Privacy

Privacy policy

Protecting your personal data matters to us. We process your data solely on the basis of the General Data Protection Regulation (GDPR) and Italian data protection law.

Controller

Mountain Spirit SNC di Plattner Guenther & C.
Zwölfmalgreiner Straße 8B
39100 Bolzano (BZ), Italy
Represented by: Günther Plattner

Data protection enquiries: shop@mountainspirit.it

Contacting us

If you contact us through a form or by email, we store what you tell us in order to deal with your enquiry and in case there are follow up questions. We do not pass this data on without your consent.

Enquiries to mountain guides

What this is about. On our pages we present self-employed mountain guides together with their tours and courses. If you send an enquiry about a tour, you fill in a form. We pass that enquiry to the mountain guide who offers the tour. Any contract for the tour is concluded later directly between you and the mountain guide, not with us.

Controller. Mountain Spirit SNC di Plattner Guenther & C., Zwölfmalgreiner Straße 8B, 39100 Bolzano (BZ), Italy. VAT ID IT02414740213. Email shop@mountainspirit.it.

What data we process. Name, email address, phone number if provided, preferred dates, number of participants, your message, the selected tour and mountain guide, the language of the enquiry, the time of submission, and the wording and time of the consent you gave. To prevent abuse we also process, for a short period, technical details of the submission in order to detect automated bulk enquiries.

Purposes.

1. Passing your enquiry to the mountain guide you selected, so that they can reply.
2. Sending you a confirmation with the name and contact details of the mountain guide.
3. An internal copy to Mountain Spirit, so that we can reconstruct what was transmitted in case of questions or complaints and document the introduction we made.
4. Protection against spam and automated submissions.

Legal bases. For purposes 1 and 2 the legal basis is Art. 6(1)(b) GDPR. You request the contact with the mountain guide yourself and the processing is necessary for this pre-contractual step.

In addition, we obtain your consent under Art. 6(1)(a) GDPR for the transfer to the mountain guide named to you. This consent sits alongside Art. 6(1)(b) GDPR. Its purpose is to name the specific recipient to you clearly before you submit, and to meet our obligation to demonstrate consent under Art. 7(1) GDPR. You may withdraw it at any time with effect for the future. The withdrawal does not affect the lawfulness of processing carried out beforehand. If you withdraw before the enquiry has been forwarded, we will not forward it. If it has already reached the mountain guide, please also address your withdrawal and your other rights directly to them, because from that point they are an independent controller.

For purposes 3 and 4 we rely on Art. 6(1)(f) GDPR. Our legitimate interest is to be able to evidence the introduction we made and to protect our systems against abuse.

Recipients.

• The mountain guide you selected. They are named to you before you submit. They process your data as an independent controller and decide on purposes and means themselves from the moment they receive it. With every mountain guide we have concluded an agreement that obliges them to use your data solely to answer your enquiry, to keep it confidential, to secure it appropriately, not to use it for marketing without your separate consent, and to delete it once the purpose has been fulfilled.
• Our email delivery provider, acting as a processor.
• Our database and application hosting provider, acting as a processor, storing data inside the European Union.

Which providers these are and how processing outside the European Economic Area is safeguarded is set out in the section Service providers and transfers to third countries.

Retention period. We delete your enquiry including your contact details no later than 12 months after we receive it. Deletion runs automatically. The consent record is deleted together with the enquiry. The mountain guide is separately obliged to delete your data once your enquiry has been dealt with, unless they still need it for a contract that was actually concluded or because of tax retention obligations. The mountain guide is responsible for the retention period on their side.

Is providing the data mandatory. Providing your data is required neither by law nor by contract. Without a name and an email address, however, we cannot forward your enquiry and the mountain guide cannot reply to you. Further details such as phone number and preferred dates are voluntary and only help the mountain guide assess the request.

Automated decision-making. No automated decision-making, including profiling, within the meaning of Art. 22 GDPR takes place.

Your rights. In relation to us you have the right of access to the data held about you (Art. 15 GDPR), rectification of inaccurate data (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20) and objection to processing based on a legitimate interest (Art. 21). Consent you have given may be withdrawn at any time with effect for the future (Art. 7(3)).

To exercise these rights, contact shop@mountainspirit.it or the postal address above. We respond within one month. Where your request concerns processing by the mountain guide, we forward it to them and let you know.

The confirmation email you receive after submitting the form contains a personal link. Through that link you can see at any time, without an account and without signing in, which data we hold about your enquiry, and have the enquiry deleted. The link applies to your own enquiry only and expires after twelve months.

