Preamble

The Normandy Regional Tourism Board (C.R.T. de Normandie) processes personal data (hereinafter referred to as “Personal Data”) concerning you in connection with your use of this website (hereinafter referred to as the “Site”).

As the data controller, we are committed to respecting your privacy and protecting the personal data of users of our Site.

This policy aims to inform you of the methods of collecting, processing, and using your Personal Data and your rights regarding the protection of personal data in accordance with applicable regulations, notably Law No. 78-17 of 6 January 1978 relating to information technology, files, and freedoms, known as “Informatique et Libertés,” in its latest version, and the GDPR (General Data Protection Regulation) in effect since 25 May 2018.

Article 1 – Scope of the Personal Data Protection Policy

This Policy sets out the principles and guidelines for the protection of your Personal Data, including the Personal Data collected on or via the Site.

The C.R.T. de Normandie collects Personal Data (online, including by email, or offline); this policy applies regardless of the method of collection or processing.

The term “Personal Data” refers to any information relating to an identified or identifiable natural person. A person is considered “identifiable” when they can be identified, directly or indirectly, particularly by reference to an identification number or to one or more specific elements related to them.

“Non-Personal Data” refers to information that does not allow for the identification of a person.

Article 2 – Storage Locations of Personal Data

All Personal Data is stored exclusively in France by our web hosting provider:

OVH
2 rue Kellermann
59100 Roubaix – France

In the case of using the booking module for tourist services on the website www.normandie-tourisme.fr, the data is stored by the provider of the booking solution:

Alliance Réseaux
26 rue de Saint-Exupéry
73300 Saint-Jean-de-Maurienne

Data collected for subscription to the “general public” electronic newsletters on the normandie-tourisme website is entrusted to Webmecanik:

Webmecanik
6 avenue de Thônes
74000 Annecy

Article 3 – Data Controller

The data controller of your Personal Data is: C.R.T. de Normandie, 14 rue Charles Corbeau – 27000 Evreux – France; certain technical services (hosting) are entrusted to our technical service providers (IRIS Interactive, OVH, Webmecanik). In accordance with Article 28 of the GDPR, these service providers are bound by a strict confidentiality clause that prohibits any use of the data entrusted to them that is not provided for in the service contract and imposes on them the implementation of technical and organizational measures that meet the security and protection requirements for personal data.

Article 4 – Collected Data

Personal Data

Personal Data may include the following:

  • Last name,
  • First name,
  • Email address,
  • Place of residence,
  • Date of birth,
  • Geolocation,
  • Dates and location of stay in the case of a reservation,
  • And any other Personal Data that may prove relevant for the purposes stated below.

Note to visitors and users of the Site: Certain functionalities and features of the Site can only be used if you provide the C.R.T. de Normandie with certain Personal Data when you visit or use the Site. You are free to provide or not provide all or part of your Personal Data.

However, if you choose not to provide them, such a decision may prevent the satisfactory achievement of the objectives outlined below, and some services and features of the Site may not function properly, and/or you may be denied access to certain pages of the Site.

Cookies and Other Trackers

The Site may use cookies or other technologies capable of collecting or storing personal data. Cookies are text files stored and used to record personal and non-personal data concerning your browsing on the Site.

Cookies can be permanent (and remain after you log out of the site to be used during your subsequent visits to the Site) or temporary (and disappear as soon as you log out of the Site).

The C.R.T. de Normandie uses cookies to enhance your user experience, including by:

  • Allowing a service to recognize your device, so you do not have to provide the same information multiple times to perform the same task;
  • Recognizing the username and password you have already provided so that you do not have to provide them again on each webpage that requests them.

The C.R.T. de Normandie uses cookies to analyze traffic and data on the sites to:

  • Measure the number of users of the services, thus making them easier to use and ensuring their ability to respond quickly to your requests;
  • Help the C.R.T. de Normandie understand how users interact with the services to improve them.

The C.R.T. de Normandie may also use the services of third-party providers to perform services on its behalf, including to:

  • Analyze your browsing habits and measure the audience of the Sites and Applications;
  • Analyze your interests and offer you targeted marketing or advertising offers;
  • Allow you to share content from the Sites or Applications with other people on social networks or inform those other people of what you are watching or thinking (e.g., the “Like” button on Facebook).

In this case, invisible “pixels” and cookies provided by these third-party providers may be used and stored. When transmitting information generated by these cookies, the cookie settings ensure that the IP address is anonymized before geolocation and before storage. Our providers will use this information to evaluate your use of the Site, prepare reports on the Site’s activity for the C.R.T. de Normandie, and offer you better services and targeted advertisements based on your needs. They will not associate your IP address with any other data they hold.

