Train to Mountain is committed to protecting your personal data. This policy explains what data we collect, why we collect it, how we use it, and what rights you have under the General Data Protection Regulation (GDPR) and Dutch law.
The data controller responsible for your personal data is:
If you have any questions about how we handle your data, or wish to exercise any of your rights, please contact us at the email above.
We collect only the minimum data necessary for the stated purpose.
| Data | Purpose | Legal Basis | Retention |
|---|---|---|---|
| Email address | To send you updates about Train to Mountain's launch, early access, and relevant product news | Consent (Art. 6(1)(a) GDPR) | Until you withdraw consent or request deletion |
| Signup source (hero / cta) | Internal analytics to understand which part of the page generated sign-ups | Legitimate interest (Art. 6(1)(f) GDPR) | Same as email address |
| Analytics data (only if you accept cookies) Includes: pseudonymised IP address, device type, browser, referring website, pages visited, session duration, approximate location (country-level) |
To understand how visitors find and use the site so we can improve it. Anonymised aggregate only - we never try to identify individual visitors. | Consent (Art. 6(1)(a) GDPR) - collected only if you click "Accept" on our cookie banner. Default is denied. | 14 months (Google Analytics default retention), then automatically deleted |
We do not collect sensitive personal data (Article 9 GDPR), financial information, location data, or any data from children under the age of 16.
Your email address will only be used to:
We will never sell your data, share it with third parties for marketing purposes, or use it for automated decision-making or profiling.
We use the following third-party service to process form submissions. This service acts as a data processor on our behalf under a Data Processing Agreement:
| Service | Purpose | Location | Safeguards |
|---|---|---|---|
| Formspree (formspree.io) | Receives and stores your email address when you sign up via the website form | United States | Standard Contractual Clauses (SCCs) under Art. 46 GDPR; Formspree Privacy Policy |
| Google Analytics 4 (Google Ireland Ltd) | Aggregated, anonymised usage analytics (only loaded if you accept cookies) | EU (primary); transfers to US possible | Google's Data Processing Terms; IP anonymisation enabled; EU-US Data Privacy Framework + SCCs; Google Privacy Policy |
| Netlify, Inc. | Website hosting and content delivery (serves pages, static assets) | Global CDN (servers in EU and US) | Standard Contractual Clauses (SCCs) under Art. 46 GDPR; Netlify Privacy Policy |
No other third parties receive your personal data.
Your data may be transferred to and processed on servers outside the European Economic Area, specifically:
All transfers are protected by legally recognised safeguards under GDPR Article 46, providing an adequate level of protection for your personal data.
As a data subject in the EU/EEA, you have the following rights, which you can exercise at any time by contacting us at info@traintomountain.com:
We will respond to all requests within 30 days as required by GDPR Article 12.
If you believe we are processing your data unlawfully, you have the right to lodge a complaint with the Dutch Data Protection Authority:
Autoriteit Persoonsgegevens (AP)
Website: www.autoriteitpersoonsgegevens.nl
Phone: +31 70 888 8500
Address: Hoge Nieuwstraat 8, 2514 EL Den Haag, The Netherlands
You may also lodge a complaint with the supervisory authority in the EU member state where you live or work.
We use a single, privacy-respecting analytics tool: Google Analytics 4. We use it to understand how visitors find and use the site so we can improve it. We do not use advertising cookies, Meta Pixel, remarketing pixels, or any cross-site tracking.
Analytics is off by default. When you first visit Train to Mountain, a cookie banner appears asking for your consent. Google Analytics does not load or set any cookies until you click "Accept". If you click "Reject", no analytics cookies are set and no data is sent to Google. Your choice is remembered locally in your browser.
If you accept analytics, the following cookies may be set:
| Cookie | Purpose | Retention |
|---|---|---|
_ga |
Distinguishes unique visitors (pseudonymous) | 2 years |
_ga_XP9ENFJ5T8 |
Persists session state for Google Analytics 4 | 2 years |
We have enabled IP anonymisation and disabled all Google advertising features (ad personalisation, ad user data, ad storage). The data Google Analytics receives cannot be used to identify you personally, and we never combine it with your email address or any other information you provide.
How to change your mind: To revoke consent, clear your browser's site data for traintomountain.com and reload the page. The cookie banner will reappear so you can choose again. You may also contact us to request deletion of any analytics data associated with your visit.
We also use one essential, non-tracking technology: a small piece of browser storage (localStorage) to remember your cookie banner choice so we do not show it to you on every visit. This is not a cookie and contains only the word "granted" or "denied".
We take reasonable technical and organisational measures to protect your personal data against accidental loss, destruction, alteration, or unauthorised disclosure or access. Email submissions are transmitted via HTTPS and handled by Formspree under industry-standard security practices.
Our services are not directed at children under the age of 16. We do not knowingly collect personal data from children. If you believe a child has provided us with data, please contact us and we will delete it immediately.
We may update this privacy policy from time to time. We will notify waiting list subscribers of any material changes by email. The "last updated" date at the top of this page will always reflect the most recent version. Continued use of our services after changes constitutes acceptance of the updated policy.
For any privacy-related questions, requests to exercise your rights, or to report a concern:
We aim to respond within 5 business days for general enquiries, and within 30 days for formal GDPR rights requests.