My Alpine Money — Privacy Notice

This notice explains how we use personal data in connection with the My Alpine Money loyalty programme (the “Programme”), what rights you have, and how to contact us.

It sits alongside the privacy notice of each business you book with, which explains how that business handles your booking. Where the two overlap, this notice applies to your membership of the Programme.

Amitours London LTD, company number 08051989, registered at 7 Bell Yard, London, England, WC2A 2JR, United Kingdom, is responsible for the personal data described here.

The Programme runs across several businesses. Your membership, your balance and your tier are our responsibility, whichever of them you booked with; the booking itself is handled by that business under its own privacy notice.

You can contact us about data protection at info@loyalty.ski.

We use the following categories of data. Not all of it will apply to every member.

We do not seek to collect special category data for the Programme. The Programme is for adults, and we do not knowingly process children’s data for it.

• From you — when you join, use your account, contact us, or share a referral link
• From the businesses you book with in our group, so that your activity can be recognised
• Generated by us — your membership identifier, your balance and credits, your tier
• From a person you referred, where they tell us you referred them
• Automatically, when you use your account online

Where we rely on a legitimate interest, we have considered the effect on you and you can ask us about that assessment. You can object to processing on that basis — see section 11.

Your balance, your credits’ expiry dates, your tier and the rate at which you earn are all calculated automatically from your activity. These are the mechanics of the Programme rather than decisions taken about you as a person, and they do not have legal effects of the kind that would give you the right to require human intervention. If you think something has been calculated wrongly, contact us and a person will look at it.

We do not use Programme data to assess your creditworthiness, to vary the price you are shown, or to target offers at you individually. Nothing we measure about your use of the site decides anything about your membership, your balance or your tier.

• Businesses in our group that take part in the Programme, so that you can earn and spend across them. They generally receive only what they need for that purpose, such as your membership identifier, your tier and your available balance.
• Suppliers who process data for us under contract and on our instructions: the host of our database, the platform that runs the site, the service that shows our cookie banner, the service that sends our email, the service that records errors on the site, and the services that measure how the site is used (section 13). We keep a current list of them and will name them on request.
• Professional advisers such as auditors, accountants and lawyers, where they need it.
• Authorities, regulators and others, where we are required or permitted by law to disclose.
• A buyer or successor, if the business or the Programme is transferred.
• Other members, only to the limited extent described for referrals in section 3.

We do not sell your personal data, and we do not share it with third parties for their own marketing.

Your data is held in the European Union: the database runs in Ireland. We are registered in the United Kingdom and reach it from there, which the European Commission allows under its adequacy decision for the United Kingdom. Where a supplier processes data outside the European Union or the United Kingdom, we put standard contractual clauses approved by the European Commission in place, and we will send you a copy on request.

We keep personal data for as long as we need it for the purposes described above, and no longer than is necessary. In deciding how long that is, we take account of:

• how long you remain a member, and whether you still have a balance;
• the periods for which we are required to keep financial and accounting records, which apply to records of balances and transactions even after a membership ends;
• whether we need the data to deal with a query, complaint, investigation or legal claim, and the time limits that apply to those;
• whether we are required to keep it by law, or to demonstrate that we have complied with the law — for example a record that you asked not to receive marketing.

When we no longer need data that identifies you, we delete it or keep it only in a form that does not identify you. Retention periods for each category are set out in our internal retention schedule, which we keep up to date and can summarise on request.

In practice: a record of a sign-in request, and the IP address it came from, is deleted 30 days after it was made. A membership with no activity and no sign-in for 36 months is anonymised — the record of credits and redemptions stays, with nothing in it that identifies you, because your balance is the sum of those entries and the programme's accounts are built on them.

Where you ask us to erase you, we keep a one-way hash of your email address indefinitely and nothing else. It exists so that a later booking does not recreate the membership you asked us to remove.

We take appropriate technical and organisational measures to protect personal data. The sign-in link is single-use, valid for fifteen minutes, and stored only as a hash, so the link in your inbox is not held anywhere in a usable form. The session cookie is signed and cannot be read by scripts. Every system permitted to call the programme’s engine holds its own key, which can be withdrawn on its own. Your data is held in the European Union and is encrypted in transit.

Access to your account may be granted using a link sent to your registered email address. That means anyone who can read your email may be able to reach your membership. Please keep your email account secure and your contact details up to date, and tell us promptly if you think something is wrong.

Subject to the conditions in data protection law, you can ask us to:

• tell you what data we hold about you and give you a copy;
• correct data that is wrong or incomplete;
• delete data, where we no longer have a good reason to keep it. Note that ending your membership means forfeiting your balance, and that we may need to keep transaction records for accounting purposes;
• restrict how we use your data, or stop using it where we rely on a legitimate interest;
• provide certain data in a portable form;
• stop sending you marketing, at any time.

Two of these are in your account. “Download my data” returns everything we hold about you as a file: your profile, your email addresses, your consents and every entry in your balance. “Delete my account” shows what you forfeit, asks you to confirm, and then removes what identifies you.

Your email address is the one detail you may need corrected, and the booking system is its source rather than this one, so that change goes through support rather than your account page.

Where we rely on your consent, you can withdraw it at any time. Withdrawing consent to marketing does not stop the operational messages we need to send about your membership.

To exercise any of these rights, contact info@loyalty.ski. We will respond within the time the law allows and will tell you if we need longer. We may ask you to confirm your identity first.

If you are not satisfied, you can complain to the Information Commissioner’s Office, which supervises us in the United Kingdom, or to the data protection authority in the country where you live or work. We would like the chance to resolve it first.

Where you have agreed, or where the law allows us to contact existing customers about similar services, we may send you information about the Programme, your tier, offers and referral opportunities. You can opt out at any time, using the link in any marketing message or in your account. Operational messages about your membership will continue, because we need to send them to run the Programme.

Your account sets one cookie of ours. It is created when you follow a sign-in link, it keeps you signed in for 30 days, it is signed and cannot be read by scripts in the page, and it holds no more than your membership identifier and its own expiry. It is strictly necessary — without it there is no signed-in session — so it is set without asking you.

Our cookie banner is provided by CookieYes, which sets its own cookies to record the choice you make in it. The declaration inside the banner lists what is set and lets you change your choice at any time.

Two analytics services run on the site. Google Analytics measures how the site is used. Microsoft Clarity records how the public pages are used — clicks, scrolling and movement across a page; the portal pages are excluded from it. Both start when a page opens. Until you agree to analytics in the banner, they set no cookies and count each visit on its own. Once you agree, they set their own cookies to recognise a returning browser, and Clarity also sets cookies of Microsoft's Bing. You can change your choice in the banner at any time.

We may update this notice. Where a change materially affects how we use your data, we will tell you before it takes effect. The current version is always available at loyalty.ski/legal/privacy.

Data protection and programme support: info@loyalty.ski

Post: Amitours London LTD, 7 Bell Yard, London, England, WC2A 2JR, United Kingdom