1. Data controller and contact
The data controller for personal data processed in connection with deepsnow.tech is SnowLabs Limited (CRO No. 799095), a private company limited by shares registered in Ireland, with its registered office at Unit 3D, North Point House, North Point Business Park, New Mallow Road, Cork, Co. Cork, T23 AT2P, Ireland. Where context requires, references to "DeepSnow", "we", "us", and "our" in this policy include affiliates within the DeepSnow group acting as joint or independent controllers for specific processing activities.
You may contact our Data Protection point of contact via the contact form on the homepage (Topic: Privacy / GDPR), by email to privacy@deepsnow.tech, or by post at the address above marked "Data Protection". We do not currently have a designated Data Protection Officer; we will appoint one if and when our processing meets the thresholds in Article 37 GDPR. The lead supervisory authority for our processing is the Irish Data Protection Commission ("DPC"), 21 Fitzwilliam Square South, Dublin 2, D02 RD28, Ireland; www.dataprotection.ie.
2. Scope of this Policy
This Policy describes how we process personal data collected through the Site (deepsnow.tech and any subdomain we operate), the Investor Portal, our public forms (pilot-request, contact, newsletter), our email correspondence, our physical post, and our analytics and security tooling. It does not cover personal data processed in the context of an executed commercial agreement (such as a pilot agreement, licensing agreement, or supplier contract); those are governed by the data-protection clauses of that specific agreement and, where applicable, a separate data-processing agreement.
3. Categories of personal data we process
- Contact data
- Name, business email, business phone, organisation / resort name, role / title — collected when you submit the pilot-request form, newsletter signup, contact form, Investor Portal access request, or correspond directly with us.
- Site usage data
- Pages viewed, referring URL, approximate location (country/region from IP), device type, browser, language preference, anonymised IP address, session duration, navigation paths, scroll depth, click events on tracked elements (e.g. CTA buttons) — collected via Google Analytics 4 with IP anonymisation enabled, conditional on your consent through the cookie banner. We use Consent Mode v2 to ensure no analytics cookies fire prior to consent.
- Investor Portal data
- Authentication credentials (hashed), access logs (timestamp, IP, user agent, document accessed, action taken). Where you submit information through a know-your-investor / accredited-investor screening, we additionally collect identity, residency, source-of-funds, and accreditation evidence as required by the applicable securities-law framework.
- Pilot programme data
- Operator name and business contact, resort site coordinates, snowmaking infrastructure details, water-source descriptors, regulatory engagement history. Collected during evaluation of a pilot relationship and processed in furtherance of pre-contractual measures at your request.
- Marketing engagement data
- If you opt in to our newsletter, we record your email, language preference, opt-in timestamp, source page, and engagement metrics (delivery status, open events where available, click events) provided by our email infrastructure (Resend). You may unsubscribe at any time via the link in any email or by contacting us.
- Security data
- Request logs, abuse signals (rate-limit triggers, suspected scraping, malformed requests), and Web Application Firewall events — retained for 90 days for security investigations and forensic purposes, processed on the basis of legitimate interests under Article 6(1)(f) GDPR.
4. Special-category data
We do not intentionally collect or process any special category of personal data within the meaning of Article 9 GDPR (data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, trade-union membership, genetic or biometric data, health data, or data concerning a natural person’s sex life or sexual orientation). You should not submit any such data to us through the Site. If you inadvertently submit special-category data, you consent to its limited processing solely for the purpose of safely deleting it or, where it is legally necessary to retain (for example, as evidence in a regulatory or judicial proceeding), to that retention on the legal basis that applies.