Notification to recipients (Art. 19 GDPR). Where we erase your enquiry at your request, we notify the mountain guide we passed it to, and the mailbox that received the internal copy. The notification asks both of them to delete their copy as well. It contains neither your name nor your contact details, only the time at which the erased enquiry reached us. On request we will tell you at any time who the recipients are. Whether and when the mountain guide actually deletes their copy is their own responsibility, we have contractually obliged them to do so.

Right to lodge a complaint. You have the right to lodge a complaint with a supervisory authority, in particular in the Member State of your habitual residence, place of work or the place of the alleged infringement (Art. 77 GDPR). The authority competent for us is:

Garante per la protezione dei dati personali
Piazza Venezia 11, 00187 Rome, Italy
Phone +39 06 696771
Email protocollo@gpdp.it
Certified email (PEC) protocollo@pec.gpdp.it
www.garanteprivacy.it

Orders and performance of the contract

To process your order we handle your name, address, email address and the details needed for payment. This data is necessary for the performance of the contract and for taking steps prior to entering into it (Art. 6(1)(b) GDPR). Without this data we cannot conclude the contract.

We only pass data to third parties where this is necessary in order to perform the contract: to the payment service provider to process the payment, to the shipping company to deliver the goods, and to our tax adviser so that we can meet our obligations under tax law.

How long we keep your data

We keep data from the contractual relationship until the statutory retention periods under tax and commercial law have expired, and delete it afterwards. Data from abandoned orders is deleted.

Cookies and your consent

The rule

Cookies are small files that a website stores in your browser and reads again on your next visit. In Italy Art. 122(1) of the Codice in materia di protezione dei dati personali (D.lgs. 196/2003) applies to them, which implements Art. 5(3) of Directive 2002/58/EC. Under that rule, only cookies that are strictly necessary for transmitting the message or for a service you have expressly asked for may be set without your consent. Everything else needs your consent, and it needs it before it is set. The details are in the guidelines of the Garante per la protezione dei dati personali on cookies and other tracking tools, Provvedimento n. 231 of 10 June 2021, in force since 10 January 2022.

How you decide

On your first visit a panel headed Cookie consent appears at the bottom centre of the page. You have three options there: Accept, Decline and Manage preferences. Declining costs you exactly one click, the same as accepting. Under Manage preferences you decide separately for analytics, personalisation and marketing. Google Analytics belongs to the analytics category, Google Ads and the map from Google Maps to the marketing category.

Until you have decided, we only set the cookies marked No in the table below. If you decline, it stays that way. The shop then works in full. You can search, order and pay as usual. We do not lock any content or any function because you declined, and you do not pay more for it either.

The dialogue is shown to all visitors, whichever country they visit us from.

Your decision stands until you change it, and you can withdraw it at any time with effect for the future. You can reopen the dialogue at any time through Cookie settings at the very bottom of every page, in the row with our terms, privacy and legal notice. Independently of that, we ask again if something about our processing changes.

Which cookies our shop sets

The list below is based on a measurement of our public pages on 4 October 2026. The Shopify cookies come from us, that is from the address of this shop, and not from an outside advertising network, with one exception: _shop_app_essential belongs to Shop Pay, Shopify's payment service, and is stored under the address shop.app. The cookies of Google Analytics and Google Ads are also stored under the address of this shop; the Google tag sends their content to Google, and what Google does with it is explained below in the sections on Google Analytics and Google Ads. We use no counting tool from Facebook, Instagram or TikTok.

The technical basis of the shop is provided by Shopify. Shopify sets its cookies for us and processes the data on our behalf. The cookies whose name starts with _ga or _gcl are set by the Google tag that the Shopify app Google & YouTube loads, and only after your consent. When you go to pay, further cookies of the payment service provider you select there may be added. They are necessary for the payment.

Audience measurement with Google Analytics

If you agree to the Analytics category in the cookie dialogue, we use Google Analytics 4, a service of Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. Google Analytics counts how many people visit our shop, how they get here, which pages and products they look at, what they put in the basket and what they buy. For rentals it also counts whether an availability check came back free, nearly booked out or booked out, and on the mountain guide page whether an enquiry was sent, in both cases without your name and without your email address. From this we learn which offers people want and where the shop gets in their way. Without your consent Google Analytics is not loaded and nothing goes to Google.

For this Google Analytics sets the cookies _ga and _ga_ followed by the identifier of our account, see the table above, and gives your browser a random number. Google uses your IP address only to work out the rough location of your visit and discards it immediately afterwards; for visits from the European Union Google does not store IP addresses. We have switched Google Signals off, use no advertising features, do not link the data to Google accounts, build no audiences for advertising and do not pass the data on to other Google services. Event data is deleted after 14 months.

