Privacy Policy

Last updated: 2026-11-09

1. Data Controller

The data controller for personal data collected through the website thesnowboardhouse.com is Emanuele Rossi (hereinafter "the Controller"). For any privacy-related request, you can write to info@thesnowboardhouse.com or use the contact page.

2. Data Collected

  • Browsing data: IP address, browser type, pages visited, and time of access. It is collected automatically when you visit the site and is needed to run and protect it.
  • Approximate location: the area you connect from, at city level, which our hosting provider (Cloudflare) derives from your IP address. We use it only when you open the home page, to choose the resort to show you (see section 3).
  • Data you give us: your name, email address, and the text of your message, when you use the contact form or email us.
  • Social profile data: your username, comments, and interactions, when you follow or comment on our Instagram and Facebook profiles (see section 6).
  • Visit statistics: the page visited, the referring site (its domain name only), any campaign parameters (utm), the links clicked, the time spent on the page, page load times, country, device type, browser, operating system, and language. They are collected in aggregate form and without cookies (see the Visit Statistics section).

3. Purposes and Legal Bases

  • Running and protecting the site: the Controller's legitimate interest in offering a secure, working site (Art. 6(1)(f) GDPR).
  • Showing you a resort near you on the home page, chosen by snowboard rating and driving time from your approximate location: the Controller's legitimate interest in offering content that is useful to visitors (Art. 6(1)(f) GDPR). The location is used only to choose the resort and is neither saved nor linked to you; when it is not available, you see the featured resort.
  • Replying to your messages: your request (Art. 6(1)(b) GDPR) and the Controller's legitimate interest in replying quickly and accurately, including with the drafts described in section 5 (Art. 6(1)(f) GDPR).
  • Protecting the contact form from abusive submissions, with the spam check and a submission limit: the Controller's legitimate interest (Art. 6(1)(f) GDPR).
  • Producing aggregate statistics on how the site is used and how fast it loads (which pages are read, where visitors come from, which links they follow), to improve its content and performance: the Controller's legitimate interest (Art. 6(1)(f) GDPR).
  • Running our Instagram and Facebook profiles and replying to comments: the Controller's legitimate interest (Art. 6(1)(f) GDPR).
  • Complying with legal obligations, when there are any (Art. 6(1)(c) GDPR).

No processing is based on consent today. If some processing ever requires it (Art. 6(1)(a) GDPR), we will ask you first, and you can withdraw it at any time.

4. Cookies and Similar Technologies

The site uses only technical cookies, set by our hosting provider (Cloudflare) for the site's security and bot protection: they do not require consent. It uses no analytics, profiling, or advertising cookies and embeds no third-party content, apart from the spam check on the contact page. For this reason the site shows no cookie banner. You can still block or delete cookies from your browser settings. If we ever introduce non-technical cookies or third-party content, we will update this policy and ask for your consent.

Visit Statistics

We measure visits in aggregate form with two tools: the statistics service of our hosting provider (Cloudflare) and a tool of our own, also hosted by Cloudflare. Neither uses cookies, stores anything on your device, or follows you to other sites, and the data is not combined with other sources. Cloudflare states that it does not keep IP addresses, and our tool does not record them: to count a day's unique visitors it uses a non-reversible code that changes every day and cannot be used to recognize you from one day to the next. The Controller sees only aggregate numbers. If your browser sends the Global Privacy Control or Do Not Track signal, our tool does not count your visits.

This data is not used to profile you and is not shared with anyone; for these reasons the statistics do not require consent. If you would rather not be counted, you can block them with a browser extension that blocks trackers; the site works the same.

Advertising and Affiliate Links

An advertising space may appear at the bottom of the pages, always labeled as such ("Sponsored" or "Ad · Affiliate link"). It is hosted by the site itself: it loads no scripts, images, or cookies from advertising networks. Some links are affiliate links: if you buy something after clicking, the shop pays the site a small commission, at no extra cost to you. The cookie that makes this possible is set by the shop's website, after the click and under its own policy, not by this site.

