Privacy policy
Last updated: 8 October 2026
This policy explains what personal data we collect when you visit simply.ski, order from us, or contact us; why we collect it; who we share it with; and what your rights are. It is written to comply with the Swiss Federal Act on Data Protection (FADP) and, for visitors in the European Union, with the General Data Protection Regulation (GDPR). We currently sell and deliver only in Switzerland, but the Site, our newsletter and our advertising measurement are accessible to visitors in the EU, so the GDPR applies to their data.
1. Controller and contact
The controller is First Track SA, Chemin du Châble-Creux 16, 1934 Le Châble VS, Switzerland (IDE CHE-313.280.224). For any question about your data or to exercise your rights, write to hello@simply.ski. Our person responsible for data protection is Yoann Chapel.
Representative in the European Union (Article 27 GDPR): Bohême France, 30 Imp. Des Rippes, 73800 Chignin, France. If you are in the EU, you may contact the representative in addition to us on any matter relating to the processing of your data.
2. What we collect, why, and on what legal basis
| When | Data | Purpose and legal basis |
|---|---|---|
| You browse the Site | IP address, device and browser information, pages viewed, approximate location, cookie identifiers | To run the Site securely and understand how it is used. Legitimate interest for strictly necessary processing; your consent for analytics and advertising cookies (see the Cookie Policy). |
| You place an order | Name, delivery and billing address, e-mail, phone number, products ordered, payment method (not your card number), order history | To process and deliver your order, invoice you and provide customer service. Performance of the contract; legal obligation for accounting records. |
| You order a mounted ski | Boot sole length, weight, height, age, skier type (set-up form), and your confirmation of these data | To mount and adjust your bindings safely and to document the settings used. Performance of the contract and our legitimate interest in product safety and liability records. |
| You contact us | Name, e-mail, the content of your message, order number if given | To answer you and keep track of the conversation. Legitimate interest and, where relevant, performance of the contract. |
| You subscribe to the newsletter | E-mail address, opening and click statistics | To send you news about Simply. and our products. Your consent, which you can withdraw at any time via the unsubscribe link. |
| You leave a review | Name or pseudonym, review content, order reference | To collect and display verified customer reviews. Your consent. |
| You make a warranty claim | Order and product data, serial number, photos, description of the issue | To handle your claim. Performance of the contract and legal obligation. |
Where the GDPR applies, the legal bases named above refer to Article 6(1) GDPR: consent (a), performance of a contract (b), legal obligation (c) and legitimate interests (f). Where we rely on legitimate interests, you may object at any time (clause 5). We do not collect data about minors knowingly, and we do not use automated decision-making that produces legal effects on you.
3. Who we share data with
We share personal data only with service providers who need it to deliver our services, under contracts that bind them to confidentiality and data protection. The main ones are:
| Provider | Role | Location of processing |
|---|---|---|
| Shopify International Ltd (Ireland) / Shopify Inc. (Canada) | E-commerce platform hosting the shop, orders and customer data; Shopify Payments for card payments; Shopify Analytics | EU, Canada, United States (Standard Contractual Clauses and Shopify's data protection commitments) |
| Infomaniak Network SA (Geneva, Switzerland) | Hosting of the simply.ski domain, DNS and e-mail | Switzerland |
| Payment providers: Shopify Payments (Stripe), PayPal, Klarna, Apple Pay, Google Pay | Processing of payments; each provider acts as an independent controller for the payment itself | EU / United States, under each provider's policy |
| Swiss Post | Shipping and delivery of your order | Switzerland |
| Google Ireland Ltd — Google Analytics 4, Google Tag Manager, Google Ads, Google Search Console | Audience measurement, tag management, advertising measurement | EU and United States (EU-US and Swiss-US Data Privacy Frameworks and Standard Contractual Clauses) |
| Meta Platforms Ireland Ltd — Meta Pixel, Facebook, Instagram | Advertising measurement and audiences | EU and United States (EU-US and Swiss-US Data Privacy Frameworks and Standard Contractual Clauses) |
Where data leave Switzerland or the EU, we rely on the recognised adequacy of the destination country (the EU recognises Switzerland as adequate, and Switzerland recognises the EU and EEA countries), on the EU-US and Swiss-US Data Privacy Frameworks for certified US providers, or on Standard Contractual Clauses approved by the European Commission and recognised by the Swiss Federal Data Protection and Information Commissioner. You can ask us for a copy of the safeguards used.
We may also disclose data when required by law, to protect our rights, or in the context of a sale or restructuring of our business. We never sell your personal data.
4. How long we keep data
- Orders, invoices and related correspondence: 10 years after the end of the financial year, as required by Swiss accounting law.
- Set-up form data for mounted skis: kept with the order for the same period, as a safety and liability record.
- Customer service messages: 3 years after the last exchange.
- Newsletter data: until you unsubscribe, then deleted within 30 days (unsubscribe link in every e-mail).
- Analytics and advertising data: 24 months at most, then deleted or anonymised.
- Cookies: for the durations indicated in the Cookie Policy.
5. Your rights
You have the right to access the data we hold about you, to have it corrected or deleted, to restrict or object to its processing, to receive it in a portable format, and to withdraw a consent you have given — without affecting the lawfulness of processing before the withdrawal. You can also object at any time to the use of your data for direct marketing.
To exercise these rights, write to hello@simply.ski; we may ask you to confirm your identity. We answer within 30 days. If you believe your rights are not respected, you may lodge a complaint with the Swiss Federal Data Protection and Information Commissioner (FDPIC, edoeb.admin.ch) or, if you live in the EU, with the data protection supervisory authority of your country.
6. Security
We protect your data with technical and organisational measures appropriate to the risk: encrypted connections (TLS), access limited to the people who need it, hosting with certified providers, and no storage of full payment card numbers on our systems. No system is perfectly secure; if a data breach is likely to put you at risk, we will inform you and the competent authority as required by law.
7. Changes to this policy
We may update this policy to reflect changes in our tools or in the law. The date at the top tells you when it was last revised; material changes will be announced on the Site. This policy is drawn up in English; if translations are published, the English version prevails.