The legal basis is your consent, Art. 6(1)(a) GDPR in conjunction with Art. 122(1) Codice privacy. You can withdraw it at any time with effect for the future through Cookie settings at the very bottom of every page, Art. 7(3) GDPR. Google processes the data on our behalf under Art. 28 GDPR on the basis of the Google Ads Data Processing Terms. Data may be transferred to the United States. Google LLC is certified under the EU-US Data Privacy Framework, whose adequacy the European Commission confirmed by decision of 10 July 2023, Art. 45 GDPR. How Google uses data from sites that use its services is explained at policies.google.com/technologies/partner-sites.

Google Ads and conversion measurement

If you agree to the Marketing category in the cookie dialogue, we use Google Ads, a service of Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. It lets us place ads in Google Search and on Google Shopping. Conversion measurement tells us whether someone who reached us through such an ad put something in the basket, started the checkout or bought, and for what order value. From this we learn which ads pay off and which do not. Google does not receive your name or your email address, but the random number from the cookie, the identifier of the ad click, the page you opened, the order value and the currency, and, as with every visit to a website, your IP address and details about your browser. Without your consent no Google Ads cookie is set and Google receives no data about your visit.

For this Google Ads sets the cookies _gcl_au and, if you arrive through an ad, _gcl_aw, see the table above. Three Google Ads features we do not use at present: Enhanced Conversions, that is sending your email address, phone number or postal address to Google as an irreversible checksum so that Google can match a purchase to an ad more precisely; Remarketing, that is ads that follow you on other websites because you visited us; and Customer Match, that is matching our customer list against Google accounts. As long as that is the case, Google builds no advertising audience from your visit to us. Before we switch on any of these features, we change this section and ask for your consent again.

The legal basis is your consent, Art. 6(1)(a) GDPR in conjunction with Art. 122(1) Codice privacy. You can withdraw it at any time with effect for the future through Cookie settings at the very bottom of every page, Art. 7(3) GDPR. For Google Ads, Google is an independent controller, for conversion measurement as well as for serving the ads in Google Search and for the data Google itself collects when you click on an ad. Between us and Google the Google Controller-Controller Data Protection Terms apply to this. Data may be transferred to the United States. Google LLC is certified under the EU-US Data Privacy Framework, whose adequacy the European Commission confirmed by decision of 10 July 2023, Art. 45 GDPR. How Google uses data for advertising is explained at policies.google.com/technologies/ads.

Our products in Google Merchant Center

So that our products appear in Google Shopping and in Google Search, we send our range through the Shopify app Google & YouTube to Google Merchant Center, a service of Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland: product name, description, image, price, availability, brand and item number. This is information about our products, not about you. Google learns nothing about your visit or your order this way.

Google Maps on the home page

On the home page a map from Google Maps shows where our store is. Google Maps is a service of Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. The map only loads if you agree to the Marketing category in the cookie dialogue or press Show the map. Until then nothing goes from this page to Google. Once the map loads, Google receives your IP address and can set its own cookies.

The legal basis is your consent, Art. 6(1)(a) GDPR in conjunction with Art. 122(1) Codice privacy. Data may reach the United States; Google LLC is certified under the EU-US Data Privacy Framework. What Google does with this data is explained at policies.google.com/privacy.

What you can do yourself

Independently of our dialogue, you can set your browser to tell you about cookies, to allow them case by case or to refuse them altogether, and you can delete cookies that have been set at any time. If you delete them, your stored decision goes with them, and we ask you again on your next visit. If you also block the technically necessary cookies in your browser, the basket and the checkout stop working.

Legal basis

For the technically necessary cookies we rely on Art. 6(1)(b) and (f) GDPR in conjunction with Art. 122(1) Codice privacy. Our legitimate interest is that the shop remains usable at all. For analytics and marketing we rely on your consent alone, Art. 6(1)(a) GDPR in conjunction with Art. 122(1) Codice privacy. You can withdraw it at any time with effect for the future, Art. 7(3) GDPR. The withdrawal does not affect what was lawfully processed until then.

Newsletter

You can subscribe to our newsletter. For that we need your email address and your consent. You can unsubscribe at any time, through the unsubscribe link in every email or by writing to shop@mountainspirit.it. We then delete the data we hold in connection with sending the newsletter.

Rental of equipment

Your identity document when you rent

Before we hand equipment over to you, we establish who our contracting party is. To do that, you upload a photo of the front of your identity document, at the self check-in in store, online before signing the rental contract or in store through our staff with your consent. Without this photo we cannot hand the equipment over to you.

