Privacy Policy

1. Who we are and what this policy covers

Viveli (“Viveli”, “we”, “us”) makes Snowdesk, software that ski and snowsport schools use to run their bookings, lessons, instructors, payments and payroll. Our company details — legal form, registered office and register number — are in our legal notice. For anything about personal data, write to info@viveli.ch.

This policy explains how personal data is handled in Snowdesk — the staff app at snowdesk.viveli.ch (also reachable at app.viveli.ch), the booking pages schools run with it, the emails and messages it sends, and the servers behind them — and what Viveli itself does with data about the people it deals with.

It is written to meet the Swiss Federal Act on Data Protection (FADP) and, where it applies, the EU General Data Protection Regulation (GDPR). Our company website viveli.ch has its own short notice, on the legal page.

2. Two roles: the school’s records and our own

A school is responsible for the records it keeps in Snowdesk. The school decides which clients, children, guests and staff it records and what it does with that data. For those records the school is the controller and Viveli is its processor: we handle the data only on the school’s documented instructions, under our Data Processing Agreement, and never for purposes of our own.

If you are a client of a school, or work for one, the school’s own privacy notice applies to you, and requests about your data should go to the school first. We will help the school answer them.

Viveli is responsible for its own relationships. We are the controller for data about the people who sign up for and use Snowdesk on a school’s behalf (their account, our contract, billing and support), for the security records that protect the service, and for data from our websites.

3. What Snowdesk holds on a school’s behalf

· Clients and their parties: names, contact details, language, the people they book for (for example their children or guests), ages, skill levels, lesson requests and preferences, bookings, lessons attended, payments, receipts, and the notes and messages exchanged with the school.

· Safety notes: a school may record information about a person’s health or needs that matters for their safety in a lesson — an allergy or a condition, for example. This is sensitive personal data. Snowdesk stores it encrypted and shows it only to the staff who need it. A school should record only what is necessary, with the consent of the person or, for a child, of a parent or guardian.

· Staff and instructors: names, contact details, role and permissions, qualifications and certificates, languages and disciplines, availability and time off, lessons taught and check-ins, training records, pay rates, pay statements and payroll figures.

· Records of use: who did what in the app and when (an audit trail), sign-in attempts, and technical data such as IP address and browser type.

4. What Viveli holds as controller

· School accounts: the name, email address, telephone number and role of the people who set up and run a school’s account; our contract, invoices and payments; our correspondence.

· Support: what you tell us when you ask for help. To solve a problem we may need to look at a school’s records. We do so only as far as needed, at the school’s request or to keep the service secure.

· Security and operations: sign-in attempts, error reports and service logs.

· Enquiries: what you send us when you write to us before becoming a customer.

5. Why we use it, and on what basis

We use personal data to provide Snowdesk and the services a school has signed up for; to keep the service secure, prevent abuse and investigate incidents; to support our customers; to invoice for the service; and to meet our legal obligations.

Under the FADP we process personal data lawfully, in good faith and proportionately, only for purposes that are recognisable to the people concerned, and we keep it accurate. Where the GDPR applies, our legal bases are: the performance of a contract (Art. 6(1)(b)) to provide the service and invoice for it; our legitimate interest (Art. 6(1)(f)) in a secure and reliable service and in improving it; a legal obligation (Art. 6(1)(c)) for accounting records; and consent (Art. 6(1)(a) and Art. 9(2)(a)) where a school relies on it, for example for safety notes about health.

We do not sell personal data, use it for advertising, or build marketing profiles.

6. Automatic assignment of instructors

Snowdesk can assign instructors to lessons automatically, by rules the school sets — qualifications, languages, availability and priorities, for example. The school decides whether to use this. Every assignment can be reviewed and changed by the school’s managers, and an instructor may ask the school to have a person review an assignment and may state their view. Snowdesk makes no automated decision with legal effect on a school’s clients.

7. Who receives the data

· Within the school: staff see what their role and permissions allow; instructors see the lessons they teach and the clients in them.