5. Why we process — purpose, legal basis, and retention
| Purpose | Legal basis | Retention |
|---|---|---|
| Respond to pilot, investor, and general enquiries | Pre-contractual measures at your request (Art. 6(1)(b)) / legitimate interests (Art. 6(1)(f)) | 24 months after last contact unless you become a customer / investor / licensee |
| Maintain customer / investor / licensee relationship | Performance of a contract (Art. 6(1)(b)) | Duration of relationship + 7 years (Irish statutory retention) |
| Site analytics | Consent (Art. 6(1)(a)) via cookie banner | Until consent withdrawn or 14 months — whichever is earlier |
| Investor Portal access and security | Performance of a contract / legitimate interests (Art. 6(1)(b)/(f)) | Active account + 12 months after deactivation; access logs 12 months |
| Newsletter and direct marketing communications | Consent (Art. 6(1)(a)) — withdrawable at any time | Until consent withdrawn or 3 years of inactivity, whichever earlier |
| Compliance with statutory obligations (tax, audit, sanctions screening, AML) | Legal obligation (Art. 6(1)(c)) | As required by applicable law — typically 6–10 years |
| Establish, exercise, or defend legal claims | Legitimate interests / legal obligation (Art. 6(1)(f)/(c)) | Duration of the limitation period applicable to the claim |
6. Automated decision-making and profiling
We do not subject you to any decision based solely on automated processing — including profiling — that produces legal effects concerning you or similarly significantly affects you within the meaning of Article 22 GDPR. Where we use AI or machine-learning tools internally (for example, to assist our polymer-discovery research, to triage inbound enquiries, or to evaluate Pilot Programme submissions), a qualified human reviews and is responsible for any decision that materially affects an individual or organisation.
7. Who we share data with — sub-processors and recipients
We use a small number of carefully selected sub-processors. Each is bound by a written data-processing agreement that includes the EU Standard Contractual Clauses (where the sub-processor is located outside the EEA) and the security and audit obligations required by Article 28 GDPR.
Current sub-processor list
| Sub-processor | Service | Location of processing |
|---|---|---|
| Netlify, Inc. | Website hosting and DNS | United States (SCCs in place) |
| Google Ireland Limited | Google Workspace (business email) and Google Analytics 4 | European Union (Ireland) with onward transfers to Google LLC (US) under SCCs |
| Resend, Inc. | Transactional and newsletter email delivery (send.deepsnow.tech) | European Union (eu-west-1, Ireland) |
| Airtable, Inc. | Pilot-request submission storage | United States (SCCs in place) |
Other recipients
- Professional advisers — external lawyers, auditors, accountants, IP counsel, tax advisers, regulatory consultants — bound by professional secrecy or contractual confidentiality.
- Regulators, courts, and law-enforcement authorities — where we are required to disclose under applicable law, or where disclosure is necessary to establish, exercise, or defend legal claims.
- Potential acquirers, investors, or successors — in connection with any actual or contemplated merger, acquisition, financing, reorganisation, or sale of all or substantially all of our assets; in such cases personal data may be transferred subject to appropriate confidentiality protections.
8. International transfers
Some of our sub-processors process personal data outside the European Economic Area — primarily in the United States. Where this occurs, the transfer is governed by appropriate safeguards under Chapter V of the GDPR, including: (a) European Commission adequacy decisions where available (for example, the EU-U.S. Data Privacy Framework where the relevant sub-processor is certified); (b) the European Commission Standard Contractual Clauses (Commission Implementing Decision (EU) 2021/914); and (c) supplementary technical, organisational, and contractual measures (including encryption in transit and at rest, pseudonymisation where feasible, strict access controls, and contractual prohibitions on disclosure to non-EEA government authorities except as legally required).
We have conducted Transfer Impact Assessments (TIAs) for each non-EEA sub-processor and will provide a redacted copy to data subjects on reasonable request through the privacy contact above.
9. Your rights under the GDPR
Subject to the conditions set out in Articles 12–22 GDPR, you have the right to:
- Access — request confirmation that we process your personal data and obtain a copy together with information about the processing (Art. 15).
- Rectification — request correction of inaccurate data and completion of incomplete data (Art. 16).
- Erasure ("right to be forgotten") — request deletion in the circumstances set out in Article 17, subject to legal exceptions including our need to retain data to comply with statutory obligations or to establish, exercise, or defend legal claims.
- Restriction of processing — request that we limit how we process your data while a dispute is resolved (Art. 18).
- Data portability — receive your data in a structured, commonly used, machine-readable format and transmit it to another controller, where processing is based on consent or contract and carried out by automated means (Art. 20).
