Privacy Policy

2. The data we collect about you

Personal data means any information about an individual from which that person can be identified. It does not include anonymised data. We may collect, use, store and transfer the following kinds of personal data about you:

• Identity Data: first name, last name, date of birth, gender, university and course year, passport number and nationality (needed for travel to France and for some suppliers).
• Contact Data: email address (including university email), phone number, billing and postal address, and emergency contact details you give us.
• Financial Data: payment card details (processed by our payment provider - we do not store full card numbers) and, where we owe you a refund, your bank account details.
• Transaction Data: details of payments to and from you, your instalment plan, and the products and services you have booked with us.
• Booking Data: details of your trip: resort, accommodation and room/apartment allocation, coach allocation, lift pass type, equipment hire, lesson bookings, ski ability, and who you have asked to share with.
• Technical Data: internet protocol (IP) address, browser type and version, device and operating system, time zone and general location, and other technology on the devices you use to access our website and booking forms.
• Profile Data: bookings made by you, your interests and preferences, feedback and survey responses.
• Usage Data: information about how you use our website, booking system and communications.
• Marketing and Communications Data: your preferences for receiving marketing from us and your communication preferences.

We also collect, use and share aggregated data, such as statistics about bookings or website traffic. Aggregated data may be derived from your personal data but is not personal data in law, because it does not directly or indirectly reveal your identity. If we ever combine aggregated data with your personal data so that it can identify you, we treat the combined data as personal data under this policy.

Special category data

We collect one special category of personal data: information about your health, where you choose to give it to us when enquiring or booking - for example, dietary requirements, allergies, medical conditions, disabilities or accessibility needs that are relevant to your trip, travel insurance or emergency assistance. We process this with your explicit consent, and only to make sure your holiday is suitable and safe for you. We do not collect any other special categories of personal data (such as race or ethnicity, religious beliefs, sexual orientation, political opinions or trade union membership), and we do not collect information about criminal convictions or offences.

If you fail to provide personal data

Where we need to collect personal data by law or under the terms of our contract with you and you do not provide it when requested, we may not be able to perform that contract (for example, we cannot arrange coach travel or lift passes without the details our suppliers require). In that case we may have to cancel your booking, but we will tell you at the time if that is the case.

3. How your personal data is collected

• Direct interactions. You give us Identity, Contact, Booking, Health and Financial Data when you fill in our booking or enquiry forms, message or email us, pay a deposit or instalment, enter a competition or giveaway, sign up to our mailing list, or give us feedback.
• Automated technologies. As you use our website and booking forms, we automatically collect Technical Data using cookies and similar technologies. See the Cookies section below.
• Third parties. We may receive Technical Data from analytics providers, advertising and social media platforms, and Contact, Financial and Transaction Data from our payment and technical service providers (for example, confirmation from our payment provider that your instalment has been paid).
• Your group. If a friend books on your behalf, or adds you to a room or coach group, they may give us your name and contact details. We will only use those details to administer the booking and will point you to this policy when we first contact you.

If you give us personal data about someone else (for example, an emergency contact or a friend in your room group), you confirm that you are entitled to share it with us and that they know how we will use it.

4. How we use your personal data

We will only use your personal data when the law allows us to. Most commonly, we use it: where we need to perform the contract we have entered into (or are about to enter into) with you; where it is necessary for our legitimate interests and your interests and fundamental rights do not override those interests; where we need to comply with a legal or regulatory obligation; and, for health data and some marketing and cookies, where you have given consent. You can withdraw consent at any time by contacting us.

The table below sets out the ways we plan to use your personal data and the legal bases we rely on. We may process your data on more than one lawful ground depending on the purpose - contact us if you need details of the specific ground for a particular activity.

Refunds

Any refunds we owe you are processed by bank transfer. To do this we collect your account holder name, account number and sort code (or, for international transfers, your IBAN and SWIFT/BIC). We delete these details from our systems once the refund has been processed, keeping only the transaction record we are required to retain for accounting purposes.