· Clients: receive their own confirmations, receipts and messages from the school.

· Our service providers (sub-processors), each bound by contract to protect the data and to use it only for us: Supabase Inc. (database hosting, Frankfurt, Germany); Railway Corporation, USA (application servers and cache); Vercel Inc., USA (hosting and delivery of the web app, worldwide network); Functional Software Inc. “Sentry”, USA (error monitoring, data stored in Germany).

· When a school switches them on: an email delivery service, Twilio Inc., USA (text messages), Cloudflare Inc. (document storage, in its EU jurisdiction) and Stripe (card payments — Stripe is responsible for card data as a controller in its own right). We tell schools before we add or replace a sub-processor, as the Data Processing Agreement sets out; the current list is available from info@viveli.ch.

· Authorities and courts: only where the law obliges us to.

8. Data outside Switzerland

Snowdesk’s database is in the European Union (Frankfurt, Germany), which Switzerland recognises as providing adequate protection. Some of the providers above are based in, or may give their staff access from, other countries, in particular the United States. Where personal data goes to a country without adequate protection, we rely on the safeguards the FADP and the GDPR recognise: the provider’s certification under the Swiss-US or EU-US Data Privacy Framework, or the standard contractual clauses approved by the European Commission and recognised by the Federal Data Protection and Information Commissioner (FDPIC), with the adaptations Swiss law requires.

9. How long we keep it

· Accounting records — bookings, payments, receipts, invoices and payroll — are kept for ten years, as Swiss law requires (Art. 958f of the Code of Obligations), even if a person asks to be erased; the rest of their record is then deleted or anonymised.

· Other records a school keeps stay for as long as the school uses Snowdesk and needs them, and are deleted on its instruction. When a school leaves, it can export its data for 30 days; we then delete it within a further 60 days, except accounting records and backup copies, which expire on their own schedule.

· Sign-in attempts are kept for up to 12 months, the audit trail for up to 2 years, and records of messages sent for up to 90 days.

· Enquiries that do not lead to a contract are kept for up to 24 months after our last exchange.

10. How we protect it

Connections are encrypted (TLS). Sensitive fields are encrypted in the database, and passwords are stored only as salted hashes. Two-step sign-in is available, access follows role-based permissions, each school’s data is kept apart from every other’s, and actions are recorded in an audit trail. No system is perfectly secure: if a breach is likely to put people at high risk, we tell the school without undue delay and, where the law requires, the FDPIC.

11. Your rights

You may ask for a copy of your personal data and how it is used, have it corrected, have it deleted, object to its use, restrict it, and receive it in a common electronic format to take elsewhere. Where we rely on your consent, you may withdraw it at any time, without affecting what was done before.

For data a school holds about you, ask the school. For data Viveli holds, write to info@viveli.ch. We answer within 30 days, free of charge as a rule, and may ask you to confirm your identity first. Some requests have legal limits — accounting records, for example, must be kept.

You may also complain to the Federal Data Protection and Information Commissioner (FDPIC), Feldeggweg 1, 3003 Bern, www.edoeb.admin.ch, or, where the GDPR applies, to the data protection authority where you live or work.

12. Children

Schools teach children, so Snowdesk holds data about children that their parents or guardians give the school. Snowdesk is used by schools and their staff, not by children, and we do not knowingly collect data directly from a child.

13. Cookies and storage in your browser

Snowdesk sets only the cookies it needs to work: at keeps you signed in for 15 minutes at a time, rt keeps your session for up to 7 days unless you sign out, and csrf_token protects you against forged requests. The demo sets demo_pov to remember which demo account you are viewing. Your browser’s local storage keeps your preferences, such as language, layout and theme. There are no analytics, advertising or tracking cookies.

14. Changes to this policy

We may update this policy when Snowdesk or the law changes. The date at the top shows the current version. We tell schools about material changes by email at least 30 days before they take effect.

15. Contact

Data protection questions and requests: info@viveli.ch