contact: up to 2 years after your question or complaint has been dealt with, or longer if needed for an ongoing warranty claim or dispute.
• Newsletter: until you unsubscribe. After that we only keep your email address with the unsubscribe record, so that we do not email you again.
• Search and click statistics from our search function: up to 12 months.
• Google Analytics: up to 14 months.
• Server logs: up to 3 months, unless we need them longer to investigate a security incident.
• Cookies: see the retention period for each cookie in section 8.

After that, we delete or anonymise your data.

8. Cookies

A cookie is a small file stored in your browser. We also use similar technologies, such as local storage in your browser. Below you can see which cookies we use.

Strictly necessary cookies (no consent required)

Without these cookies the online shop does not work properly or securely.

• PHPSESSID, form_key, private_content_version, X-Magento-Vary, mage-cache-sessid, mage-messages and local storage (mage-cache-storage): remember your basket, whether you are signed in and your language and shop choice, and protect forms. Retention: from the end of your visit up to 7 days; local storage until you clear it.
• Security cookie from our bot check: remembers that your browser has passed the check, so you do not see it again every time. Retention: up to 7 days.
• skz_consent: remembers your cookie choice, so we don’t have to ask again on every page. Retention: 12 months.

Statistics cookies from our search function

• STUID and STVID: a random visit ID and visitor ID for our own search and click statistics. The data stays on our own server. Retention: STUID 1 hour, STVID 1 year.

Google analytics and advertising cookies (only with your consent)

• _ga and _ga_* (Google Analytics): distinguish visitors and visits for statistics. Retention: up to 2 years.
• _gcl_au and _gcl_* (Google Ads): measure whether a click on an ad leads to an order. Retention: 90 days.

We only set these cookies after you have given consent in the cookie banner. You choose separately for analytics cookies (Google Analytics) and advertising cookies (Google Ads). Until you give consent, we use Google Consent Mode: Google’s tags then only send cookieless signals, for example that a page was viewed or that you arrived via an ad. No cookies are placed in or read from your browser, but Google does receive technical data such as your IP address. You can change your choice or withdraw your consent at any time via the “Cookie settings” link at the bottom of every page. If you withdraw your consent, we remove the Google Analytics cookies (_ga, _ga_*) or Google Ads cookies (_gcl_*) from your browser. Withdrawing consent does not affect processing that was lawfully carried out before.

Content from Google

On pages with a Google Maps map and on the account registration page (reCAPTCHA), your browser loads content from Google. Google may use its own cookies and receives your IP address. The fonts used in our online shop are also loaded from Google Fonts servers.

9. Your rights

You have the following rights:

• Access: you can ask what data we hold about you and what we do with it.
• Rectification: you can have inaccurate or incomplete data corrected or completed.
• Erasure: you can ask us to delete your data, unless we are legally required to keep it.
• Restriction: you can ask us to restrict processing temporarily, for example while we look into a request for correction.
• Data portability: you can receive data you have given us in a commonly used digital format, or have it sent to another organisation.
• Objection: you can object to processing based on our legitimate interest. You can always object to use for direct marketing; we will then stop immediately.
• Withdrawing consent: where we process your data based on consent, you can withdraw that consent at any time.

Send your request to info@skizaak.nl and tell us which right you want to exercise. To make sure we do not give data to the wrong person, we may ask you to confirm your identity, for example by emailing us from the email address we have on file. We will respond within one month. For complex or numerous requests this period can be extended by two months; if so, we will let you know within the first month.

10. Children

Our online shop is not intended for children under 16. If a parent, guardian or other adult rents equipment for a child, that adult gives us the child's details. Please only provide details that are necessary and correct. We only use them for the rental and to set up the equipment safely.

11. Security

We protect your data with appropriate technical and organisational measures. Our online shop uses a secure connection (https), we store passwords in encrypted form and only staff who need the data for their work have access to it. If you think your data is not properly secured or is being misused, please contact us straight away at info@skizaak.nl.

12. Making a complaint

Unhappy with how we handle your data? Please tell us first and we will work with you to find a solution. You also have the right to complain to a supervisory authority. Because Skizaak is based in the Netherlands, this is primarily the Dutch Data Protection Authority, the Autoriteit Persoonsgegevens. You can also contact the supervisory authority where you live; in the UK, that is the Information Commissioner's Office (ICO).

13. Changes

We update this privacy policy when our online shop, our services or the law change. This page always shows the latest version, with the date at the top.