Change of purpose

We will only use your personal data for the purposes for which we collected it, unless we reasonably consider that we need to use it for another reason that is compatible with the original purpose. If we need to use your data for an unrelated purpose, we will notify you and explain the legal basis that allows us to do so. We may process your personal data without your knowledge or consent where this is required or permitted by law.

5. Marketing

We want to tell you about our trips, SLUSH events and offers without being annoying about it, and we give you choices about the marketing you receive.

You will receive marketing from us if you have booked or enquired about a trip, signed up to our mailing list, or entered one of our competitions or giveaways - and, in each case, you have not opted out. We may use your Identity, Contact, Technical, Usage and Profile Data to work out which trips, events and offers are likely to interest you.

We will never sell your personal data, and we will get your express opt-in consent before sharing your personal data with any other company for their own marketing purposes.

Opting out

You can ask us to stop sending you marketing at any time by using the unsubscribe link in any marketing email or by contacting us directly. Opting out of marketing does not affect the service messages we need to send you about an existing booking (payment reminders, pre-departure information and so on).

6. Who we share your personal data with

Because we are a tour operator, delivering your holiday means sharing some of your data with the suppliers who provide parts of your trip. We may share your personal data with:

• Accommodation providers - who receive rooming lists and the details required for check-in and French tourist tax.
• Coach and transport operators, who receive passenger manifests including the details required for international coach travel between the UK and France.
• Lift pass, ski school and equipment hire providers in resort, who receive the details needed to issue your pass or booking (which may include your name, date of birth and, for some passes, a photo).
• ABTOT, our financial protection provider, and our insurers and brokers, where required to protect your booking or handle a claim.
• Payment and banking providers, including Stripe (card payments) and our business bank, who process payments on our behalf.
• IT and software providers we use to run the business, including our booking form and database tools, email provider and accounting software, who act as processors under our instructions.
• Professional advisers, including accountants, lawyers, insurers and auditors, where needed.
• HM Revenue & Customs, Companies House, regulators and other authorities, where the law requires it.
• Anyone we may sell, transfer or merge parts of our business or assets to in future. If a change happens to our business, the new owners may use your personal data in the same way as set out in this policy.

Resort operations and safety

So that we can look after you properly on the trip, our resort reps and trip leaders may have access to relevant parts of your information while you are on holiday - for example, your room allocation, emergency contact and any health information you have shared that is relevant to your safety. Access is limited to what is needed, granted on a short-term basis, and revoked once the trip ends.

We require all third parties to respect the security of your personal data and to treat it in accordance with the law. We do not allow our service providers to use your personal data for their own purposes; they may only process it for specified purposes and in accordance with our instructions.

7. International transfers

Delivering a ski trip to France means transferring some of your personal data outside the UK. In particular, we share passenger and rooming details with our suppliers in France (accommodation, lift passes and resort services), and some of our software providers store data in the European Economic Area or the United States.

Whenever we transfer your personal data out of the UK, we make sure a similar degree of protection is given to it by ensuring at least one of the following safeguards is in place:

• The country has been deemed to provide an adequate level of protection for personal data under UK adequacy regulations. This covers our transfers to France and the rest of the EEA.
• We use contracts approved for UK use - the ICO’s International Data Transfer Agreement or the UK Addendum to the EU Standard Contractual Clauses - which give your data essentially the same protection it has in the UK.
• For providers based in the US, the provider is certified under the UK Extension to the EU–US Data Privacy Framework.

Occasionally a transfer may be necessary to perform our holiday contract with you even where the above safeguards are not available (for example, an urgent transfer to a medical provider in resort). Please contact us if you want further information about the specific mechanism we use for any transfer.

8. Data security

We have put in place appropriate security measures to prevent your personal data from being accidentally lost, used or accessed in an unauthorised way, altered or disclosed. We limit access to your personal data to those directors, reps, contractors and suppliers who have a genuine business need to know it; they only process it on our instructions and are subject to a duty of confidentiality. We have procedures in place to deal with any suspected personal data breach and will notify you and the ICO where we are legally required to do so.

9. Data retention

We will only retain your personal data for as long as necessary to fulfil the purposes we collected it for, including satisfying any legal, accounting or reporting requirements. In deciding retention periods we consider the amount, nature and sensitivity of the data, the risk of harm from unauthorised use or disclosure, the purposes of the processing and whether we can achieve them another way, and legal requirements.

