Privacy Policy — Snowplaza & Skiinformatie.nl apps.

This policy explains what personal data the Snowplaza app and the Skiinformatie.nl app collect, why, and what your rights are. Both apps are run by the same company, which is the controller under the GDPR (AVG):

The two apps work the same way, but each has its own separate database. Data from the Snowplaza app is never combined with data from the Skiinformatie.nl app. Where this policy says "the app", it means whichever of the two you use.

This policy covers the apps only. Our websites (snowplaza.nl, skiinformatie.nl and others) have their own privacy and cookie policy.

You can use the app without an account. On first launch the app creates an anonymous user ID for you, so you can save favorites, a trip and alerts without signing up. If you sign in, we also store your email address and name.

You are not legally or contractually required to give us any of this data. Without an account you can still read all content. If you don't share preferences, favorites or a trip, the app just shows less personal content and can't send alerts for your areas.

If you remove a favorite or a trip, we mark it as deleted but keep the record until your account is deleted.

We do not use your data for automated decisions that have legal or similarly significant effects on you. Personalising content and ads based on your preferences is a light form of profiling; you can turn the ad part off at any time.

We only send notifications if you allow them in your phone's prompt. You can switch them off at any time in your phone's settings; the app then removes your push token.

To send notifications we store your push token, whether your phone runs iOS or Android, and your app language, so alerts arrive in the right language. We keep this until you withdraw permission, log out or delete your account.

For every notification we send, we keep a short record: your user ID, whether it was a snow alert or an editorial message, its title and text, which device it went to, which ski areas and how many centimetres of snow it was about, and whether it was delivered. We use this to make sure you get each alert only once and never more than a daily maximum, and so our editors can see what was sent to whom. These records are deleted automatically after 60 days.

Notifications are delivered through an external push notification service and, from there, through Apple's or Google's notification service for your phone. Snow alerts are scheduled by a job that runs with a cloud hosting provider. Our editors use an internal Spalder dashboard to view user accounts and send editorial notifications.

The app is free and shows ads through Google Ad Manager and Google AdMob. Personalised ads are only shown if you agree to them; otherwise you see our own Spalder ads, for which no personal data is used.

Asking for consent. When you first open the app, Google's consent form asks whether you agree to personalised ads (based on the IAB Transparency & Consent Framework). Your choice is stored on your device by Google's software. You can change it at any time from your profile screen in the app. On iPhone, Apple's "Allow tracking" prompt also appears; only if you allow it may Google use your iPhone's advertising ID (IDFA). On Android, Google's software uses the Android advertising ID, which you can reset or delete in your phone's settings.

What is sent with every ad request. To show an ad that fits the page, we send information about the page, not about you: which screen and ad slot, which ski area, village, country, region or article you are viewing, which app, the app language, your device type and the app version.

What is sent only if you agreed to personalised ads. Whether you have a guest or registered account, your ski level, piste preference, atmosphere and resort size, which alerts you have on, your snow threshold, the IDs of your favorite ski areas and villages, whether you have a trip planned and its area and village, and the country you last selected.

What we never send to Google. Your name, email address, user ID, push token or location.

Google processes ad data as an independent controller. Read how Google uses data from apps that use its services at policies.google.com/technologies/partner-sites, and Google's privacy policy at policies.google.com/privacy. Google may process this data outside the EU, including in the United States.

The legal basis for personalised ads is your consent (GDPR art. 6(1)(a)). Withdrawing consent does not affect ads already shown.

When the app crashes or hits an error, it sends a report to our error-monitoring service, hosted in the European Union, so we can find and fix the problem. A report contains your device model, operating system version, app version, the error itself, and a short trail of recent app events and screens (for example a failed ad request). Failed Google or Apple sign-ins are reported with the provider and error code. The service also receives your IP address and basic request data.

We do this based on our legitimate interest in a stable, working app (GDPR art. 6(1)(f)). Reports are kept for 30 days.

Some data never leaves your phone:

• Your login session, so you stay logged in.
• Your chosen app language (only shared with us as part of the push token, see section 3).
• The country you last selected on the Destinations and Snow tabs.
• Your onboarding progress (favorites, preferences and alert choices) until you finish.
• Your push token, so the app can remove it if you withdraw notification permission.
• Cached public content (ski areas, weather, articles, translations) for offline use, kept for 14 days.
• Your ad consent choice, stored by Google's software (see section 4).

Deleting your account or the app removes this data from your device.

We do not sell your data. We share it only with the services below, which we need to run the app. Processors work only on our instructions under a data processing agreement; independent controllers decide for themselves how they use the data, under their own privacy policy.

Webcams. Webcam images are shown inside the app from third-party player pages. These pages may set their own cookies, under their own policies.

Booking and advertiser links open in your external browser. The privacy policy of that website applies there.

We may also share data if the law requires it, for example on a court order.

Your account data is stored by our database provider in London, United Kingdom. The UK is outside the EU, but the European Commission has decided that it offers an adequate level of protection (renewed on 19 December 2025, valid until 27 December 2031), so no extra safeguards are needed. Error reports stay in the European Union.

Some of the services in section 7, such as push notification delivery and advertising, are based in the United States. Where data goes to the US, we rely on the EU-US Data Privacy Framework for companies certified under it, and otherwise on the European Commission's Standard Contractual Clauses. You can ask us for a copy of the relevant safeguards via the contact details in section 1.

Under the GDPR you have the right to:

• see the personal data we hold about you (access);
• have incorrect data corrected;
• have your data deleted;
• restrict how we use your data;
• receive your data in a machine-readable format and have it moved elsewhere (portability);
• object to processing based on our legitimate interest, such as error monitoring;
• withdraw your consent at any time, without affecting what we did before.

Delete your account in the app. In your profile you can delete your account. This permanently deletes your account, profile, favorites, trips, push tokens and push history, and clears the app's local storage on your phone.

Change your ad choice at any time from the profile screen. Stop notifications in your phone's settings; the app then removes your push token.

No longer have the app? You can also ask us to delete your account and data by emailing [email protected] from the address linked to your account, or via spalder.com/data-requests/. For any other request, email us at [email protected]. We answer within one month. We may ask you to confirm your identity first.

Not happy with how we handle your data? Please tell us first. You also have the right to file a complaint with the Dutch Data Protection Authority, the Autoriteit Persoonsgegevens, or with the authority in the EU country where you live.

The apps are meant for people aged 16 and over. In the Netherlands, children under 16 need permission from a parent or guardian to consent to things like personalised ads. If you are under 16, ask a parent before creating an account or agreeing to personalised ads. If we learn that a child under 16 has an account without permission, we delete it. Parents can contact us at [email protected].

The app does not use your location, camera, photos, contacts or microphone. We store no passwords and no payment details. Apart from our error-monitoring service and Google's ad software, the app contains no analytics or tracking tools.

We protect your data with encrypted connections (HTTPS), access controls so that only authorised Spalder staff can see account data, and login without passwords. Your login session on your phone is stored in the device's secure storage.

We may update this policy when the app or the law changes. The date at the top shows the latest version. If a change matters for you, for example a new use of your data, we will tell you in the app before it takes effect and, where needed, ask for your consent again.