Contact Form Spam Check

To protect the contact form from automated submissions, the contact page uses Cloudflare's bot protection service. It usually checks within a few moments, without asking you anything, that a person is filling in the form; only occasionally does it ask you to tick a box. To do this, Cloudflare processes your IP address and some technical characteristics of your connection and browser, and saves a single technical item in your browser, which is not a cookie and is used by the check itself. It does not read what you type in the form.

Cloudflare states that it uses this data only to tell people from bots, not to identify or profile you. It processes the data on the Controller's behalf and, as an independent controller, to improve its own bot detection: the details are in Cloudflare's privacy addendum for this service. The check does not require consent. The form cannot be sent without it: if you prefer, email us directly at info@thesnowboardhouse.com.

5. Messages and Draft Replies

Giving us your name, email address, and message is optional, but without them we cannot reply to you.

To reply faster, an artificial intelligence service (Claude, by Anthropic) prepares a draft reply to the messages sent through the contact form. It receives only the text of the message, without your name or email address: if your name, email addresses, or phone numbers appear in the text, we remove them first. A person reads and approves every reply before it is sent: no reply goes out automatically, and we make no decisions based solely on automated processing. The tool that prepares the drafts is hosted in the European Union and deletes messages and drafts after 90 days.

6. Instagram and Facebook Profiles

We have an Instagram profile and a Facebook Page, on Meta's platforms. When you follow them, like a post, or comment, Meta processes your data under its own policies (Instagram, Facebook). For the statistics Meta provides about our Facebook Page, we are joint controllers with Meta (Art. 26 GDPR), under Meta's joint controller addendum; requests about that data go to Meta.

We read the comments on our posts to answer questions. Once a week an automated tool counts, for each post, the new comments and how many look like questions, so we know where to reply: it reads the comments without storing their text or names and does not send them to artificial intelligence services. We hide spam and offensive comments, and you can delete yours at any time. We don't answer private messages on the profiles: to write to us, use the contact page.

7. Recipients and Data Transfers

We do not share data with third parties for marketing purposes. To run the site, the following providers process it on the Controller's behalf:

  • Cloudflare: site hosting and security, the spam check, and visit statistics;
  • Microsoft: email and cloud services, including the tool that prepares draft replies;
  • Resend: sending the contact form's emails and our replies;
  • Anthropic: an artificial intelligence service (Claude), for the draft replies, with the text of the message only (section 5), and to prepare some of the site's texts, for which it receives only public sources and draft texts.

Some of these providers are based in the United States, so data may be transferred outside the European Union. These transfers rely on the European Commission's adequacy decision for providers certified under the EU-U.S. Data Privacy Framework, or on the standard contractual clauses approved by the Commission. For information about these safeguards, or a copy of them, write to info@thesnowboardhouse.com.

8. Data Retention

Personal data is retained for the time strictly necessary for the purposes for which it was collected, and in any case no longer than the periods required by law. In particular:

  • messages received through the contact form or by email: at most 24 months;
  • messages and drafts in the tool that prepares the replies: 90 days, then they are deleted automatically;
  • comments on our posts: they stay on Instagram and Facebook until you or we delete them; the tool that counts them keeps nothing;
  • the non-reversible value derived from your IP address to limit abusive use of the contact form: at most one hour;
  • the approximate location used for the home page resort: we do not keep it; it serves only to answer that request;
  • visit statistics: Cloudflare keeps the full data for 7 days, then only an aggregate sample; our tool deletes its data after three months, and the summaries we draw from it contain aggregate figures only.

9. Your Rights

Under the GDPR (EU Regulation 2016/679), you have the right to:

  • Access your personal data (Art. 15);
  • Rectify inaccurate data (Art. 16);
  • Request erasure of data ("right to be forgotten", Art. 17);
  • Restrict processing (Art. 18);
  • Object to processing based on legitimate interest (Art. 21);
  • Request data portability (Art. 20);
  • Withdraw consent at any time, where processing is based on consent, without affecting the lawfulness of processing prior to the withdrawal.

To exercise your rights you can contact us via the contact page. You also have the right to lodge a complaint with the Italian data protection authority, the Garante per la protezione dei dati personali (www.garanteprivacy.it), or with the supervisory authority of your country of residence.

10. Changes to This Policy

The Controller reserves the right to update this policy. Changes will be published on this page together with the date of the update. We encourage you to check this page from time to time.