Data Protection Notice

Voyaguide has appointed a contact responsible for overseeing compliance with data protection law. You can reach them at dpo@voyaguide.fr.

We process personal data on the bases set out in Article 6 GDPR:

• Performance of a contract — what is needed to provide the service you asked for: account creation, newsletter subscription.
• Legitimate interests — anonymised analytics to improve the service, and fraud prevention.
• Consent — optional functional cookies, marketing communications.
• Legal obligation — retention periods required by applicable law.

Some of our providers are established outside the EU and EEA. Where an international transfer takes place, it is covered by one of the following safeguards:

• The European Commission's Standard Contractual Clauses.
• An adequacy decision of the European Commission.
• For the United States, the EU-US Data Privacy Framework, adopted in July 2023 — the framework that replaced Privacy Shield after it was struck down in Schrems II.

We apply strict minimisation: collect only what is necessary, keep it only as long as it is useful, and delete it securely once it no longer is. It is the governing principle of the design, not an intention.

Our technical and organisational measures include:

• TLS 1.3 encryption for all data in transit.
• AES-256 encryption for data at rest.
• Role-based access control, on the principle of least privilege.
• Regular penetration testing and security audits.
• An incident response plan, with the 72-hour breach notification duty.
• Annual staff training on data protection.

The GDPR gives you the following rights:

• Right of access (Article 15) — obtain a copy of your data.
• Right to rectification (Article 16) — correct inaccurate data.
• Right to erasure (Article 17) — the "right to be forgotten".
• Right to restrict processing (Article 18).
• Right to data portability (Article 20).
• Right to object (Article 21) — object to processing based on legitimate interests.
• Rights related to automated decision-making (Article 22).

You may lodge a complaint with your national supervisory authority — the CNIL (cnil.fr) in France, or the authority of your own country elsewhere in the Union. We would ask you to write to us first: most requests are settled directly.

This notice is reviewed annually, and updated whenever a processing activity changes materially. The date at the top of the page is that of the version in force. Registered users are notified of material changes by email.