When you browse the Site, cookies are activated by default, and data may be read or stored locally on your device. You will be notified the first time you receive a cookie and will be able to decide whether to accept or refuse it. By continuing to use the Sites, you expressly accept the use of such cookies by the C.R.T. de Normandie.

You can also configure your browser to systematically refuse cookies (including cookies used for audience measurement). However, if you do so, some functionalities and features of the Site may not work properly, and you may not be able to access certain parts or services of the Site.

If you wish to modify or delete your information, please refer to Article 10: Your Rights.

You can access your cookie management panel to configure the setting and reading of cookies.on des cookies afin de paramétrer le dépôt et la lecture de cookies.

Article 5 – Purposes of Collecting Personal Data

As mentioned above, you provide your Personal Data voluntarily.

Personal Data is generally collected for the needs of the C.R.T. de Normandie’s activities, such as improving the marketing and advertising efforts of the C.R.T. de Normandie, better adapting the products and services of the C.R.T. de Normandie to customer needs, or complying with the declarative obligations provided by law, as well as other similar activities.

The C.R.T. de Normandie collects and uses the Personal Data concerning you for its operational needs, notably for the following purposes:

We process your data, in whole or in part, for the purposes of:

  • Collecting email addresses for sending newsletters promoting tourism in Normandy,
  • Verifying the proper functioning of the tools for booking tourist services.

Subject to applicable local legislation, by providing your email address, you expressly authorize the C.R.T. de Normandie to use it along with other useful Personal Data to send you commercial or marketing messages.

The C.R.T. de Normandie may also use your email address for administrative purposes or other objectives not related to marketing (for example, to notify you of important changes made to the Site).

Article 6 – Conditions for Processing and Storing Personal Data

The “processing” of Personal Data includes, in particular, the use, retention, recording, transfer, adaptation, analysis, modification, declaration, sharing, and destruction of Personal Data as necessary according to circumstances or legal requirements.

All Personal Data collected is retained for a limited duration depending on the purpose of the processing and only for the duration provided by applicable legislation.

All Personal Data collected is stored in Metropolitan France.

Data Retention

By type of data:

  • Civil status data (name, first name, postal address, etc.): maximum 3 years;
  • Connection data: maximum 3 years;
  • Location data: 48 hours;

We retain your Personal Data only for a period necessary and proportionate to the purpose for which it was collected, namely for a maximum period of 3 years from the last interaction you had with us, initiated by you.

After the aforementioned periods, your data will be permanently deleted or anonymized.

Article 7 – Links to Websites not controlled by the C.R.T. de Normandie

The Site may offer links to third-party websites that may interest you.

The C.R.T. de Normandie has no control over the content of third-party sites or the practices of these third parties regarding the Personal Data they may collect. Consequently, the C.R.T. de Normandie disclaims all responsibility concerning the processing of your Personal Data by these third parties. It is your responsibility to inform yourself about the personal data protection policies of these third parties.

Article 8 – Transfer of Personal Data

In the event of accessing the Site from a non-European Union country where the legislation regarding the collection, use, and transfer of data differs from that of the European Union, we draw your attention to the fact that by continuing to use the Site, which is governed by French law, the corresponding Terms of Use, and this Policy, you are transferring your Personal Data to the European Union and consenting to this transfer.

Your Personal Data may be disclosed within the C.R.T. de Normandie for the purposes outlined in Article 3 of this Policy.

The C.R.T. de Normandie may also disclose your Personal Data to:

Any competent administrative or judicial authority, at its request, or to comply with applicable laws and regulations.

Article 9 – Security of Personal Data

The C.R.T. of Normandy provides visitors to the website www.normandie-tourisme.fr with an online booking module for tourist services. This booking module utilizes the marketplaces of the Eure, Manche, and Seine-Maritime departments. For providers in the Calvados and Orne departments, the company Alliance Réseaux offers its booking tools, enabling the C.R.T. of Normandy to provide a consistent service across the entire Normandy region.

It is important to note that the C.R.T. of Normandy is neither the owner nor the operator of this booking system. However, if needed, it can connect any requester with the services of the relevant departments or with Alliance Réseaux. Additionally, the C.R.T. of Normandy has tracking tools in place to ensure the proper functioning of the service. The personal data accessible to C.R.T. staff is detailed in Article 4 of this Privacy Policy. For any additional information regarding this feature, please contact: [email protected].

Article 10 – Your Rights

Your Right to Access and Rectify Your Data

You have the right to access and rectify your personal data.

You may request that your personal data be corrected or completed if it is inaccurate, incomplete, unclear, or outdated.