• By law we must keep basic customer information (Contact, Identity, Financial and Transaction Data) for six years after you cease being a customer, for tax and legal purposes.
• Health information you give us for a trip is deleted or anonymised after the trip and any related insurance matters have concluded, unless we need it to defend a legal claim.
• Refund bank details are deleted once the refund is processed.

In some circumstances you can ask us to delete your data - see Your legal rights below. We may also anonymise your data (so it can no longer be associated with you) for research or statistical purposes, in which case we may use that information indefinitely without further notice to you.

10. Your legal rights

Under UK data protection law you have the right, in certain circumstances, to:

• Request access - a copy of the personal data we hold about you and confirmation that we are processing it lawfully (a “data subject access request”).
• Request correction - have incomplete or inaccurate data corrected, though we may need to verify the new data you give us.
• Request erasure - ask us to delete or remove personal data where there is no good reason for us to continue processing it. We may not always be able to comply for specific legal reasons (for example, records we must keep for tax purposes), which we will tell you about at the time.
• Object to processing - object where we rely on legitimate interests and something about your situation makes you want to object, and object at any time to direct marketing.
• Request restriction - ask us to suspend processing while we establish the data’s accuracy, where processing is unlawful but you do not want erasure, where you need the data for legal claims, or while we check overriding grounds after an objection.
• Request transfer - receive certain data in a structured, commonly used, machine-readable format, or have it transferred to a third party. This applies to automated data processed on the basis of consent or contract.
• Withdraw consent - where we rely on consent (for example, for health data or some marketing), withdraw it at any time. This does not affect processing carried out before you withdrew consent, but it may mean we cannot provide certain services - we will tell you if so.

To exercise any of these rights, email us at customersupport@slushltd.co.uk. You will not usually have to pay a fee, but we may charge a reasonable fee, or refuse the request, if it is clearly unfounded, repetitive or excessive. We may need to ask you for specific information to confirm your identity before acting on a request - this is a security measure to make sure personal data is not disclosed to someone who has no right to receive it. We try to respond to all legitimate requests within one month; if your request is complex or you have made several, it may take longer, and we will keep you updated.

11. Cookies

Our website uses cookies - small text files placed on your device - to make the site work properly and help us improve it. We use:

• Essential cookies - required for the website and booking journey to function, such as remembering your progress through a form. These cannot be switched off through our site, though you can block them in your browser (parts of the site may then not work).
• Analytics cookies - (for example, Google Analytics) help us understand how visitors use the site - how many people visit, which pages they view and how they found us - so we can keep improving it.
• Functionality and social cookies - set by third parties whose features we embed, such as video players or social sharing buttons. Their use is governed by the third party’s own privacy policy.
• Advertising cookies - (including remarketing) may be set when you visit our site so that we, and platforms such as Meta or Google, can show you relevant SLUSH adverts elsewhere online. These do not give us or advertisers personally identifiable information.

Where required by law, we ask for your consent to non-essential cookies before setting them, and you can change your preferences at any time. You can also set your browser to refuse some or all cookies, or to alert you when websites set or access them - but if you disable cookies, some parts of the website may not work properly. You can opt out of most tailored advertising at youronlinechoices.com.

12. Glossary

• Legitimate interests - the interest of our business in running SLUSH so we can give you the best trips and the most secure experience. Before relying on this basis we consider and balance any potential impact on you and your rights, and we do not use your data where our interests are overridden by that impact (unless we have your consent or are otherwise required or permitted by law).
• Performance of a contract - processing your data where it is necessary to perform a contract you are party to, or to take steps at your request before entering into one (for example, holding your details while you decide whether to book).
• Legal obligation - processing your personal data where necessary to comply with a legal or regulatory obligation we are subject to - for example, tax record-keeping, the Package Travel and Linked Travel Arrangements Regulations 2018, or transport and border requirements.
• Processors - organisations that process your personal data on our behalf and under our instructions, such as our booking system, email, accounting and payment providers.