What data the photo contains. Depending on the document, the front shows first name and surname, date and place of birth, sex, nationality, height, your photograph, your signature, the date of issue and of expiry, the document number and, on some documents, a six-digit chip access number (CAN). We accept an identity card, a passport or a driving licence; other cards, such as a health card, are not needed and should not be photographed. We do not need the document number and the chip access number; you may mask them before taking the photo. Name, date of birth, the photograph and the expiry date must remain legible. Please photograph only the front and only the document of the adult who concludes the contract. We do not upload documents of children; if a child rents, a parent or another adult concludes the contract and identifies themselves.

Why we need the photo. The photo serves two purposes only: to establish who the contracting party is, and to be able to prove it if equipment is damaged, lost or not returned. We do not ask for a security deposit. That makes it all the more important for us to be able to show, in a dispute, to whom we handed the equipment. We do not evaluate the photo automatically, we do not read any data from it by machine and we do not use facial recognition. We do not use it for advertising or for any other purpose.

Legal basis. For the photo it is Art. 6(1)(f) GDPR. Our legitimate interest: we hand over valuable safety equipment without a security deposit to people we often do not know personally, in part after an online booking. In the event of damage, loss or failure to return, we want to be able to pursue our claims against the right person and, where appropriate, report the matter.

Is the photo compulsory? Yes. Without a photo of the front of your identity document we do not hand over any equipment. It is the only proof of whom we handed the equipment to, and we do not ask for a security deposit in return.

Who can see the photo. The photo is kept in non-public storage in the European Union. Only staff of Mountain Spirit authorised to do so can view it, and every viewing is logged with person and time. It is displayed only through a link that expires after 60 seconds. Technically it is processed by our provider for database and storage and our provider for running the rental application, both as processors under Art. 28 GDPR. The photo is disclosed only if equipment is damaged, lost or not returned, and only as far as necessary: to the police, the public prosecutor or a court, and to a lawyer instructed by us.

How long we keep the photo. We delete the photo 30 days after the return of the equipment. If no rental takes place, we delete it 30 days after the upload. If equipment is damaged, lost or not returned, we keep the photo until the matter is settled and, in the case of court proceedings, until their conclusion, and then delete it.

Your rights regarding the photo. You may ask at any time whether we hold a photo of your document, and you may ask for it to be deleted (Art. 15 and 17 GDPR).

Your right to object: You may object at any time to the storage of the photo under Art. 21 GDPR. We then delete the photo; for a further handover of equipment we need a new one. This does not apply while damage, loss or failure to return is unresolved for your rental; in that case we need the photo in order to pursue our claims (Art. 17(3)(e) and Art. 21(1) GDPR). Write to us at shop@mountainspirit.it.

You may also lodge a complaint with the Garante per la protezione dei dati personali, Piazza Venezia 11, 00187 Rome (Art. 77 GDPR).

Service providers and transfers to third countries

To run the shop, the rental service and the mountain guide enquiries we use service providers that process your data on our behalf and on our instructions (processors, Art. 28 GDPR). They are bound by contract to process the data only on our instructions.

• Shopify International Ltd., Dublin, Ireland: the technical basis of the shop, orders, checkout, customer account and newsletter. Shopify also processes data in Canada and in the United States.
• Supabase Inc., United States: database and file storage of the rental and mountain guide application. The data is stored in Ireland; maintenance access may take place from outside the European Economic Area.
• Vercel Inc., United States: operation of the rental and mountain guide application on servers in Frankfurt am Main; maintenance access may take place from outside the European Economic Area.
• Resend Inc., United States: sending our emails about rentals and mountain guide enquiries.
• Google Ireland Limited, Dublin, Ireland: Google Analytics, only with your consent, and Google Merchant Center for the data of our products. Google also processes data in the United States. For Google Ads, including conversion measurement, Google is an independent controller, see the section Cookies and your consent.

In addition, the payment service providers you choose at checkout (Shopify Payments, PayPal, Klarna, Apple Pay, Google Pay) and the carrier that delivers your order receive the data needed for that purpose; they process it as independent controllers.

Where data reaches the United States in this way, the transfer is safeguarded by the standard contractual clauses of the European Commission (Art. 46(2)(c) GDPR). For providers certified under the EU-US Data Privacy Framework, the Commission's adequacy decision of 10 July 2023 (Art. 45 GDPR) applies in addition; an adequacy decision exists for Canada. You can request a copy of the safeguards at shop@mountainspirit.it.

Your rights

You have the right of access, rectification, erasure, restriction of processing, data portability, withdrawal of consent and objection. If you believe that the processing of your data infringes data protection law, you can lodge a complaint with the supervisory authority. In Italy this is the Garante per la protezione dei dati personali, Piazza Venezia 11, 00187 Rome.

Changes

We reserve the right to adapt this privacy policy, in particular if the law changes or if our services change.