Privacy Policy

Data controller

The data controller within the meaning of Art. 4(7) GDPR is:

Tomáš Růžička is a sole trader registered in the Czech Trade Licensing Register. No Data Protection Officer (DPO) has been appointed, as the obligation to appoint one does not arise.

For any questions regarding the protection of personal data, please contact the e-mail address stated above.

What personal data we process

a) Customers — ski and snowboard schools

When concluding a contract and during the contractual relationship we process:

• the first and last name of the contact person (owner, managing director, manager),
• e-mail address and phone number,
• the name, registered office and Company ID (IČO) of the school,
• billing details (needed to issue invoices),
• records of communication (e-mails, messages from the contact form).

b) Application users — instructors and school staff

The customer (school) creates profiles of its employees in SnowDash. As part of this we process:

• the first and last name of the instructor,
• e-mail address (for login and notifications),
• the role in the system (instructor, reception, admin, etc.),
• records of assigned lessons and seasons worked.

In this case the customer — the school — is the data controller of its employees' personal data; SnowDash is the data processor within the meaning of Art. 28 GDPR.

c) School clients — booking widget

The SnowDash online booking widget, which the school embeds on its website, collects from the school's clients:

• the first and last name of each participant (adult or child),
• the e-mail address of the person placing the order,
• the phone number of the person placing the order,
• booking information (date, number of hours, lesson type, choice of instructor).

The school is the data controller of this data and bears full responsibility for the lawfulness of its processing towards its clients. SnowDash is the data processor.

d) Contact form (snowdash.cz/kontakt)

If you write to us via the contact form, we process:

• first and last name,
• e-mail address,
• phone number (if you provide it),
• the name of the school,
• the content of your message.

This data is used solely to answer your enquiry or to arrange a demo and is not passed on to third parties for marketing purposes.

Legal basis for processing

We process personal data on the basis of one of the following legal bases within the meaning of Art. 6 GDPR:

• Performance of a contract (Art. 6(1)(b)): processing the customer's contact and billing data is necessary to provide the SnowDash service and for invoicing.
• Compliance with a legal obligation (Art. 6(1)(c)): archiving tax documents for the statutory period.
• Legitimate interest (Art. 6(1)(f)): processing data to ensure the security of the service, prevent fraud and directly contact customers with information about our own service.
• Consent (Art. 6(1)(a)): in the case of sending commercial communications, where the customer requests them. Consent may be withdrawn at any time.

Retention period for personal data

• Customer (school) data: for the duration of the contract + 3 years after its termination in case of dispute resolution.
• Invoicing documents: 10 years from the end of the tax period in accordance with the Accounting Act (Act No. 563/1991 Coll.).
• Instructor and staff data: for the duration of the contractual relationship with the customer + a 30-day export period under the Terms of Service.
• School client data (booking): the customer (school) determines the retention period; SnowDash deletes the data after termination of the contract with the school (+ a 30-day export period).
• Contact form: for the duration of answering the enquiry, no longer than 2 years from submission.

After the relevant period has elapsed, the data is irretrievably deleted or anonymised.

Recipients of personal data — data processors

To process personal data we use the following subcontractors (data processors), with whom we have concluded a Data Processing Agreement (DPA):

Data processor	Purpose	Registered office / Data region
Supabase Inc.	Database (PostgreSQL), user authentication, storage of all operational data	USA (registered office) · Data: EU region Frankfurt (eu-central-1) · DPA concluded
Resend Inc.	Sending transactional e-mails (booking confirmations, invoices, notifications)	USA · SCCs concluded · DPA concluded
Vercel Inc.	Hosting of the SnowDash application (Next.js), serverless functions, CDN	USA · SCCs concluded · DPA concluded

We do not sell, rent or share personal data with any other third parties for marketing purposes.

We disclose personal data to public authorities only in cases provided for by law (e.g. on the basis of a legal obligation or a court order).

Transfer of personal data outside the EU

The primary location where data is stored is the Supabase data centre in the EU (Frankfurt, Germany). This transfer does not require any special legal basis.

Resend Inc. and Vercel Inc. are based in the USA. The transfer is secured by means of Standard Contractual Clauses (SCCs) within the meaning of Art. 46(2)(c) GDPR, approved by the European Commission.

Copies of the SCCs and DPAs used are available on request — write to info@snowdash.cz.

Your rights as a data subject

In accordance with the GDPR, you have the following rights:

These rights apply to customers (schools) and persons whose data we process as a data controller. Instructors and school clients have rights towards the school as the data controller — as the data processor, we fulfil them on the school's instructions.

How to exercise your rights

Exercise your rights by e-mail at info@snowdash.cz. Please state "Data protection" in the subject line.

We will respond to your request within 30 days of receiving it. In more complex cases we reserve the right to extend this period by a further 60 days, of which we will inform you.

To verify your identity, we may ask you for additional information in order to prevent unauthorised access to other people's data.

Exercising your rights is free of charge. Where requests are manifestly unfounded or excessively repetitive, we are entitled to charge a reasonable fee or to refuse the request.

Right to lodge a complaint with a supervisory authority

If you believe that the processing of your personal data infringes the GDPR, you have the right to lodge a complaint with a supervisory authority.

Before lodging a complaint, we recommend that you first resolve the matter directly with us — we resolve most situations faster and to your satisfaction.

Cookies and technical data

As a web application and as a marketing website, SnowDash uses only technically necessary cookies. Specifically:

• a session cookie for authenticating the logged-in user (Supabase Auth) — without this cookie the application cannot be used; it expires on logout or when the browser is closed,
• a CSRF token to secure forms,
• technical cookies set by the Vercel platform for correct routing of requests (anonymous, containing no personal data).

We do not use any third-party analytical, marketing or tracking cookies (Google Analytics, Facebook Pixel, etc.). We do not store any persistent browser identifiers for advertising purposes.

The snowdash.cz marketing website and the SnowDash application itself use Vercel Web Analytics for anonymous traffic measurement. This service does not use cookies or persistent identifiers, does not store personal data, and cannot identify individual visitors or track them across websites. Only aggregated, anonymous statistics are processed (page-view counts, approximate country of origin, device type and traffic source). The provider is Vercel Inc. (see Article 5).

Changes to the privacy policy

We may update this policy from time to time, for example in response to changes in the services provided, in legislation or in the way data is processed.

We will inform customers of material changes by e-mail at the address provided at registration, at least 30 days before the new version takes effect.

The current wording of this policy is always available at snowdash.cz/en/gdpr.

The date of the last update is stated in the header of this document.

Effective date

This Privacy Policy takes effect on 1 July 2026 and supersedes any previous data protection arrangements.