- Objection — object to processing based on legitimate interests on grounds relating to your particular situation; we will cease such processing unless we have compelling legitimate grounds that override your interests, rights, and freedoms (Art. 21). You may object at any time to direct marketing.
- Withdraw consent — where processing is based on your consent, you may withdraw it at any time without affecting the lawfulness of processing carried out before withdrawal (Art. 7(3)).
- Lodge a complaint — with the Irish Data Protection Commission (www.dataprotection.ie) as our lead supervisory authority, or with the supervisory authority in your country of residence or place of alleged infringement.
10. How to exercise your rights
To exercise any right above, contact us at privacy@deepsnow.tech or via the contact form on the homepage (Topic: Privacy / GDPR). We may need to verify your identity before responding, particularly where the request relates to sensitive data or could result in disclosure of personal data to a third party — we will request the minimum information necessary for verification (typically confirmation of an email address already on file, or a single matching identifier). We respond to requests within one month of verified receipt; we may extend this period by a further two months where the request is complex or where we have received a number of requests from you, and we will inform you of any extension within the first month with reasons. There is no fee for exercising your rights, except where requests are manifestly unfounded or excessive (in which case we may charge a reasonable fee or refuse to act).
11. Direct marketing and the newsletter
We send the DeepSnow newsletter only to subscribers who have opted in via the footer signup or another explicit opt-in mechanism. Each newsletter contains an unsubscribe link that withdraws your consent immediately on click. We will not use your email for direct marketing of third-party products and we do not sell, rent, or share email lists. We do not engage in cross-context behavioural advertising or use cookies to build advertising profiles.
12. Security
We maintain appropriate technical and organisational measures designed to protect personal data against unauthorised access, alteration, disclosure, accidental loss, and destruction. These measures include: TLS 1.2+ for all data in transit; encryption at rest for production storage layers; role-based access controls with multi-factor authentication on every administrative account; least-privilege provisioning; regular review of access logs; periodic third-party penetration testing once we cross the relevant scale threshold; centralised secrets management with rotation; secure software-development lifecycle with peer-reviewed code changes; and a documented incident-response process.
No system can be guaranteed impenetrable. We will notify affected individuals and the Irish Data Protection Commission of any personal data breach in accordance with Articles 33 and 34 GDPR. We will notify affected individuals without undue delay and, where feasible, no later than 72 hours after becoming aware of a breach that is likely to result in a high risk to their rights and freedoms.
13. Children
The Site is directed to professional audiences — resort operators, investors, licensees, scientific collaborators, regulators, and journalists — and is not directed to children under the age of sixteen (16). We do not knowingly collect personal data from children. If you believe a child has provided personal data to us, please contact us via the privacy form (Topic: Privacy / GDPR) and we will delete it.
14. Information for residents of California, USA
If you are a California resident, the California Consumer Privacy Act (CCPA), as amended by the California Privacy Rights Act (CPRA), provides you with additional rights with respect to your personal information. These include rights to know what categories of personal information we have collected about you and the sources and purposes of collection; to delete personal information subject to certain exceptions; to correct inaccurate personal information; to opt out of the "sale" or "sharing" of personal information (we do not sell or share personal information as those terms are defined under the CCPA); to limit the use of "sensitive personal information" (we do not knowingly collect such information); and not to be discriminated against for exercising your rights. To exercise California rights, contact us through the privacy form.
15. Updates to this Policy
We may update this Policy from time to time to reflect changes in our processing activities, our sub-processor list, or applicable law. Material changes will be highlighted at the top of this page and, where the change affects an active consent (for example, a new processing purpose or sub-processor), we will re-prompt for consent. The "Last updated" date at the top of this page is the date this Policy became effective. Continued use of the Site after a revision constitutes acceptance of the revised Policy except where applicable law requires us to obtain renewed consent.
16. Contact
Privacy enquiries: privacy@deepsnow.tech or the contact form on the homepage (Topic: Privacy / GDPR). For postal correspondence: SnowLabs Limited, attn. Data Protection, Unit 3D, North Point House, North Point Business Park, New Mallow Road, Cork, Co. Cork, T23 AT2P, Ireland.