Your Right to erasure of your Data

You may request the deletion of your personal data if one of the following grounds applies:

  • The personal data is no longer necessary for the purposes for which it was collected or otherwise processed;
  • You withdraw the consent you previously provided;
  • You object to the processing of your personal data for legitimate reasons;
  • The processing of personal data does not comply with applicable laws and regulations.

However, this right cannot be exercised if the retention of your personal data is necessary under applicable laws or regulations, for example, for the establishment, exercise, or defense of legal claims.

Your Right to Restrict Data Processing

You may request the restriction of the processing of your personal data in the cases provided for by applicable laws and regulations.

Your Right to Object to Data Processing

You have the right to object to the processing of your personal data when the processing is based on the legitimate interests of the data controller.

Your Right to Data Portability

Since May 25, 2018, you have the right to data portability regarding your personal data.

The data to which this right applies includes:

  • Only your personal data, excluding anonymized data or data that does not concern you;
  • Declarative personal data as well as operational personal data mentioned earlier;
  • Personal data that does not infringe upon the rights and freedoms of third parties, such as data protected by trade secret.

This right is limited to processing based on consent or a contract, as well as personal data that you have personally generated.

This right does not include derived data or inferred data, which are personal data created by the C.R.T. de Normandie.

Your Right to Withdraw Your Consent

When the data processing we undertake is based on your consent, you may withdraw it at any time. We will then cease processing your personal data, without affecting the lawfulness of the processing carried out prior to your withdrawal of consent.

Your Right to Lodge a Complaint

You have the right to lodge a complaint with the CNIL (Commission Nationale de l’Informatique et des Libertés) in France, without prejudice to any other administrative or judicial remedies available to you.

Your Right to Set Post-Mortem Directives

You have the option to set directives regarding the retention, deletion, and communication of your personal data after your death, and you can designate a trusted third party, certified and responsible for ensuring the deceased’s wishes in accordance with the applicable legal framework.

The Procedures for Exercising your Rights

All the rights listed above can be exercised:

  • By postal mail to the following address: C.R.T. de Normandie, 14 rue Charles Corbeau – 27000 Évreux – France, enclosing a copy of your identity card and proof of address;
  • Via our email address: [email protected].

We are committed to responding to these requests within one month of receiving the request. This period may be extended by two months depending on the complexity and number of requests received, for a total of three months.

However, regarding the exercise of the right to information, we may not be obligated to respond if:

  • You already have this information;
  • The recording or communication of your personal data is expressly provided for by law;
  • The communication of information proves to be impossible;
  • The communication of information would require disproportionate efforts.

Article 11 – Changes to the Policy

The C.R.T. de Normandie is committed to protecting and securing the Personal Data you have chosen to share, ensuring its confidentiality and preventing it from being altered, damaged, destroyed, or disclosed to unauthorized third parties.

The C.R.T. de Normandie has implemented physical, electronic, and organizational security measures to prevent any loss, misuse, unauthorized access or disclosure, alteration, or potential destruction of such Personal Data. These protective measures include the use of technologies specifically designed to secure Personal Data during its transfer. However, despite the efforts of the C.R.T. de Normandie to safeguard your Personal Data, it cannot guarantee the absolute infallibility of these protections due to unavoidable risks associated with the transmission of Personal Data.

All Personal Data is treated as confidential, and access is restricted to the employees and service providers of the C.R.T. de Normandie who require it to perform their duties. Everyone with access to your Personal Data is bound by a confidentiality obligation and may face disciplinary and/or other sanctions for failing to comply with these obligations.

Nevertheless, it is important for you to take precautions to prevent unauthorized access to your Personal Data. You are responsible for maintaining the confidentiality of your password and the information in your account. Therefore, you should ensure that you log out when using a shared computer or device.


Article 12 – Dispute Resolution

While the C.R.T. de Normandie has implemented reasonable measures to protect Personal Data, no transmission or storage technology is entirely secure.

However, the C.R.T. de Normandie is committed to ensuring the protection of Personal Data. If you have reason to believe that the security of your Personal Data has been compromised or that it has been misused, you are encouraged to contact the C.R.T. de Normandie at the following address: [email protected].

The C.R.T. de Normandie will investigate complaints regarding the use and disclosure of Personal Data and will seek to resolve them in accordance with the principles outlined in this Policy.

Unauthorized access to or misuse of Personal Data may constitute a violation of applicable local laws.

Article 13 – Contact

For any questions regarding this Policy, to stop receiving information from the C.R.T. de Normandie, or to request the correction, supplementation, updating, or deletion of your Personal Data, you may send an email to the following address: [email protected].

Article 14 – Effective Date and Revisions to the Personal Data Protection Policy

This Policy may be updated as needed by the C.R.T. de Normandie, based on circumstances or as required by law. We therefore encourage you to regularly review any updates to this Policy.

Last modification: 01/09/2024