Privacy policy

When booking: first and last name, email address, phone number, rental dates, chosen items and, for each skier, the fitting information (weight, height, shoe size, age group). This data is recorded as soon as you start the payment, even if the payment does not go through.

When paying: card details are entered directly with Stripe and never pass through our servers. Stripe also receives your first and last name, email address and phone number, with the amount and reference of the booking. We keep only the payment reference and status.

Through the contact form: name, email address, subject and message. They are sent to the shop by email and are not stored on the website.

To protect bookings and the contact form against abuse (bursts of bookings that would tie up the equipment, automated messages), the website counts the requests coming from each IP address over short periods. It does not store the IP address itself, but a fingerprint computed from it with a secret key (HMAC), and the number of requests. These counters are deleted after about two days.

Managing the booking, preparing and setting up the equipment, taking payments and sending the confirmation: performance of the rental contract.

Keeping the accounts: legal obligation.

Answering messages, preventing payment fraud and protecting the website against abuse: Eco Ski’s legitimate interest.

The data is intended for Eco Ski. It is processed on its behalf by its technical providers: Stripe Payments Europe Ltd (Ireland) for payments, Vercel Inc. (United States) for hosting the website, Neon Inc. (servers in Frankfurt, Germany) for the database and Resend (United States) for sending emails.

Transfers of data outside the European Union are covered by appropriate safeguards (European Commission standard contractual clauses or the EU–US Data Privacy Framework). Data is never sold or used for advertising.

Booking data, including fitting information, is kept for 5 years after the rental ends, then deleted. Accounting records are kept for 10 years, as the law requires.

You have the right to access, rectify, erase, restrict, object to and port your data. To exercise these rights, write to the email address given above.

If you believe your rights are not respected, you can lodge a complaint with the CNIL, the French data protection authority (www.cnil.fr).

This website uses no advertising cookies and no audience measurement tools. The trackers below are strictly necessary for the service you ask for, and so do not require consent.

In your browser’s local storage: the chosen rental dates (eco-ski-rental-dates), so they carry over from page to page, and the content of your cart (eco-ski-cart-v1), including the skiers’ measurements you enter in it (weight, height, shoe size, age group), so it survives a page reload. The cart stays on your device and reaches us only when you start the payment; it is emptied after a successful payment or when you remove its items.

In your browser’s session storage: the payment in progress (eco-ski-checkout-v1), that is the references of the booking and payment started and the contact details entered (first and last name, email, phone). It lets you resume that payment after closing the payment window or reloading the page, without tying up the equipment a second time, and it is deleted after a successful payment or when the tab is closed.

Two cookies: NEXT_LOCALE, which remembers the language you chose when it differs from your browser’s and disappears when the browser is closed, and better-auth.session_token, which keeps the shop’s staff signed in to the administration area and is set only when they sign in.

The Stripe payment module is loaded only when you open the payment from the cart. It then sets cookies needed for payment security and fraud prevention.

The Google Maps map on the Contact page loads only if you ask for it, by clicking “Show the map”. Google may then set cookies and receive your IP address, under its own privacy rules. Without that click nothing is sent to Google; the “Open in Google Maps” link simply opens Google’s website.

You can delete cookies and local storage at any time in your browser settings.

Traffic with the website is encrypted (HTTPS) and access to booking data is restricted to the shop.