Privacy Policy

Effective and last updated: 17 August 2026

This Policy applies to the Bonvo Ski mobile application, bonvo.ski, business.bonvo.ski and related Bonvo Ski services (together, the “Service”). The data controller is Bonvo Consulting Korlátolt Felelősségű Társaság (“Bonvo”, “we”).

1. Controller and contact details

2. Data we process

• Account and contact data: email, display name, authentication identifiers, profile details and support messages.
• Location and run data: GPS coordinates, time, altitude, speed, heading, accuracy, recorded route and derived run statistics when the map is used or a run is active.
• Group data: group membership, invitations, messages and location shared with selected group members.
• User content: photos, profile content, map contributions and content submitted to an optional AI feature.
• Purchase data: product, entitlement and transaction status supplied by the App Store; Bonvo does not receive full payment-card details.
• Technical and usage data: device and app version, language, IP address, diagnostics, security events, viewed resorts and feature interactions.
• Website data: necessary cookies and, where consent is required and given, analytics or preference cookies.

3. When location is used

Bonvo Ski uses location while the map is in use or while the user has started a ski run. Background location is used only to keep an active run and its optional live location continuous when the screen is locked or the app is not in the foreground.

• Location permission is optional, but GPS-dependent features cannot work without it.
• Background location is not used for general off-mountain monitoring, advertising or marketing.
• An active run or optional group-sharing session can be stopped by the user. Sharing also stops when the active run ends.
• Group members see only the location the user has chosen to share. Access should be granted only to trusted people.

4. Offline and group location

Downloaded maps, resort data, the user's GPS position and run recording can work without mobile service. Live group positions require a connection; offline, the last synchronized position may remain visible until connectivity returns.

A last synchronized group position is historical, not live, and may remain visible on another member’s device until the map refreshes or the group data is cleared.

5. Purposes and legal bases

• Contract: accounts, maps, run recording, groups, purchases, support and requested content generation.
• Consent: device permissions, optional location sharing, optional AI/photo processing and non-essential cookies where required. Consent may be withdrawn.
• Legitimate interests: security, fraud prevention, service reliability, aggregate product improvement and responding to enquiries, balanced against user rights.
• Legal obligation: accounting, tax, consumer-protection requests and lawful authority requests.

Precise location is not sold and is not used to build advertising or marketing profiles.

6. Recipients and service providers

Data is disclosed only as necessary to provide the Service or comply with law, including:

• selected group members for location or content the user chooses to share;
• Apple for app distribution, Sign in with Apple and App Store transactions;
• Supabase for authentication, database and storage services;
• Mapbox and OpenStreetMap-derived services for map delivery and attribution;
• hosting, content-delivery, diagnostics, email and security providers acting under contract;
• an AI-processing provider only when the user deliberately invokes an AI feature;
• courts, regulators or public authorities when disclosure is legally required.

We do not sell personal data or precise location.

7. Retention

• Account and saved run data is retained while the account or saved item exists, then deleted or anonymised subject to backups and legal obligations.
• Live group location is used for the active sharing session. Saved run history remains until the user deletes it or the account.
• Support correspondence is normally retained for up to 24 months after closure.
• Purchase and accounting records are retained for the period required by Hungarian law.
• Security and diagnostic logs are retained only for a proportionate troubleshooting and security period.

8. International transfers

Some providers may process data outside Hungary or the European Economic Area. Where required, we use an adequacy decision, Standard Contractual Clauses or another valid GDPR transfer mechanism and apply appropriate safeguards.

9. Children

Children may use Bonvo Ski with permission and appropriate supervision from a parent or legal guardian, especially for accounts, purchases, content and location sharing.

A parent or guardian should control a child’s account, purchases, group membership, user content and location sharing. Please contact us to review or delete a child’s data. We will take reasonable steps to verify the requester’s authority.

10. Your rights

Subject to the GDPR and applicable law, users may request access, correction, deletion, restriction, portability or objection, and may withdraw consent without affecting earlier lawful processing. Users may also delete available content or their account through the Service or contact us.

Complaints may be made to the Hungarian National Authority for Data Protection and Freedom of Information (NAIH), naih.hu, or the competent supervisory authority in the user’s country.

11. Security

We use access controls, encrypted transport, restricted provider access, backups and monitoring appropriate to the risk. No internet or storage system is completely secure, so users should protect their account and share location only with trusted people.

12. Changes

Material changes will be dated here and communicated through the Service or by email where appropriate. The current version is always published at this URL.